@stacksjs/defaults 0.75.432 → 0.75.439

package/ai/skills/stacks-auth/SKILL.md

@@ -112,6 +112,9 @@ is rejected because multiplexed application actions can handle it as a write.
 `requestImpersonation()` exposes trusted actor/subject metadata; ORM trails
 attribute writes to the original actor. `Auth.endImpersonation(credential)`
 requires the original actor request without the support header.
+Ordinary bearer lookups may be cached within a request. Viewed identities are
+never stored in that cache: each support-view resolution rechecks live authority
+and clears previously trusted support context before authenticating again.
 
 Store viewing state independently from the actor's login and cached profile,
 show a persistent disclosure and Exit control, disable offline persistence,

package/ai/skills/stacks-cli/SKILL.md

@@ -195,3 +195,21 @@ Source evidence: `storage/framework/core/cli/src/index.ts`,
 `commands.ts` and `terminal.ts`; command discovery is owned by buddy's
 runtime registry. `buddy list` and `buddy <command> --help` are the
 authoritative command/flag inventory, including package-contributed commands.
+
+## Native command ownership
+
+Import `spawnOwnedProcess` from `@stacksjs/cli/owned-process` for a command whose
+normally inherited descendants belong to the same lifetime. This subpath uses
+only native Bun/Node primitives, with no CLI or application bootstrap.
+
+A controlled owner establishes a POSIX process group or native Windows Job
+Object before admitting the command. `started` resolves its actual command PID;
+`pid` identifies the stable lifecycle owner. Consumer IPC is forwarded with the
+verified command PID. `exited` preserves command status and settles after tree
+disposal. `stop()` is idempotent, and signaling the owner also initiates cleanup.
+Compiled callers supply their installed Bun path as `ownerRuntime`.
+
+This is lifecycle ownership, not a sandbox: deliberate POSIX breakaway is outside
+the group contract. Native admission or disposal failures reject rather than
+falling back to direct-child cleanup. `runBoundedProcess` in `cli/process` retains
+its separate output-byte/deadline contract; it is not this ownership API.

package/ai/skills/stacks-desktop/SKILL.md

@@ -361,6 +361,22 @@ buddy desktop:apple:publish    # validate or upload the package to App Store Con
 buddy desktop:probe            # measure what a Craft window offers interactive/game content
 ```
 
+A TestFlight release from the developer's Mac needs only the App Store Connect
+key (`APP_STORE_CONNECT_API_KEY*`, encrypted in `.env.production`):
+
+```bash
+APP_ENV=production buddy desktop:apple:publish --build-number next --testflight 'My Team'
+```
+
+`--build-number next` asks App Store Connect for the app's highest build and
+uses one more, so every upload is `<version> (n + 1)` with no counter kept
+anywhere. `--testflight` waits for processing, gives the build to the named beta
+groups (they must already exist; an automatic-distribution internal group gets it
+without an explicit add), and sets "What to Test" from `--whats-new` or the
+commit subjects since the last tag. Signing identities not named by a variable
+are read from the keychain for the team, and a missing
+`APPLE_PROVISIONING_PROFILE` is downloaded from App Store Connect.
+
 `desktop:probe` opens a visible Craft window (not `--headless`, which stops
 requestAnimationFrame) and measures WebGL2/WebGPU, frame pacing under load,
 input and audio latency, the Gamepad API, fullscreen and pointer lock.

package/ai/skills/stacks-native/CATALOG.md

@@ -15,7 +15,7 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/ai` | [`stacks-ai`](../stacks-ai/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/index.ts) | 21 |
 | `@stacksjs/alias` | [`stacks-alias`](../stacks-alias/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/alias/src/index.ts) | 3 |
 | `@stacksjs/analytics` | [`stacks-analytics`](../stacks-analytics/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/analytics/src/index.ts) | 6 |
-| `@stacksjs/api` | [`stacks-api`](../stacks-api/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/api/src/index.ts) | 9 |
+| `@stacksjs/api` | [`stacks-api`](../stacks-api/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/api/src/index.ts) | 12 |
 | `@stacksjs/arrays` | [`stacks-arrays`](../stacks-arrays/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/arrays/src/index.ts) | 9 |
 | `@stacksjs/audio` | [`stacks-audio`](../stacks-audio/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/audio/src/index.ts) | 3 |
 | `@stacksjs/auth` | [`stacks-auth`](../stacks-auth/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/index.ts) | 126 |
@@ -88,7 +88,7 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/socials` | [`stacks-socials`](../stacks-socials/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/socials/src/index.ts) | 17 |
 | `@stacksjs/storage` | [`stacks-storage`](../stacks-storage/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/index.ts) | 47 |
 | `@stacksjs/strings` | [`stacks-strings`](../stacks-strings/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/strings/src/index.ts) | 10 |
-| `@stacksjs/testing` | [`stacks-testing`](../stacks-testing/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/index.ts) | 22 |
+| `@stacksjs/testing` | [`stacks-testing`](../stacks-testing/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/index.ts) | 24 |
 | `@stacksjs/tinker` | [`stacks-repl`](../stacks-repl/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/tinker/src/index.ts) | 1 |
 | `@stacksjs/tunnel` | [`stacks-tunnel`](../stacks-tunnel/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/tunnel/src/index.ts) | 1 |
 | `@stacksjs/types` | [`stacks-types`](../stacks-types/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/index.ts) | 2 |
@@ -159,7 +159,7 @@ Read the entrypoint and package export map for re-exported or type-only surfaces
 
 Local source modules: [src/fetcher.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/api/src/fetcher.ts), [src/generate-client.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/api/src/generate-client.ts), [src/generate-openapi.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/api/src/generate-openapi.ts), [src/generate-types.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/api/src/generate-types.ts), [src/operation.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/api/src/operation.ts), [src/resource.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/api/src/resource.ts).
 
-Evidence directory: [9 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/api/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [12 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/api/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/arrays
 
@@ -861,7 +861,7 @@ Read the entrypoint and package export map for re-exported or type-only surfaces
 
 Local source modules: [src/console.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/console.ts), [src/disposable-database.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/disposable-database.ts), [src/events.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/events.ts), [src/feature.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/feature.ts), [src/isolated.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/isolated.ts), [src/mail.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/mail.ts), [src/schema.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/schema.ts), [src/service.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/service.ts), [src/time.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/time.ts).
 
-Evidence directory: [22 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [24 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/tinker
 

package/ai/skills/stacks-testing/SKILL.md

@@ -209,7 +209,10 @@ for (const dialect of ['sqlite', 'postgres'] as const) {
 - `runIsolated(file, { env, timeoutMs = 60_000, args, cwd, mode, preload, bunfig, envFile, inheritEnv, stdin })`
   resolves `{ code, signal, stdout, stderr, timedOut, durationMs, command }`. `mode: 'auto'` runs
   `*.test.*` / `*.spec.*` with `bun test`, anything else as a script; `env` values of `undefined`
-  remove a variable. The watchdog sends SIGTERM at the timeout and SIGKILL 2 s later.
+  remove a variable. Native ownership disposes the command and normally inherited descendants
+  before returning, including after a normal early command exit. POSIX uses an anchored group
+  with SIGTERM then SIGKILL after 2 seconds; Windows uses a parent-held Job Object and confirms
+  zero active members. Deliberate POSIX breakaway is outside this lifecycle contract.
 - `bunfig: 'path/bunfig.toml'` runs the child with that config (`--config=`), resolved against
   `cwd`; it must exist. `preload` instead generates a config holding only those preloads. They are
   exclusive (a TypeError): list the preloads in your bunfig. Bun resolves a bunfig's relative

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.75.432",
+  "version": "0.75.439",
   "description": "Stacks, built into VS Code: stx templates, pickier linting and formatting, encrypted env files, the dev server preview and every buddy command. No other extensions required.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.432",
+  "version": "0.75.439",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -45,7 +45,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.35",
-    "@stacksjs/mobile": "0.75.432",
+    "@stacksjs/mobile": "0.75.439",
     "@stacksjs/sanitizer": "0.2.784",
     "@stacksjs/stx": "0.2.784",
     "@xterm/addon-fit": "^0.11.0",