@stacksjs/actions 0.70.160 → 0.70.162

package/dist/stacks.js

@@ -1,9 +1,19 @@
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import process from "node:process";
 import { log } from "@stacksjs/logging";
-import { dirname, join, projectPath, relative, stacksBackupPath, stacksLockPath } from "@stacksjs/path";
+import { registry } from "@stacksjs/registry";
 import { copyFile, createFolder, deleteFile, deleteEmptyFolders, doesFolderExist, fs } from "@stacksjs/storage";
-const STACK_DIRS = ["app", "config", "database", "resources", "routes", "public", "locales"];
-async function readStackLock() {
-  const lockPath = stacksLockPath();
+const STACK_DIRS = ["app", "config", "database", "resources", "routes", "public", "locales", "docs"];
+function stackLockPath(projectRoot) {
+  return join(projectRoot, "storage", "framework", "stacks.lock.json");
+}
+function stackBackupPath(projectRoot, stackName) {
+  return join(projectRoot, "storage", "framework", "stacks", "backups", stackName);
+}
+async function readStackLock(projectRoot) {
+  const lockPath = stackLockPath(projectRoot);
   try {
     if (fs.existsSync(lockPath)) {
       const content = await Bun.file(lockPath).text();
@@ -16,35 +26,47 @@ async function readStackLock() {
     stacks: {}
   };
 }
-async function writeStackLock(lock) {
-  const lockPath = stacksLockPath(), lockDir = dirname(lockPath);
+async function writeStackLock(projectRoot, lock) {
+  const lockPath = stackLockPath(projectRoot), lockDir = dirname(lockPath);
   if (!fs.existsSync(lockDir))
     await createFolder(lockDir);
   lock.generatedAt = new Date().toISOString();
   await Bun.write(lockPath, JSON.stringify(lock, null, 2));
 }
-function resolveStackPackagePath(name) {
-  const pantryDir = projectPath("pantry"), directPath = join(pantryDir, name);
-  if (fs.existsSync(join(directPath, "package.json")))
-    return directPath;
-  const scopedPath = join(pantryDir, "@stacksjs", name);
-  if (fs.existsSync(join(scopedPath, "package.json")))
-    return scopedPath;
-  if (name.startsWith("@")) {
-    const fullPath = join(pantryDir, name);
-    if (fs.existsSync(join(fullPath, "package.json")))
-      return fullPath;
-  }
-  const patterns = ["*/package.json", "@*/*/package.json"];
-  for (const pattern of patterns) {
-    const glob = new Bun.Glob(pattern);
-    for (const file of glob.scanSync({ cwd: pantryDir, absolute: !0, onlyFiles: !0 }))
-      try {
-        if (JSON.parse(fs.readFileSync(file, "utf-8"))?.stacks?.name === name)
-          return dirname(file);
-      } catch {}
+function resolveProjectRoot(project) {
+  return resolve(project || process.cwd());
+}
+function resolveRegistryEntry(name) {
+  const entry = registry.find((candidate) => {
+    if (typeof candidate === "string")
+      return candidate === name;
+    return candidate.name === name || candidate.package === name;
+  });
+  if (!entry || typeof entry === "string")
+    return null;
+  if (!entry.github)
+    return null;
+  return { name: entry.name, github: entry.github, package: entry.package };
+}
+async function checkoutRegistryStack(github) {
+  const tempRoot = mkdtempSync(join(tmpdir(), "stacks-stack-")), checkoutPath = join(tempRoot, "source"), source = `https://github.com/${github}.git`;
+  if (await Bun.spawn(["git", "clone", "--depth", "1", "--quiet", source, checkoutPath], {
+    stdout: "inherit",
+    stderr: "inherit"
+  }).exited !== 0) {
+    rmSync(tempRoot, { recursive: !0, force: !0 });
+    throw Error(`Could not pull ${source}`);
   }
-  return null;
+  return {
+    path: checkoutPath,
+    cleanup: () => rmSync(tempRoot, { recursive: !0, force: !0 })
+  };
+}
+function isSafeStackDirectory(directory) {
+  return directory.length > 0 && !isAbsolute(directory) && !directory.includes("..") && !directory.includes("\\");
+}
+function fileChecksum(path) {
+  return new Bun.CryptoHasher("sha256").update(fs.readFileSync(path)).digest("hex");
 }
 function collectFiles(dir, baseDir) {
   const files = [];
@@ -55,118 +77,151 @@ function collectFiles(dir, baseDir) {
     const fullPath = join(dir, entry.name);
     if (entry.isDirectory())
       files.push(...collectFiles(fullPath, baseDir));
-    else
-      files.push(relative(baseDir, fullPath));
+    else if (entry.isSymbolicLink())
+      throw Error(`Stack contains an unsupported symbolic link: ${relative(baseDir, fullPath)}`);
+    else {
+      const relPath = relative(baseDir, fullPath);
+      if (!isSafeStackDirectory(relPath))
+        throw Error(`Stack contains an unsafe path: ${relPath}`);
+      files.push(relPath);
+    }
   }
   return files;
 }
 export async function installStack(options) {
-  const { name, force = !1, dryRun = !1, verbose = !1 } = options, conflict = force ? "overwrite" : options.conflict ?? "skip";
+  const { name, force = !1, dryRun = !1, verbose = !1 } = options, conflict = force ? "overwrite" : options.conflict ?? "skip", projectRoot = resolveProjectRoot(options.project);
   log.info(`Installing stack "${name}"...`);
-  const stackPath = resolveStackPackagePath(name);
-  if (!stackPath) {
-    log.error(`Stack "${name}" not found in pantry. Install it first with: bun add <package-name>`);
+  if (!fs.existsSync(join(projectRoot, "package.json"))) {
+    log.error(`No Stacks project found at "${projectRoot}"`);
+    return null;
+  }
+  const registryEntry = resolveRegistryEntry(name);
+  if (!registryEntry) {
+    log.error(`Stack "${name}" is not in the Stacks registry. Run "buddy stack:list" to see available stacks.`);
     return null;
   }
-  let pkg, meta;
+  let checkout;
   try {
-    const pkgContent = await Bun.file(join(stackPath, "package.json")).text();
-    pkg = JSON.parse(pkgContent);
-    meta = pkg.stacks;
-    if (!meta?.name) {
-      log.error(`Package at "${stackPath}" does not have a valid "stacks" field in package.json`);
-      return null;
-    }
+    checkout = await checkoutRegistryStack(registryEntry.github);
   } catch (error) {
-    log.error(`Failed to read stack package.json: ${error}`);
+    log.error(error instanceof Error ? error.message : String(error));
     return null;
   }
-  const lock = await readStackLock(), packageName = pkg.name || name;
-  if (lock.stacks[packageName] && !force) {
-    log.warn(`Stack "${meta.name}" is already installed. Use --force to reinstall.`);
-    return lock.stacks[packageName];
-  }
-  const dirsToScan = meta.directories ?? STACK_DIRS, allFiles = [];
-  for (const dir of dirsToScan) {
-    const dirPath = join(stackPath, dir);
-    if (fs.existsSync(dirPath)) {
-      const files = collectFiles(dirPath, stackPath);
-      allFiles.push(...files);
+  try {
+    const stackPath = checkout.path;
+    let pkg, meta;
+    try {
+      const pkgContent = await Bun.file(join(stackPath, "package.json")).text();
+      pkg = JSON.parse(pkgContent);
+      meta = pkg.stacks;
+      if (!meta?.name || meta.name !== registryEntry.name) {
+        log.error(`Registry source "${registryEntry.github}" does not declare stacks.name as "${registryEntry.name}"`);
+        return null;
+      }
+    } catch (error) {
+      log.error(`Failed to read stack metadata: ${error}`);
+      return null;
     }
-  }
-  if (allFiles.length === 0) {
-    log.warn(`Stack "${meta.name}" has no files to install`);
-    return null;
-  }
-  if (verbose)
-    log.info(`Found ${allFiles.length} file(s) to install`);
-  const copiedFiles = [], skippedFiles = [];
-  for (const relPath of allFiles) {
-    const src = join(stackPath, relPath), dest = projectPath(relPath);
-    if (dryRun) {
-      if (fs.existsSync(dest)) {
-        log.info(`[dry-run] Would ${conflict}: ${relPath}`);
-        if (conflict === "skip")
-          skippedFiles.push(relPath);
-        else
-          copiedFiles.push(relPath);
-      } else {
-        log.info(`[dry-run] Would copy: ${relPath}`);
-        copiedFiles.push(relPath);
+    const lock = await readStackLock(projectRoot), packageName = pkg.name || registryEntry.package || name;
+    if (lock.stacks[packageName] && !force) {
+      log.warn(`Stack "${meta.name}" is already installed. Use --force to reinstall.`);
+      return lock.stacks[packageName];
+    }
+    const dirsToScan = meta.directories ?? STACK_DIRS;
+    if (dirsToScan.some((directory) => !isSafeStackDirectory(directory))) {
+      log.error(`Stack "${meta.name}" declares an unsafe project directory`);
+      return null;
+    }
+    const allFiles = [];
+    try {
+      for (const dir of dirsToScan) {
+        const dirPath = join(stackPath, dir);
+        if (fs.existsSync(dirPath))
+          allFiles.push(...collectFiles(dirPath, stackPath));
       }
-      continue;
+    } catch (error) {
+      log.error(error instanceof Error ? error.message : String(error));
+      return null;
+    }
+    if (allFiles.length === 0) {
+      log.warn(`Stack "${meta.name}" has no project files to install`);
+      return null;
     }
-    if (fs.existsSync(dest))
-      switch (conflict) {
-        case "skip":
-          if (verbose)
-            log.warn(`Skipping (file exists): ${relPath}`);
-          skippedFiles.push(relPath);
-          continue;
-        case "backup": {
-          const backupDir = stacksBackupPath(meta.name), backupDest = join(backupDir, relPath), backupDestDir = dirname(backupDest);
-          if (!fs.existsSync(backupDestDir))
-            await createFolder(backupDestDir);
-          copyFile(dest, backupDest);
-          if (verbose)
-            log.info(`Backed up: ${relPath}`);
-          break;
+    if (verbose)
+      log.info(`Pulled ${registryEntry.github} and found ${allFiles.length} project file(s)`);
+    const copiedFiles = [], skippedFiles = [], checksums = {};
+    for (const relPath of allFiles) {
+      const src = join(stackPath, relPath), dest = join(projectRoot, relPath);
+      if (dryRun) {
+        if (fs.existsSync(dest)) {
+          log.info(`[dry-run] Would ${conflict}: ${relPath}`);
+          if (conflict === "skip")
+            skippedFiles.push(relPath);
+          else
+            copiedFiles.push(relPath);
+        } else {
+          log.info(`[dry-run] Would copy: ${relPath}`);
+          copiedFiles.push(relPath);
         }
-        case "overwrite":
-          if (verbose)
-            log.warn(`Overwriting: ${relPath}`);
-          break;
+        continue;
       }
-    const destDir = dirname(dest);
-    if (!fs.existsSync(destDir))
-      await createFolder(destDir);
-    copyFile(src, dest);
-    copiedFiles.push(relPath);
-    if (verbose)
-      log.info(`Copied: ${relPath}`);
-  }
-  if (dryRun) {
-    log.info(`[dry-run] Would install ${copiedFiles.length} file(s), skip ${skippedFiles.length} file(s)`);
-    return null;
+      if (fs.existsSync(dest))
+        switch (conflict) {
+          case "skip":
+            if (verbose)
+              log.warn(`Skipping (file exists): ${relPath}`);
+            skippedFiles.push(relPath);
+            continue;
+          case "backup": {
+            const backupDir = stackBackupPath(projectRoot, meta.name), backupDest = join(backupDir, relPath), backupDestDir = dirname(backupDest);
+            if (!fs.existsSync(backupDestDir))
+              await createFolder(backupDestDir);
+            copyFile(dest, backupDest);
+            if (verbose)
+              log.info(`Backed up: ${relPath}`);
+            break;
+          }
+          case "overwrite":
+            if (verbose)
+              log.warn(`Overwriting: ${relPath}`);
+            break;
+        }
+      const destDir = dirname(dest);
+      if (!fs.existsSync(destDir))
+        await createFolder(destDir);
+      copyFile(src, dest);
+      copiedFiles.push(relPath);
+      checksums[relPath] = fileChecksum(dest);
+      if (verbose)
+        log.info(`Copied: ${relPath}`);
+    }
+    const entry = {
+      packageName,
+      name: meta.name,
+      version: pkg.version || "0.0.0",
+      installedAt: new Date().toISOString(),
+      files: copiedFiles,
+      checksums,
+      source: registryEntry.github,
+      skipped: skippedFiles,
+      conflictStrategy: conflict
+    };
+    if (dryRun) {
+      log.info(`[dry-run] Would install ${copiedFiles.length} file(s), skip ${skippedFiles.length} file(s)`);
+      return entry;
+    }
+    lock.stacks[packageName] = entry;
+    await writeStackLock(projectRoot, lock);
+    log.success(`Installed stack "${meta.name}" from ${registryEntry.github} (${copiedFiles.length} file(s) copied, ${skippedFiles.length} skipped)`);
+    return entry;
+  } finally {
+    checkout.cleanup();
   }
-  const entry = {
-    packageName,
-    name: meta.name,
-    version: pkg.version || "0.0.0",
-    installedAt: new Date().toISOString(),
-    files: copiedFiles,
-    skipped: skippedFiles,
-    conflictStrategy: conflict
-  };
-  lock.stacks[packageName] = entry;
-  await writeStackLock(lock);
-  log.success(`Installed stack "${meta.name}" (${copiedFiles.length} file(s) copied, ${skippedFiles.length} skipped)`);
-  return entry;
 }
 export async function uninstallStack(options) {
-  const { name, force = !1, verbose = !1 } = options;
+  const { name, force = !1, verbose = !1 } = options, projectRoot = resolveProjectRoot(options.project);
   log.info(`Uninstalling stack "${name}"...`);
-  const lock = await readStackLock();
+  const lock = await readStackLock(projectRoot);
   let entryKey = null, entry = null;
   for (const [key, value] of Object.entries(lock.stacks))
     if (value.name === name || key === name) {
@@ -179,24 +234,20 @@ export async function uninstallStack(options) {
     return !1;
   }
   let removedCount = 0;
+  const remainingFiles = [];
   for (const relPath of entry.files) {
-    const filePath = projectPath(relPath);
+    const filePath = join(projectRoot, relPath);
     if (!fs.existsSync(filePath)) {
       if (verbose)
         log.info(`Already removed: ${relPath}`);
       continue;
     }
     if (!force) {
-      const stackPath = resolveStackPackagePath(name);
-      if (stackPath) {
-        const srcPath = join(stackPath, relPath);
-        if (fs.existsSync(srcPath)) {
-          const srcContent = await Bun.file(srcPath).text(), destContent = await Bun.file(filePath).text();
-          if (srcContent !== destContent) {
-            log.warn(`Skipping modified file: ${relPath} (use --force to remove)`);
-            continue;
-          }
-        }
+      const installedChecksum = entry.checksums?.[relPath];
+      if (!installedChecksum || fileChecksum(filePath) !== installedChecksum) {
+        log.warn(`Skipping modified file: ${relPath} (use --force to remove)`);
+        remainingFiles.push(relPath);
+        continue;
       }
     }
     await deleteFile(filePath);
@@ -204,11 +255,19 @@ export async function uninstallStack(options) {
     if (verbose)
       log.info(`Removed: ${relPath}`);
   }
-  const backupDir = stacksBackupPath(entry.name);
+  if (remainingFiles.length > 0) {
+    entry.files = remainingFiles;
+    entry.checksums = Object.fromEntries(remainingFiles.map((file) => [file, entry.checksums?.[file]]).filter((item) => typeof item[1] === "string"));
+    lock.stacks[entryKey] = entry;
+    await writeStackLock(projectRoot, lock);
+    log.warn(`Stack "${entry.name}" is still tracked because ${remainingFiles.length} modified file(s) remain`);
+    return !1;
+  }
+  const backupDir = stackBackupPath(projectRoot, entry.name);
   if (fs.existsSync(backupDir) && doesFolderExist(backupDir)) {
     const backupFiles = collectFiles(backupDir, backupDir);
     for (const relPath of backupFiles) {
-      const backupSrc = join(backupDir, relPath), dest = projectPath(relPath), destDir = dirname(dest);
+      const backupSrc = join(backupDir, relPath), dest = join(projectRoot, relPath), destDir = dirname(dest);
       if (!fs.existsSync(destDir))
         await createFolder(destDir);
       copyFile(backupSrc, dest);
@@ -218,38 +277,30 @@ export async function uninstallStack(options) {
     fs.rmSync(backupDir, { recursive: !0, force: !0 });
   }
   for (const dir of STACK_DIRS) {
-    const dirPath = projectPath(dir);
+    const dirPath = join(projectRoot, dir);
     if (fs.existsSync(dirPath))
       await deleteEmptyFolders(dirPath);
   }
   delete lock.stacks[entryKey];
-  await writeStackLock(lock);
+  await writeStackLock(projectRoot, lock);
   log.success(`Uninstalled stack "${entry.name}" (${removedCount} file(s) removed)`);
   return !0;
 }
-export async function listStacks() {
-  const entries = [], lock = await readStackLock(), pantryDir = projectPath("pantry");
-  if (fs.existsSync(pantryDir)) {
-    const patterns = ["*/package.json", "@*/*/package.json"];
-    for (const pattern of patterns) {
-      const glob = new Bun.Glob(pattern);
-      for (const file of glob.scanSync({ cwd: pantryDir, absolute: !0, onlyFiles: !0 }))
-        try {
-          const pkgContent = fs.readFileSync(file, "utf-8"), pkg = JSON.parse(pkgContent);
-          if (!pkg?.stacks?.name)
-            continue;
-          const packageName = pkg.name, installed = !!lock.stacks[packageName], lockEntry = lock.stacks[packageName];
-          entries.push({
-            name: pkg.stacks.name,
-            packageName,
-            version: pkg.version || "0.0.0",
-            description: pkg.stacks.description,
-            installed,
-            installedAt: lockEntry?.installedAt,
-            fileCount: lockEntry?.files.length
-          });
-        } catch {}
-    }
+export async function listStacks(project) {
+  const entries = [], projectRoot = resolveProjectRoot(project), lock = await readStackLock(projectRoot);
+  for (const candidate of registry) {
+    if (typeof candidate === "string")
+      continue;
+    const packageName = candidate.package || candidate.name, lockEntry = lock.stacks[packageName];
+    entries.push({
+      name: candidate.name,
+      packageName,
+      version: lockEntry?.version || "latest",
+      description: candidate.description,
+      installed: Boolean(lockEntry),
+      installedAt: lockEntry?.installedAt,
+      fileCount: lockEntry?.files.length
+    });
   }
   for (const [packageName, entry] of Object.entries(lock.stacks))
     if (!entries.some((e) => e.packageName === packageName))

package/dist/templates.js

@@ -62,22 +62,25 @@ export default new Action({
     return { ok: true, userId: user.id, data }
   },
 })`,
-  component: `<script setup lang="ts">
-console.log('Hello World component created')
+  component: `<script server>
+interface ComponentProps {
+  message?: string
+}
+
+const { message = 'Hello World component created' } = defineProps<ComponentProps>()
 </script>
 
 <template>
-  <div>
-    Some HTML block
-  </div>
+  <div>{{ message }}</div>
 </template>`,
-  page: `<script setup lang="ts">
-console.log('Hello World page created')
+  page: `<script server>
+const heading = 'Hello World page created'
 </script>
 
 <template>
   <div>
-    Visit http://127.0.0.1/{0}
+    <h1>{{ heading }}</h1>
+    <p>Visit /{0}</p>
   </div>
 </template>`,
   function: `// reactive state

package/dist/test/feature.js

@@ -1,11 +1,2 @@
-import process from "node:process";
-import { log } from "@stacksjs/cli";
-import { projectPath } from "@stacksjs/path";
-const proc = Bun.spawn(["sh", "-c", "bun test ./tests/feature/**"], {
-  cwd: projectPath(),
-  stdio: ["inherit", "inherit", "inherit"]
-}), exitCode = await proc.exited;
-if (exitCode !== 0) {
-  log.error("Tests failed");
-  process.exit(exitCode ?? 1);
-}
+import { runTestSuites } from "./runner";
+await runTestSuites(["feature"]);

package/dist/test/index.js

@@ -1,11 +1,2 @@
-import process from "node:process";
-import { log } from "@stacksjs/cli";
-import { projectPath } from "@stacksjs/path";
-const proc = Bun.spawn(["sh", "-c", "bun test --timeout 30000 ./tests/feature/** ./tests/integration/** ./tests/unit/**"], {
-  cwd: projectPath(),
-  stdio: ["inherit", "inherit", "inherit"]
-}), exitCode = await proc.exited;
-if (exitCode !== 0) {
-  log.error("Tests failed");
-  process.exit(exitCode ?? 1);
-}
+import { runTestSuites } from "./runner";
+await runTestSuites([""], 30000);

package/dist/test/runner.d.ts

@@ -0,0 +1 @@
+export declare function runTestSuites(suites: string[], timeout?: number): Promise<void>;

package/dist/test/runner.js

@@ -0,0 +1,30 @@
+import process from "node:process";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { log } from "@stacksjs/cli";
+import { projectPath } from "@stacksjs/path";
+const testFiles = new Bun.Glob("**/*.{test,spec}.{js,jsx,ts,tsx,mjs,mts,cjs,cts}");
+export async function runTestSuites(suites, timeout) {
+  const project = projectPath(), filters = suites.flatMap((suite) => {
+    const suiteDirectory = join(project, "tests", suite);
+    if (!existsSync(suiteDirectory))
+      return [];
+    return [...testFiles.scanSync({ cwd: suiteDirectory, onlyFiles: !0 })].map((file) => suite ? `./tests/${suite}/${file}` : `./tests/${file}`);
+  });
+  if (filters.length === 0) {
+    log.info("No matching tests found.");
+    return;
+  }
+  const args = ["bun", "test"];
+  if (timeout)
+    args.push("--timeout", String(timeout));
+  args.push(...filters);
+  const exitCode = await Bun.spawn(args, {
+    cwd: project,
+    stdio: ["inherit", "inherit", "inherit"]
+  }).exited;
+  if (exitCode !== 0) {
+    log.error("Tests failed");
+    process.exit(exitCode ?? 1);
+  }
+}

package/dist/test/unit.js

@@ -1,11 +1,2 @@
-import process from "node:process";
-import { log } from "@stacksjs/cli";
-import { projectPath } from "@stacksjs/path";
-const proc = Bun.spawn(["sh", "-c", "bun test ./tests/unit/**"], {
-  cwd: projectPath(),
-  stdio: ["inherit", "inherit", "inherit"]
-}), exitCode = await proc.exited;
-if (exitCode !== 0) {
-  log.error("Tests failed");
-  process.exit(exitCode ?? 1);
-}
+import { runTestSuites } from "./runner";
+await runTestSuites(["unit"]);

package/dist/upgrade/packages.d.ts

@@ -1,3 +1,16 @@
+export declare function hasStacksDependency(pkg: PkgJson): boolean;
+export declare function standalonePackageUpdateCommand(): string;
+/** Strip a range operator (`^`, `~`, `>=`, …) so a declared range compares to a bare version. */
+export declare function baseVersion(range: string): string;
+/*` tooling
+ * (e.g. `better-dx`) are excluded, so they are never force-bumped to a framework
+ * version they don't publish (stacksjs/stacks#2078).
+ */
+export declare function lockstepPackages(metaDeps: Record<string, string>, target: string): Set<string>;
+/*` packages — is left
+ * untouched. Returns the set of applied changes.
+ */
+export declare function applyBumps(pkg: PkgJson, target: string, lockstep: Set<string>): Array<{ name: string, from: string, to: string }>;
 /**
  * Upgrade a node_modules app to a published framework version. Called by the
  * framework upgrade script when no vendored `storage/framework/core` exists.
@@ -12,3 +25,8 @@ export declare interface PackageUpgradeOptions {
   dryRun?: boolean
   noPostinstall?: boolean
 }
+declare interface PkgJson {
+  dependencies?: Record<string, string>
+  devDependencies?: Record<string, string>
+  [key: string]: unknown
+}