@stacksjs/defaults 0.70.365 → 0.70.366

package/ai/skills/stacks-dashboard/SKILL.md

@@ -354,20 +354,19 @@ drawers must use the shared `dashboard-modal-layer` class so their interactive
 surface starts beside that sidebar and returns to `left: 0` on mobile and in
 the Craft native-sidebar shell.
 
-Use the shared `Dashboard/UI/Modal` and `Dashboard/UI/ConfirmDialog`
-components when possible. A custom overlay root must use this shape:
-
-```html
-<div class="fixed inset-y-0 overflow-y-auto right-0 z-[55] dashboard-modal-layer">
-  <button class="absolute inset-0" aria-label="Close dialog"></button>
-  <!-- dialog panel -->
-</div>
-```
-
-Do not solve sidebar overlap by increasing z-index alone. That places the
-dialog above the sidebar without centering it in the available content area.
-Keep overlay children `absolute`, not `fixed`, so they remain bounded by the
-sidebar-aware root.
+Use `Dashboard/UI/Modal`, `Dashboard/UI/Drawer`, and
+`Dashboard/UI/ConfirmDialog` for page dialogs, inspectors, forms, and
+confirmations. They own native `<dialog>` behavior, scroll locking, focus
+restoration, Escape and backdrop handling, accessibility labels, and the
+sidebar-aware boundary. `Dashboard/Modals/BaseModal` and
+`Dashboard/Modals/Popups/Alert` are compatibility wrappers over that same
+primitive, not alternate overlay implementations.
+
+Do not add a page-owned `fixed inset-0` overlay. A purpose-built application
+surface such as the global command palette or mobile navigation may own a
+custom layer only when the shared dialog or drawer semantics do not fit. It
+must still use `dashboard-modal-layer` and provide complete keyboard, focus,
+and ARIA behavior. Do not solve sidebar overlap by increasing z-index alone.
 
 ### Live dashboard audit
 
@@ -378,6 +377,9 @@ the project root:
 bun storage/framework/defaults/ai/skills/stacks-dashboard/scripts/audit.ts
 # Or target a non-default origin:
 bun storage/framework/defaults/ai/skills/stacks-dashboard/scripts/audit.ts --base-url http://127.0.0.1:3002
+
+# Exercise hydrated navigation, console errors, failed requests, and layout:
+bun storage/framework/defaults/ai/skills/stacks-browse/scripts/browse.ts crawl http://localhost:3002/ --max 500 --settle 350 --summary
 ```
 
 Pass a base URL as the first argument when the dashboard is not on
@@ -388,6 +390,13 @@ dashboard API. It fails on missing page renders, invalid fragment contracts,
 empty or non-HTML pages, unresolved component tags, 5xx or method-mismatch
 APIs, HTML API fallbacks, invalid JSON, and HTTP-200 error payloads.
 
+The dependency-free browser crawl follows the rendered link graph in a real
+browser and fails on non-200 pages, console errors, failed subrequests, or
+horizontal overflow. Seed source-only routes with repeated `--path` flags,
+including optional or parameterized pages that the current data set does not
+link. The HTTP audit and browser crawl cover different boundaries, so run both
+for exhaustive dashboard work.
+
 Run this after dashboard route, Action, STX, model, migration, or dev-server
 changes. Record provider-backed or destructive success paths as explicit
 environment boundaries. Never replace a failed live contract with sample data

package/app/Actions/Auth/LoginAction.ts

@@ -1,5 +1,5 @@
 import { Action } from '@stacksjs/actions'
-import { Auth, createTwoFactorChallenge, getTwoFactorState } from '@stacksjs/auth'
+import { Auth, authCookie, createTwoFactorChallenge, getTwoFactorState } from '@stacksjs/auth'
 import { User } from '@stacksjs/orm'
 import { response } from '@stacksjs/router'
 import { schema } from '@stacksjs/validation'
@@ -66,6 +66,15 @@ export default new Action({
     // The legacy `token` field is kept for backward compatibility
     // with clients that haven't been updated yet — it shadows
     // `access_token` and will be removed in a future major.
+    //
+    // The same token also goes out as an httpOnly cookie, matching
+    // SocialCallbackAction. Without it, how a browser ends up signed in
+    // depended on which way it signed in: OAuth left a cookie, email+password
+    // left only JSON, and a server-rendered page cannot read JSON — it posts a
+    // form, follows a redirect, and comes back carrying nothing but cookies.
+    // So the first authenticated document render had no way to identify the
+    // user (#2306). The body is unchanged, so an API client that ignores the
+    // cookie behaves exactly as before.
     return response.json({
       access_token: result.token,
       refresh_token: result.refreshToken,
@@ -77,6 +86,6 @@ export default new Action({
         email: user?.email,
         name: user?.name,
       },
-    })
+    }, { headers: { 'Set-Cookie': authCookie(result.token) } })
   },
 })

package/app/Actions/Auth/RefreshTokenAction.ts

@@ -1,5 +1,5 @@
 import { Action } from '@stacksjs/actions'
-import { refreshToken } from '@stacksjs/auth'
+import { authCookie, refreshToken } from '@stacksjs/auth'
 import { response } from '@stacksjs/router'
 import { schema } from '@stacksjs/validation'
 
@@ -25,12 +25,16 @@ export default new Action({
         refreshExpiresInDays: 30, // 30 day refresh token
       })
 
+      // Rotation invalidates the token the cookie was carrying, so a cookie
+      // left untouched here would go stale at the exact moment the session was
+      // meant to be extended: the browser keeps presenting a revoked token
+      // while the JSON body holds a live one it cannot read (#2306).
       return response.json({
         access_token: result.plainTextToken,
         refresh_token: result.refreshToken,
         token_type: 'Bearer',
         expires_in: result.expiresIn,
-      })
+      }, { headers: { 'Set-Cookie': authCookie(result.plainTextToken) } })
     }
     catch (error: any) {
       return response.unauthorized(error.message || 'Invalid or expired refresh token')

package/app/Actions/Auth/RegisterAction.ts

@@ -1,5 +1,5 @@
 import { Action } from '@stacksjs/actions'
-import { Auth, register } from '@stacksjs/auth'
+import { Auth, authCookie, register } from '@stacksjs/auth'
 import { dispatch } from '@stacksjs/events'
 import { response } from '@stacksjs/router'
 import { schema } from '@stacksjs/validation'
@@ -53,6 +53,10 @@ export default new Action({
       // were signed out an hour into their first session while every other
       // user refreshed normally (stacksjs/stacks#2212). The legacy `token`
       // alias stays for backward compatibility.
+      // Registering signs the account in, so it is a session-issuing path like
+      // the other three and carries the cookie for the same reason: the very
+      // next thing a server-rendered app does is redirect to an authenticated
+      // page (#2306).
       return response.json({
         access_token: result.token,
         refresh_token: result.refreshToken,
@@ -64,7 +68,7 @@ export default new Action({
           email: user?.email,
           name: user?.name,
         },
-      })
+      }, { headers: { 'Set-Cookie': authCookie(result.token) } })
     }
 
     return response.error('Registration failed')

package/app/Actions/Auth/VerifyTwoFactorLoginAction.ts

@@ -1,5 +1,5 @@
 import { Action } from '@stacksjs/actions'
-import { Auth, consumeTwoFactorChallenge, verifyTwoFactorLoginCode } from '@stacksjs/auth'
+import { Auth, authCookie, consumeTwoFactorChallenge, verifyTwoFactorLoginCode } from '@stacksjs/auth'
 import { response } from '@stacksjs/router'
 import { schema } from '@stacksjs/validation'
 
@@ -41,6 +41,10 @@ export default new Action({
 
     const user = result.user
 
+    // This is where a 2FA account's session actually begins — LoginAction
+    // deliberately mints nothing for these users until the code is verified —
+    // so the cookie belongs here too. Setting it only on LoginAction would
+    // have left every 2FA account exactly where it started (#2306).
     return response.json({
       access_token: result.token,
       refresh_token: result.refreshToken,
@@ -52,6 +56,6 @@ export default new Action({
         email: user?.email,
         name: user?.name,
       },
-    })
+    }, { headers: { 'Set-Cookie': authCookie(result.token) } })
   },
 })

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.70.365",
+  "version": "0.70.366",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.70.365",
+  "version": "0.70.366",
   "description": "The complete managed Stacks application scaffold, including runtime defaults, AI guidance, editor metadata, and npm-backed project support files.",
   "author": "Chris Breuer",
   "license": "MIT",

package/resources/components/Dashboard/Auth/ForgotPasswordDashboard.stx

@@ -17,8 +17,6 @@ async function handleForgotPassword(data) {
   }
   catch (err) {
     error.set(err instanceof Error ? err.message : 'Failed to send reset link')
-    // eslint-disable-next-line no-console
-    console.error(err)
   }
   finally {
     isLoading.set(false)

package/resources/components/Dashboard/Auth/LoginDashboard.stx

@@ -27,7 +27,7 @@ async function handleLogin(credentials) {
     navigate(safeRedirect())
   }
   catch (err) {
-    error.set(err.message || 'An error occurred during login')
+    error.set(err instanceof Error ? err.message : 'An error occurred during login')
   }
   finally {
     isLoading.set(false)

package/resources/components/Dashboard/Auth/RegisterDashboard.stx

@@ -27,9 +27,7 @@ async function handleRegister(credentials) {
     navigate(safeRedirect())
   }
   catch (err) {
-    error.set(err.message || 'An error occurred during registration')
-    // eslint-disable-next-line no-console
-    console.error(err)
+    error.set(err instanceof Error ? err.message : 'An error occurred during registration')
   }
   finally {
     isLoading.set(false)