#681 Sync package updates and check QUERY requests for request forgery

Upstream Updates

• framework #61797 — Check QUERY requests for request forgery. The middleware treated QUERY as a reading method and skipped its origin and token checks. Since method override is enabled, a cross-site form could POST with _method=QUERY and reach a QUERY route with the visitor's session cookie but without either check. Port upstream's tests, and cover spoofed POSTs from the query string and the body, with and without a valid token, and QUERY in origin-only mode. Port the matching CSRF and routing documentation from docs 226b064.
• ai #1139 — Set the remote file size limit, ai.remote_files.max_size, in kilobytes as upstream does, and reject a response that declares a larger Content-Length before downloading its body. Hypervel already limited decoded downloads; the default stays 32 MiB and null still disables the limit. The streaming check keeps using the body's position instead of upstream's stat call on every chunk. Document the unit and the early rejection.
• ai #1150 — Rebuild stored Gemini model turns with their thought step before their text, the order Gemini expects.
• docs #11401 — Add moving files to the FileStorage tool list, and note that Groq only supports web search and code execution on its GPT-OSS models and ignores the web search max, allow and location methods. The rest was already documented.
• scout #1015, #1013, #1014 — Port the tests for queued imports keeping their queue and connection, missing Typesense collections being created with the model's indexable name, and Meilisearch escaping whereIn and whereNotIn values. Hypervel already had all three fixes. Upstream's job tests replace two Hypervel duplicates.
• telescope #1770, #1772 — Format query previews in the SQL dialect of their connection's driver, and show queries from drivers the formatter doesn't support as recorded. Port upstream's Vitest setup and preview tests and run them in CI. MongoDB isn't supported, so its JSON formatting is left out. Update source-map-js to 1.2.2 and rebuild the dashboard assets.
• wayfinder #324 — Port upstream's tests for QUERY routes, which Hypervel's Wayfinder already supported. Document their generated query method and how forms spoof them.
• wayfinder #331 — Add wayfinder:generate --skip-database for builds that can't reach the database. Route binding types then come from casts and @property docblocks instead of the schema. Document the option.
• docs d9b95fe — Document MCP client authentication with bearer tokens, linking user accounts with OAuth, and client metadata, and explain how it differs from authenticating clients to your own servers.
• docs #11409 — Explain that @stack only renders content pushed before it is reached.
• docs #11413 — Warn that a signed URL's signature doesn't cover the request body, so signed values should be read with query().
• permission #2978 — Make hasRole() and hasAllRoles() respect the requested guard when given a Role model. A role from another guard used to match.
• permission #2969 — Upstream indexes cached permissions by name and key. Hypervel already had these indexes, but built them by reading attributes, so loading the catalog ran name and guard accessors, and an indexed lookup could disagree with filtering when an accessor or cast changed a value. Build the name index from stored attributes, and use an index only when reading its attributes returns the stored values. Upstream also rescans returned models for unsaved changes. Hypervel keeps lookups free of that rescan and documents that a changed role or permission must be saved before further lookups. Port upstream's tests and lookup benchmark.
• rate-limit-plugin #30 — Port the tests that cached responses don't count against rate limits. Hypervel's Saloon manager already checks the cache before rate limiting.

Additional Hypervel Fixes

• Pass socket read timeouts by name in the HTTP and database test fixtures. Swoole\Coroutine\Socket::recv() takes the length first, so ten calls meant to wait two or three seconds instead read at most two or three bytes at a time, with no time limit.
• Add a Permission section to the Laravel porting guide, covering the expiration_seconds setting, the same-backend lock requirement and saving changed models before further lookups.
• Match Role models in a list passed to hasAllRoles() or hasExactRoles(), and a single model passed to hasExactRoles(), by key and guard. They were compared by name, so a role with the same name from another guard matched.
• Remove a stale link from the HTTP testing docs to a QUERY route limitation that no longer exists.
• Let the benchmark harnesses run full measurements without an extra confirmation flag. Their READMEs now just ask for an idle machine.

The full suite, formatting and static analysis pass, along with the Scout integration tests against Meilisearch and Typesense and the Telescope and Wayfinder JavaScript tests. CI will run the full suite and supported service matrix.

[!NOTE]

Check QUERY requests for request forgery and sync package updates

• Removes QUERY from the read-only methods in PreventRequestForgery.php, so cross-site QUERY requests and spoofed _method=QUERY form posts now require a CSRF token or origin verification. Tests cover tokenless rejection, valid-token pass-through, and both method-override bags.
• Changes AI remote-file max_size in UntrustedUrl.php and ai.php from bytes to kilobytes. The default stays 32 MiB, and oversized responses are now rejected from the declared Content-Length before the body is read.
• Hardens the permission lookup catalog in PermissionRegistrar.php: indexed lookups fall back to filtering when model accessors, casts, or non-scalar lookup values make string-keyed indexes unsafe, and enum values compare by their underlying value.
• Fixes hasRole, hasAllRoles, and hasExactRoles in HasRoles.php so Role model arguments match by key and guard instead of name only.
• Adds a --skip-database option to wayfinder:generate via BindingResolver.php, inferring binding types from model docblocks. Also removes the --idle-confirmed guard from all benchmark scripts.
• Behavioral Change: tokenless QUERY requests that previously passed now throw TokenMismatchException; the AI max_size config unit changes from bytes to kilobytes, so existing byte-valued configs are interpreted as kilobytes.

^{Macroscope summarized 48c1c8a.}