Implements the migration plan in #14: Postline moves off the vendored storage/framework/ workspace (55M, 89 core packages) to consuming @stacksjs/* as published npm packages at 0.70.145.
Two-part migration
1. Mechanical (9dcbfad) — stacks: workspace:* → ^0.70.145; workspaces removed; self-contained tsconfig.json; project-local build.ts (@stacksjs/stx buildApp()); local preloader.ts; vendored core removed. Verified the static build (12/12 pages).
2. SSR/API completion (this PR's second commit) — the mechanical pass only exercised the static build. The API/server path — where all of Postline's features live — needed real fixes, because several features had been implemented as edits to framework packages in place, which vanished with the vendored tree:
| Broke | Cause | Fix |
|---|---|---|
| API boot | app/Routes.ts re-exported deleted defaults/app/Routes | self-contained RouteRegistry |
| auto-imports | @stacksjs/queue couldn't resolve @stacksjs/bun-queue | add the transitive dep |
| Bluesky publish/threads/facets/images/metrics | were edits to vendored @stacksjs/socials | re-homed as app-owned Drivers/BlueskyDriver.ts + Support/Social/bluesky.ts |
| Instagram/Threads media | shared PublishContent.media widened url to optional | map to the published drivers' url-only shape |
browser /api calls 401 | cookie→bearer bridge was a vendored dev-proxy edit | re-homed to a layout fetch wrapper |
| login 500 | 0.70.145 useAuth selects two_factor_* columns | migration 0000000032 adds them |
| ORM/auth models | defaults/app/Models (incl. User) deleted; nothing repopulates on clone | commit regenerated storage/framework/{defaults,auto-imports} (5.7M, from @stacksjs/defaults) |
Verification (end-to-end on deps)
buddy build→ 12/12 static pages,distrenders login + composer- API boots; full flow green via curl: register → login → providers → queue save/list → analytics → blog; wrong password 401; unauth 401
bun test16 pass;tsc --noEmitexit 0;pickierclean- Browser QA (source of truth): unauth→/login, first-run register→composer, all 5 provider chips load through the cookie→bearer bridge, queue shows real data (2 scheduled · 5 drafts), analytics renders, sign-out re-gates — 0 console errors
Notes / tradeoffs
storage/framework/shrinks 55M → 5.7M (thedefaults/+auto-imports/the runtime needs). Committed rather than gitignored-and-regenerated (ghostanalytics's approach) because no postinstall/bootstrap step repopulatesdefaults/on a fresh clone — committing is the reproducible, verifiable choice. Apostinstallsync-from-@stacksjs/defaultsscript is a sensible future cleanup to drop the duplication.- componentsDir straggler (
0.70.145hardcodesstorage/framework/defaults/resources/componentsindev/views.js) is present but harmless here — our pages use our own components; it's covered by the committeddefaults/. - The server-side
protectedPathspage gate (a vendored dev-proxy edit) is not re-homed; the client-side layout guard + API auth cover it. Minor defense-in-depth reduction, not a hole.
Closes #14