@stacksjs/defaults 0.75.445 → 0.75.450

package/ai/skills/stacks-arrays/SKILL.md

@@ -269,9 +269,11 @@ These standalone functions are also available through the root `arr` namespace:
 - `groupBy`, `keyBy`, `countBy` use selector functions and return typed records.
   Repeated keyBy keys overwrite earlier entries; groupBy accumulates them.
 - `sortBy(array, ...selectors)` copies before sorting, supports multiple keys,
-  and accepts `{ by, order: 'desc' }` selectors.
+  and accepts `{ by, order: 'desc' }` selectors. Each selector runs once per element;
+  cached keys preserve stable ties.
 - `sumBy`, `meanBy`, `minBy`, `maxBy` aggregate selected values. `meanBy` returns
   undefined on an empty input; extrema return the selected element, not its value.
+  Extrema retain infinite endpoints and ignore NaN candidates; ties keep the first.
 - `zip`, `zipWith` stop at the shorter input; `unzip` splits pairs.
 - `difference` keeps first-input duplicates that are not excluded;
   `intersection` and `union` deduplicate by Set identity.
@@ -280,6 +282,12 @@ These standalone functions are also available through the root `arr` namespace:
 - `splitAt` supports negative indexes; `splitWhen` starts the second half at
   the first match; `times` requires a non-negative integer count.
 
+`take`, `takeLast`, `drop` and `dropLast` truncate fractional counts toward zero,
+clamp negatives/NaN to zero and treat Infinity as the entire array. Population
+variance, standard deviation, covariance and z-scores use scaled centered arithmetic
+for finite inputs. Standard deviation stays finite when only its square is outside
+the number range; unrepresentable final results keep IEEE number behavior.
+
 Read `core/arrays/src/transform.ts` and `tests/transform.test.ts` for precise
 empty-input and selector behavior. These pure helpers are preferable to a new
 utility dependency for common native transformations.

package/ai/skills/stacks-auth/SKILL.md

@@ -737,13 +737,39 @@ not authenticate them. OAuth resource endpoints must explicitly use
 required scopes. Ordinary refresh also refuses delegated refresh credentials;
 use the OAuth token endpoint and the registered client's protocol authentication.
 
+### Userinfo and pairwise subjects
+
+The provider has no id_token. A relying party that signs people in with this
+provider reads `oauthUserInfoResponse(request, { scopes, resource, audience,
+workspaceId, isSubjectEligible, pairwiseSecret, claims })`: the same delegated
+token checks as any protected resource, then `{ ...claims, sub }`. `sub` comes
+from `pairwiseOAuthSubject(secret, clientId, subject)`, an HMAC that differs per
+client so two relying parties cannot join records on it; keep its secret apart
+from rotating app keys. `claims({ sub, subject, clientId, scopes })` releases
+only what the granted scopes cover, and null answers 401. The socials
+`StacksIssuerProvider` is the matching client.
+
 ## Token-only recovery endpoints
 
 For high-entropy reset credentials, `mintPasswordResetToken()` returns `{ token, digest }`.
 Store the digest in `password_resets.token`, never the plaintext.
+Prefer `issuePasswordResetToken(email, { throttleMs?, expiresAt?, eligible? })` when
+issuing for an existing account. It locks that account before checking its current
+email, the synchronous application eligibility predicate and the saved throttle.
+It considers all supported legacy email-case variants when throttling, and retires
+them together when replacing the credential. `throttleMs: 0` disables throttling.
+It atomically replaces the digest and returns `{ issued: true, token, userId, email }`
+or `{ issued: false }`. The latter deliberately combines unknown, ineligible and
+throttled accounts; recovery endpoints must keep their public response generic.
+Only send the returned credential after issuance commits.
+Treat its value as opaque. It is bound to the issuing account, so reassigning an
+email address cannot let an old recovery reset the address's new account.
 `consumePasswordResetToken(token, async claim => { ... })` locks the owner and token,
 checks the stored expiry and consumes it in the same transaction as callback writes.
 `claim` is `{ userId, email, hasExplicitExpiry }`; result is `{ consumed: false }` or
 `{ consumed: true, value }`. Failures roll back the credential and account changes.
 Use database work only in the callback, and send notifications after commit.
+The credential is consumed before the callback, so it composes with
+`revokeAccountCredentials(claim.userId)`. That sweep also removes any pending
+password-reset links; changing a password must retire recovery credentials too.
 The existing `passwordResets(email)` flow supports email-addressed bcrypt tokens.

package/ai/skills/stacks-cache/SKILL.md

@@ -27,8 +27,9 @@ const products = await cache.mget<{ name: string }>(['product:42', 'product:43']
   shipped) on every driver, memory included, so a value set with no TTL
   expires after an hour. The `memory` export is a separate in-process
   instance with no default expiry.
-- `setForever` stores without expiry; `getTtl` reads remaining TTL and
-  `ttl(key, seconds)` updates it. Missing values are undefined.
+- `setForever` stores without expiry; `getTtl` reads the absolute expiry in epoch
+  milliseconds (zero for forever); `ttl(key, seconds)` updates it.
+  Missing or expired values are undefined.
 - `mset([{ key, value, ttl? }])` writes entries. `del(keyOrKeys)` and
   `deleteMany(keys)` return counts; `remove(key)` returns void.
 - `has/missing/take`, `keys(pattern?)`, `getStats`,
@@ -61,6 +62,15 @@ deploys, pointing `path` at a file the deploy preserves (the app's own SQLite
 database works; the table is the driver's alone). `createCache(driver,
 options?)` selects one of memory, redis, singlestore or sqlite.
 
+SQLite TTLs, including `stdTTL`, must be finite non-negative seconds with
+representable expiry timestamps. Zero alone means forever; fractions work.
+Invalid TTLs throw RangeError before publication; invalid `mset` entries roll
+back the batch. `getTtl` evicts expired entries instead of reporting stale
+metadata. `mget` preserves special keys such as `__proto__` as own properties.
+SQLite key globs are case-sensitive, with only `*` a wildcard; `?`, brackets,
+percent, underscore and backslash are literal. An empty pattern matches an
+empty key, while an omitted pattern lists all live keys in the prefix.
+
 The `cache` export is the driver `config/cache.ts` selects, with its `prefix`
 and `ttl` applied on every driver (memory also takes `maxKeys`, `useClones`
 and `drivers.memory`), resolved on first use and once the app's config has

package/ai/skills/stacks-datetime/SKILL.md

@@ -258,6 +258,11 @@ offset; the named IANA zone converts it into an instant. `isoInZone` retains
 that zone's offset in serialized output rather than merely displaying a date.
 `addCalendarMonths` clones and clamps the day; ordinary `DateTime.addMonths`
 preserves native Date overflow instead. Do not interchange those contracts.
+Calendar-month clamping keeps literal early years in local and UTC mode and throws
+RangeError for an out-of-range result. A zero-month shift preserves the exact instant.
+Named-zone conversion rejects impossible calendar and clock fields before applying
+DST disambiguation. Era-aware offsets support year zero and BCE instants; `isoInZone`
+retains seconds for expanded ISO years.
 
 `zonedTimeToUtc` resolves DST edges the same way in every zone (RFC 5545 and
 Temporal's `'compatible'` rule):
@@ -309,6 +314,7 @@ minutesUntil('2026-10-25', '09:00', 'Europe/Berlin', new Date('2026-10-24T22:00:
 - `minutesUntil` keeps the seconds of `now` as a fraction; round where you
   display or compare. Negative once the moment has passed.
 - `addDays` refuses a result past 9999-12-31.
+- `todayIn` returns canonical dates from 0000 through 9999 and rejects BCE or expanded-year dates.
 
 ### Reading `DATE` columns: `parseSqlDate` (`@stacksjs/database`)
 
@@ -363,6 +369,8 @@ clockMinutes, addClockMinutes and timeWindowsCover. Recurrence validation
 rejects invalid weekday entries; expansion refuses excessive ranges and
 midnight-crossing durations instead of silently truncating them. Adjacent
 windows can cover one continuous slot. ScheduleInputError carries status 422.
+Every supplied availability window is validated before checking coverage, even
+when an earlier valid window already covers the slot.
 
 localDateRange(from, to, ...zones) converts inclusive calendar days to an
 exclusive-end UTC instant range in a selected valid zone, including DST days.

package/ai/skills/stacks-native/CATALOG.md

@@ -16,14 +16,14 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/alias` | [`stacks-alias`](../stacks-alias/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/alias/src/index.ts) | 3 |
 | `@stacksjs/analytics` | [`stacks-analytics`](../stacks-analytics/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/analytics/src/index.ts) | 6 |
 | `@stacksjs/api` | [`stacks-api`](../stacks-api/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/api/src/index.ts) | 12 |
-| `@stacksjs/arrays` | [`stacks-arrays`](../stacks-arrays/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/arrays/src/index.ts) | 10 |
+| `@stacksjs/arrays` | [`stacks-arrays`](../stacks-arrays/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/arrays/src/index.ts) | 12 |
 | `@stacksjs/audio` | [`stacks-audio`](../stacks-audio/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/audio/src/index.ts) | 3 |
-| `@stacksjs/auth` | [`stacks-auth`](../stacks-auth/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/index.ts) | 126 |
+| `@stacksjs/auth` | [`stacks-auth`](../stacks-auth/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/index.ts) | 127 |
 | `@stacksjs/browser` | [`stacks-browser`](../stacks-browser/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser/src/index.ts) | 8 |
 | `@stacksjs/browser-extension` | [`stacks-browser-extension`](../stacks-browser-extension/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/index.ts) | 9 |
 | `@stacksjs/buddy` | [`stacks-buddy`](../stacks-buddy/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/buddy/src/index.ts) | 179 |
 | `@stacksjs/build` | [`stacks-build`](../stacks-build/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/build/src/index.ts) | 6 |
-| `@stacksjs/cache` | [`stacks-cache`](../stacks-cache/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/cache/src/index.ts) | 23 |
+| `@stacksjs/cache` | [`stacks-cache`](../stacks-cache/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/cache/src/index.ts) | 24 |
 | `@stacksjs/calendar-api` | [`stacks-calendar`](../stacks-calendar/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/calendar-api/src/index.ts) | 5 |
 | `@stacksjs/charts` | [`stacks-charts`](../stacks-charts/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/charts/src/index.ts) | 3 |
 | `@stacksjs/chat` | [`stacks-chat`](../stacks-chat/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/chat/src/index.ts) | 6 |
@@ -36,7 +36,7 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/config` | [`stacks-config`](../stacks-config/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/config/src/index.ts) | 16 |
 | `@stacksjs/cron` | [`stacks-cron`](../stacks-cron/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/cron/src/index.ts) | 6 |
 | `@stacksjs/database` | [`stacks-database`](../stacks-database/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/index.ts) | 138 |
-| `@stacksjs/datetime` | [`stacks-datetime`](../stacks-datetime/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/datetime/src/index.ts) | 21 |
+| `@stacksjs/datetime` | [`stacks-datetime`](../stacks-datetime/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/datetime/src/index.ts) | 22 |
 | `@stacksjs/defaults` | [`stacks-build`](../stacks-build/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/defaults/package.json) | 2 |
 | `@stacksjs/deploy` | [`stacks-deploy`](../stacks-deploy/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/deploy/package.json) | 1 |
 | `@stacksjs/desktop-build` | [`stacks-desktop`](../stacks-desktop/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/desktop/src/index.ts) | 15 |
@@ -64,9 +64,9 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/model-meta` | [`stacks-models`](../stacks-models/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/model-meta/src/index.ts) | 1 |
 | `@stacksjs/newsletter` | [`stacks-newsletter`](../stacks-newsletter/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/newsletter/src/index.ts) | 7 |
 | `@stacksjs/notifications` | [`stacks-notifications`](../stacks-notifications/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/notifications/src/index.ts) | 18 |
-| `@stacksjs/objects` | [`stacks-objects`](../stacks-objects/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/objects/src/index.ts) | 6 |
+| `@stacksjs/objects` | [`stacks-objects`](../stacks-objects/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/objects/src/index.ts) | 8 |
 | `@stacksjs/orm` | [`stacks-orm`](../stacks-orm/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/orm/src/index.ts) | 76 |
-| `@stacksjs/pagination` | [`stacks-pagination`](../stacks-pagination/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/pagination/src/index.ts) | 0 |
+| `@stacksjs/pagination` | [`stacks-pagination`](../stacks-pagination/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/pagination/src/index.ts) | 1 |
 | `@stacksjs/path` | [`stacks-path`](../stacks-path/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/path/src/index.ts) | 13 |
 | `@stacksjs/payments` | [`stacks-payments`](../stacks-payments/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/payments/src/index.ts) | 39 |
 | `@stacksjs/push` | [`stacks-push`](../stacks-push/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/push/src/index.ts) | 8 |
@@ -85,16 +85,16 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/skills` | [`stacks-skills`](../stacks-skills/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/skills/src/index.ts) | 1 |
 | `@stacksjs/slug` | [`stacks-slug`](../stacks-slug/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/slug/src/index.ts) | 5 |
 | `@stacksjs/sms` | [`stacks-sms`](../stacks-sms/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/sms/src/index.ts) | 6 |
-| `@stacksjs/socials` | [`stacks-socials`](../stacks-socials/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/socials/src/index.ts) | 17 |
-| `@stacksjs/storage` | [`stacks-storage`](../stacks-storage/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/index.ts) | 47 |
-| `@stacksjs/strings` | [`stacks-strings`](../stacks-strings/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/strings/src/index.ts) | 10 |
+| `@stacksjs/socials` | [`stacks-socials`](../stacks-socials/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/socials/src/index.ts) | 18 |
+| `@stacksjs/storage` | [`stacks-storage`](../stacks-storage/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/index.ts) | 48 |
+| `@stacksjs/strings` | [`stacks-strings`](../stacks-strings/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/strings/src/index.ts) | 11 |
 | `@stacksjs/testing` | [`stacks-testing`](../stacks-testing/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/index.ts) | 24 |
 | `@stacksjs/tinker` | [`stacks-repl`](../stacks-repl/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/tinker/src/index.ts) | 1 |
 | `@stacksjs/tunnel` | [`stacks-tunnel`](../stacks-tunnel/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/tunnel/src/index.ts) | 1 |
 | `@stacksjs/types` | [`stacks-types`](../stacks-types/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/index.ts) | 2 |
 | `@stacksjs/ui` | [`stacks-ui`](../stacks-ui/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ui/src/index.ts) | 6 |
-| `@stacksjs/utils` | [`stacks-utils`](../stacks-utils/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/utils/src/index.ts) | 15 |
-| `@stacksjs/validation` | [`stacks-validation`](../stacks-validation/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/validation/src/index.ts) | 22 |
+| `@stacksjs/utils` | [`stacks-utils`](../stacks-utils/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/utils/src/index.ts) | 22 |
+| `@stacksjs/validation` | [`stacks-validation`](../stacks-validation/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/validation/src/index.ts) | 25 |
 | `@stacksjs/video` | [`stacks-video`](../stacks-video/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/video/src/index.ts) | 3 |
 | `@stacksjs/whois` | [`stacks-whois`](../stacks-whois/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/whois/src/index.ts) | 5 |
 
@@ -169,7 +169,7 @@ Declared runtime exports: `arr`.
 
 Local source modules: [src/arr.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/arrays/src/arr.ts), [src/macro.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/arrays/src/macro.ts).
 
-Evidence directory: [10 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/arrays/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [12 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/arrays/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/audio
 
@@ -187,9 +187,9 @@ Guidance: [`stacks-auth`](../stacks-auth/SKILL.md). Source: [storage/framework/c
 
 Declared runtime exports: `DEFAULT_ROLE_PACKS`, `createBqbRbacStore`, `generateTOTP`, `generateTOTPSecret`, `requestImpersonation`, `seedDefaultRoles`, `totpKeyUri`, `verifyTOTP`.
 
-Local source modules: [src/authentication.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/authentication.ts), [src/authenticator.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/authenticator.ts), [src/authorizable.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/authorizable.ts), [src/browser-session.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/browser-session.ts), [src/client.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/client.ts), [src/cookie-auth.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/cookie-auth.ts), [src/credential-user.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/credential-user.ts), [src/email-verification.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/email-verification.ts), [src/gate.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/gate.ts), [src/impersonation-auth.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/impersonation-auth.ts), [src/impersonation-store.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/impersonation-store.ts), [src/impersonation.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/impersonation.ts), [src/magic-link.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/magic-link.ts), [src/middleware.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/middleware.ts), [src/oauth-authorization-codes.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-codes.ts), [src/oauth-authorization-endpoint.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-endpoint.ts), [src/oauth-authorization-requests.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-requests.ts), [src/oauth-authorization-response.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-response.ts), [src/oauth-authorization.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization.ts), [src/oauth-browser-session.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-browser-session.ts), [src/oauth-client-registration.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-client-registration.ts), [src/oauth-consent.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-consent.ts), [src/oauth-delegated-access.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-delegated-access.ts), [src/oauth-dynamic-registration.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-dynamic-registration.ts), [src/oauth-grants.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-grants.ts), [src/oauth-introspection.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-introspection.ts), [src/oauth-metadata.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-metadata.ts), [src/oauth-pkce.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-pkce.ts), [src/oauth-protected-resource.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-protected-resource.ts), [src/oauth-provider.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-provider.ts), [src/oauth-pruning.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-pruning.ts), [src/oauth-revocation.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-revocation.ts), [src/oauth-server.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-server.ts), [src/oauth-token-endpoint.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-endpoint.ts), [src/oauth-token-exchange.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-exchange.ts), [src/oauth-token-request.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-request.ts), [src/oauth-token-response.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-response.ts), [src/page-gate.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/page-gate.ts), [src/passkey.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/passkey.ts), [src/passkeys.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/passkeys.ts), [src/password/reset-token.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/password/reset-token.ts), [src/password/reset.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/password/reset.ts), [src/permissions.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/permissions.ts), [src/policy.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/policy.ts), [src/rate-limiter.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rate-limiter.ts), [src/rbac-seed.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rbac-seed.ts), [src/rbac-store-bqb.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rbac-store-bqb.ts), [src/rbac.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rbac.ts), [src/referrals.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/referrals.ts), [src/register.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/register.ts), [src/request-token.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/request-token.ts), [src/session-auth.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/session-auth.ts), [src/session-handoff.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/session-handoff.ts), [src/socials.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/socials.ts), [src/team.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/team.ts), [src/tokens.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/tokens.ts), [src/two-factor.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/two-factor.ts), [src/user.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/user.ts).
+Local source modules: [src/authentication.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/authentication.ts), [src/authenticator.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/authenticator.ts), [src/authorizable.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/authorizable.ts), [src/browser-session.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/browser-session.ts), [src/client.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/client.ts), [src/cookie-auth.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/cookie-auth.ts), [src/credential-user.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/credential-user.ts), [src/email-verification.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/email-verification.ts), [src/gate.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/gate.ts), [src/impersonation-auth.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/impersonation-auth.ts), [src/impersonation-store.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/impersonation-store.ts), [src/impersonation.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/impersonation.ts), [src/magic-link.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/magic-link.ts), [src/middleware.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/middleware.ts), [src/oauth-authorization-codes.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-codes.ts), [src/oauth-authorization-endpoint.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-endpoint.ts), [src/oauth-authorization-requests.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-requests.ts), [src/oauth-authorization-response.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-response.ts), [src/oauth-authorization.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization.ts), [src/oauth-browser-session.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-browser-session.ts), [src/oauth-client-registration.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-client-registration.ts), [src/oauth-consent.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-consent.ts), [src/oauth-delegated-access.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-delegated-access.ts), [src/oauth-dynamic-registration.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-dynamic-registration.ts), [src/oauth-grants.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-grants.ts), [src/oauth-introspection.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-introspection.ts), [src/oauth-metadata.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-metadata.ts), [src/oauth-pkce.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-pkce.ts), [src/oauth-protected-resource.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-protected-resource.ts), [src/oauth-provider.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-provider.ts), [src/oauth-pruning.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-pruning.ts), [src/oauth-revocation.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-revocation.ts), [src/oauth-server.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-server.ts), [src/oauth-token-endpoint.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-endpoint.ts), [src/oauth-token-exchange.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-exchange.ts), [src/oauth-token-request.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-request.ts), [src/oauth-token-response.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-response.ts), [src/oauth-userinfo.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-userinfo.ts), [src/page-gate.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/page-gate.ts), [src/passkey.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/passkey.ts), [src/passkeys.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/passkeys.ts), [src/password/reset-token.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/password/reset-token.ts), [src/password/reset.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/password/reset.ts), [src/permissions.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/permissions.ts), [src/policy.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/policy.ts), [src/rate-limiter.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rate-limiter.ts), [src/rbac-seed.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rbac-seed.ts), [src/rbac-store-bqb.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rbac-store-bqb.ts), [src/rbac.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rbac.ts), [src/referrals.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/referrals.ts), [src/register.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/register.ts), [src/request-token.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/request-token.ts), [src/session-auth.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/session-auth.ts), [src/session-handoff.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/session-handoff.ts), [src/socials.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/socials.ts), [src/team.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/team.ts), [src/tokens.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/tokens.ts), [src/two-factor.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/two-factor.ts), [src/user.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/user.ts).
 
-Evidence directory: [126 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [127 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/browser
 
@@ -239,7 +239,7 @@ Read the entrypoint and package export map for re-exported or type-only surfaces
 
 Local source modules: [src/drivers/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/cache/src/drivers/index.ts), [src/key.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/cache/src/key.ts).
 
-Evidence directory: [23 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/cache/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [24 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/cache/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/calendar-api
 
@@ -367,7 +367,7 @@ Declared runtime exports: `DateTime`, `addCalendarMonths`, `addDays`, `dateForma
 
 Local source modules: [src/calendar.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/datetime/src/calendar.ts), [src/format.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/datetime/src/format.ts), [src/local.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/datetime/src/local.ts), [src/now.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/datetime/src/now.ts), [src/parse.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/datetime/src/parse.ts), [src/schedule.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/datetime/src/schedule.ts), [src/zone.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/datetime/src/zone.ts).
 
-Evidence directory: [21 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/datetime/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [22 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/datetime/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/defaults
 
@@ -631,7 +631,7 @@ Declared runtime exports: `clearUndefined`, `deepMerge`, `hasOwnProperty`, `isKe
 
 Local source modules: [src/transform.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/objects/src/transform.ts).
 
-Evidence directory: [6 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/objects/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [8 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/objects/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/orm
 
@@ -649,6 +649,8 @@ Guidance: [`stacks-pagination`](../stacks-pagination/SKILL.md). Source: [storage
 
 Declared runtime exports: `isCursorPaginator`, `isPaginator`, `isSimplePaginator`, `toCursorPaginator`, `toPaginator`, `toSimplePaginator`.
 
+Evidence directory: [1 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/pagination/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+
 ### @stacksjs/path
 
 Guidance: [`stacks-path`](../stacks-path/SKILL.md). Source: [storage/framework/core/path/src/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/path/src/index.ts).
@@ -831,7 +833,7 @@ Read the entrypoint and package export map for re-exported or type-only surfaces
 
 Local source modules: [src/abstract.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/socials/src/abstract.ts), [src/authorize.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/socials/src/authorize.ts), [src/drivers/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/socials/src/drivers/index.ts), [src/exceptions.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/socials/src/exceptions.ts), [src/flows.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/socials/src/flows.ts), [src/handoff.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/socials/src/handoff.ts), [src/identities.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/socials/src/identities.ts), [src/meta-graph.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/socials/src/meta-graph.ts), [src/publish.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/socials/src/publish.ts), [src/registry.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/socials/src/registry.ts), [src/token.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/socials/src/token.ts), [src/types.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/socials/src/types.ts).
 
-Evidence directory: [17 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/socials/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [18 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/socials/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/storage
 
@@ -841,7 +843,7 @@ Declared runtime exports: `PathSanitizeError`, `Storage`, `StorageManager`, `Upl
 
 Local source modules: [src/adapters/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/adapters/index.ts), [src/bounded-text-file.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/bounded-text-file.ts), [src/completed-artifact-directory.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/completed-artifact-directory.ts), [src/copy.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/copy.ts), [src/delete.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/delete.ts), [src/drivers/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/drivers/index.ts), [src/facade.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/facade.ts), [src/file-info.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/file-info.ts), [src/files.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/files.ts), [src/folders.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/folders.ts), [src/fs.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/fs.ts), [src/glob.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/glob.ts), [src/hash.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/hash.ts), [src/helpers.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/helpers.ts), [src/mime-verify.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/mime-verify.ts), [src/path-sanitize.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/path-sanitize.ts), [src/provision.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/provision.ts), [src/s3-presigned-post.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/s3-presigned-post.ts), [src/signed-url.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/signed-url.ts), [src/static-serve.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/static-serve.ts), [src/storage.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/storage.ts), [src/temporary-workspaces.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/temporary-workspaces.ts), [src/types.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/types.ts), [src/types/filesystem.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/types/filesystem.ts), [src/uploaded-file.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/uploaded-file.ts), [src/zip.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/zip.ts).
 
-Evidence directory: [47 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [48 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/strings
 
@@ -851,7 +853,7 @@ Declared runtime exports: `string`.
 
 Local source modules: [src/string.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/strings/src/string.ts).
 
-Evidence directory: [10 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/strings/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [11 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/strings/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/testing
 
@@ -909,7 +911,7 @@ Declared runtime exports: `browserUtils`, `clamp`, `notNullish`, `retry`, `useOn
 
 Local source modules: [src/bytes.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/utils/src/bytes.ts), [src/clean.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/utils/src/clean.ts), [src/colors.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/utils/src/colors.ts), [src/config.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/utils/src/config.ts), [src/debounce.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/utils/src/debounce.ts), [src/detect.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/utils/src/detect.ts), [src/equal.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/utils/src/equal.ts), [src/errors.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/utils/src/errors.ts), [src/export-size.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/utils/src/export-size.ts), [src/find.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/utils/src/find.ts), [src/git.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/utils/src/git.ts), [src/hash.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/utils/src/hash.ts), [src/helpers.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/utils/src/helpers.ts), [src/macroable.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/utils/src/macroable.ts), [src/markdown.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/utils/src/markdown.ts), [src/merge.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/utils/src/merge.ts), [src/observer.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/utils/src/observer.ts), [src/pipe.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/utils/src/pipe.ts), [src/pipeline.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/utils/src/pipeline.ts), [src/safe-json.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/utils/src/safe-json.ts), [src/size.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/utils/src/size.ts), [src/versions.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/utils/src/versions.ts).
 
-Evidence directory: [15 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/utils/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [22 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/utils/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/validation
 
@@ -919,7 +921,7 @@ Declared runtime exports: `applyConditionals`, `isArray`, `isBoolean`, `isFuncti
 
 Local source modules: [src/input.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/validation/src/input.ts), [src/messages.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/validation/src/messages.ts), [src/reporter.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/validation/src/reporter.ts), [src/schema.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/validation/src/schema.ts), [src/validator.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/validation/src/validator.ts).
 
-Evidence directory: [22 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/validation/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [25 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/validation/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/video
 

package/ai/skills/stacks-objects/SKILL.md

@@ -81,16 +81,10 @@ const result = deepMerge(target, source)
 const merged = deepMerge(defaults, userConfig, overrides)
 ```
 
-The `DeepMerge<T, S>` type (from `@stacksjs/types`) provides full type inference:
-```typescript
-type DeepMerge<F, S> = MergeInsertions<{
-  [K in keyof F | keyof S]: K extends keyof S & keyof F
-    ? DeepMerge<F[K], S[K]>
-    : K extends keyof S ? S[K]
-    : K extends keyof F ? F[K]
-    : never
-}>
-```
+The `DeepMerge<T, S>` type from `@stacksjs/types` preserves primitive, array and
+built-in instance values while merging record keys recursively. A replaced Date
+target no longer exposes Date methods. The authoritative type is in
+`core/types/src/utils.ts`; verify consumers against built declarations.
 
 ### objectPick -- Pick Properties by Key
 ```typescript
@@ -153,7 +147,7 @@ if (isKeyOf(config, key)) {
 
 ### objectKeys -- Strictly Typed Object.keys
 ```typescript
-function objectKeys<T extends object>(obj: T): Array<`${keyof T & (string | number | boolean | null | undefined)}`>
+function objectKeys<T extends object>(obj: T): Array<ObjectStringKey<T>>
 ```
 
 Returns `Object.keys(obj)` with a stricter return type than the built-in `Object.keys()` (which returns `string[]`).
@@ -166,10 +160,13 @@ const keys = objectKeys(user)
 
 ### objectEntries -- Strictly Typed Object.entries
 ```typescript
-function objectEntries<T extends object>(obj: T): Array<[keyof T, T[keyof T]]>
+function objectEntries<T extends object>(obj: T): Array<ObjectStringEntry<T>>
 ```
 
 Returns `Object.entries(obj)` with a stricter return type than the built-in `Object.entries()` (which returns `[string, any][]`).
+`ObjectStringKey<T>` stringifies numeric keys and excludes symbols;
+`ObjectStringEntry<T>` pairs those keys with the visited values. Both functions
+declare their return types explicitly so built declarations preserve the arrays.
 
 ```typescript
 const user = { name: 'John', age: 30 }
@@ -197,9 +194,14 @@ The root also exports `omit`, `pickBy`, `omitBy`, `mapValues`, `mapKeys`,
 `invert`, `isEmptyObject`, `getPath` and `setPath` from `transform.ts`.
 Use a path array such as `['items', 0, 'name']`, not an assumed dot-string
 parser. `getPath(source, path, fallback?)` reads a nested value;
+`getPath` returns `unknown` even with a fallback; narrow a present value before use.
+`mapValues` preserves optional properties and omits symbol keys in its result type,
+matching its enumerable string-key traversal. The pure `@stacksjs/objects/transform`
+entry ships both JavaScript and declarations.
 `setPath(source, path, value)` performs a persistent update by copying containers
 along the path and sharing unaffected siblings. Treat paths as application-owned
-inputs; this helper is not a path authorization boundary. Choose `objectPick` for key-based selection and
+inputs; this helper is not a path authorization boundary. Array `length` updates
+use native length semantics on the copy and reject invalid lengths. Choose `objectPick` for key-based selection and
 `pickBy` for predicate selection. Read transform signatures for callback
 argument order; `objectMap`'s `(key, value)` is not a universal convention.
 Retained evidence: `core/objects/tests/transform.test.ts`.
@@ -212,6 +214,7 @@ Retained evidence: `core/objects/tests/transform.test.ts`.
 - `deepMerge` does NOT deeply merge arrays -- arrays from source replace arrays in target entirely.
 - `deepMerge` merges only plain objects key by key: a Date, Map, Set or class instance from a source is assigned as
   is, and a string, array or number in the target is replaced by a source's object.
+  A non-plain nested target also gives way to a plain source record.
 - `deepMerge` uses `isObject()` from `@stacksjs/validation` combined with `!Array.isArray()` to determine mergeability.
 - A `"__proto__"` key is data, never a prototype. `JSON.parse` and the router's request input keep one as an own key:
   `deepMerge` skips it and merges only into the target's own properties, and the transform helpers keep it as an own

package/ai/skills/stacks-pagination/SKILL.md

@@ -25,7 +25,14 @@ native parser. Do not treat a cursor as a trusted SQL fragment.
 
 toPaginator, toSimplePaginator and toCursorPaginator adapt source results.
 isPaginator/isSimplePaginator/isCursorPaginator identify the canonical shapes;
-they do not authenticate a source or validate every row.
+they require every mandatory metadata field, safe positive page integers,
+non-negative integer totals and correctly typed optional links. They do not
+authenticate a source or validate rows. Empty out-of-range pages remain valid.
+
+BigInt cursors serialize as exact decimal strings. Composite cursors encode
+BigInts as decimal string entries inside a JSON array. Keep those tokens intact
+through query parameters; the ORM parser restores tuples and SQL bindings
+accept decimal strings without a lossy Number conversion.
 
 ## HTTP and UI
 

package/ai/skills/stacks-socials/SKILL.md

@@ -34,6 +34,20 @@ instance redirect. X always uses PKCE; its verifier lives in the base class
 (getPkceVerifier/withCodeVerifier), so a callback on a fresh instance can
 restore it. Registry descriptors say `pkce` (X) and `nonce` (Apple).
 
+## Signing in with another Stacks application
+
+`StacksIssuerProvider({ issuer, clientId, clientSecret, redirectUrl, scopes,
+resource, userInfoUrl })` signs people in with another Stacks app that runs
+`oauthProvider`: Authorization Code with S256 PKCE (always on, so carry
+`getPkceVerifier()` in the flow and restore it with `withCodeVerifier()`) and
+client_secret_basic. Send `resource` whenever the issuer binds scopes to one.
+`getTokens(code)` keeps the refresh token that `getAccessToken` drops;
+`refreshTokens(rt)` rotates it, `revokeToken(rt)` unlinks (RFC 7009) and
+`getClaims(token)` / `getUserByToken(token)` read the issuer's
+`oauthUserInfoResponse` endpoint, keyed by its pairwise `sub`. Only a boolean
+`email_verified` counts as verified. It is constructed directly, not through the
+registry.
+
 ## Flow state (login CSRF)
 
 A callback that exchanges any `code` signs the victim into the attacker's

package/ai/skills/stacks-storage/SKILL.md

@@ -291,6 +291,14 @@ const local = createLocalStorage({ root: './storage' })
 - MIME type detection is extension-based (supports txt, html, css, js, json, xml, pdf, zip, jpg, jpeg, png, gif, svg, mp4, mp3, wav)
 - `list()` returns an async iterable; supports `deep: true` for recursive listing
 
+### Memory adapter stream lifecycle
+
+A move to the same normalized path is a no-op for an existing file, preserving
+bytes, visibility and modification time. A missing source still throws.
+`putStream` aborts pending reads promptly, cancels the reader and never publishes
+partial contents. Stream writes release reader locks on success, failure and
+abort. Existing destination contents survive a failed or aborted upload.
+
 ### S3 Adapter (`S3StorageAdapter`)
 
 ```typescript

package/ai/skills/stacks-strings/SKILL.md

@@ -429,6 +429,8 @@ interface PluralizeOptions { count?, inclusive? }
 - `helpers.ts` exports `toString()` (Object.prototype.toString, not ordinary
   string coercion) and `mask(value, character, index, length?)`. Mask supports
   a negative starting index and uses the first character of its mask string.
+  Index and explicit length must be safe integers, otherwise it throws RangeError.
+  Negative integer lengths mask nothing. Coordinates count Unicode code points.
 
 ## CSV exports
 

package/ai/skills/stacks-utils/SKILL.md

@@ -45,7 +45,7 @@ export { clamp, notNullish, retry, useOnline } from '@stacksjs/browser'
 
 ## Deep Merge (`merge.ts`)
 
-Replacement for `defu`. Arrays are concatenated, objects are recursively merged, special objects (Date, RegExp, Error, Promise, Map, Set, WeakMap, WeakSet, ArrayBuffer views) are NOT deeply merged. A `"__proto__"` key is skipped, as defu skips it, so a parsed request body cannot set the result's prototype.
+Replacement for `defu`. Only own enumerable string keys are read. Arrays concatenate; plain records recursively merge. Non-plain nested values (including URL, ArrayBuffer, Blob and class instances) retain identity. A plain record replaces a non-plain target rather than copying its indices or prototype fields. A `"__proto__"` key is skipped, as defu skips it, so a parsed request body cannot set the result's prototype.
 
 ```typescript
 import { merge, mergeDefaults, createMerger, defu } from '@stacksjs/utils'
@@ -79,6 +79,13 @@ throttledFn.cancel()     // cancel pending invocation
 await delay(1000)        // sleep for 1 second (returns Promise<void>)
 ```
 
+Calls and debounce `flush()` return `ReturnType<T> | undefined`: before any
+invocation there is no result; suppressed calls return the last result,
+including a Promise for async callbacks. Both preserve the callback receiver.
+Pending arguments are consumed before invoking, so reentrant calls survive.
+`cancel()` clears pending work; throttle cancellation also resets its interval.
+Manual debounce `flush()` invokes pending work even with `trailing: false`.
+
 Note: unlike some implementations, this debounce does NOT support `maxWait`. The throttle uses `Date.now()` for timing, not setTimeout stacking.
 
 ## Color Output (`colors.ts`)
@@ -156,6 +163,10 @@ readableSize(1024)                         // alias for formatBytes
 
 Units: B, KB, MB, GB, TB, PB, EB, ZB, YB (decimal) or B, KiB, MiB, GiB, TiB, PiB, EiB, ZiB, YiB (binary).
 
+`parseBytes` accepts a complete decimal with an optional known decimal or
+binary unit (case-insensitive). It rejects partial numbers, unknown units,
+trailing text and non-finite output. Fractions and negative values are allowed.
+
 ## Export Size Calculation (`size.ts`)
 
 ```typescript
@@ -433,19 +444,27 @@ Glob belongs to `@stacksjs/storage`; it is not re-exported from the utils root.
 
 ## Safe serialization and typed composition
 
-`safeJsonParse(text, fallback?)`, `safeJsonParseResult`, and
-`safeJsonStringify(value, space?)` make parse failure behavior explicit. Their
-generic result type is a caller annotation, not validation of untrusted JSON.
+`safeJsonParse(text, fallback?)` and `safeJsonParseResult` make parse failure
+behavior explicit. A parse generic result type is a caller annotation, not
+validation of untrusted JSON.
 Validate decoded objects at the request boundary before treating them as a
 model, config, or provider payload.
 
+`safeJsonStringify` returns `string | undefined`, matching JSON for unsupported
+roots (undefined, functions and symbols). Shared non-cyclic objects serialize
+at every occurrence; only ancestor cycles become `[Circular]`. BigInts become
+decimal strings. User getters and `toJSON` methods can still throw.
+
 `pipe(value, ...steps)` applies ordinary typed unary functions left to right.
 `piped(...steps)` returns the composed function and `tap(effect)` returns a
 pass-through step. These differ from middleware-style `Pipeline`, whose pipes
 receive a next function. Choose the simple function seam for data transforms.
 
 `isDeepEqual` now compares Date, RegExp, Map, Set, typed arrays and ArrayBuffers
-by value and tracks circular pairs. Host objects and Errors remain identity
+by value and tracks active circular pairs. Cycle topology/sharing need not
+match when fields are structurally equal. Objects require matching own
+enumerable string keys. Arrays distinguish a hole from an own undefined slot;
+two corresponding holes compare equal. Host objects and Errors remain identity
 comparisons. Read retained equal tests for a non-plain object rather than
 assuming every object with similar printable fields is equal.
 

package/ai/skills/stacks-validation/SKILL.md

@@ -274,14 +274,17 @@ const result = await validateField('User', { name: 'John', email: 'john@example.
 ```
 
 Behavior:
-1. Finds the model file by name in user models or framework defaults
+1. Finds exact model filenames or qualified paths recursively, preferring app overrides
 2. Extracts validation rules from model attributes
-3. Converts attribute names to snake_case for validation
-4. Sets custom error messages via `MessageProvider`
-5. Validates using `schema.object(ruleObject).validate(params)`
+3. Accepts attribute and snake-case column names, preferring the attribute spelling when both are supplied
+4. Applies custom messages to reported failures without executing predicates again or replacing the shared provider
+5. Validates through the context-aware object schema
 6. Throws `HttpError(422)` with error JSON on validation failure
 7. Throws `HttpError(404)` if model not found
-8. Skips validation for attributes with default values unless `isRequired` is true
+8. An optional default excuses absence, never a supplied invalid value
+
+Ambiguous bare model names require a qualified path. Declared fields and conditional
+siblings use own properties; inherited values never count as submitted input.
 
 ### `customValidate(attributes, params)`
 
@@ -314,13 +317,17 @@ isObjectNotEmpty(undefined)     // false
 
 ## Error Reporter (`reporter.ts`)
 
-Process-local latest-error reporter for validation:
+Validation operations start an async-local latest-error scope before their first await.
+Successful operations clear prior failures; `getErrors()` returns an independent snapshot.
+Standalone adapters that report directly create a scope with `withValidationContext()`:
 
 ```typescript
-import { reportError, getErrors } from '@stacksjs/validation'
+import { reportError, getErrors, withValidationContext } from '@stacksjs/validation'
 
-reportError([{ message: 'Invalid', value: '', field: 'email' }])
-const errors = getErrors()   // returns the latest MessageObject[]; reportError replaces it
+withValidationContext(() => {
+  reportError([{ message: 'Invalid', value: '', field: 'email' }])
+  const errors = getErrors() // this scope's latest MessageObject[]
+})
 ```
 
 Interface: `{ message: string, value: string, field: string }`
@@ -388,7 +395,7 @@ type ValidationString = ValidationRule
 - Numeric classification functions (`isEvenOrOdd`, etc.) return string defaults for non-numbers rather than throwing
 - Schema validators map to database column types -- `schema.integer()` creates an integer column, `schema.string()` creates a varchar, etc.
 - `validateField` converts attribute names to snake_case using `snakeCase()` from `@stacksjs/strings`
-- `validateField` skips attributes with default values unless `isRequired` is explicitly set
+- `validateField` validates supplied values even when their attributes declare defaults
 - Validation error messages are customizable per-rule in model definitions via the `message` object
 - The schema export is Stacks' proxy over the underlying validation instance, with typed object/array/enum inference, file validation and conditionals; it is not the same object as the upstream v export
 - Custom validators can be added with `schema.custom<T>(fn, message)` for types not covered by built-in validators
@@ -397,16 +404,23 @@ type ValidationString = ValidationRule
 
 ## Request, conditional and file validation
 
-The root validate(requestOrRecord, rules) is async, returns the validated payload
+The root validate(requestOrRecord, rules, options?) is async, returns the validated payload
 and throws HttpError(422) with normalized field errors on failure. Rules are
-validators or { rule, message? }; enhanced request.all supplies native input,
-otherwise query/body/route data are merged by request-validator.ts. Do not
-substitute a boolean check or ignore the returned validated data at a boundary.
+validators or { rule, message? }. Plain records are application data, including URL,
+query and params fields. Native Request bodies and enhanced request.all() are read
+directly; jsonBody/formBody adapters remain supported. URL/query/params-only adapters
+select { source: 'request' }; { source: 'data' } forces data interpretation.
+Returned values contain declared supplied fields, recursively through object shapes
+and array.each() elements. Opaque validators retain their accepted values. Use the
+returned cleaned payload at the boundary, including action getValidated()/safe().
 
 Schema declarations can use the narrow `@stacksjs/validation/runtime` entry.
 The schema proxy adds typed object/array/enum inference and conditional rules:
 when(sibling, literalOrPredicate, refine) applies cross-field refinements through
-objectWithContext; sometimes has the underlying optional/empty-value semantics.
+objectWithContext, action validations, model writes and validateModelInput.
+Model contexts recognize attribute/column aliases. Creates include declared defaults;
+partial updates validate supplied fields and siblings without loading stored values.
+Refinements preserve reusable schemas. sometimes has the underlying optional/empty-value semantics.
 Read object-with-context.ts before treating presence-only rules as stricter than
 they are. Inferred object shapes are native, not a hand-written request interface.
 
@@ -417,19 +431,17 @@ An upload is a class instance (the router's `UploadedFile`); a plain object, whi
 is what a JSON body gives for the same field name, is refused.
 
 registerRule/getCustomRule, unique(table,column,exceptId?), exists(table,column)
-and validateFieldAsync support application async validation. Current unique/exists
-helpers return allowed when the database cannot be queried, so they are advisory
-validation, not authorization or a replacement for database constraints. Validate
+and validateFieldAsync support application async validation. These helpers propagate query failures
+instead of approving unchecked values. Keep operational failures separate from invalid input. Validate
 uniqueness at the durable write boundary and handle a uniqueness violation there.
 
-The latest-error reporter is shared process state; do not use getErrors as
-request-local concurrent state. Read errors on the returned/raised validation
-result instead. Local is.ts helpers and legacy rules/type declarations are not
+Local is.ts helpers and legacy rules/type declarations are not
 automatically all public exports from the root.
 
 Source: `storage/framework/core/validation/src/index.ts`, runtime.ts,
 schema.ts, request-validator.ts, conditional.ts, file-validator.ts and validator.ts.
-Tests: conditional.test.ts, file-validator.test.ts, async-rules.test.ts,
+Tests: conditional.test.ts, conditional-boundaries.test.ts, input-contracts.test.ts,
+boundary-e2e.test.ts, file-validator.test.ts, async-rules.test.ts,
 runtime-entry.test.ts and type-inference.test-d.ts under core/validation/tests.
 
 ## Custom action input
@@ -456,6 +468,11 @@ null, and absent boolean input returns undefined. Boolean input accepts JSON
 booleans and the explicit form values `true`, `false`, `1`, `0` and their strings,
 and a checkbox's `on` and `off`.
 
+Numeric bounds reject NaN and inverted intervals; -Infinity and Infinity explicitly
+mean an unbounded lower/upper endpoint. Text maxLength requires a nonnegative safe
+integer. Invalid configuration throws RangeError even for absent optional input.
+Unsafe whole numbers are rejected whether or not integer-only input was requested.
+
 `validateModelInput` checks only supplied fields using `getDefinition()` rules.
 The action still selects writable fields, requires creation fields and validates
 relationships. Use the transaction callback executor for all atomic persistence.

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.75.445",
+  "version": "0.75.450",
   "description": "Stacks, built into VS Code: stx templates, pickier linting and formatting, encrypted env files, the dev server preview and every buddy command. No other extensions required.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.445",
+  "version": "0.75.450",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -45,9 +45,9 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.35",
-    "@stacksjs/mobile": "0.75.445",
-    "@stacksjs/sanitizer": "0.2.789",
-    "@stacksjs/stx": "0.2.789",
+    "@stacksjs/mobile": "0.75.450",
+    "@stacksjs/sanitizer": "0.2.792",
+    "@stacksjs/stx": "0.2.792",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/xterm": "^6.0.0",
     "ts-qr-codes": "^0.1.8"

package/resources/components/Dashboard/UI/Avatar.stx

@@ -3,12 +3,13 @@ interface AvatarProps {
   src?: string
   alt?: string
   name?: string
+  initials?: string
   size?: 'xs' | 'sm' | 'md' | 'lg' | 'xl' | '2xl'
   rounded?: 'sm' | 'md' | 'lg' | 'full'
   status?: 'online' | 'offline' | 'away' | 'busy'
 }
 
-const { src = '', alt = '', name = '', size = 'md', rounded = 'full', status = '' } = defineProps<AvatarProps>()
+const { src = '', alt = '', name = '', initials: suppliedInitials = '', size = 'md', rounded = 'full', status = '' } = defineProps<AvatarProps>()
 
 const sizeClasses = {
   xs: 'h-5 w-5 text-[10px]',
@@ -50,10 +51,10 @@ function getInitials(fullName: string) {
   return (parts[0][0] + parts[parts.length - 1][0]).toUpperCase()
 }
 
-const initials = getInitials(name)
+const initials = suppliedInitials || getInitials(name)
 
 // Background colors for initials (consistent based on name)
-const bgColors = [
+export const bgColors = [
   'bg-red-500/15 text-red-600 dark:bg-red-400/20 dark:text-red-400',
   'bg-orange-500/15 text-orange-600 dark:bg-orange-400/20 dark:text-orange-400',
   'bg-yellow-500/15 text-yellow-600 dark:bg-yellow-400/20 dark:text-yellow-400',
@@ -66,33 +67,42 @@ const bgColors = [
   'bg-pink-500/15 text-pink-600 dark:bg-pink-400/20 dark:text-pink-400'
 ]
 
-function getBgColorIndex(fullName: string) {
-  if (!fullName) return 0
+defineClientPayload({ bgColors })
+</script>
+<script client>
+const avatarSrc = useReactiveProp('src', {{ src }})
+const avatarAlt = useReactiveProp('alt', {{ alt }})
+const avatarName = useReactiveProp('name', {{ name }})
+const avatarInitials = useReactiveProp('initials', {{ suppliedInitials }})
+const avatarDescription = derived(() => avatarAlt() || avatarName() || 'Avatar')
+const avatarFallback = derived(() => {
+  if (avatarInitials()) return avatarInitials()
+  const parts = String(avatarName() || '').trim().split(/\s+/).filter(Boolean)
+  if (!parts.length) return ''
+  return (parts.length === 1 ? parts[0].slice(0, 2) : parts[0][0] + parts[parts.length - 1][0]).toUpperCase()
+})
+const avatarColor = derived(() => {
+  const name = String(avatarName() || '')
+  if (!name) return 'bg-black/[0.06] text-neutral-500 dark:bg-white/10 dark:text-neutral-400'
   let hash = 0
-  for (let i = 0; i < fullName.length; i++) {
-    hash = fullName.charCodeAt(i) + ((hash << 5) - hash)
-  }
-  return Math.abs(hash) % bgColors.length
-}
-
-const bgColor = name ? bgColors[getBgColorIndex(name)] : 'bg-black/[0.06] text-neutral-500 dark:bg-white/10 dark:text-neutral-400'
+  for (let i = 0; i < name.length; i++) hash = name.charCodeAt(i) + ((hash << 5) - hash)
+  const colors = bgColors
+  return colors[Math.abs(hash) % colors.length]
+})
 </script>
 <div class="inline-flex relative flex-shrink-0">
-    @if(src)
       <img
+        :if="avatarSrc"
         src="{{ src }}"
+        :src="avatarSrc"
         alt="{{ alt || name || 'Avatar' }}"
+        :alt="avatarDescription"
         class="object-cover {{ sizeClasses[size] }} {{ radiusClasses[rounded] }}"
       >
-    @else
-      <div class="inline-flex items-center justify-center font-medium {{ sizeClasses[size] }} {{ radiusClasses[rounded] }} {{ bgColor }}">
-        @if(initials)
-          <span>{{ initials }}</span>
-        @else
-          <span aria-hidden="true" class="h-1/2 w-1/2 text-neutral-400 i-hugeicons-user"></span>
-        @endif
+      <div :if="!avatarSrc" :class="avatarColor" class="inline-flex items-center justify-center font-medium {{ sizeClasses[size] }} {{ radiusClasses[rounded] }}">
+          <span :if="avatarFallback" :text="avatarFallback">{{ initials }}</span>
+          <span :if="!avatarFallback" aria-hidden="true" class="h-1/2 w-1/2 text-neutral-400 i-hugeicons-user"></span>
       </div>
-    @endif
 
     @if(status)
       <span class="absolute bottom-0 right-0 rounded-full ring-2 ring-white dark:ring-neutral-900 {{ statusColors[status] }} {{ statusSizes[size] }}"></span>