stkit 17.0.0__tar.gz → 17.0.2__tar.gz

{stkit-17.0.0 → stkit-17.0.2}/CHANGELOG.md

@@ -1,6 +1,22 @@
 # Changelog
 
-## v17.0.0 (unreleased)
+## v17.0.2 (2026-10-25)
+
+No migration required.
+
+- `stk verify` follows redirects from `/` and checks that the page it lands on answers 200, so an app whose `/` sends people to sign-in or to its own home passes. A redirect to a broken page still fails.
+- Replacing stk's landing view is documented: `app.view_functions["public.index"] = home` in an extension's `init_app` (Architecture, Public).
+- `STK_CLI_SECTIONS` groups an app's own commands in `stk --help`, after stk's sections, instead of listing them all under Other.
+
+## v17.0.1 (2026-10-25)
+
+No migration required.
+
+- Every dependency is locked at its latest release and tested: SQLAlchemy 2.1, Quart 0.23, webauthn 3, uvicorn 0.54, cryptography 50.0.2, and the rest. `pip-audit` finds no known vulnerabilities.
+- Requires quart-security 2.0.3, which declares the passkey usage choices the way wtforms 3.3 expects (tuple choices are removed in wtforms 3.4).
+- The pre-commit ruff hook matches the locked ruff (0.17.2). Ruff now also formats the Python samples in the docs.
+
+## v17.0.0 (2026-10-25)
 
 stk becomes an installed, versioned package. An app is a separate, thin package that composes it and never edits a framework file, so upgrading stk is a version bump plus whatever its release note says.
 
@@ -22,6 +38,10 @@ stk becomes an installed, versioned package. An app is a separate, thin package
 - `stk db check` and `stk smoke` use a throwaway database of the configured dialect, so Postgres apps are checked on Postgres (the role needs CREATEDB). Autogenerate never offers to drop PostGIS's `spatial_ref_sys`. `stk.migrations.portable_tables()` returns the tables SQLite can build.
 - Autogenerated revisions import what their column types need, and pass ruff without per-file exceptions.
 - `stk doctor` reports the app it loaded and understands two lineages.
+- `stk init` gives each app a `CLAUDE.md` (with `AGENTS.md` linked) carrying stk's rules and pointing at the docs, the stk skills, and a CI workflow running tests, `stk verify`, and `stk smoke`. `stk verify` in stk's repository fails when the template's rules drift from stk's.
+- `stk new` uses English plurals for pages and APIs (`category` gives `/categories/`). Pass the singular name.
+- stk moves from httpx to `httpx2`, with `authlib>=1.9.1` and `quart-security>=2.0.2` doing the same, so authlib no longer warns about its deprecated httpx fallback on every command.
+- The unused `sidebar` and `layout_classes` blocks are gone from stk's templates and the scaffold.
 
 ### Upgrade considerations
 

{stkit-17.0.0 → stkit-17.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: stkit
-Version: 17.0.0
+Version: 17.0.2
 Summary: An async Quart framework optimized for AI-assisted development workflows
 Author-email: Level09 <hello@level09.com>
 License: MIT
@@ -16,7 +16,6 @@ Requires-Dist: click>=8.3.1
 Requires-Dist: cryptography>=45.0.5
 Requires-Dist: email-validator>=2.2.0
 Requires-Dist: httpx2>=2.16.0
-Requires-Dist: httpx>=0.27.0
 Requires-Dist: jinja2>=3.1.6
 Requires-Dist: joserfc<2,>=1.7.1
 Requires-Dist: libpass>=1.9.0
@@ -25,7 +24,7 @@ Requires-Dist: pillow>=13.0.0
 Requires-Dist: psycopg2-binary>=2.9.10
 Requires-Dist: python-dotenv>=1.1.1
 Requires-Dist: qrcode>=8.2
-Requires-Dist: quart-security<3,>=2.0.1
+Requires-Dist: quart-security<3,>=2.0.3
 Requires-Dist: quart-session>=3.0.0
 Requires-Dist: quart>=0.20.0
 Requires-Dist: rich>=14.0.0

{stkit-17.0.0 → stkit-17.0.2}/examples/minimal/uv.lock

@@ -2,9 +2,12 @@ version = 1
 revision = 3
 requires-python = ">=3.11"
 resolution-markers = [
-    "python_full_version >= '3.14'",
-    "python_full_version == '3.13.*'",
-    "python_full_version == '3.12.*'",
+    "python_full_version >= '3.14' and sys_platform == 'emscripten'",
+    "python_full_version >= '3.14' and sys_platform != 'emscripten'",
+    "python_full_version == '3.13.*' and sys_platform == 'emscripten'",
+    "python_full_version == '3.13.*' and sys_platform != 'emscripten'",
+    "python_full_version == '3.12.*' and sys_platform == 'emscripten'",
+    "python_full_version == '3.12.*' and sys_platform != 'emscripten'",
     "python_full_version < '3.12'",
 ]
 
@@ -366,15 +369,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/d4/c0/e27a1e516a89af7194fc497f4b96d9601771ca41bb66fd5738113df80282/cbor2-6.1.5-cp315-cp315t-win_arm64.whl", hash = "sha256:fd34b35b0a2b366f5b4bd53489ccd10d7576b0d4dd68db38ef64b4e617ea8f76", size = 294495, upload-time = "2026-10-01T18:09:32.192Z" },
 ]
 
-[[package]]
-name = "certifi"
-version = "2026.10.23"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/fd/11/b524cbd9bbdaca58608e4cf4053fd463417549e1959fa8d3aa18319f9555/certifi-2026.10.23.tar.gz", hash = "sha256:a9895e6e2758b371e0545e321a3a8fd1fcfd9829ada8824a936dfb16aaaf36cd", size = 136225, upload-time = "2026-10-23T11:36:16.478Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/32/d1/a3652fe2c19134d0d15922177821d863cbd7e842d53a21bbe7e8e3a1b5ac/certifi-2026.10.23-py3-none-any.whl", hash = "sha256:e9b54de76e530bb6cf0ccd036787103acb58fd42ba930ea8bf948ddbaa2f61d1", size = 135082, upload-time = "2026-10-23T11:36:14.763Z" },
-]
-
 [[package]]
 name = "cffi"
 version = "2.1.1"
@@ -734,19 +728,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/71/b4/4a9fcfb2aef6ba44d9073ecd301443aa00b3dac95de5619f2a7de7ec8a91/hpack-4.2.0-py3-none-any.whl", hash = "sha256:858ac0b02280fa582b5080d68db0899c62a80375e0e5413a74970c5e518b6986", size = 34246, upload-time = "2026-06-23T18:34:45.472Z" },
 ]
 
-[[package]]
-name = "httpcore"
-version = "1.0.9"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "certifi" },
-    { name = "h11" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/06/94/82699a10bca87a5556c9c59b5963f2d039dbd239f25bc2a63907a05a14cb/httpcore-1.0.9.tar.gz", hash = "sha256:6e34463af53fd2ab5d807f399a9b45ea31c3dfa2276f15a2c3f00afff6e176e8", size = 85484, upload-time = "2025-04-24T22:06:22.219Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/7e/f5/f66802a942d491edb555dd61e3a9961140fd64c90bce1eafd741609d334d/httpcore-1.0.9-py3-none-any.whl", hash = "sha256:2d400746a40668fc9dec9810239072b40b4484b640a8c38fd654a024c7a1bf55", size = 78784, upload-time = "2025-04-24T22:06:20.566Z" },
-]
-
 [[package]]
 name = "httpcore2"
 version = "2.16.0"
@@ -760,21 +741,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/af/c2/ce417c397afa5181f0e3c6ff01a4d01639414e1adef08730d97571297151/httpcore2-2.16.0-py3-none-any.whl", hash = "sha256:5c4358319f2602d984ad93182c9fee5160f22e9da7babdda870a5e7c4e2dc34f", size = 85070, upload-time = "2026-10-21T07:09:42.802Z" },
 ]
 
-[[package]]
-name = "httpx"
-version = "0.28.1"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "anyio" },
-    { name = "certifi" },
-    { name = "httpcore" },
-    { name = "idna" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/b1/df/48c586a5fe32a0f01324ee087459e112ebb7224f646c0b5023f5e79e9956/httpx-0.28.1.tar.gz", hash = "sha256:75e98c5f16b0f35b567856f597f06ff2270a374470a5c2392242528e3e3e42fc", size = 141406, upload-time = "2024-12-06T15:37:23.222Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/2a/39/e50c7c3a983047577ee07d2a9e53faf5a69493943ec3f6a384bdc792deb2/httpx-0.28.1-py3-none-any.whl", hash = "sha256:d909fcccc110f8c7faf814ca82a9a4d816bc5a6dbfea25d6591d6985b8ba59ad", size = 73517, upload-time = "2024-12-06T15:37:21.509Z" },
-]
-
 [[package]]
 name = "httpx2"
 version = "2.16.0"
@@ -1460,9 +1426,12 @@ name = "pyee"
 version = "14.0.0"
 source = { registry = "https://pypi.org/simple" }
 resolution-markers = [
-    "python_full_version >= '3.14'",
-    "python_full_version == '3.13.*'",
-    "python_full_version == '3.12.*'",
+    "python_full_version >= '3.14' and sys_platform == 'emscripten'",
+    "python_full_version >= '3.14' and sys_platform != 'emscripten'",
+    "python_full_version == '3.13.*' and sys_platform == 'emscripten'",
+    "python_full_version == '3.13.*' and sys_platform != 'emscripten'",
+    "python_full_version == '3.12.*' and sys_platform == 'emscripten'",
+    "python_full_version == '3.12.*' and sys_platform != 'emscripten'",
 ]
 dependencies = [
     { name = "typing-extensions" },
@@ -1601,7 +1570,8 @@ name = "quart"
 version = "0.22.0"
 source = { registry = "https://pypi.org/simple" }
 resolution-markers = [
-    "python_full_version == '3.12.*'",
+    "python_full_version == '3.12.*' and sys_platform == 'emscripten'",
+    "python_full_version == '3.12.*' and sys_platform != 'emscripten'",
     "python_full_version < '3.12'",
 ]
 dependencies = [
@@ -1625,8 +1595,10 @@ name = "quart"
 version = "0.23.1"
 source = { registry = "https://pypi.org/simple" }
 resolution-markers = [
-    "python_full_version >= '3.14'",
-    "python_full_version == '3.13.*'",
+    "python_full_version >= '3.14' and sys_platform == 'emscripten'",
+    "python_full_version >= '3.14' and sys_platform != 'emscripten'",
+    "python_full_version == '3.13.*' and sys_platform == 'emscripten'",
+    "python_full_version == '3.13.*' and sys_platform != 'emscripten'",
 ]
 dependencies = [
     { name = "aiofiles" },
@@ -1646,7 +1618,7 @@ wheels = [
 
 [[package]]
 name = "quart-security"
-version = "2.0.1"
+version = "2.0.3"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "aiosmtplib" },
@@ -1655,7 +1627,7 @@ dependencies = [
     { name = "cbor2" },
     { name = "cryptography" },
     { name = "email-validator" },
-    { name = "httpx" },
+    { name = "httpx2" },
     { name = "libpass", extra = ["bcrypt"] },
     { name = "pyotp" },
     { name = "qrcode", extra = ["pil"] },
@@ -1665,9 +1637,9 @@ dependencies = [
     { name = "webauthn" },
     { name = "wtforms" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/a6/de/e2b0f19adf6dc2f781551264a0041f4683386c7dee5927d6f702d8a04433/quart_security-2.0.1.tar.gz", hash = "sha256:fa0fe168a819483229aa7d7292af84506c89fef0efd7d32b92e9314a96ea7d0b", size = 35667, upload-time = "2026-10-06T12:59:04.506Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/2b/88/43c45890dd40db6fa5e57d09705b35c42f3a36981997ab3269a2c33403a0/quart_security-2.0.3.tar.gz", hash = "sha256:74be1c5177afca54cc90bafd10d7ae69a1f4923e1786ff106fb9990dd8f7eb5c", size = 35687, upload-time = "2026-10-25T10:39:02.875Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/ab/2d/ac5e2c7bfe78b3103d5dc78db8139bf0a1d2867553b2f64cf87355eed1b1/quart_security-2.0.1-py3-none-any.whl", hash = "sha256:6a90561b3cbd05a1769985358a3e453caf8683b89b3fd12374c95314f93fb5ef", size = 41794, upload-time = "2026-10-06T12:59:03.231Z" },
+    { url = "https://files.pythonhosted.org/packages/ef/b5/798c32a417ecba01152a4633cc4552b7ae0a4d70285f003ea7e5f1799e61/quart_security-2.0.3-py3-none-any.whl", hash = "sha256:08ac07b53242b70b519515299e89912cca2c21fabf12a6d25b87f6e4c8601268", size = 41815, upload-time = "2026-10-25T10:39:01.684Z" },
 ]
 
 [[package]]
@@ -1819,7 +1791,7 @@ asyncio = [
 
 [[package]]
 name = "stkit"
-version = "17.0.0"
+version = "17.0.1"
 source = { editable = "../../" }
 dependencies = [
     { name = "aiosmtplib" },
@@ -1831,7 +1803,6 @@ dependencies = [
     { name = "click" },
     { name = "cryptography" },
     { name = "email-validator" },
-    { name = "httpx" },
     { name = "httpx2" },
     { name = "jinja2" },
     { name = "joserfc" },
@@ -1876,7 +1847,6 @@ requires-dist = [
     { name = "click", specifier = ">=8.3.1" },
     { name = "cryptography", specifier = ">=45.0.5" },
     { name = "email-validator", specifier = ">=2.2.0" },
-    { name = "httpx", specifier = ">=0.27.0" },
     { name = "httpx2", specifier = ">=2.16.0" },
     { name = "hypercorn", marker = "extra == 'asgi'", specifier = ">=0.17.0" },
     { name = "jinja2", specifier = ">=3.1.6" },
@@ -1891,7 +1861,7 @@ requires-dist = [
     { name = "python-dotenv", specifier = ">=1.1.1" },
     { name = "qrcode", specifier = ">=8.2" },
     { name = "quart", specifier = ">=0.20.0" },
-    { name = "quart-security", specifier = ">=2.0.1,<3" },
+    { name = "quart-security", specifier = ">=2.0.3,<3" },
     { name = "quart-session", specifier = ">=3.0.0" },
     { name = "redis", marker = "extra == 'full'", specifier = ">=7.1.0" },
     { name = "rich", specifier = ">=14.0.0" },

{stkit-17.0.0 → stkit-17.0.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "stkit"
-version = "17.0.0"
+version = "17.0.2"
 description = "An async Quart framework optimized for AI-assisted development workflows"
 authors = [
     {name = "Level09", email = "hello@level09.com"}
@@ -19,8 +19,7 @@ dependencies = [
     "click>=8.3.1",
     "cryptography>=45.0.5",
     "email-validator>=2.2.0",
-    "httpx>=0.27.0",
-    "httpx2>=2.16.0",  # authlib's HTTP client; plain httpx is its deprecated fallback
+    "httpx2>=2.16.0",
     "jinja2>=3.1.6",
     "joserfc>=1.7.1,<2",
     "libpass>=1.9.0",
@@ -30,7 +29,7 @@ dependencies = [
     "python-dotenv>=1.1.1",
     "qrcode>=8.2",
     "quart>=0.20.0",
-    "quart-security>=2.0.1,<3",
+    "quart-security>=2.0.3,<3",
     "quart-session>=3.0.0",
     "rich>=14.0.0",
     "sqlalchemy[asyncio]>=2.0.41",

{stkit-17.0.0 → stkit-17.0.2}/stk/__init__.py

@@ -3,7 +3,7 @@ stk Framework
 A modern Python web framework optimized for AI-assisted development.
 """
 
-__version__ = "17.0.0"
+__version__ = "17.0.2"
 
 
 def __getattr__(name):

{stkit-17.0.0 → stkit-17.0.2}/stk/checks.py

@@ -286,10 +286,11 @@ def check_admin_reset_route(app):
     )
 
 
-@check("GET / returns 200")
+@check("GET / answers 200, after any redirects")
 async def check_http_index(app):
+    # An app may send / to its sign-in or home page; what it lands on must work.
     client = app.test_client()
-    response = await client.get("/")
+    response = await client.get("/", follow_redirects=True)
     assert response.status_code == 200, f"Expected 200, got {response.status_code}"
 
 

{stkit-17.0.0 → stkit-17.0.2}/stk/cli/agent.py

@@ -147,7 +147,10 @@ def _watch_and_verify(interval=0.5):
 @click.option("--json", "as_json", is_flag=True, help="Emit JSON.")
 def smoke(as_json):
     """Run a real-browser smoke check against a temporary development app."""
-    report = run_smoke()
+    try:
+        report = run_smoke()
+    except RuntimeError as exc:
+        raise click.ClickException(str(exc)) from exc
     if as_json:
         click.echo(json.dumps(report, indent=2))
     else:

{stkit-17.0.0 → stkit-17.0.2}/stk/cli/database.py

@@ -167,7 +167,10 @@ def db_revision(message, autogenerate, head):
 @db.command("check")
 def db_check():
     """Fail if models have drifted away from the migrations."""
-    drift = build_migration_drift_report(cli_app())
+    try:
+        drift = build_migration_drift_report(cli_app())
+    except RuntimeError as exc:
+        raise click.ClickException(str(exc)) from exc
     if not drift:
         console.print("[green]No migration drift: models match migrations[/]")
         return

{stkit-17.0.0 → stkit-17.0.2}/stk/cli/main.py

@@ -10,7 +10,7 @@ import inspect
 from importlib.metadata import version
 
 import click
-from quart.cli import QuartGroup
+from quart.cli import NoAppException, QuartGroup, ScriptInfo
 
 import stk.cli as cli
 from stk.cli.base import load_app
@@ -44,7 +44,7 @@ class StkGroup(QuartGroup):
             if command is not None and not command.hidden:
                 commands[name] = command
 
-        for title, names in SECTIONS:
+        for title, names in [*SECTIONS, *_app_sections(ctx)]:
             rows = [
                 (name, commands.pop(name).get_short_help_str(limit=60))
                 for name in names
@@ -64,6 +64,17 @@ class StkGroup(QuartGroup):
                 )
 
 
+def _app_sections(ctx):
+    """The app's own help sections, `STK_CLI_SECTIONS`; none outside an app."""
+    try:
+        app = ctx.ensure_object(ScriptInfo).load_app()
+    except NoAppException:
+        return []
+    return [
+        (title, list(names)) for title, names in app.config.get("STK_CLI_SECTIONS", ())
+    ]
+
+
 def _create_app(**_kwargs):
     return load_app()
 

{stkit-17.0.0 → stkit-17.0.2}/stk/cli/smoke.py

@@ -10,7 +10,7 @@ import time
 from pathlib import Path
 
 import click
-import httpx
+import httpx2
 
 from stk.agent_login import create_agent_login_token
 from stk.cli.base import cli_app, run_async
@@ -255,10 +255,10 @@ def _wait_for_smoke_server(base_url, process):
                 f"{stdout.strip()}\n{stderr.strip()}"
             )
         try:
-            response = httpx.get(f"{base_url}/login", timeout=1)
+            response = httpx2.get(f"{base_url}/login", timeout=1)
             if response.status_code < 500:
                 return
-        except httpx.HTTPError:
+        except httpx2.HTTPError:
             pass
         time.sleep(0.2)
     raise click.ClickException("smoke server did not start within 20 seconds")

{stkit-17.0.0 → stkit-17.0.2}/stk/migrations/__init__.py

@@ -107,6 +107,7 @@ def throwaway_database_url(database_url: str, *, sync: bool = False):
     SQLite cannot render. Postgres needs a role with CREATEDB.
     """
     from sqlalchemy import create_engine, text
+    from sqlalchemy.exc import ProgrammingError
 
     url = make_url(database_url)
     if url.get_backend_name() != "postgresql":
@@ -119,8 +120,14 @@ def throwaway_database_url(database_url: str, *, sync: bool = False):
         _render(url.set(database="postgres"), sync=True), isolation_level="AUTOCOMMIT"
     )
     try:
-        with admin.connect() as connection:
-            connection.execute(text(f'create database "{name}"'))
+        try:
+            with admin.connect() as connection:
+                connection.execute(text(f'create database "{name}"'))
+        except ProgrammingError as exc:
+            raise RuntimeError(
+                f"role {url.username!r} cannot create a throwaway database: grant it"
+                " CREATEDB, or run this check with a role that has it"
+            ) from exc
         try:
             yield _render(url.set(database=name), sync=sync)
         finally:

{stkit-17.0.0 → stkit-17.0.2}/stk/public/views.py

@@ -1,7 +1,7 @@
 import datetime
 import secrets
 
-import httpx
+import httpx2
 from authlib.integrations.httpx_client import AsyncOAuth2Client
 from authlib.oidc.core import CodeIDToken
 from joserfc import jwt
@@ -180,7 +180,7 @@ def get_github_client():
 
 
 async def google_discovery():
-    async with httpx.AsyncClient(timeout=10) as client:
+    async with httpx2.AsyncClient(timeout=10) as client:
         response = await client.get(GOOGLE_DISCOVERY_URL)
         response.raise_for_status()
         return response.json()
@@ -265,7 +265,7 @@ async def google_callback():
                 redirect_uri=transaction["redirect_uri"],
                 code_verifier=transaction["verifier"],
             )
-        async with httpx.AsyncClient(timeout=10) as client:
+        async with httpx2.AsyncClient(timeout=10) as client:
             response = await client.get(discovery["jwks_uri"])
             response.raise_for_status()
             decoded = jwt.decode(
@@ -315,7 +315,7 @@ async def github_callback():
                 redirect_uri=transaction["redirect_uri"],
                 code_verifier=transaction["verifier"],
             )
-        async with httpx.AsyncClient(timeout=10) as client:
+        async with httpx2.AsyncClient(timeout=10) as client:
             headers = {
                 "Authorization": f"Bearer {token['access_token']}",
                 "Accept": "application/json",

{stkit-17.0.0 → stkit-17.0.2}/stk/scaffold/app/claude/skills/stk-migrate/SKILL.md

@@ -79,6 +79,7 @@ op.create_index("ix_products_name", "products", ["name"])
 from alembic import op
 from sqlalchemy import text
 
+
 def upgrade():
     op.add_column("users", sa.Column("display_name", sa.String(255)))
     op.execute(text("UPDATE users SET display_name = name WHERE display_name IS NULL"))
@@ -92,5 +93,7 @@ with op.batch_alter_table("users") as batch_op:
 
 **Add a composite unique constraint:**
 ```python
-op.create_unique_constraint("uq_oauth_provider_user", "oauth", ["provider", "provider_user_id"])
+op.create_unique_constraint(
+    "uq_oauth_provider_user", "oauth", ["provider", "provider_user_id"]
+)
 ```

stkit-17.0.2/stk/scaffold/app/github/workflows/checks.yml

@@ -0,0 +1,35 @@
+name: Checks
+
+on:
+  push:
+  pull_request:
+
+env:
+  SECRET_KEY: ci-only-secret-key-not-for-production
+  SECURITY_PASSWORD_SALT: ci-only-password-salt-not-for-production
+
+jobs:
+  checks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v9.0.0
+      - name: Install dependencies
+        run: uv sync
+      - name: Install Chromium
+        run: uv run playwright install --with-deps chromium
+      - name: Migrate
+        run: uv run stk db upgrade
+      - name: Unit tests
+        run: uv run python -m unittest discover -s tests -v
+      - name: Verify (lint, sanity, migrations)
+        run: uv run stk verify --json
+      - name: Browser smoke (behavioral)
+        run: uv run stk smoke --json
+      - name: Upload smoke artifacts on failure
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: smoke-artifacts
+          path: .stk/smoke/
+          if-no-files-found: ignore

{stkit-17.0.0 → stkit-17.0.2}/stk/scaffold/generator.py

@@ -27,6 +27,7 @@ DOTFILES = {
     "dockerignore": ".dockerignore",
     "env-sample": ".env-sample",
     "claude": ".claude",
+    "github": ".github",
 }
 
 # Names that conflict with existing blueprints, SQLAlchemy reserved words, or

stkit-17.0.2/tests/test_app_index.py

@@ -0,0 +1,43 @@
+"""An app may replace stk's landing page, and verify judges where / lands."""
+
+import unittest
+from types import SimpleNamespace
+
+from quart import redirect
+
+from stk.app import Stk
+from stk.checks import check_http_index
+from stk.cli.main import _app_sections
+from stk.settings import TestingConfig
+
+
+class AppIndexTest(unittest.IsolatedAsyncioTestCase):
+    async def test_index_can_be_replaced_and_a_redirect_passes_the_check(self):
+        app = Stk(__name__, config=TestingConfig)
+
+        async def home():
+            return redirect("/login")
+
+        app.view_functions["public.index"] = home
+        response = await app.test_client().get("/")
+        self.assertEqual(response.status_code, 302)
+        self.assertTrue(await check_http_index(app))
+
+    async def test_a_redirect_to_a_broken_page_fails_the_check(self):
+        app = Stk(__name__, config=TestingConfig)
+
+        async def home():
+            return redirect("/nowhere")
+
+        app.view_functions["public.index"] = home
+        self.assertFalse(await check_http_index(app))
+
+
+class AppHelpSectionsTest(unittest.TestCase):
+    def test_app_sections_come_from_config(self):
+        app = Stk(__name__, config=TestingConfig)
+        app.config["STK_CLI_SECTIONS"] = [("Runs", ("worker", "enrich"))]
+        ctx = SimpleNamespace(
+            ensure_object=lambda _: SimpleNamespace(load_app=lambda: app)
+        )
+        self.assertEqual(_app_sections(ctx), [("Runs", ["worker", "enrich"])])

{stkit-17.0.0 → stkit-17.0.2}/tests/test_production_security.py

@@ -385,7 +385,7 @@ class ProductionSecurityTests(unittest.IsolatedAsyncioTestCase):
             "token_endpoint": "https://accounts.google.com/token",
             "jwks_uri": "https://accounts.google.com/keys",
         }
-        import httpx
+        import httpx2
 
         for invalid in (None, "nonce", "iss", "aud", "exp", "signature"):
             with self.subTest(invalid=invalid):
@@ -429,8 +429,8 @@ class ProductionSecurityTests(unittest.IsolatedAsyncioTestCase):
                     "id_token": encoded,
                     "access_token": "fixture",
                 }
-                response = httpx.Response(
-                    200, request=httpx.Request("GET", discovery["jwks_uri"]), json={}
+                response = httpx2.Response(
+                    200, request=httpx2.Request("GET", discovery["jwks_uri"]), json={}
                 )
                 response.json = lambda: {"keys": [RSAKey.import_key(public).as_dict()]}
                 http = AsyncMock()
@@ -442,7 +442,7 @@ class ProductionSecurityTests(unittest.IsolatedAsyncioTestCase):
                         new=AsyncMock(return_value=discovery),
                     ),
                     patch("stk.public.views.get_google_client", return_value=oauth),
-                    patch("stk.public.views.httpx.AsyncClient", return_value=http),
+                    patch("stk.public.views.httpx2.AsyncClient", return_value=http),
                 ):
                     await client.get(
                         "/login/google/callback?code=fixture&state=" + args["state"][0]

{stkit-17.0.0 → stkit-17.0.2}/tests/test_scaffolder.py

@@ -281,7 +281,13 @@ class InitAndNewTests(unittest.TestCase):
         self.assertIn('app = "acme.app:app"', pyproject)
         self.assertIn(f'"stkit>={stk.__version__},<', pyproject)
         self.assertNotIn("[tool.uv.sources]", pyproject)
-        for name in (".gitignore", ".env-sample", "acme/settings.py", "Dockerfile"):
+        for name in (
+            ".gitignore",
+            ".env-sample",
+            "acme/settings.py",
+            "Dockerfile",
+            ".github/workflows/checks.yml",
+        ):
             self.assertTrue((self.app / name).is_file(), name)
         env = (self.app / ".env").read_text()
         self.assertNotIn("\nSECRET_KEY=\n", env)