@stacksjs/defaults 0.75.421 → 0.75.423

package/ai/skills/stacks-arrays/SKILL.md

@@ -198,10 +198,12 @@ zScore([1, 2, 3, 4], 3)           // 0.447...
 percentile([1, 2, 3, 4, 5], 50)   // 3       -- interpolated percentile
 percentile([1, 2, 3, 4], 25)      // 1.75    -- linear interpolation
 // Note: takes percentile value (0-100), uses linear interpolation
+// Throws for an empty array (like median) and a RangeError outside 0-100
 
 interquartileRange([1, 2, 3, 4, 5, 6, 7, 8, 9, 10])
 // Q3 median - Q1 median
-// Splits array at midpoint, computes median of each half
+// Sorts, splits at the midpoint, computes the median of each half
+// One number gives 0; an empty array throws
 
 covariance([1, 2, 3, 4], [1, 2, 3, 4])     // 1.25  -- positive correlation
 covariance([1, 2, 3, 4], [4, 3, 2, 1])     // -1.25 -- negative correlation

package/ai/skills/stacks-cache/SKILL.md

@@ -22,10 +22,11 @@ const products = await cache.mget<{ name: string }>(['product:42', 'product:43']
 // mget returns a record keyed by cache key, not an array.
 ~~~
 
-- TTL is in seconds. Zero means forever; omitted TTL uses the factory's
-  stdTTL, which defaults to zero. The exported cache/memory singleton is a
-  memory instance with no default expiry. Config's ttl value does not silently
-  turn that singleton into a configured Redis instance.
+- TTL is in seconds. Zero means forever; an omitted TTL uses the store's
+  default. For the `cache` export that is `ttl` from config/cache.ts (3600 as
+  shipped) on every driver, memory included, so a value set with no TTL
+  expires after an hour. The `memory` export is a separate in-process
+  instance with no default expiry.
 - `setForever` stores without expiry; `getTtl` reads remaining TTL and
   `ttl(key, seconds)` updates it. Missing values are undefined.
 - `mset([{ key, value, ttl? }])` writes entries. `del(keyOrKeys)` and
@@ -60,11 +61,14 @@ deploys, pointing `path` at a file the deploy preserves (the app's own SQLite
 database works; the table is the driver's alone). `createCache(driver,
 options?)` selects one of memory, redis, singlestore or sqlite.
 
-The `cache` export is the driver `config/cache.ts` selects (`driver`, with
-`prefix` and `ttl` applied to the non-memory drivers), resolved on first use
-and once the app's config has loaded. With the default `driver: 'memory'` it
-answers from the `memory` instance itself. `cacheFromConfig(settings?)` builds
-the same choice explicitly; `resetConfiguredCache()` forgets it.
+The `cache` export is the driver `config/cache.ts` selects, with its `prefix`
+and `ttl` applied on every driver (memory also takes `maxKeys`, `useClones`
+and `drivers.memory`), resolved on first use and once the app's config has
+loaded. It is the shared `memory` instance only when the config sets none of
+those. The shipped config sets them, so there `cache` and `memory` are two
+stores: a value written through one is not visible through the other.
+`cacheFromConfig(settings?)` builds the same choice explicitly;
+`resetConfiguredCache()` forgets it.
 `config/cache.ts` reads `REDIS_URL`, `REDIS_HOST`, `REDIS_PORT`,
 `REDIS_USERNAME`, `REDIS_PASSWORD` and `REDIS_DB`, as `config/queue.ts` does.
 

package/ai/skills/stacks-calendar/SKILL.md

@@ -38,11 +38,13 @@ title, required allDay and optional description/address/timezone; the root entry
 does not re-export that type. Infer a literal or read src/types.ts when extending
 the package.
 
-The older single-event generator has its own timezone/time-format rules and
-does not emit a VTIMEZONE block. Its UID derives from event timing/title, so
-editing those changes the UID. Do not promise subscription update semantics
-from a generated single-event link. Prefer the feed builder for stable records,
-escaping and folded lines.
+Single-event exports write a timed event as UTC instants (`...Z`), so a link
+means the same on every host; `timezone` only sets the zone Google's compose
+screen displays it in. All-day dates are the UTC calendar dates of from/to.
+The ICS body escapes and folds its text as the feed builder does. Its UID
+derives from the event's instants and title, so editing those changes the
+UID. Do not promise subscription update semantics from a generated
+single-event link; use the feed builder for stable records.
 
 ## Native subscribable feeds
 
@@ -59,13 +61,19 @@ control, even when the feed declares a suggested interval.
 
 ## Recurrence
 
-parseRRule(value) returns RecurrenceRule or null for unsupported frequency.
-expandRecurrence(rule, dtstart, windowStart, windowEnd) returns matching UTC
-start instants, capped defensively. Supported fields include DAILY/WEEKLY/
-MONTHLY/YEARLY, INTERVAL, COUNT, UNTIL, BYDAY and BYMONTHDAY. This is a subset;
-unknown fields are not a proof of full RFC conformance. Callers own timezone
-interpretation and DST policy. Calendar clients can expand a feed's raw rrule
-independently from the server subset.
+parseRRule(value) returns a RecurrenceRule, or null for any rule it cannot
+follow exactly: an unsupported frequency or part (BYMONTH, BYSETPOS, BYWEEKNO,
+BYYEARDAY, BYHOUR...), a combination RFC 5545 rules out or this subset does
+not cover, or a value it cannot read. Null means "do not expand this here",
+never "expanded without the part". expandRecurrence(rule, dtstart, windowStart,
+windowEnd) returns matching UTC start instants, capped at 1000.
+
+The subset: DAILY/WEEKLY/MONTHLY/YEARLY, INTERVAL, COUNT or UNTIL, WKST, BYDAY
+(a filter for DAILY and WEEKLY; within a month, `MO` is every Monday and `2TU`
+or `-1FR` an ordinal) and BYMONTHDAY for DAILY or MONTHLY (`-1` is the last
+day). Weeks start on WKST, Monday by default, as clients expand them. YEARLY
+repeats dtstart's date, skipping years without it (Feb 29). Callers own
+timezone interpretation and DST policy.
 
 ## Sources and evidence
 

package/ai/skills/stacks-chat/SKILL.md

@@ -95,7 +95,7 @@ abstract class BaseChatDriver implements ChatDriver {
 
 ```typescript
 interface ChatMessage {
-  to: string | string[]                // recipient (channel ID, user ID, etc.)
+  to?: string | string[]               // a bot token's channel or user ID; omit for a webhook
   from?: { id?: string, name?: string, avatar?: string }
   subject?: string                      // title for rich messages
   content?: string                      // plain text content
@@ -181,8 +181,14 @@ interface SlackAttachment {
 
 ### Slack Sending Modes
 
-1. **Webhook mode**: If `config.webhookUrl` is set, sends via `POST` to webhook URL. Payload includes `text`, `username`, `mrkdwn: true`. If `message.template` exists, builds Block Kit blocks.
-2. **Bot token mode**: If `config.botToken` is set, sends via Slack API `https://slack.com/api/chat.postMessage` with `Authorization: Bearer <token>`. Returns `ts` (timestamp) as message ID.
+1. **Webhook mode**: If `config.webhookUrl` is set, sends via `POST` to webhook URL. Payload includes `text`, `username`, `mrkdwn: true`. If `message.template` exists, builds Block Kit blocks. Needs no `message.to`.
+2. **Bot token mode**: If `config.botToken` is set, sends via Slack API `https://slack.com/api/chat.postMessage` with `Authorization: Bearer <token>`, to the channel in `message.to` (required). Returns `ts` (timestamp) as message ID.
+
+`send()` treats `content` as the plain text `ChatMessage` says it is: `&`, `<`
+and `>` are escaped (`escapeSlackText`), so `<!channel>` or a disguised
+`<url|label>` in user text arrives as literal text instead of pinging the
+channel or hiding a link. Plain URLs still link. `sendWebhook(url, text)` is
+raw, for Slack markup written on purpose.
 3. Throws `Error('Slack not configured: provide webhookUrl or botToken')` if neither is set.
 
 ### Direct Webhook Function
@@ -247,8 +253,15 @@ interface DiscordMessage {
 
 ### Discord Sending Modes
 
-1. **Webhook mode**: POST to `config.webhookUrl`. Handles `204` (empty success) responses. Returns `id` from response.
-2. **Bot token mode**: POST to `https://discord.com/api/v10/channels/{channelId}/messages` with `Authorization: Bot <token>`. Uses `message.to` as the channel ID.
+1. **Webhook mode**: POST to `config.webhookUrl`. Handles `204` (empty success) responses. Returns `id` from response. Needs no `message.to`.
+2. **Bot token mode**: POST to `https://discord.com/api/v10/channels/{channelId}/messages` with `Authorization: Bot <token>`. Uses `message.to` as the channel ID (required).
+
+Every payload carries `allowed_mentions`, by default `{ parse: ['users', 'roles'] }`
+(`DEFAULT_ALLOWED_MENTIONS`): people and roles named by ID ping, `@everyone`
+and `@here` in content never do. `sendWebhook()`'s `allowedMentions` replaces
+the default, and its camelCase options are sent under Discord's names
+(`avatar_url`, `allowed_mentions`) by `discordPayload()`. With a subject or
+template the body goes in the embed only, not also as `content`.
 
 ### Embed Building
 When `message.subject` or `message.template` is set, `buildEmbed()` creates an embed with:
@@ -457,10 +470,10 @@ All three drivers implement `sendWithRetry()`:
 
 Direct send returns ChatResult, with success false for a handled provider failure;
 inspect it before persisting sent state. Awaiting a send only proves the promise
-settled. Webhook configuration does not replace ChatMessage's to/content or
-template fields. The generic notify chat channel supplies a body-only shape and
-does not normalize every structured transport failure, so use this package's
-direct API when application behavior depends on valid chat delivery.
+settled. A webhook send needs no `to`; a bot-token send needs the channel in
+`to`. notify()'s chat channel sends the body as `content` and `chatRecipient`
+as `to`, through `recipient.chatDriver` or `config.notification.chat.default`,
+and a failed send is a failed NotifyResult.
 
 Settings resolve per send after app config readiness, with explicit configure
 overrides taking precedence. Retained request/config coverage lives under

package/ai/skills/stacks-desktop/SKILL.md

@@ -133,6 +133,13 @@ Write `app/Desktop/launcher.ts` and `build:desktop` compiles that instead, the
 same way anything under `app/` overrides its framework default. `DESKTOP_URL`
 and `APP_URL` then become optional, because the launcher decides what to open.
 
+Every launcher, the framework's or yours, compiles through
+`desktopLauncherCompileArgs()` to bytecode as an ES module: parsing the bundle
+was most of a launcher's start (Browser's agent reached its window host in
+379 ms as source, 146 ms as bytecode), for an executable about a quarter
+larger. Pass `bytecode: false` only to compare. Compile any helper binary of
+your own with the same function rather than hand-written `bun build` flags.
+
 ```ts
 // app/Desktop/launcher.ts - compiled to Contents/MacOS/<AppName>
 import { dirname, join } from 'node:path'

package/ai/skills/stacks-i18n/SKILL.md

@@ -21,7 +21,7 @@ i18n/src/
 ├── translator.ts         # I18n class, global API (t, tc, te, tm)
 ├── formatter.ts          # Locale-aware formatting (dates, numbers, currency, lists)
 ├── loader.ts             # File-based translation loader (JSON, YAML, JS/TS)
-└── pluralization.ts      # CLDR plural rules for 25+ languages
+└── pluralization.ts      # CLDR plural rules, from the runtime's Intl.PluralRules
 ```
 
 ## Core Types
@@ -101,14 +101,13 @@ tc('items', 5)    // '5 items'
 
 ### Supported Languages
 
-| Rule | Languages |
-|------|-----------|
-| One/Other | en, de, nl, es, it, pt, sv, da, no, fi, el, he, hu, tr |
-| French (0-1=one) | fr |
-| No plural | zh, ja, ko, vi, th, id, ms |
-| One/Few/Many/Other | ru, uk, pl |
-| One/Few/Other | cs, sk |
-| Full (zero/one/two/few/many/other) | ar, cy |
+Every language the runtime's CLDR data covers, through `Intl.PluralRules`,
+for the full locale (`pt` counts 0 as `one`, `pt-PT` does not). A language it
+has no data for says `other` for every number; `hasPluralRule(locale)` tells
+you which. `addPluralRule(locale, rule)` overrides a language. The rules were
+a hand-written table of 33 languages until it turned out to leave out Catalan,
+Croatian, Serbian, Bulgarian and `nb` (they said `other` for 1) and to get
+Hebrew's `two` and Latvian's `zero` wrong.
 
 ```typescript
 import { getPluralCategory, addPluralRule, hasPluralRule } from '@stacksjs/i18n'
@@ -218,6 +217,6 @@ default:
 - **YAML parsed with Bun.YAML** - not a third-party parser
 - **Missing keys return the key itself** - not an error, not empty string
 - **Pluralization uses `|` separator** - not ICU MessageFormat
-- **CLDR rules are built-in** - no external data needed, 25+ languages hardcoded
+- **CLDR rules come from the runtime** - `Intl.PluralRules`, no data shipped and no table to fall out of date
 - **HTML escaping is opt-in** - `escapeValues: true` in config
 - **Formatting uses Intl APIs** - delegates to `Intl.DateTimeFormat`, `Intl.NumberFormat`, etc.

package/ai/skills/stacks-native/CATALOG.md

@@ -16,7 +16,7 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/alias` | [`stacks-alias`](../stacks-alias/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/alias/src/index.ts) | 1 |
 | `@stacksjs/analytics` | [`stacks-analytics`](../stacks-analytics/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/analytics/src/index.ts) | 6 |
 | `@stacksjs/api` | [`stacks-api`](../stacks-api/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/api/src/index.ts) | 9 |
-| `@stacksjs/arrays` | [`stacks-arrays`](../stacks-arrays/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/arrays/src/index.ts) | 6 |
+| `@stacksjs/arrays` | [`stacks-arrays`](../stacks-arrays/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/arrays/src/index.ts) | 7 |
 | `@stacksjs/audio` | [`stacks-audio`](../stacks-audio/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/audio/src/index.ts) | 3 |
 | `@stacksjs/auth` | [`stacks-auth`](../stacks-auth/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/index.ts) | 125 |
 | `@stacksjs/browser` | [`stacks-browser`](../stacks-browser/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser/src/index.ts) | 8 |
@@ -24,9 +24,9 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/buddy` | [`stacks-buddy`](../stacks-buddy/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/buddy/src/index.ts) | 177 |
 | `@stacksjs/build` | [`stacks-build`](../stacks-build/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/build/src/index.ts) | 5 |
 | `@stacksjs/cache` | [`stacks-cache`](../stacks-cache/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/cache/src/index.ts) | 23 |
-| `@stacksjs/calendar-api` | [`stacks-calendar`](../stacks-calendar/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/calendar-api/src/index.ts) | 2 |
+| `@stacksjs/calendar-api` | [`stacks-calendar`](../stacks-calendar/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/calendar-api/src/index.ts) | 5 |
 | `@stacksjs/charts` | [`stacks-charts`](../stacks-charts/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/charts/src/index.ts) | 3 |
-| `@stacksjs/chat` | [`stacks-chat`](../stacks-chat/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/chat/src/index.ts) | 5 |
+| `@stacksjs/chat` | [`stacks-chat`](../stacks-chat/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/chat/src/index.ts) | 6 |
 | `@stacksjs/cli` | [`stacks-cli`](../stacks-cli/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/cli/src/index.ts) | 13 |
 | `@stacksjs/cloud` | [`stacks-cloud`](../stacks-cloud/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/cloud/src/index.ts) | 10 |
 | `@stacksjs/cms` | [`stacks-cms`](../stacks-cms/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/cms/src/index.ts) | 5 |
@@ -56,20 +56,20 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/github` | [`stacks-git`](../stacks-git/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/github/src/index.ts) | 8 |
 | `@stacksjs/health` | [`stacks-health`](../stacks-health/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/health/src/index.ts) | 2 |
 | `@stacksjs/http` | [`stacks-http`](../stacks-http/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/http/src/index.ts) | 2 |
-| `@stacksjs/i18n` | [`stacks-i18n`](../stacks-i18n/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/i18n/src/index.ts) | 4 |
+| `@stacksjs/i18n` | [`stacks-i18n`](../stacks-i18n/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/i18n/src/index.ts) | 5 |
 | `@stacksjs/image` | [`stacks-image`](../stacks-image/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/image/src/index.ts) | 3 |
 | `@stacksjs/lint` | [`stacks-lint`](../stacks-lint/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/lint/src/index.ts) | 3 |
 | `@stacksjs/logging` | [`stacks-logging`](../stacks-logging/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/logging/src/index.ts) | 14 |
 | `@stacksjs/mobile` | [`stacks-mobile`](../stacks-mobile/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/mobile/src/index.ts) | 23 |
 | `@stacksjs/model-meta` | [`stacks-models`](../stacks-models/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/model-meta/src/index.ts) | 1 |
 | `@stacksjs/newsletter` | [`stacks-newsletter`](../stacks-newsletter/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/newsletter/src/index.ts) | 7 |
-| `@stacksjs/notifications` | [`stacks-notifications`](../stacks-notifications/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/notifications/src/index.ts) | 16 |
-| `@stacksjs/objects` | [`stacks-objects`](../stacks-objects/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/objects/src/index.ts) | 4 |
+| `@stacksjs/notifications` | [`stacks-notifications`](../stacks-notifications/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/notifications/src/index.ts) | 17 |
+| `@stacksjs/objects` | [`stacks-objects`](../stacks-objects/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/objects/src/index.ts) | 5 |
 | `@stacksjs/orm` | [`stacks-orm`](../stacks-orm/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/orm/src/index.ts) | 75 |
 | `@stacksjs/pagination` | [`stacks-pagination`](../stacks-pagination/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/pagination/src/index.ts) | 0 |
 | `@stacksjs/path` | [`stacks-path`](../stacks-path/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/path/src/index.ts) | 13 |
-| `@stacksjs/payments` | [`stacks-payments`](../stacks-payments/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/payments/src/index.ts) | 37 |
-| `@stacksjs/push` | [`stacks-push`](../stacks-push/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/push/src/index.ts) | 6 |
+| `@stacksjs/payments` | [`stacks-payments`](../stacks-payments/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/payments/src/index.ts) | 38 |
+| `@stacksjs/push` | [`stacks-push`](../stacks-push/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/push/src/index.ts) | 8 |
 | `@stacksjs/query-builder` | [`stacks-query-builder`](../stacks-query-builder/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/query-builder/src/index.ts) | 6 |
 | `@stacksjs/queue` | [`stacks-queue`](../stacks-queue/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/queue/src/index.ts) | 49 |
 | `@stacksjs/realtime` | [`stacks-realtime`](../stacks-realtime/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/realtime/src/index.ts) | 12 |
@@ -87,16 +87,16 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/sms` | [`stacks-sms`](../stacks-sms/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/sms/src/index.ts) | 5 |
 | `@stacksjs/socials` | [`stacks-socials`](../stacks-socials/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/socials/src/index.ts) | 17 |
 | `@stacksjs/storage` | [`stacks-storage`](../stacks-storage/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/index.ts) | 47 |
-| `@stacksjs/strings` | [`stacks-strings`](../stacks-strings/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/strings/src/index.ts) | 7 |
-| `@stacksjs/testing` | [`stacks-testing`](../stacks-testing/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/index.ts) | 21 |
+| `@stacksjs/strings` | [`stacks-strings`](../stacks-strings/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/strings/src/index.ts) | 10 |
+| `@stacksjs/testing` | [`stacks-testing`](../stacks-testing/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/index.ts) | 22 |
 | `@stacksjs/tinker` | [`stacks-repl`](../stacks-repl/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/tinker/src/index.ts) | 1 |
 | `@stacksjs/tunnel` | [`stacks-tunnel`](../stacks-tunnel/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/tunnel/src/index.ts) | 1 |
 | `@stacksjs/types` | [`stacks-types`](../stacks-types/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/index.ts) | 2 |
 | `@stacksjs/ui` | [`stacks-ui`](../stacks-ui/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ui/src/index.ts) | 6 |
 | `@stacksjs/utils` | [`stacks-utils`](../stacks-utils/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/utils/src/index.ts) | 15 |
-| `@stacksjs/validation` | [`stacks-validation`](../stacks-validation/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/validation/src/index.ts) | 17 |
+| `@stacksjs/validation` | [`stacks-validation`](../stacks-validation/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/validation/src/index.ts) | 19 |
 | `@stacksjs/video` | [`stacks-video`](../stacks-video/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/video/src/index.ts) | 3 |
-| `@stacksjs/whois` | [`stacks-whois`](../stacks-whois/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/whois/src/index.ts) | 4 |
+| `@stacksjs/whois` | [`stacks-whois`](../stacks-whois/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/whois/src/index.ts) | 5 |
 
 ## Source surfaces
 
@@ -167,7 +167,7 @@ Declared runtime exports: `arr`.
 
 Local source modules: [src/arr.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/arrays/src/arr.ts), [src/macro.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/arrays/src/macro.ts).
 
-Evidence directory: [6 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/arrays/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [7 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/arrays/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/audio
 
@@ -245,7 +245,7 @@ Declared runtime exports: `buildCalendarFeed`, `calendarFeedHeaders`, `escapeIcs
 
 Local source modules: [src/feed.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/calendar-api/src/feed.ts), [src/generators/google.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/calendar-api/src/generators/google.ts), [src/generators/ics.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/calendar-api/src/generators/ics.ts), [src/generators/weboutlook.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/calendar-api/src/generators/weboutlook.ts), [src/generators/yahoo.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/calendar-api/src/generators/yahoo.ts), [src/recurrence.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/calendar-api/src/recurrence.ts).
 
-Evidence directory: [2 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/calendar-api/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [5 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/calendar-api/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/charts
 
@@ -265,7 +265,7 @@ Declared runtime exports: `MessagingError`, `configureDiscord`, `configureSlack`
 
 Local source modules: [src/drivers/discord.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/chat/src/drivers/discord.ts), [src/drivers/slack.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/chat/src/drivers/slack.ts), [src/drivers/teams.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/chat/src/drivers/teams.ts), [src/inbox/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/chat/src/inbox/index.ts).
 
-Evidence directory: [5 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/chat/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [6 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/chat/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/cli
 
@@ -551,7 +551,7 @@ Declared runtime exports: `I18n`, `addTranslations`, `applyRequestLocale`, `crea
 
 Local source modules: [src/bootstrap.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/i18n/src/bootstrap.ts), [src/formatter.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/i18n/src/formatter.ts), [src/loader.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/i18n/src/loader.ts), [src/locale-switch.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/i18n/src/locale-switch.ts), [src/pluralization.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/i18n/src/pluralization.ts), [src/translator.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/i18n/src/translator.ts), [src/types.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/i18n/src/types.ts).
 
-Evidence directory: [4 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/i18n/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [5 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/i18n/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/image
 
@@ -611,11 +611,11 @@ Evidence directory: [7 retained tests](https://github.com/stacksjs/stacks/blob/m
 
 Guidance: [`stacks-notifications`](../stacks-notifications/SKILL.md). Source: [storage/framework/core/notifications/src/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/notifications/src/index.ts).
 
-Declared runtime exports: `BroadcastNotificationDriver`, `DEFAULT_SMS_OPT_OUT`, `DEFAULT_UNSUBSCRIBE_NOTICE`, `DatabaseNotificationDriver`, `NOTIFICATION_FRAME_STRINGS`, `SMS_SENDER_MAX_LENGTH`, `accountNotificationTemplates`, `advanceSequence`, `bulkSetPreferences`, `commerceNotificationTemplates`, `createNotificationTemplates`, `defineNotificationTemplates`, `emailParagraphs`, `ensureSuccessfulEmailResult`, `ensureSuccessfulNotificationResults`, `filterChannelsByPreferences`, `getNotificationPreferences`, `interpolateNotificationText`, `isQuietTime`, `listUnsubscribeHeaders`, `makeDeliveryRecord`, `nextSendableTime`, `notification`, `notificationChannel`, `notificationEmailHtml`, `notificationEmailMessage`, `notificationEmailText`, `notificationFrameStrings`, `notificationLanguageTag`, `notificationSmsBody`, `notificationTemplateVariables`, `notificationUnsubscribeLinks`, `notificationUnsubscribeToken`, `notify`, `parseNotificationUnsubscribeToken`, `recordNotificationDelivery`, `renderNotificationTemplate`, `resolveDeliveryRecipient`, `resolveNotificationLocale`, `sequenceTimeline`, `setNotificationPreference`, `smsSenderPrefix`, `subscriptionNotificationTemplates`, `unsubscribeTokenFromRequest`, `unsubscribeWithToken`, `useBroadcast`, `useChat`, `useDatabase`, `useEmail`, `useNotification`, `usePush`, `useSMS`, `wherePreferenceCategory`.
+Declared runtime exports: `BroadcastNotificationDriver`, `DEFAULT_SMS_OPT_OUT`, `DEFAULT_UNSUBSCRIBE_NOTICE`, `DatabaseNotificationDriver`, `NOTIFICATION_FRAME_STRINGS`, `SMS_SENDER_MAX_LENGTH`, `accountNotificationTemplates`, `advanceSequence`, `bulkSetPreferences`, `commerceNotificationTemplates`, `configuredChatDriver`, `createNotificationTemplates`, `defineNotificationTemplates`, `emailParagraphs`, `ensureSuccessfulEmailResult`, `ensureSuccessfulNotificationResults`, `filterChannelsByPreferences`, `getNotificationPreferences`, `interpolateNotificationText`, `isQuietTime`, `listUnsubscribeHeaders`, `makeDeliveryRecord`, `nextSendableTime`, `notification`, `notificationChannel`, `notificationEmailHtml`, `notificationEmailMessage`, `notificationEmailText`, `notificationFrameStrings`, `notificationLanguageTag`, `notificationSmsBody`, `notificationTemplateVariables`, `notificationUnsubscribeLinks`, `notificationUnsubscribeToken`, `notify`, `parseNotificationUnsubscribeToken`, `recordNotificationDelivery`, `renderNotificationTemplate`, `resolveDeliveryRecipient`, `resolveNotificationLocale`, `sequenceTimeline`, `setNotificationPreference`, `smsSenderPrefix`, `subscriptionNotificationTemplates`, `unsubscribeTokenFromRequest`, `unsubscribeWithToken`, `useBroadcast`, `useChat`, `useDatabase`, `useEmail`, `useNotification`, `usePush`, `useSMS`, `wherePreferenceCategory`.
 
 Local source modules: [src/delivery.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/notifications/src/delivery.ts), [src/drivers/broadcast.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/notifications/src/drivers/broadcast.ts), [src/drivers/database.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/notifications/src/drivers/database.ts), [src/drivers/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/notifications/src/drivers/index.ts), [src/email-body.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/notifications/src/email-body.ts), [src/frame-strings.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/notifications/src/frame-strings.ts), [src/preferences.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/notifications/src/preferences.ts), [src/sequences.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/notifications/src/sequences.ts), [src/templates.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/notifications/src/templates.ts), [src/unsubscribe.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/notifications/src/unsubscribe.ts).
 
-Evidence directory: [16 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/notifications/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [17 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/notifications/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/objects
 
@@ -625,7 +625,7 @@ Declared runtime exports: `clearUndefined`, `deepMerge`, `hasOwnProperty`, `isKe
 
 Local source modules: [src/transform.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/objects/src/transform.ts).
 
-Evidence directory: [4 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/objects/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [5 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/objects/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/orm
 
@@ -661,7 +661,7 @@ Declared runtime exports: `Payment`, `freshIdempotencyKey`, `stacksIdempotencyKe
 
 Local source modules: [src/billable/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/payments/src/billable/index.ts), [src/checkout-outcome.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/payments/src/checkout-outcome.ts), [src/connect/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/payments/src/connect/index.ts), [src/direct-debit.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/payments/src/direct-debit.ts), [src/driver/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/payments/src/driver/index.ts), [src/drivers/stripe.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/payments/src/drivers/stripe.ts), [src/idempotency.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/payments/src/idempotency.ts), [src/payment.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/payments/src/payment.ts), [src/subscription-state.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/payments/src/subscription-state.ts), [src/terminal.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/payments/src/terminal.ts).
 
-Evidence directory: [37 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/payments/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [38 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/payments/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/push
 
@@ -671,7 +671,7 @@ Declared runtime exports: `apns`, `buildVapidHeaders`, `configureAPNS`, `configu
 
 Local source modules: [src/drivers/apns.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/push/src/drivers/apns.ts), [src/drivers/expo.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/push/src/drivers/expo.ts), [src/drivers/fcm.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/push/src/drivers/fcm.ts), [src/drivers/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/push/src/drivers/index.ts), [src/drivers/web-push.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/push/src/drivers/web-push.ts).
 
-Evidence directory: [6 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/push/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [8 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/push/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/query-builder
 
@@ -843,7 +843,7 @@ Declared runtime exports: `string`.
 
 Local source modules: [src/string.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/strings/src/string.ts).
 
-Evidence directory: [7 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/strings/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [10 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/strings/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/testing
 
@@ -853,7 +853,7 @@ Read the entrypoint and package export map for re-exported or type-only surfaces
 
 Local source modules: [src/console.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/console.ts), [src/disposable-database.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/disposable-database.ts), [src/events.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/events.ts), [src/feature.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/feature.ts), [src/isolated.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/isolated.ts), [src/mail.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/mail.ts), [src/schema.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/schema.ts), [src/service.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/service.ts), [src/time.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/time.ts).
 
-Evidence directory: [21 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [22 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/tinker
 
@@ -909,9 +909,9 @@ Guidance: [`stacks-validation`](../stacks-validation/SKILL.md). Source: [storage
 
 Declared runtime exports: `applyConditionals`, `isArray`, `isBoolean`, `isFunction`, `isNull`, `isNullOrUndefined`, `isNumber`, `isObject`, `isString`, `isUndefined`, `objectWithContext`, `schema`, `shouldApplyConditional`, `withConditionals`.
 
-Local source modules: [src/input.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/validation/src/input.ts), [src/reporter.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/validation/src/reporter.ts), [src/schema.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/validation/src/schema.ts), [src/validator.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/validation/src/validator.ts).
+Local source modules: [src/input.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/validation/src/input.ts), [src/messages.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/validation/src/messages.ts), [src/reporter.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/validation/src/reporter.ts), [src/schema.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/validation/src/schema.ts), [src/validator.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/validation/src/validator.ts).
 
-Evidence directory: [17 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/validation/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [19 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/validation/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/video
 
@@ -931,4 +931,4 @@ Declared runtime exports: `SocksClient`, `WhoIsParser`, `batchWhois`, `findWhoIs
 
 Local source modules: [src/constants.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/whois/src/constants.ts), [src/socks.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/whois/src/socks.ts), [src/types.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/whois/src/types.ts), [src/utils.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/whois/src/utils.ts).
 
-Evidence directory: [4 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/whois/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [5 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/whois/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.

package/ai/skills/stacks-notifications/SKILL.md

@@ -36,7 +36,7 @@ optional `error`. A resolved call does not imply every channel succeeded.
 |---|---|---|
 | email | email | `@stacksjs/email` |
 | sms | phone | `@stacksjs/sms` |
-| chat | chatRecipient, a channel/user id or array | `@stacksjs/chat` |
+| chat | chatRecipient for a bot token's channel; none for a webhook | `@stacksjs/chat` |
 | database | userId | database notification inbox |
 | push | pushTokens, a string or string array | `@stacksjs/push`, default Expo |
 | broadcast | broadcastChannel or userId | `@stacksjs/realtime` |
@@ -48,7 +48,11 @@ type for an action link. The broadcast fallback is `private-user.{userId}` or
 public `notifications` when no user/channel is supplied. Its delivery is
 best-effort; a missing realtime server is not a durable notification queue.
 Read `stacks-chat` to configure transport credentials. Notify maps body to
-ChatMessage.content and chatRecipient to ChatMessage.to. Email, SMS, chat and
+ChatMessage.content and chatRecipient to ChatMessage.to, through
+`recipient.chatDriver`, else `config.notification.chat.default` (`msTeams` is
+Teams), else Slack. A webhook needs no chatRecipient, so `notify({}, payload,
+['chat'])` posts to the configured webhook; a bot-token send without one fails
+naming the field. Email, SMS, chat and
 push structured failures and broadcast delivered:false produce failed
 NotifyResult entries. Provider acceptance is not a final delivery receipt.
 `ensureSuccessfulNotificationResults(results)` throws for an empty result list

package/ai/skills/stacks-objects/SKILL.md

@@ -210,10 +210,15 @@ Retained evidence: `core/objects/tests/transform.test.ts`.
 - `objectPick` creates a NEW object -- original is not affected.
 - `objectMap` creates a NEW object via `Object.fromEntries`.
 - `deepMerge` does NOT deeply merge arrays -- arrays from source replace arrays in target entirely.
+- `deepMerge` merges only plain objects key by key: a Date, Map, Set or class instance from a source is assigned as
+  is, and a string, array or number in the target is replaced by a source's object.
 - `deepMerge` uses `isObject()` from `@stacksjs/validation` combined with `!Array.isArray()` to determine mergeability.
+- A `"__proto__"` key is data, never a prototype. `JSON.parse` and the router's request input keep one as an own key:
+  `deepMerge` skips it and merges only into the target's own properties, and the transform helpers keep it as an own
+  key (`Object.fromEntries`), so input that carries one cannot set a prototype.
 - `objectMap` can filter entries by returning `undefined` from the callback -- filtered via `notNullish` from `@stacksjs/utils`.
 - `objectKeys` return type uses a template literal type to handle non-string keys.
 - `clearUndefined` only removes `undefined` -- `null` values are preserved.
 - `hasOwnProperty` accepts `null`/`undefined` objects without throwing.
 - `objectPick` with `omitUndefined=false` (default) includes keys even if their values are `undefined`, as long as the key exists in the object.
-- These utilities are also re-exported through `@stacksjs/utils`.
+- `@stacksjs/utils` does not re-export these. Its `merge` / `defu` is a separate merge that builds a new object.

package/ai/skills/stacks-payments/SKILL.md

@@ -717,8 +717,10 @@ when the app declares no portal.
 
 ```typescript
 Payment.formatAmount(2999, 'usd')   // '$29.99' (uses Intl.NumberFormat)
-Payment.toCents(29.99)               // 2999
-Payment.toDollars(2999)              // 29.99
+Payment.formatAmount(1000, 'jpy')   // '¥1,000': JPY has no minor unit
+Payment.minorUnitExponent('jpy')    // 0 (Stripe's table on the Stripe driver; ISO 4217 otherwise)
+Payment.toCents(29.99)               // 2999, two-decimal currencies only
+Payment.toDollars(2999)              // 29.99, two-decimal currencies only
 ```
 
 ### Client-Side Billing (useBillable)
@@ -918,7 +920,7 @@ The instance methods are exactly the keys of `createBillableMethods` in
   its original raw payload before applying domain events.
 - Stripe API keys MUST be in `.env` as `STRIPE_SECRET_KEY` and `STRIPE_PUBLISHABLE_KEY` -- never hardcode them in config files
 - The Stripe client is created lazily, on first use: importing `@stacksjs/payments` without `STRIPE_SECRET_KEY` (or without the opt-in `stripe` package) is fine, and the first Stripe call throws naming what is missing
-- All amounts are in cents -- use `toCents()` and `toDollars()` for conversion
+- All amounts are in the currency's minor unit: cents for USD, whole yen for JPY (Stripe's zero-decimal list), hundredths for ISK and UGX (Stripe's special cases). `toCents()` and `toDollars()` are for two-decimal currencies; `minorUnitExponent(currency)` says how many decimals an amount has, and `formatAmount()` uses it
 - `Payment.charge()` (Stripe driver) creates AND confirms the PaymentIntent in one step
 - `subscribe()` resolves the price via `lookup_key`, not a direct Stripe price ID
 - `Payment.removePaymentMethod()` and the billable instance method `removePaymentMethod()` both take the provider's id (string); `managePaymentMethod.deletePaymentMethod()` takes the local row id (number)

package/ai/skills/stacks-push/SKILL.md

@@ -42,8 +42,9 @@ Routes to the appropriate driver based on `options.driver` (default: `'expo'`).
 
 - For **Expo**: Passes the notification directly to `expo.send()` with all fields mapped.
 - For **FCM** with single token: Calls `fcm.send()` with notification mapped to `{ to, notification: { title, body }, data, priority }`.
-- For **FCM** with multiple tokens: Calls `fcm.sendMulticast()` and returns an aggregated result with success count.
-- FCM priority mapping: `'default'` is converted to `'normal'`; `'high'` and `'normal'` pass through.
+- For **FCM** with multiple tokens: Calls `fcm.sendMulticast()` and returns an aggregated result with success count, and `data: { results }`, one per token in order, so a dead token (404 `UNREGISTERED`) can be told from a transient failure.
+- FCM priority mapping: `'default'` is converted to `'normal'`; `'high'` and `'normal'` pass through. Unset means `high`, on Android and iOS alike.
+- `data` is the same for every driver. FCM takes only strings, so a non-string value is sent as its JSON text (`{ orderId: 42 }` arrives as `"42"`).
 
 ## PushNotification Interface (index.ts)
 
@@ -128,12 +129,16 @@ async function send(message: ExpoPushMessage): Promise<PushResult>
 ```
 
 - Endpoint: `https://exp.host/--/api/v2/push/send`
-- Validates tokens with `isExpoPushToken()` before sending
-- Filters out invalid tokens and warns via `log.warn()`
+- Validates tokens with `isExpoPushToken()` before sending; an invalid token
+  is warned about via `log.warn()`, not sent, and counted as a failure
 - Returns early with failure if no valid tokens remain
 - Creates one payload entry per token (fans out `to` array into individual messages)
+- Sends them in requests of at most 100, one after another: Expo refuses a
+  larger request outright, so a send to 101 devices used to reach none. A
+  refused request fails its own messages and the rest still go
 - Default `sound: 'default'`, default `priority: 'high'`
-- Returns `PushResult` with `data: { tickets }` containing the full ticket array
+- Returns `PushResult` with `data: { tickets }`: one ticket per token in `to`,
+  in the same order, so each ticket can be matched to its token
 - `success` is `true` only if zero tickets have `status: 'error'`
 - `messageId` is the first ticket's `id` (if any)
 
@@ -147,13 +152,13 @@ Validates token format: matches `Expo(nent)?PushToken[...]` pattern OR alphanume
 ```typescript
 async function getReceipts(ticketIds: string[]): Promise<Record<string, ExpoPushReceipt>>
 ```
-Endpoint: `https://exp.host/--/api/v2/push/getReceipts`. Checks delivery status for previously sent notifications.
+Endpoint: `https://exp.host/--/api/v2/push/getReceipts`. Checks delivery status for previously sent notifications, asking 1000 IDs per request (Expo's limit) and merging the answers.
 
 #### sendBatch()
 ```typescript
 async function sendBatch(messages: ExpoPushMessage[], chunkSize?: number): Promise<PushResult[]>
 ```
-Sends multiple messages in chunks (default chunk size: 100, per Expo's recommendation). Processes chunks sequentially, messages within each chunk in parallel via `Promise.all`.
+Sends several messages, `chunkSize` (default 100) at a time: chunks sequentially, messages within a chunk in parallel via `Promise.all`. Each message's own tokens are split into requests of 100 by `send()`.
 
 ### Exports
 - `send`, `sendBatch`, `getReceipts`, `isExpoPushToken` functions
@@ -192,7 +197,7 @@ interface FCMMessage {
     clickAction?: string
     tag?: string
   }
-  data?: Record<string, string>         // NOTE: values must be strings for FCM
+  data?: Record<string, unknown>        // sent as strings: a non-string value as its JSON text
   priority?: 'high' | 'normal'
   ttl?: number
   collapseKey?: string
@@ -221,7 +226,7 @@ endpoint it used to fall back to is gone.
 1. Generates JWT with RS256 signing using the service account private key
 2. Exchanges JWT for OAuth2 access token at `https://oauth2.googleapis.com/token`
 3. Sends to `https://fcm.googleapis.com/v1/projects/{projectId}/messages:send`
-4. Includes Android priority settings and APNS headers (`apns-priority: 10` for high, `5` for normal)
+4. Includes Android priority settings and APNS headers (`apns-priority: 10` for high, `5` for normal); an unset priority is high on both
 5. Supports `to` (token), `topic`, or `condition` targeting
 
 **JWT generation details:**

package/ai/skills/stacks-strings/SKILL.md

@@ -100,9 +100,9 @@ interface TitleCaseOptions {
   locale?: string | string[]
   sentenceCase?: boolean                 // only capitalize first word + after terminators
   sentenceTerminators?: Set<string>      // default: '.', '!', '?'
-  titleTerminators?: Set<string>         // default: '.', '!', '?', ':', '"', "'", '"'
+  titleTerminators?: Set<string>         // default: '.', '!', '?', ':', '"', "'", and a closing curly quote (U+201D)
   smallWords?: Set<string>               // words not capitalized (see SMALL_WORDS)
-  wordSeparators?: Set<string>           // default: '---', '--', '-', '---', '/'
+  wordSeparators?: Set<string>           // default: em dash (U+2014), en dash (U+2013), '-', horizontal bar (U+2015), '/'
 }
 ```
 
@@ -196,6 +196,7 @@ Extensive built-in character map covering:
 - Vietnamese diacritics
 - Currency symbols ($, EUR, GBP, YEN, etc.)
 - Special characters (trademark, copyright, etc.)
+- An en dash (U+2013) becomes a hyphen and so separates words; an em dash is still removed (#3112)
 
 ### Locale Support
 Locale-specific character mappings for: `bg`, `de`, `es`, `fr`, `pt`, `uk`, `vi`, `da`, `nb`, `it`, `nl`, `sv`.
@@ -241,7 +242,7 @@ Native TypeScript implementations (no external validator dependency). All accept
 ### Core Validators
 ```typescript
 isEmail('user@example.com')               // true -- regex: /^[^\s@]+@[^\s@]+\.[^\s@]+$/
-isStrongPassword('Abc123!@#')             // true -- min 8 chars, upper, lower, digit, symbol
+isStrongPassword('Abc123!@#')             // true -- min 8 chars, upper, lower, digit, symbol (any non-letter, non-number)
 isAlphanumeric('abc123')                  // true -- /^[a-zA-Z0-9]+$/
 isAlpha('abcdef')                         // true -- /^[a-zA-Z]+$/
 isNumeric('123')                          // true -- /^[0-9]+$/ (whole numbers only)
@@ -256,16 +257,16 @@ isBase64('SGVsbG8=')                      // true -- btoa(atob(x)) === x
 isBase32('MFZWI===')                      // true -- /^[A-Z2-7]+=*$/
 isAscii('hello')                          // true -- /^[\x00-\x7F]*$/
 isJSON('{"key":"value"}')                 // true -- JSON.parse succeeds
-isHSL('hsl(0, 100%, 50%)')               // true
+isHSL('hsl(0, 100%, 50%)')               // true -- comma syntax: hsl(hue, saturation%, lightness%)
 isMimeType('text/html')                   // true -- /^[a-z]+\/[a-z0-9\-+.]+$/i
-isDataURI('data:text/plain;base64,...')   // true
+isDataURI('data:text/plain;base64,...')   // true -- RFC 2397: the media type and ;base64 are both optional
 isJWT('eyJhbGciOiJIUzI1NiJ9.e30.c2ln')   // true -- shape check only, not signature verification
 ```
 
 ### Network Validators
 ```typescript
 isIP('192.168.1.1')                       // true -- IPv4 and IPv6
-isIPRange('192.168.1.0/24')               // true -- CIDR notation (IPv4: 0-32, IPv6: 0-128)
+isIPRange('192.168.1.0/24')               // true -- CIDR notation, a whole-number prefix (IPv4: 0-32, IPv6: 0-128)
 isMACAddress('00:11:22:33:44:55')         // true -- colon or hyphen separated
 isFQDN('example.com')                     // true -- fully qualified domain name
 ```
@@ -282,7 +283,7 @@ isISSN('0378-5955')                        // true -- mod 11 check
 
 ### Geographic Validators
 ```typescript
-isLatLong('40.7128,-74.0060')             // true -- lat: -90..90, long: -180..180
+isLatLong('40.7128,-74.0060')             // true -- plain decimal numbers; lat: -90..90, long: -180..180
 isLatitude('40.7128')                     // true
 isLongitude('-74.0060')                   // true
 isPostalCode('12345')                     // true -- US, UK, Canada, generic formats
@@ -291,8 +292,8 @@ isPostalCode('12345')                     // true -- US, UK, Canada, generic for
 ### Phone, Identity, Date Validators
 ```typescript
 isMobilePhone('+1234567890')              // true -- international format, min 7 digits
-isUUID('550e8400-e29b-41d4-a716-446655440000') // true -- full value required
-isISO8601('2024-01-01T00:00:00Z')         // true -- with Date validity check
+isUUID('550e8400-e29b-41d4-a716-446655440000') // true -- versions 1-8 (RFC 9562), nil and max; full value required
+isISO8601('2024-01-01T00:00:00Z')         // true -- the day must exist in its month; any number of fraction digits
 isIdentityCard('AB123456')                // true -- generic 5-20 alphanumeric
 isISRC('USRC17607839')                    // true
 isISO31661Alpha2('US')                    // true
@@ -404,7 +405,12 @@ interface PluralizeOptions { count?, inclusive? }
 ```
 
 ## Gotchas
-- Case conversion uses Unicode-aware word boundary detection (`\p{Ll}`, `\p{Lu}`) -- handles international characters
+- Case conversion uses Unicode-aware word boundary detection (`\p{Ll}`, `\p{Lu}`) -- handles international characters.
+  Combining marks stay with their letter and digits from any script are kept, so `kebabCase('नमस्ते दुनिया')`
+  is `'नमस्ते-दुनिया'`
+- `truncate(str, length, end)` never returns more than `length` characters, `end` included; with a `length`
+  shorter than `end` it returns as much of `end` as fits. It and `mask` count code points, so an emoji is one
+  character and is never cut in half
 - `slug()` calls `slugify()` under the hood but defaults to `{ lower: true, strict: true }`; `slugify()` defaults to `{ lower: false, strict: false }`
 - `pascalCase` and `camelCase` accept `PascalCaseOptions` with `mergeAmbiguousCharacters` to control number-prefixed word handling
 - All case functions support `prefixCharacters`/`suffixCharacters` to preserve leading/trailing non-word characters

package/ai/skills/stacks-testing/SKILL.md

@@ -278,7 +278,11 @@ expect(pageAuditClean(report)).toBe(true) // no duplicate /api/ requests, failed
   pattern holds with no listener stays held (a hanging request on purpose).
   `matchesUrlPattern(pattern, url)` and `pausedRequestMatches(pattern, paused)` are Chrome's
   matching rules (`*`, `?`, `\` escape; stage and resource type).
-- `settle(cdp, { quietMs, timeoutMs })` resolves false (not throws) when a page never goes quiet.
+- `settle(cdp, { quietMs, timeoutMs, includeSpeculative? })` resolves false (not throws) when a page never goes quiet.
+  By default all finite requests count. `includeSpeculative: false` uses `cdp.foregroundInFlight`,
+  excluding only Chrome `Prefetch` requests and explicit `Purpose` / `Sec-Purpose: prefetch`
+  declarations. The raw `inFlight` map and all HTTP, duplicate API, console and runtime audit
+  failures remain observable. `navigate` and `auditPage` accept the same option.
 - `click(cdp, selector | { selector, text }, { timeoutMs? })` scrolls the unique target into view,
   waits for layout, enabled state and an unobscured hit test, then uses Chrome's real mouse input.
   Use it for journey controls instead of local coordinate-click helpers or DOM-dispatched clicks.

package/ai/skills/stacks-utils/SKILL.md

@@ -45,7 +45,7 @@ export { clamp, notNullish, retry, useOnline } from '@stacksjs/browser'
 
 ## Deep Merge (`merge.ts`)
 
-Replacement for `defu`. Arrays are concatenated, objects are recursively merged, special objects (Date, RegExp, Error, Promise, Map, Set, WeakMap, WeakSet, ArrayBuffer views) are NOT deeply merged.
+Replacement for `defu`. Arrays are concatenated, objects are recursively merged, special objects (Date, RegExp, Error, Promise, Map, Set, WeakMap, WeakSet, ArrayBuffer views) are NOT deeply merged. A `"__proto__"` key is skipped, as defu skips it, so a parsed request body cannot set the result's prototype.
 
 ```typescript
 import { merge, mergeDefaults, createMerger, defu } from '@stacksjs/utils'

package/ai/skills/stacks-validation/SKILL.md

@@ -249,6 +249,17 @@ export default defineModel({
 })
 ```
 
+### Custom messages
+
+A rule's `message` is one string for any failure of the field, or an object keyed
+by rule name: `min`, `max`, `email`, `enum`, `required` and so on. `messageKeys(rule)`
+lists the keys a validator takes; `timestamp()` and `date()` take `timestamp` and
+`date`. A key named after the field covers failures no rule key matched, unless the
+validator has a rule of that name (`email: { email: ... }` is the email rule's).
+Action `validations`, `request.validate()`, `validateField()` and model writes all
+apply them through `fieldErrorMessages()` from `@stacksjs/validation/messages`, after
+validation; none of them sets ts-validation's process-wide message provider.
+
 ## Model Validation (`validator.ts`)
 
 ### `validateField(modelFile, params)`
@@ -402,6 +413,8 @@ they are. Inferred object shapes are native, not a hand-written request interfac
 schema.file().required().image().mimeTypes([...]).maxBytes(n).minBytes(n).
 extensions([...]).custom(fn) provides FileLike validation. Client MIME/extension
 checks do not prove the bytes; use stacks-storage's MIME verification where needed.
+An upload is a class instance (the router's `UploadedFile`); a plain object, which
+is what a JSON body gives for the same field name, is refused.
 
 registerRule/getCustomRule, unique(table,column,exceptId?), exists(table,column)
 and validateFieldAsync support application async validation. Current unique/exists
@@ -437,9 +450,11 @@ validateModelInput(MyModel, { title })
 
 Failures throw `InputValidationError` with `status: 422`. JSON must be an object;
 text never coerces objects or silently truncates; numeric input rejects booleans,
-non-finite values and unsafe whole numbers. Optional text/number input returns
+non-finite values, unsafe whole numbers and anything but decimal notation (`0x10`
+is not 16), and an identifier is decimal digits only. Optional text/number input returns
 null, and absent boolean input returns undefined. Boolean input accepts JSON
-booleans and the explicit form values `true`, `false`, `1`, `0` and their strings.
+booleans and the explicit form values `true`, `false`, `1`, `0` and their strings,
+and a checkbox's `on` and `off`.
 
 `validateModelInput` checks only supplied fields using `getDefinition()` rules.
 The action still selects writable fields, requires creation fields and validates
@@ -449,9 +464,10 @@ Root and narrow input imports share the same error constructor.
 ## Reusable boundary and stored-value rules
 
 `parseTextInput(value, field, required?, maxLength?)` rejects overlong text
-rather than truncating it. `parseEnumInput(value, field, choices)` requires
+rather than truncating it; `maxLength` counts characters, as a database column
+does, not UTF-16 units. `parseEnumInput(value, field, choices)` requires
 exact string membership; it never stringifies an object or boolean.
-`storedBoolean(value, fallback)` decodes SQL/form 0/1 and false/true; the
+`storedBoolean(value, fallback)` decodes SQL/form 0/1, false/true and on/off; the
 caller explicitly chooses the fallback for missing or corrupt stored data.
 Partial model validation accepts attribute names and their snake-case column
 spelling, including camel-case definitions.

package/ai/skills/stacks-whois/SKILL.md

@@ -133,11 +133,12 @@ When `outputData` is `null`, `parseData()` uses this default template:
 }
 ```
 
-The parser iterates character by character through raw WHOIS text:
-- Keys are identified when a line matches a key in `outputData`
-- Values follow after `": "` separator
+The parser reads raw WHOIS text a line at a time:
+- A line's field is everything before its first colon; it counts when it is a key in `outputData`
+- The value is everything after that colon, as written, so `2024-08-14T07:01:34Z` and `https://...` keep their colons
+- A field with nothing after its colon takes the next non-empty line as its value (registries that print `Registrar:` with the name below)
 - Array-typed fields (like `Domain Status`) accumulate multiple values
-- Parsing stops at `"Record maintained by"` or `">>>"` markers
+- Parsing stops at a line starting with `"Record maintained by"` or `">>>"`
 
 Custom parse templates: pass an object with the field names you want extracted. Use empty string `''` for single values, use `[]` for fields with multiple values.
 

package/app/Actions/Dashboard/Content/post-input.ts

@@ -59,7 +59,7 @@ function optionalId(value: unknown): number | null {
 }
 
 function booleanValue(value: unknown): boolean {
-  return storedBoolean(value === 'on' ? true : value, false)
+  return storedBoolean(value, false)
 }
 
 export function invalidPostContent(payload: PostPayload): string | null {

package/app/Models/Content/Post.ts

@@ -216,7 +216,7 @@ export default defineModel({
       validation: {
         rule: schema.enum(['published', 'draft', 'archived']),
         message: {
-          oneOf: 'Status must be either published, draft, or archived',
+          enum: 'Status must be either published, draft, or archived',
         },
       },
       factory: faker => faker.helpers.arrayElement(['published', 'draft', 'archived']),

package/app/Models/Error.ts

@@ -71,7 +71,7 @@ export default defineModel({
       validation: {
         rule: schema.number(),
         message: {
-          string: 'status must be a number',
+          number: 'status must be a number',
         },
       },
       factory: faker => faker.number.int({ min: 400, max: 500 }),

package/app/Models/Log.ts

@@ -53,7 +53,7 @@ export default defineModel({
         // (stacksjs/stacks#2996).
         rule: schema.unix().required(),
         message: {
-          date: 'Timestamp must be a valid date',
+          unix: 'Timestamp must be a valid Unix timestamp',
         },
       },
       factory: faker => faker.date.recent().getTime(),

package/app/Models/PaymentMethod.ts

@@ -50,7 +50,7 @@ export default defineModel({
       validation: {
         rule: schema.string().required().max(50),
         message: {
-          number: 'brand must be a number',
+          string: 'brand must be a string',
           required: 'brand is required',
         },
       },
@@ -63,7 +63,7 @@ export default defineModel({
       validation: {
         rule: schema.number().required(),
         message: {
-          string: 'exp_month must be a number',
+          number: 'exp_month must be a number',
           required: 'exp_month is required',
         },
       },
@@ -76,7 +76,7 @@ export default defineModel({
       validation: {
         rule: schema.number().required(),
         message: {
-          string: 'exp_year must be a number',
+          number: 'exp_year must be a number',
           required: 'exp_year is required',
         },
       },

package/app/Models/PaymentProduct.ts

@@ -55,7 +55,7 @@ export default defineModel({
       validation: {
         rule: schema.number().required(),
         message: {
-          string: 'expires must be a string',
+          number: 'unit_price must be a number',
           required: 'expires is required',
         },
       },

package/app/Models/Subscription.ts

@@ -70,7 +70,7 @@ export default defineModel({
       validation: {
         rule: schema.number().required(),
         message: {
-          string: 'unit_price must be a number',
+          number: 'unit_price must be a number',
           required: 'unit_price is required',
         },
       },

package/app/Models/commerce/PrintDevice.ts

@@ -100,7 +100,7 @@ export default defineModel({
       validation: {
         rule: schema.unix(),
         message: {
-          invalid: 'Invalid timestamp format',
+          unix: 'Invalid timestamp format',
         },
       },
       factory: faker => faker.date.recent().getTime(),

package/app/Models/commerce/Receipt.ts

@@ -79,7 +79,7 @@ export default defineModel({
       validation: {
         rule: schema.timestampTz().required(),
         message: {
-          invalid: 'Invalid date format',
+          timestampTz: 'Invalid date format',
         },
       },
       factory: faker => faker.date.recent().toISOString(),

package/app/Models/realtime/Websocket.ts

@@ -33,7 +33,7 @@ export default defineModel({
       validation: {
         rule: schema.enum(['disconnection', 'error', 'success']),
         message: {
-          in: 'Type must be one of: disconnection, error, success',
+          enum: 'Type must be one of: disconnection, error, success',
         },
       },
       factory: faker => faker.helpers.arrayElement(['success', 'success', 'success', 'disconnection', 'error']),
@@ -77,7 +77,7 @@ export default defineModel({
         // and MySQL (stacksjs/stacks#2996).
         rule: schema.unix(),
         message: {
-          date: 'Time must be a valid timestamp',
+          unix: 'Time must be a valid timestamp',
         },
       },
       factory: faker => faker.date.recent().getTime(),

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.75.421",
+  "version": "0.75.423",
   "description": "Stacks, built into VS Code: stx templates, pickier linting and formatting, encrypted env files, the dev server preview and every buddy command. No other extensions required.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.421",
+  "version": "0.75.423",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -45,9 +45,9 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.35",
-    "@stacksjs/mobile": "0.75.421",
-    "@stacksjs/sanitizer": "0.2.783",
-    "@stacksjs/stx": "0.2.783",
+    "@stacksjs/mobile": "0.75.423",
+    "@stacksjs/sanitizer": "0.2.784",
+    "@stacksjs/stx": "0.2.784",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/xterm": "^6.0.0",
     "ts-qr-codes": "^0.1.8"