npm - @stacksjs/defaults - Versions diffs - 0.72.97 → 0.72.99 - Mend

@stacksjs/defaults 0.72.97 → 0.72.99

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (87) hide show

package/resources/components/Storefront/CartDrawer.stx CHANGED Viewed

@@ -63,24 +63,44 @@
 <script data-stx-scoped>
 ;(() => {
+  /*
+   * The two properties this block puts on `window`, named in one place.
+   *
+   * A cast rather than a `declare global`: an ambient declaration has to sit at
+   * the top level of a module, and this block is not one. A cast is an ordinary
+   * annotation, which is what the rest of this script already relies on.
+   */
+  const w = window as Window & {
+    /** Set by this block so a fragment swap cannot stack a second set of listeners. */
+    __stxCartWired?: boolean
+    /** The hooks this drawer publishes for other components to drive it. */
+    stxCart?: { open: () => void, shut: () => void, refresh: () => Promise<void> }
+  }
   // Idempotency guard. SPA fragment swaps re-inject scoped scripts when
   // the cart link is followed; without this, every navigation stacked
   // another set of click listeners on [data-stx-add-to-cart] buttons,
   // and a single click would fire two/three/N XHRs — the user-visible
   // tell was a brief flicker as the drawer opened, refreshed, then
   // refreshed again from the duplicate handlers.
-  if (window.__stxCartWired) return
-  window.__stxCartWired = true
+  if (w.__stxCartWired) return
+  w.__stxCartWired = true
-  const root = document.querySelector('[data-stx-cart-drawer]')
+  const root = document.querySelector<HTMLElement>('[data-stx-cart-drawer]')
   if (!root) return
-  const backdrop = root.querySelector('[data-stx-cart-backdrop]')
-  const panel = root.querySelector('[data-stx-cart-panel]')
-  const closeBtn = root.querySelector('[data-stx-cart-close]')
-  const list = root.querySelector('[data-stx-cart-list]')
-  const empty = root.querySelector('[data-stx-cart-empty]')
-  const footer = root.querySelector('[data-stx-cart-footer]')
-  const subtotalEl = root.querySelector('[data-stx-cart-subtotal]')
+  const backdrop = root.querySelector<HTMLElement>('[data-stx-cart-backdrop]')
+  const panel = root.querySelector<HTMLElement>('[data-stx-cart-panel]')
+  const closeBtn = root.querySelector<HTMLElement>('[data-stx-cart-close]')
+  const list = root.querySelector<HTMLElement>('[data-stx-cart-list]')
+  const empty = root.querySelector<HTMLElement>('[data-stx-cart-empty]')
+  const footer = root.querySelector<HTMLElement>('[data-stx-cart-footer]')
+  const subtotalEl = root.querySelector<HTMLElement>('[data-stx-cart-subtotal]')
+  // `open()` and `shut()` drive both of these on every call. A drawer missing
+  // either is not a drawer, so this leaves rather than throwing halfway
+  // through the first open.
+  if (!backdrop || !panel)
+    return
   // Reserve the scrollbar gutter on <html> so locking page scroll while
   // the drawer is open doesn't cause the page width to jump (~17px on
@@ -89,10 +109,10 @@
   // because the scrollbar disappeared.
   document.documentElement.style.scrollbarGutter = 'stable'
-  let lastFocus = null
+  let lastFocus: HTMLElement | null = null
-  function open() {
-    lastFocus = document.activeElement
+  const open = () => {
+    lastFocus = document.activeElement instanceof HTMLElement ? document.activeElement : null
     root.style.pointerEvents = 'auto'
     root.setAttribute('aria-hidden', 'false')
     backdrop.style.opacity = '1'
@@ -101,7 +121,7 @@
     // Move focus into the panel so Esc + Tab work as expected.
     requestAnimationFrame(() => { panel.focus({ preventScroll: true }) })
   }
-  function shut() {
+  const shut = () => {
     root.style.pointerEvents = 'none'
     root.setAttribute('aria-hidden', 'true')
     backdrop.style.opacity = '0'
@@ -118,11 +138,12 @@
     if (e.key === 'Escape' && root.getAttribute('aria-hidden') === 'false') shut()
   })
-  function escapeHtml(s) {
-    return String(s ?? '').replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c])
+  function escapeHtml(s: string) {
+    const entities: Record<string, string> = { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }
+    return String(s ?? '').replace(/[&<>"']/g, c => entities[c] ?? c)
   }
-  function render(items, subtotal) {
+  const render = (items: Array<{ slug?: string, name?: string, image?: string, qty?: number | string, price?: number | string, lineTotal?: number | string }> | null | undefined, subtotal: number | string) => {
     if (!list || !empty || !footer) return
     if (!items || items.length === 0) {
       list.classList.add('hidden')
@@ -156,13 +177,14 @@
     if (subtotalEl) subtotalEl.textContent = '$' + (Number(subtotal) || 0).toFixed(2)
   }
-  let inflightRefresh = null
-  async function refresh() {
+  let inflightRefresh: Promise<void> | null = null
+  const refresh = async (): Promise<void> => {
     // Coalesce concurrent refreshes — if a click fires two refresh() in a
     // row (e.g. add-to-cart + open both call refresh), they reuse the
     // same network request and the drawer doesn't briefly toggle between
     // empty and populated.
-    if (inflightRefresh) return inflightRefresh
+    if (inflightRefresh)
+      return inflightRefresh
     inflightRefresh = (async () => {
       try {
         const res = await fetch('/api/cart', {
@@ -174,7 +196,7 @@
         render(data.items || [], data.subtotal || 0)
         const badge = document.querySelector('[data-stx-cart-count]')
         if (badge) {
-          const total = (data.items || []).reduce((s, i) => s + (Number(i.qty) || 0), 0)
+          const total = (data.items || []).reduce((sum: number, item: { qty?: number | string }) => sum + (Number(item.qty) || 0), 0)
           badge.textContent = String(total)
           badge.classList.toggle('hidden', total === 0)
         }
@@ -186,7 +208,7 @@
   }
   // Public hooks for other components to call.
-  window.stxCart = {
+  w.stxCart = {
     open: () => { open(); refresh() },
     shut,
     refresh,

package/resources/components/Storefront/ProductGallery.stx CHANGED Viewed

@@ -64,8 +64,9 @@ const {
   //      so clicking a thumb in gallery B updated gallery A's hero.
   //   2. SPA fragment swaps re-injected the scoped script and stacked
   //      a duplicate listener on every existing thumb.
-  if (window.__stxGalleryWired) return
-  window.__stxGalleryWired = true
+  const w = window as Window & { __stxGalleryWired?: boolean }
+  if (w.__stxGalleryWired) return
+  w.__stxGalleryWired = true
   document.addEventListener('click', (e) => {
     const target = e.target instanceof Element ? e.target : null

package/resources/components/Storefront/QuantitySelector.stx CHANGED Viewed

@@ -43,8 +43,13 @@ const {
   //      = two listeners per button = doubled increments per click.
   //   2. SPA fragment swaps that re-inject our scoped script don't
   //      keep multiplying handlers; the guard below early-returns.
-  if (window.__stxQtyWired) return
-  window.__stxQtyWired = true
+  const w = window as Window & {
+    /** Set by this block so a fragment swap cannot stack a second set of listeners. */
+    __stxQtyWired?: boolean
+  }
+  if (w.__stxQtyWired) return
+  w.__stxQtyWired = true
   // Default min/max chosen to match the component's defineProps fallbacks.
   // STX SSR doesn't reliably propagate defineProps default values into
@@ -53,13 +58,13 @@ const {
   // these fallbacks Math.min(0, qty+1) capped every increment at 0 and
   // the +/- buttons appeared dead. Read either the data-* on the wrapper
   // or the input attribute, whichever is non-empty.
-  function bound(wrap, kind, fallback) {
+  function bound(wrap: HTMLElement, kind: string, fallback: number) {
     const fromData = wrap.getAttribute('data-' + kind)
     if (fromData && fromData.trim() !== '') {
       const n = Number(fromData)
       if (Number.isFinite(n)) return n
     }
-    const input = wrap.querySelector('input[type="number"]')
+    const input = wrap.querySelector<HTMLInputElement>('input[type="number"]')
     const fromAttr = input && input.getAttribute(kind)
     if (fromAttr && fromAttr.trim() !== '') {
       const n = Number(fromAttr)
@@ -68,8 +73,8 @@ const {
     return fallback
   }
-  function step(wrap, delta) {
-    const input = wrap.querySelector('input[type="number"]')
+  function step(wrap: HTMLElement, delta: number) {
+    const input = wrap.querySelector<HTMLInputElement>('input[type="number"]')
     if (!input) return
     const min = bound(wrap, 'min', 1)
     const max = bound(wrap, 'max', 99)
@@ -88,7 +93,7 @@ const {
     const dec = target.closest('[data-stx-qty-dec]')
     const inc = target.closest('[data-stx-qty-inc]')
     if (!dec && !inc) return
-    const wrap = (dec || inc).closest('[data-stx-qty]')
+    const wrap = (dec ?? inc)?.closest<HTMLElement>('[data-stx-qty]')
     if (!wrap) return
     e.preventDefault()
     step(wrap, dec ? -1 : 1)

package/resources/functions/storefront/cart-cookie.ts ADDED Viewed

@@ -0,0 +1,58 @@
+/**
+ * Read the storefront cart token out of the request.
+ *
+ * The cart and the three checkout steps each opened with
+ *
+ *     const token = (typeof requestContext !== 'undefined')
+ *       ? requestContext.cookie('stacks_cart')
+ *       : null
+ *
+ * and `requestContext` is not a binding stx has ever put in a server script's
+ * scope. It is the NAME OF A PARAMETER inside the template hydrator, and the
+ * page context a server assembles carries `params`, `request` and `method`.
+ * So the `typeof` guard was always false, `token` was always null, and every
+ * one of those pages rendered its empty-cart branch no matter what was in the
+ * cart. The guard is what hid it: without it the pages would have thrown on
+ * the first request instead of quietly showing nothing.
+ *
+ * `request` is really provided, so the cookie is read from its header.
+ */
+/** The cookie the storefront stores its cart session token in. */
+export const CART_COOKIE = 'stacks_cart'
+/**
+ * The value of `name` in a request's Cookie header, or null.
+ *
+ * Values are percent-encoded on the way in, so they are decoded here. A
+ * malformed encoding yields the raw value rather than throwing, since a
+ * cookie is attacker-supplied and a render must not fail on one.
+ */
+export function cookieFromRequest(request: Request | undefined, name: string): string | null {
+  const header = request?.headers?.get('cookie')
+  if (!header)
+    return null
+  for (const part of header.split(';')) {
+    const index = part.indexOf('=')
+    if (index < 0)
+      continue
+    if (part.slice(0, index).trim() !== name)
+      continue
+    const raw = part.slice(index + 1).trim()
+    try {
+      return decodeURIComponent(raw)
+    }
+    catch {
+      return raw
+    }
+  }
+  return null
+}
+/** The storefront cart token carried by this request, or null. */
+export function cartTokenFromRequest(request: Request | undefined): string | null {
+  return cookieFromRequest(request, CART_COOKIE)
+}

package/resources/layouts/storefront.stx CHANGED Viewed

@@ -22,6 +22,7 @@
  * badge is correct on first paint, before any client-side JS runs.
  */
+const { cartTokenFromRequest } = require('../functions/storefront/cart-cookie')
 const Database = require('bun:sqlite').Database
 const path = require('path')
@@ -29,7 +30,7 @@ const dbPath = path.resolve(process.cwd(), process.env.DB_DATABASE_PATH || 'data
 let cartCount = 0
 try {
-  const sessionToken = (typeof requestContext !== 'undefined') ? requestContext.cookie('stacks_cart') : null
+  const sessionToken = cartTokenFromRequest(request)
   if (sessionToken) {
     const db = new Database(dbPath, { readonly: true })
     const cart = db.query(`SELECT total_items FROM carts WHERE session_token = ?1 AND status = 'active' LIMIT 1`).get(sessionToken)
@@ -52,7 +53,7 @@ catch { /* schema not migrated yet, or db missing — render an empty header */
       injects __stxRouterConfig with container:'body', which would erase
       the header/footer on every navigation. STX_ROUTER_OPTIONS is checked
       last by the router's Object.assign, so this wins. --}}
-  <script>window.STX_ROUTER_OPTIONS = { container: 'main' };</script>
+  <script>(window as Window & { STX_ROUTER_OPTIONS?: { container: string } }).STX_ROUTER_OPTIONS = { container: 'main' };</script>
 </head>
 <body class="antialiased font-serif text-stone-900 bg-stone-50">

package/resources/views/cart.stx CHANGED Viewed

@@ -3,13 +3,29 @@
 @section('title', 'Your cart')
 <script server>
+const { cartTokenFromRequest } = require('../../functions/storefront/cart-cookie')
+// The columns this query selects. bun:sqlite returns `any`, so nothing
+// downstream of the map was checked either.
+interface CartItemRow {
+  id: number
+  quantity: number | string
+  unit_price: number | string
+  total_price: number | string
+  product_name: string
+  product_image: string | null
+  product_sku: string
+  weight_grams: number | null
+}
+interface StorefrontLineItem { lineTotal: number }
 const Database = require('bun:sqlite').Database
 const path = require('path')
 const dbPath = path.resolve(process.cwd(), process.env.DB_DATABASE_PATH || 'database/stacks.sqlite')
 const db = new Database(dbPath, { readonly: true })
-const token = (typeof requestContext !== 'undefined') ? requestContext.cookie('stacks_cart') : null
+const token = cartTokenFromRequest(request)
 let items = []
 let cart = null
@@ -23,7 +39,7 @@ if (token) {
       LEFT JOIN products p ON p.slug = ci.product_sku
       WHERE ci.cart_id = ?1
       ORDER BY ci.id ASC
-    `).all(cart.id).map((row) => {
+    `).all(cart.id).map((row: CartItemRow) => {
       const qty = Number(row.quantity)
       const price = Number(row.unit_price)
       const lineTotal = Number(row.total_price)
@@ -49,7 +65,7 @@ if (token) {
 // app/Actions/Storefront/_shipping.ts when changing.
 const FREE_SHIPPING_THRESHOLD = Number(process.env.STOREFRONT_FREE_SHIPPING_THRESHOLD ?? 40) || 40
 const FLAT_SHIPPING = Number(process.env.STOREFRONT_FLAT_SHIPPING ?? 5) || 5
-const subtotal = items.reduce((sum, i) => sum + i.lineTotal, 0)
+const subtotal = items.reduce((sum: number, i: StorefrontLineItem) => sum + i.lineTotal, 0)
 const shipping = subtotal <= 0 ? 0 : (subtotal >= FREE_SHIPPING_THRESHOLD ? 0 : FLAT_SHIPPING)
 const total = subtotal + shipping
 const remainingForFree = Math.max(0, FREE_SHIPPING_THRESHOLD - subtotal)

package/resources/views/checkout/contact.stx CHANGED Viewed

@@ -3,13 +3,24 @@
 @section('title', 'Checkout — Contact')
 <script server>
+const { cartTokenFromRequest } = require('../../../functions/storefront/cart-cookie')
+// The columns this query selects. bun:sqlite returns `any`, so nothing
+// downstream of the map was checked either.
+interface CartSummaryRow {
+  product_name: string
+  quantity: number | string
+  total_price: number | string
+}
+interface StorefrontLineItem { lineTotal: number }
 const Database = require('bun:sqlite').Database
 const path = require('path')
 const dbPath = path.resolve(process.cwd(), process.env.DB_DATABASE_PATH || 'database/stacks.sqlite')
 const db = new Database(dbPath, { readonly: true })
-const token = (typeof requestContext !== 'undefined') ? requestContext.cookie('stacks_cart') : null
+const token = cartTokenFromRequest(request)
 let items = []
 let cart = null
@@ -19,7 +30,7 @@ if (token) {
     items = db.query(`
       SELECT product_name, quantity, total_price
       FROM cart_items WHERE cart_id = ?1 ORDER BY id ASC
-    `).all(cart.id).map((row) => {
+    `).all(cart.id).map((row: CartSummaryRow) => {
       const qty = Number(row.quantity)
       const lineTotal = Number(row.total_price)
       return {
@@ -36,7 +47,7 @@ if (token) {
 // totals on every checkout step match what gets charged.
 const FREE_SHIPPING_THRESHOLD = Number(process.env.STOREFRONT_FREE_SHIPPING_THRESHOLD ?? 40) || 40
 const FLAT_SHIPPING = Number(process.env.STOREFRONT_FLAT_SHIPPING ?? 5) || 5
-const subtotal = items.reduce((s, i) => s + i.lineTotal, 0)
+const subtotal = items.reduce((s: number, i: StorefrontLineItem) => s + i.lineTotal, 0)
 const shipping = subtotal <= 0 ? 0 : (subtotal >= FREE_SHIPPING_THRESHOLD ? 0 : FLAT_SHIPPING)
 const total = subtotal + shipping
 const remainingForFree = Math.max(0, FREE_SHIPPING_THRESHOLD - subtotal)

package/resources/views/checkout/payment.stx CHANGED Viewed

@@ -3,13 +3,24 @@
 @section('title', 'Checkout — Payment')
 <script server>
+const { cartTokenFromRequest } = require('../../../functions/storefront/cart-cookie')
+// The columns this query selects. bun:sqlite returns `any`, so nothing
+// downstream of the map was checked either.
+interface CartSummaryRow {
+  product_name: string
+  quantity: number | string
+  total_price: number | string
+}
+interface StorefrontLineItem { lineTotal: number }
 const Database = require('bun:sqlite').Database
 const path = require('path')
 const dbPath = path.resolve(process.cwd(), process.env.DB_DATABASE_PATH || 'database/stacks.sqlite')
 const db = new Database(dbPath, { readonly: true })
-const token = (typeof requestContext !== 'undefined') ? requestContext.cookie('stacks_cart') : null
+const token = cartTokenFromRequest(request)
 let items = []
 let cart = null
@@ -19,7 +30,7 @@ if (token) {
     items = db.query(`
       SELECT product_name, quantity, total_price
       FROM cart_items WHERE cart_id = ?1 ORDER BY id ASC
-    `).all(cart.id).map((row) => {
+    `).all(cart.id).map((row: CartSummaryRow) => {
       const qty = Number(row.quantity)
       const lineTotal = Number(row.total_price)
       return {
@@ -34,7 +45,7 @@ if (token) {
 const FREE_SHIPPING_THRESHOLD = Number(process.env.STOREFRONT_FREE_SHIPPING_THRESHOLD ?? 40) || 40
 const FLAT_SHIPPING = Number(process.env.STOREFRONT_FLAT_SHIPPING ?? 5) || 5
-const subtotal = items.reduce((s, i) => s + i.lineTotal, 0)
+const subtotal = items.reduce((s: number, i: StorefrontLineItem) => s + i.lineTotal, 0)
 const shipping = subtotal <= 0 ? 0 : (subtotal >= FREE_SHIPPING_THRESHOLD ? 0 : FLAT_SHIPPING)
 const total = subtotal + shipping
 const remainingForFree = Math.max(0, FREE_SHIPPING_THRESHOLD - subtotal)

package/resources/views/checkout/shipping.stx CHANGED Viewed

@@ -3,13 +3,24 @@
 @section('title', 'Checkout — Shipping')
 <script server>
+const { cartTokenFromRequest } = require('../../../functions/storefront/cart-cookie')
+// The columns this query selects. bun:sqlite returns `any`, so nothing
+// downstream of the map was checked either.
+interface CartSummaryRow {
+  product_name: string
+  quantity: number | string
+  total_price: number | string
+}
+interface StorefrontLineItem { lineTotal: number }
 const Database = require('bun:sqlite').Database
 const path = require('path')
 const dbPath = path.resolve(process.cwd(), process.env.DB_DATABASE_PATH || 'database/stacks.sqlite')
 const db = new Database(dbPath, { readonly: true })
-const token = (typeof requestContext !== 'undefined') ? requestContext.cookie('stacks_cart') : null
+const token = cartTokenFromRequest(request)
 let items = []
 let cart = null
@@ -19,7 +30,7 @@ if (token) {
     items = db.query(`
       SELECT product_name, quantity, total_price
       FROM cart_items WHERE cart_id = ?1 ORDER BY id ASC
-    `).all(cart.id).map((row) => {
+    `).all(cart.id).map((row: CartSummaryRow) => {
       const qty = Number(row.quantity)
       const lineTotal = Number(row.total_price)
       return {
@@ -34,7 +45,7 @@ if (token) {
 const FREE_SHIPPING_THRESHOLD = Number(process.env.STOREFRONT_FREE_SHIPPING_THRESHOLD ?? 40) || 40
 const FLAT_SHIPPING = Number(process.env.STOREFRONT_FLAT_SHIPPING ?? 5) || 5
-const subtotal = items.reduce((s, i) => s + i.lineTotal, 0)
+const subtotal = items.reduce((s: number, i: StorefrontLineItem) => s + i.lineTotal, 0)
 const shipping = subtotal <= 0 ? 0 : (subtotal >= FREE_SHIPPING_THRESHOLD ? 0 : FLAT_SHIPPING)
 const total = subtotal + shipping
 const remainingForFree = Math.max(0, FREE_SHIPPING_THRESHOLD - subtotal)

package/resources/views/cms/blocks/form.stx CHANGED Viewed

@@ -6,10 +6,15 @@
 --}}
 <div class="cms-form mx-auto max-w-xl px-6 py-8" data-form-uuid="{{ props.formUuid }}">
   <script client>
-  const host = useRef('host')
-  const definition = state(null)
-  const values = reactive({})
-  const errors = state({})
+  import type { PublicFormDefinition, PublicFormField, SubmissionErrors } from '@stacksjs/forms'
+  // `_form` carries a whole-form failure; the rest are keyed by field name.
+  type FormErrors = SubmissionErrors & { _form?: string }
+  const host = useRef<HTMLElement>('host')
+  const definition = state<PublicFormDefinition | null>(null)
+  const values = reactive<Record<string, string | number | boolean>>({})
+  const errors = state<FormErrors>({})
   const sending = state(false)
   const done = state('')
   const openedAt = Date.now()
@@ -17,7 +22,7 @@
   effect(() => {
     if (!host() || definition())
       return
-    const uuid = host().dataset.formUuid
+    const uuid = host()?.dataset.formUuid
     if (!uuid)
       return
     fetch(`/api/forms/${uuid}`, { credentials: 'same-origin' })
@@ -26,7 +31,7 @@
       .catch(() => {})
   })
-  function fieldVisible(field) {
+  function fieldVisible(field: PublicFormField): boolean {
     const conditions = field.conditions
     if (!conditions || !conditions.rules || conditions.rules.length === 0)
       return true
@@ -47,7 +52,7 @@
     return conditions.action === 'show' ? matched : !matched
   }
-  async function submit(event) {
+  async function submit(event: Event): Promise<void> {
     event.preventDefault()
     if (sending())
       return
@@ -55,7 +60,7 @@
     errors.set({})
     try {
-      const uuid = host().dataset.formUuid
+      const uuid = host()?.dataset.formUuid
       const reply = await fetch(`/api/forms/${uuid}/submissions`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
@@ -90,11 +95,11 @@
   <div ref="host" data-form-uuid="{{ props.formUuid }}">
     <div :if="done()" class="rounded-lg border border-green-200 bg-green-50 px-5 py-4 text-[15px] text-green-900">{{ done() }}</div>
     <form :else-if="definition()" @submit="submit" novalidate>
-      <h2 class="text-2xl font-semibold tracking-tight">{{ definition().name }}</h2>
+      <h2 class="text-2xl font-semibold tracking-tight">{{ definition()?.name }}</h2>
       <p :if="errors()._form" class="mt-3 rounded-lg border border-red-200 bg-red-50 px-4 py-3 text-[14px] text-red-800">{{ errors()._form }}</p>
       <div class="mt-6 grid grid-cols-1 gap-5 sm:grid-cols-2">
-        <template :for="field in definition().fields">
+        <template :for="field in definition()?.fields ?? []">
           <div :if="fieldVisible(field)" class="{{ field.width === 'half' ? '' : 'sm:col-span-2' }}">
             <h3 :if="field.type === 'section_break'" class="mt-2 border-t border-gray-200 pt-4 text-lg font-medium">{{ field.label }}</h3>
             <template :else>
@@ -124,7 +129,7 @@
       <input type="text" name="website" tabindex="-1" autocomplete="off" aria-hidden="true" class="hidden" @input="values._hp = $event.target.value">
       <button type="submit" :disabled="sending()" class="mt-7 rounded-lg px-6 py-3 font-medium bg-gray-900 text-white transition-transform active:scale-[0.98] disabled:opacity-60">
-        {{ sending() ? 'Sending...' : (definition().submitLabel ?? 'Submit') }}
+        {{ sending() ? 'Sending...' : (definition()?.submitLabel ?? 'Submit') }}
       </button>
     </form>
     <p :else class="text-[15px] text-gray-500">Loading form...</p>

package/resources/views/cms/page.stx CHANGED Viewed

@@ -10,6 +10,34 @@
   Deliberately minimal chrome: real sites override this to add their own
   navigation (fetchMenuTree), theme tokens and footer.
 --}}
+<script server>
+/*
+ * The bindings `renderCmsPage` puts in this template's context, declared so
+ * the checker sees the same contract the docblock above describes. They are
+ * supplied by the renderer rather than imported, so `declare` is the accurate
+ * spelling: it types them and emits nothing.
+ *
+ * See `storage/framework/core/cms/src/public/render.ts`.
+ */
+declare const site: {
+  id: number
+  name: string
+  subdomain: string | null
+  settings: Record<string, unknown>
+}
+declare const page: {
+  id: number
+  title: string
+  path: string
+  template: string
+  metaDescription: string
+}
+/** Pre-rendered, sanitized block HTML. */
+declare const content: string
+</script>
 <!DOCTYPE html>
 <html lang="en">
 <head>

package/resources/views/coming-soon.stx CHANGED Viewed

@@ -1,9 +1,3 @@
-<script>
-defineOptions({
-  name: 'ComingSoonPage',
-})
-</script>
 <main>
   <ComingSoon />
 </main>

package/resources/views/orders/[id].stx CHANGED Viewed

@@ -3,13 +3,29 @@
 @section('title', 'Order confirmed')
 <script server>
+// The columns this query selects. bun:sqlite returns `any`, so nothing
+// downstream of the map was checked either.
+interface OrderItemRow {
+  quantity: number | string
+  price: number | string
+  name: string
+  image_url: string | null
+  slug: string
+  weight_grams: number | null
+}
+interface StorefrontLineItem { lineTotal: number }
 const Database = require('bun:sqlite').Database
 const path = require('path')
 const dbPath = path.resolve(process.cwd(), process.env.DB_DATABASE_PATH || 'database/stacks.sqlite')
 const db = new Database(dbPath, { readonly: true })
-const orderId = Number((typeof id !== 'undefined' && id) || 0)
+// From `params`, which is what stx puts in a server script's scope for a
+// `[id]` route. A bare `id` has never been a binding, so the `typeof` guard
+// was always false and this page rendered "order not found" for every order.
+const orderId = Number(params?.id ?? 0) || 0
 const order = orderId
   ? db.query(`
@@ -27,7 +43,7 @@ const items = order
       LEFT JOIN products p ON p.id = oi.product_id
       WHERE oi.order_id = ?1
       ORDER BY oi.id ASC
-    `).all(order.id).map((row) => ({
+    `).all(order.id).map((row: OrderItemRow) => ({
       name: row.name,
       slug: row.slug,
       image: row.image_url,
@@ -38,7 +54,7 @@ const items = order
     }))
   : []
-const subtotal = items.reduce((s, i) => s + i.lineTotal, 0)
+const subtotal = items.reduce((s: number, i: StorefrontLineItem) => s + i.lineTotal, 0)
 const shipping = order ? Number(order.delivery_fee || 0) : 0
 const total = order ? Number(order.total_amount || 0) : 0
 </script>

package/views/dashboard/composables/index.ts CHANGED Viewed

@@ -30,7 +30,7 @@ export {
   sidebarThemeFor,
   useAppearance,
 } from './useAppearance'
-export type { ChartCtor, ChartHandle, ChartLike, LazyChartsHandle, UseChartOptions } from './useChart'
+export type { ChartConfig, ChartCtor, ChartData, ChartDataset, ChartHandle, ChartLike, ChartOptions, ChartType, LazyChartsHandle, UseChartOptions } from './useChart'
 export { useChart, useCharts, useLazyCharts } from './useChart'
 export type { NavigationSnapshot } from './useNavigation'
 export { useNavigation } from './useNavigation'