@stacksjs/defaults 0.75.432 → 0.75.443

package/ai/skills/stacks-auth/SKILL.md

@@ -112,6 +112,9 @@ is rejected because multiplexed application actions can handle it as a write.
 `requestImpersonation()` exposes trusted actor/subject metadata; ORM trails
 attribute writes to the original actor. `Auth.endImpersonation(credential)`
 requires the original actor request without the support header.
+Ordinary bearer lookups may be cached within a request. Viewed identities are
+never stored in that cache: each support-view resolution rechecks live authority
+and clears previously trusted support context before authenticating again.
 
 Store viewing state independently from the actor's login and cached profile,
 show a persistent disclosure and Exit control, disable offline persistence,

package/ai/skills/stacks-cli/SKILL.md

@@ -195,3 +195,21 @@ Source evidence: `storage/framework/core/cli/src/index.ts`,
 `commands.ts` and `terminal.ts`; command discovery is owned by buddy's
 runtime registry. `buddy list` and `buddy <command> --help` are the
 authoritative command/flag inventory, including package-contributed commands.
+
+## Native command ownership
+
+Import `spawnOwnedProcess` from `@stacksjs/cli/owned-process` for a command whose
+normally inherited descendants belong to the same lifetime. This subpath uses
+only native Bun/Node primitives, with no CLI or application bootstrap.
+
+A controlled owner establishes a POSIX process group or native Windows Job
+Object before admitting the command. `started` resolves its actual command PID;
+`pid` identifies the stable lifecycle owner. Consumer IPC is forwarded with the
+verified command PID. `exited` preserves command status and settles after tree
+disposal. `stop()` is idempotent, and signaling the owner also initiates cleanup.
+Compiled callers supply their installed Bun path as `ownerRuntime`.
+
+This is lifecycle ownership, not a sandbox: deliberate POSIX breakaway is outside
+the group contract. Native admission or disposal failures reject rather than
+falling back to direct-child cleanup. `runBoundedProcess` in `cli/process` retains
+its separate output-byte/deadline contract; it is not this ownership API.

package/ai/skills/stacks-dependencies/SKILL.md

@@ -152,6 +152,15 @@ changed, and `lockfile-matches-manifests.test.ts` compares the ranges both
 lockfiles record against the manifests. Either failure means a lockfile was
 not regenerated with its manifest, not that the guard is wrong.
 
+## Framework release destination
+
+Framework tags require successful main-push CI for the exact release commit.
+Before releasing from a work branch, configure its upstream with
+`git branch --set-upstream-to=origin/main`, integrate current main, and use
+`bun run release:patch`. The release and standalone bump preflights reject a
+framework destination other than main before generating manifests or tags.
+Application releases continue to use their own configured upstream.
+
 ## Dependency Update System
 
 - **buddy-bot** (`@buddysh/buddy`, shipped by `better-dx`) handles dependency updates, NOT renovatebot

package/ai/skills/stacks-desktop/SKILL.md

@@ -361,6 +361,22 @@ buddy desktop:apple:publish    # validate or upload the package to App Store Con
 buddy desktop:probe            # measure what a Craft window offers interactive/game content
 ```
 
+A TestFlight release from the developer's Mac needs only the App Store Connect
+key (`APP_STORE_CONNECT_API_KEY*`, encrypted in `.env.production`):
+
+```bash
+APP_ENV=production buddy desktop:apple:publish --build-number next --testflight 'My Team'
+```
+
+`--build-number next` asks App Store Connect for the app's highest build and
+uses one more, so every upload is `<version> (n + 1)` with no counter kept
+anywhere. `--testflight` waits for processing, gives the build to the named beta
+groups (they must already exist; an automatic-distribution internal group gets it
+without an explicit add), and sets "What to Test" from `--whats-new` or the
+commit subjects since the last tag. Signing identities not named by a variable
+are read from the keychain for the team, and a missing
+`APPLE_PROVISIONING_PROFILE` is downloaded from App Store Connect.
+
 `desktop:probe` opens a visible Craft window (not `--headless`, which stops
 requestAnimationFrame) and measures WebGL2/WebGPU, frame pacing under load,
 input and audio latency, the Gamepad API, fullscreen and pointer lock.

package/ai/skills/stacks-native/CATALOG.md

@@ -15,8 +15,8 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/ai` | [`stacks-ai`](../stacks-ai/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/index.ts) | 21 |
 | `@stacksjs/alias` | [`stacks-alias`](../stacks-alias/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/alias/src/index.ts) | 3 |
 | `@stacksjs/analytics` | [`stacks-analytics`](../stacks-analytics/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/analytics/src/index.ts) | 6 |
-| `@stacksjs/api` | [`stacks-api`](../stacks-api/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/api/src/index.ts) | 9 |
-| `@stacksjs/arrays` | [`stacks-arrays`](../stacks-arrays/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/arrays/src/index.ts) | 9 |
+| `@stacksjs/api` | [`stacks-api`](../stacks-api/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/api/src/index.ts) | 12 |
+| `@stacksjs/arrays` | [`stacks-arrays`](../stacks-arrays/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/arrays/src/index.ts) | 10 |
 | `@stacksjs/audio` | [`stacks-audio`](../stacks-audio/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/audio/src/index.ts) | 3 |
 | `@stacksjs/auth` | [`stacks-auth`](../stacks-auth/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/index.ts) | 126 |
 | `@stacksjs/browser` | [`stacks-browser`](../stacks-browser/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser/src/index.ts) | 8 |
@@ -88,13 +88,13 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/socials` | [`stacks-socials`](../stacks-socials/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/socials/src/index.ts) | 17 |
 | `@stacksjs/storage` | [`stacks-storage`](../stacks-storage/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/index.ts) | 47 |
 | `@stacksjs/strings` | [`stacks-strings`](../stacks-strings/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/strings/src/index.ts) | 10 |
-| `@stacksjs/testing` | [`stacks-testing`](../stacks-testing/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/index.ts) | 22 |
+| `@stacksjs/testing` | [`stacks-testing`](../stacks-testing/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/index.ts) | 24 |
 | `@stacksjs/tinker` | [`stacks-repl`](../stacks-repl/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/tinker/src/index.ts) | 1 |
 | `@stacksjs/tunnel` | [`stacks-tunnel`](../stacks-tunnel/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/tunnel/src/index.ts) | 1 |
 | `@stacksjs/types` | [`stacks-types`](../stacks-types/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/index.ts) | 2 |
 | `@stacksjs/ui` | [`stacks-ui`](../stacks-ui/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ui/src/index.ts) | 6 |
 | `@stacksjs/utils` | [`stacks-utils`](../stacks-utils/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/utils/src/index.ts) | 15 |
-| `@stacksjs/validation` | [`stacks-validation`](../stacks-validation/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/validation/src/index.ts) | 21 |
+| `@stacksjs/validation` | [`stacks-validation`](../stacks-validation/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/validation/src/index.ts) | 22 |
 | `@stacksjs/video` | [`stacks-video`](../stacks-video/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/video/src/index.ts) | 3 |
 | `@stacksjs/whois` | [`stacks-whois`](../stacks-whois/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/whois/src/index.ts) | 5 |
 
@@ -159,7 +159,7 @@ Read the entrypoint and package export map for re-exported or type-only surfaces
 
 Local source modules: [src/fetcher.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/api/src/fetcher.ts), [src/generate-client.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/api/src/generate-client.ts), [src/generate-openapi.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/api/src/generate-openapi.ts), [src/generate-types.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/api/src/generate-types.ts), [src/operation.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/api/src/operation.ts), [src/resource.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/api/src/resource.ts).
 
-Evidence directory: [9 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/api/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [12 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/api/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/arrays
 
@@ -169,7 +169,7 @@ Declared runtime exports: `arr`.
 
 Local source modules: [src/arr.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/arrays/src/arr.ts), [src/macro.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/arrays/src/macro.ts).
 
-Evidence directory: [9 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/arrays/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [10 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/arrays/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/audio
 
@@ -861,7 +861,7 @@ Read the entrypoint and package export map for re-exported or type-only surfaces
 
 Local source modules: [src/console.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/console.ts), [src/disposable-database.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/disposable-database.ts), [src/events.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/events.ts), [src/feature.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/feature.ts), [src/isolated.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/isolated.ts), [src/mail.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/mail.ts), [src/schema.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/schema.ts), [src/service.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/service.ts), [src/time.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/time.ts).
 
-Evidence directory: [22 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [24 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/tinker
 
@@ -919,7 +919,7 @@ Declared runtime exports: `applyConditionals`, `isArray`, `isBoolean`, `isFuncti
 
 Local source modules: [src/input.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/validation/src/input.ts), [src/messages.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/validation/src/messages.ts), [src/reporter.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/validation/src/reporter.ts), [src/schema.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/validation/src/schema.ts), [src/validator.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/validation/src/validator.ts).
 
-Evidence directory: [21 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/validation/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [22 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/validation/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/video
 

package/ai/skills/stacks-testing/SKILL.md

@@ -209,7 +209,10 @@ for (const dialect of ['sqlite', 'postgres'] as const) {
 - `runIsolated(file, { env, timeoutMs = 60_000, args, cwd, mode, preload, bunfig, envFile, inheritEnv, stdin })`
   resolves `{ code, signal, stdout, stderr, timedOut, durationMs, command }`. `mode: 'auto'` runs
   `*.test.*` / `*.spec.*` with `bun test`, anything else as a script; `env` values of `undefined`
-  remove a variable. The watchdog sends SIGTERM at the timeout and SIGKILL 2 s later.
+  remove a variable. Native ownership disposes the command and normally inherited descendants
+  before returning, including after a normal early command exit. POSIX uses an anchored group
+  with SIGTERM then SIGKILL after 2 seconds; Windows uses a parent-held Job Object and confirms
+  zero active members. Deliberate POSIX breakaway is outside this lifecycle contract.
 - `bunfig: 'path/bunfig.toml'` runs the child with that config (`--config=`), resolved against
   `cwd`; it must exist. `preload` instead generates a config holding only those preloads. They are
   exclusive (a TypeError): list the preloads in your bunfig. Bun resolves a bunfig's relative

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.75.432",
+  "version": "0.75.443",
   "description": "Stacks, built into VS Code: stx templates, pickier linting and formatting, encrypted env files, the dev server preview and every buddy command. No other extensions required.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.432",
+  "version": "0.75.443",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -45,9 +45,9 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.35",
-    "@stacksjs/mobile": "0.75.432",
-    "@stacksjs/sanitizer": "0.2.784",
-    "@stacksjs/stx": "0.2.784",
+    "@stacksjs/mobile": "0.75.443",
+    "@stacksjs/sanitizer": "0.2.787",
+    "@stacksjs/stx": "0.2.787",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/xterm": "^6.0.0",
     "ts-qr-codes": "^0.1.8"