@stacksjs/defaults 0.74.28 → 0.74.29

package/ai/skills/stacks-models/SKILL.md

@@ -102,7 +102,6 @@ generated model types stay precise.
 | `useApi` | Generates REST actions and routes: `{ uri, routes, middleware? }` |
 | `useSearch` (alias `searchable`) | Search-engine indexing: `{ displayable, searchable, sortable, filterable }` |
 | `useSocials` | OAuth identities, e.g. `['github']` |
-| `useActivityLog` | Writes an `Activity` row per change |
 | `observe` | Emits `{model}:created` / `:updated` / `:deleted` events |
 | `billable` | Stripe methods (`checkout()`, `activeSubscription()`, ...) |
 | `taggable` / `categorizable` / `commentable` / `likeable` | Pivot tables and their relation methods |

package/app/Middleware/Csrf.ts

@@ -63,6 +63,8 @@ const CSRF_SECURE_TRANSPORT = Symbol.for('@stacksjs/router:csrf-secure-transport
 const CSRF_HEADER_NAME = 'x-csrf-token'
 const CSRF_COOKIE_PREFIX = `${CSRF_COOKIE_NAME}=`
 const LEGACY_CSRF_COOKIE_PREFIX = 'csrf-token='
+const CSRF_COOKIE_SUFFIX = '; Path=/; SameSite=Lax; Max-Age=7200'
+const CSRF_COOKIE_SECURE_SUFFIX = `${CSRF_COOKIE_SUFFIX}; Secure`
 const TOKEN_BYTES = 32
 const TOKEN_HEX_LENGTH = TOKEN_BYTES * 2
 const TOKEN_RANDOM_BYTES = Buffer.allocUnsafe(TOKEN_BYTES)
@@ -81,7 +83,7 @@ const RIGHT_TOKEN_BYTES = new Uint8Array(TOKEN_HEX_LENGTH)
  */
 export function generateCsrfToken(): string {
   crypto.getRandomValues(TOKEN_RANDOM_BYTES)
-  return TOKEN_RANDOM_BYTES.toString('hex')
+  return TOKEN_RANDOM_BYTES.toHex()
 }
 
 /**
@@ -131,10 +133,10 @@ function responseAlreadySeeds(response: Response): boolean {
 export function createCsrfCookie(req: Request, minted?: string): string {
   const token = minted || generateCsrfToken()
   const knownSecureTransport = (req as unknown as Record<symbol, unknown>)[CSRF_SECURE_TRANSPORT]
-  const secure = knownSecureTransport === true || (knownSecureTransport === undefined && req.url.startsWith('https://'))
-    ? '; Secure'
-    : ''
-  return `${CSRF_COOKIE_NAME}=${token}; Path=/; SameSite=Lax; Max-Age=7200${secure}`
+  const suffix = knownSecureTransport === true || (knownSecureTransport === undefined && req.url.startsWith('https://'))
+    ? CSRF_COOKIE_SECURE_SUFFIX
+    : CSRF_COOKIE_SUFFIX
+  return `${CSRF_COOKIE_PREFIX}${token}${suffix}`
 }
 
 export function seedCsrfCookieIfMissing(req: Request, response: Response, minted?: string, responseHasNoCookies = false): Response {

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.74.28",
+  "version": "0.74.29",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.74.28",
+  "version": "0.74.29",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.27",
-    "@stacksjs/mobile": "^0.74.28",
+    "@stacksjs/mobile": "^0.74.29",
     "@stacksjs/sanitizer": "^0.2.113",
     "ts-qr-codes": "^0.1.8"
   }

package/stx-components-plugin.ts

@@ -19,7 +19,48 @@ const candidates = [
   join(process.cwd(), 'node_modules/@stacksjs/components/src/ui'),
 ].filter((dir): dir is string => Boolean(dir))
 
+const library = candidates.find(dir => existsSync(dir)) ?? candidates[candidates.length - 1]
+
+/**
+ * Component directories contributed by installed packages.
+ *
+ * Wrapped on its own rather than left to the plugin loader's catch. stx wraps
+ * plugin loading in `try { … } catch { console.warn(…) }`, so an exception
+ * raised here would drop the WHOLE plugin - and this plugin is what supplies
+ * the dashboard's sidebar. Degrading to "no package components" keeps the
+ * library and the framework defaults working.
+ *
+ * `@stacksjs/config` is imported for the resolution rather than re-implemented,
+ * because it carries the guard that refuses a path escaping the package.
+ */
+function packageDirs(): string[] {
+  try {
+    // eslint-disable-next-line ts/no-require-imports
+    const { packageComponentRoots } = require('@stacksjs/config')
+    return packageComponentRoots().map((root: { dir: string }) => root.dir)
+  }
+  catch {
+    return []
+  }
+}
+
 export default {
   name: '@stacksjs/components',
-  components: candidates.find(dir => existsSync(dir)) ?? candidates[candidates.length - 1],
+  /*
+   * Order is the precedence, because stx searches this list and takes the
+   * first match.
+   *
+   * The framework's own components are listed explicitly, ahead of any
+   * package's. They already resolve today through stx's fallback directory, so
+   * naming them here changes nothing on its own - what it does is put a floor
+   * under the package roots, making an installed package purely ADDITIVE. A
+   * package shipping its own `Button.stx` gets it used where nothing else
+   * defines `<Button />`, and cannot quietly replace the framework's.
+   */
+  components: [
+    library,
+    // Relative to this file, which is what stx resolves plugin entries against.
+    'resources/components',
+    ...packageDirs(),
+  ],
 }