@stacksjs/defaults 0.74.51 → 0.74.53

package/ai/skills/stacks-database/SKILL.md

@@ -259,13 +259,18 @@ Entity-centric API for single-table design:
   migrationLocks: 'migration_locks',
   queryLogging: {
     // Defaults on outside production and off in production. Production also
-    // skips query hooks unless persistent history is explicitly enabled.
+    // skips query hooks unless persistent history is explicitly enabled,
+    // except one onQueryError hook on PostgreSQL and MySQL that reports a
+    // pool broken by oven-sh/bun#42804.
     enabled: env.DB_QUERY_LOGGING_ENABLED ?? !['production', 'prod'].includes(env.APP_ENV || ''),
     captureAllTraces: false, // slow and failed queries always keep traces
     // Bound values in query_logs.bindings, credentials stored as `<redacted>`
     // (by name and shape, so not every secret); production keeps only each
     // value's type unless this is enabled. Env takes true/false, 1/0, yes/no, on/off.
     captureBindings: env.DB_QUERY_LOGGING_CAPTURE_BINDINGS ?? !['production', 'prod'].includes(env.APP_ENV || ''),
+    // More secret columns, on top of those names: 'code' in every table,
+    // 'gift_cards.code' in that one. Also taken out of a failed query's error.
+    sensitiveColumns: [],
     slowThreshold: 100,  // ms
     retention: 7,        // days
     pruneFrequency: 24,  // hours

package/app/Controllers/ComingSoonController.ts

@@ -1,4 +1,4 @@
-import { Controller } from '@stacksjs/server'
+import { Controller } from '@stacksjs/server/controllers/base'
 /**
  * Base Controller class providing Laravel-like functionality
  */

package/app/Controllers/QueryController.ts

@@ -1,6 +1,6 @@
 import { config } from '@stacksjs/config'
 import { db, mutationCount, sql, sqlDateTime } from '@stacksjs/database/runtime'
-import { Controller } from '@stacksjs/server'
+import { Controller } from '@stacksjs/server/controllers/base'
 
 const DAY_MS = 86_400_000
 /** `2026-09-10T11` - the stored timestamp truncated to its hour. */

package/app/Storefront/CartCookie.ts

@@ -60,6 +60,32 @@ function timingSafeEqual(a: string, b: string): boolean {
   return diff === 0
 }
 
+/**
+ * The token a signed `<token>.<sig>` value carries, or null when the
+ * value is missing, unsigned or its signature does not match.
+ *
+ * The storefront pages read the cookie through this. They take no
+ * unsigned value: the actions accept one only to re-sign a cart that
+ * predates signing, and a page never writes the cookie.
+ */
+export function verifyCartCookie(value: string | null | undefined): string | null {
+  if (!value || typeof value !== 'string') return null
+
+  const dot = value.lastIndexOf('.')
+  if (dot < 0) return null
+
+  const token = value.slice(0, dot)
+  const presented = value.slice(dot + 1)
+  if (!token || presented.length !== SIG_CHARS) return null
+
+  const expected = createHmac('sha256', getKey())
+    .update(token)
+    .digest('base64url')
+    .slice(0, SIG_CHARS)
+
+  return timingSafeEqual(expected, presented) ? token : null
+}
+
 /**
  * Pull a verified cart token out of the request, or null if the
  * cookie is missing/malformed/forged. Legacy unsigned tokens
@@ -75,17 +101,7 @@ export function readCartCookie(request: any, cookieName: string): string | null
   // returns no row for unknown tokens — same fallback path.
   if (!raw.includes('.')) return raw
 
-  const dot = raw.lastIndexOf('.')
-  const token = raw.slice(0, dot)
-  const presented = raw.slice(dot + 1)
-  if (!token || presented.length !== SIG_CHARS) return null
-
-  const expected = createHmac('sha256', getKey())
-    .update(token)
-    .digest('base64url')
-    .slice(0, SIG_CHARS)
-
-  return timingSafeEqual(expected, presented) ? token : null
+  return verifyCartCookie(raw)
 }
 
 /**
@@ -101,7 +117,7 @@ export function writeCartCookie(
   request.cookies?.set?.(cookieName, sign(token), opts)
 }
 
-export const cartCookie = { read: readCartCookie, write: writeCartCookie, sign }
+export const cartCookie = { read: readCartCookie, write: writeCartCookie, sign, verify: verifyCartCookie }
 export default cartCookie
 
 // Re-export `SIG_BYTES` so tests can assert the byte budget without

package/app/Storefront/StorefrontDatabase.ts

@@ -0,0 +1,73 @@
+/**
+ * How the storefront's server-rendered pages read the database.
+ *
+ * The cart, the three checkout steps and the storefront layout query
+ * SQLite directly from their `<script server>` blocks. Each used to open
+ * the file itself, and every way that could fail rendered an empty cart
+ * without a word in any log:
+ *
+ *   - stx swallows an error thrown by a server script unless STX_DEBUG
+ *     is set, and renders the page from the script's static values, so
+ *     a missing column read as "Your cart is empty." No migration
+ *     creates `carts.session_token`, which every one of these pages
+ *     looks the cart up by.
+ *   - The layout caught its own errors and said nothing, on purpose.
+ *   - They opened the file read-only, and SQLite (as Bun 1.4.1 ships it)
+ *     refuses a read-only connection to a WAL-mode database that has no
+ *     `-shm` file beside it. The framework's query builder puts the
+ *     database in WAL mode, so a page read worked only while a `-shm`
+ *     file happened to exist.
+ *   - Under a `DB_CONNECTION` other than sqlite they read whatever SQLite
+ *     file `DB_DATABASE_PATH` or `database/stacks.sqlite` named, which
+ *     is not the app's database.
+ *
+ * {@link readStorefront} is the one place those are handled: the page
+ * still degrades to its empty cart, and the server log says why.
+ */
+
+import { Database } from 'bun:sqlite'
+import { resolve } from 'node:path'
+import process from 'node:process'
+
+/** Each distinct warning once per process, so a broken schema is not one line per request. */
+const warned = new Set<string>()
+
+function warnOnce(message: string): void {
+  if (warned.has(message))
+    return
+
+  warned.add(message)
+  console.warn(message)
+}
+
+/**
+ * Run `read` against the app's SQLite database and return what it returns,
+ * or `fallback` when the database cannot be read, with a warning in the
+ * server log naming `page` and the reason.
+ *
+ * Opened read-write without `create`, with `query_only` on: it can make the
+ * `-shm` file a WAL-mode database needs, cannot create a database that is
+ * not there, and cannot write to one that is. Closed before returning.
+ */
+export function readStorefront<T>(page: string, fallback: T, read: (db: Database) => T): T {
+  const connection = (process.env.DB_CONNECTION || 'sqlite').toLowerCase()
+  if (connection !== 'sqlite') {
+    warnOnce(`[storefront] ${page} shows no cart: it reads carts from SQLite, and DB_CONNECTION is ${connection}.`)
+    return fallback
+  }
+
+  const file = resolve(process.cwd(), process.env.DB_DATABASE_PATH || 'database/stacks.sqlite')
+  let db: Database | undefined
+  try {
+    db = new Database(file, { readwrite: true, create: false })
+    db.run('PRAGMA query_only = ON')
+    return read(db)
+  }
+  catch (error) {
+    warnOnce(`[storefront] ${page} shows no cart: reading ${file} failed: ${error instanceof Error ? error.message : String(error)}`)
+    return fallback
+  }
+  finally {
+    db?.close()
+  }
+}

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.74.51",
+  "version": "0.74.53",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.74.51",
+  "version": "0.74.53",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.27",
-    "@stacksjs/mobile": "^0.74.51",
+    "@stacksjs/mobile": "^0.74.53",
     "@stacksjs/sanitizer": "^0.2.113",
     "ts-qr-codes": "^0.1.8"
   }

package/resources/layouts/storefront.stx

@@ -19,27 +19,23 @@
  * the request handler.
  *
  * The cart count is read from the storefront's session cookie so the
- * badge is correct on first paint, before any client-side JS runs.
+ * badge is correct on first paint, before any client-side JS runs. A
+ * copy has to point the two requires below at the storefront helpers
+ * from wherever it sits.
  */
 
-const { cartTokenFromRequest } = require('../functions/storefront/cart-cookie')
-const Database = require('bun:sqlite').Database
-const path = require('path')
+const { verifyCartCookie } = require('../../app/Storefront/CartCookie')
+const { readStorefront } = require('../../app/Storefront/StorefrontDatabase')
 
-const dbPath = path.resolve(process.cwd(), process.env.DB_DATABASE_PATH || 'database/stacks.sqlite')
-
-let cartCount = 0
-try {
-  const sessionToken = cartTokenFromRequest(request)
-  if (sessionToken) {
-    const db = new Database(dbPath, { readonly: true })
-    const cart = db.query(`SELECT total_items FROM carts WHERE session_token = ?1 AND status = 'active' LIMIT 1`).get(sessionToken)
-    if (cart && cart.total_items)
-      cartCount = Number(cart.total_items) || 0
-    db.close()
-  }
-}
-catch { /* schema not migrated yet, or db missing — render an empty header */ }
+// The same signed cookie the cart page reads. When the cart cannot be read
+// the badge shows nothing, and the server log says why.
+const token = verifyCartCookie(requestContext.cookie('stacks_cart'))
+const cartCount = token
+  ? readStorefront('layouts/storefront.stx', 0, (db: import('bun:sqlite').Database) => {
+      const row = db.query<{ total_items: number | string | null }, [string]>(`SELECT total_items FROM carts WHERE session_token = ?1 AND status = 'active' LIMIT 1`).get(token)
+      return Number(row?.total_items) || 0
+    })
+  : 0
 </script>
 
 <!DOCTYPE html>

package/resources/views/cart.stx

@@ -3,9 +3,7 @@
 @section('title', 'Your cart')
 
 <script server>
-const { cartTokenFromRequest } = require('../../functions/storefront/cart-cookie')
-// The columns this query selects. bun:sqlite returns `any`, so nothing
-// downstream of the map was checked either.
+// The columns the line query selects.
 interface CartItemRow {
   id: number
   quantity: number | string
@@ -17,46 +15,56 @@ interface CartItemRow {
   weight_grams: number | null
 }
 
+// The column of `carts` this page reads. The query selects `*`.
+interface CartRow {
+  id: number
+}
+
 interface StorefrontLineItem { lineTotal: number }
 
-const Database = require('bun:sqlite').Database
-const path = require('path')
-
-const dbPath = path.resolve(process.cwd(), process.env.DB_DATABASE_PATH || 'database/stacks.sqlite')
-const db = new Database(dbPath, { readonly: true })
-
-const token = cartTokenFromRequest(request)
-let items = []
-let cart = null
-
-if (token) {
-  cart = db.query(`SELECT * FROM carts WHERE session_token = ?1 AND status = 'active' LIMIT 1`).get(token)
-  if (cart) {
-    items = db.query(`
-      SELECT ci.id, ci.quantity, ci.unit_price, ci.total_price, ci.product_name,
-            ci.product_image, ci.product_sku, p.weight_grams
-      FROM cart_items ci
-      LEFT JOIN products p ON p.slug = ci.product_sku
-      WHERE ci.cart_id = ?1
-      ORDER BY ci.id ASC
-    `).all(cart.id).map((row: CartItemRow) => {
-      const qty = Number(row.quantity)
-      const price = Number(row.unit_price)
-      const lineTotal = Number(row.total_price)
-      return {
-        id: row.id,
-        slug: row.product_sku,
-        name: row.product_name,
-        weight: row.weight_grams ? `${row.weight_grams}g` : '',
-        qty,
-        priceLabel: `$${price.toFixed(2)}`,
-        lineTotal,
-        lineTotalLabel: `$${lineTotal.toFixed(2)}`,
-        image: row.product_image,
-      }
+const { verifyCartCookie } = require('../../app/Storefront/CartCookie')
+const { readStorefront } = require('../../app/Storefront/StorefrontDatabase')
+
+// Signed by the storefront actions as the token, a dot and its HMAC. An
+// unsigned or tampered cookie is no cart, and is never looked up.
+const token = verifyCartCookie(requestContext.cookie('stacks_cart'))
+
+const found = token
+  ? readStorefront('views/cart.stx', { cart: null, items: [] }, (db: import('bun:sqlite').Database) => {
+      const row = db.query<CartRow, [string]>(`SELECT * FROM carts WHERE session_token = ?1 AND status = 'active' LIMIT 1`).get(token)
+      if (!row)
+        return { cart: null, items: [] }
+
+      const lines = db.query<CartItemRow, [number]>(`
+        SELECT ci.id, ci.quantity, ci.unit_price, ci.total_price, ci.product_name,
+              ci.product_image, ci.product_sku, p.weight_grams
+        FROM cart_items ci
+        LEFT JOIN products p ON p.slug = ci.product_sku
+        WHERE ci.cart_id = ?1
+        ORDER BY ci.id ASC
+      `).all(row.id).map((line: CartItemRow) => {
+        const qty = Number(line.quantity)
+        const price = Number(line.unit_price)
+        const lineTotal = Number(line.total_price)
+        return {
+          id: line.id,
+          slug: line.product_sku,
+          name: line.product_name,
+          weight: line.weight_grams ? `${line.weight_grams}g` : '',
+          qty,
+          priceLabel: `$${price.toFixed(2)}`,
+          lineTotal,
+          lineTotalLabel: `$${lineTotal.toFixed(2)}`,
+          image: line.product_image,
+        }
+      })
+
+      return { cart: row, items: lines }
     })
-  }
-}
+  : { cart: null, items: [] }
+
+const cart = found.cart
+const items = found.items
 
 // Mirror the rule used by PlaceOrderAction so the price the shopper
 // sees in their cart matches the total they're actually charged. Both

package/resources/views/checkout/contact.stx

@@ -3,45 +3,55 @@
 @section('title', 'Checkout — Contact')
 
 <script server>
-const { cartTokenFromRequest } = require('../../../functions/storefront/cart-cookie')
-// The columns this query selects. bun:sqlite returns `any`, so nothing
-// downstream of the map was checked either.
+// The columns the line query selects.
 interface CartSummaryRow {
   product_name: string
   quantity: number | string
   total_price: number | string
 }
 
+// The columns of `carts` this page reads. The query selects `*`, and no
+// migration creates any but `id` (see app/Storefront/StorefrontDatabase.ts).
+interface CartRow {
+  id: number
+  email: string | null
+}
+
 interface StorefrontLineItem { lineTotal: number }
 
-const Database = require('bun:sqlite').Database
-const path = require('path')
-
-const dbPath = path.resolve(process.cwd(), process.env.DB_DATABASE_PATH || 'database/stacks.sqlite')
-const db = new Database(dbPath, { readonly: true })
-
-const token = cartTokenFromRequest(request)
-let items = []
-let cart = null
-
-if (token) {
-  cart = db.query(`SELECT * FROM carts WHERE session_token = ?1 AND status = 'active' LIMIT 1`).get(token)
-  if (cart) {
-    items = db.query(`
-      SELECT product_name, quantity, total_price
-      FROM cart_items WHERE cart_id = ?1 ORDER BY id ASC
-    `).all(cart.id).map((row: CartSummaryRow) => {
-      const qty = Number(row.quantity)
-      const lineTotal = Number(row.total_price)
-      return {
-        name: row.product_name,
-        qty,
-        lineTotal,
-        lineTotalLabel: `$${lineTotal.toFixed(2)}`,
-      }
+const { verifyCartCookie } = require('../../../app/Storefront/CartCookie')
+const { readStorefront } = require('../../../app/Storefront/StorefrontDatabase')
+
+// Signed by the storefront actions as the token, a dot and its HMAC. An
+// unsigned or tampered cookie is no cart, and is never looked up.
+const token = verifyCartCookie(requestContext.cookie('stacks_cart'))
+
+const found = token
+  ? readStorefront('views/checkout/contact.stx', { cart: null, items: [] }, (db: import('bun:sqlite').Database) => {
+      const row = db.query<CartRow, [string]>(`SELECT * FROM carts WHERE session_token = ?1 AND status = 'active' LIMIT 1`).get(token)
+      if (!row)
+        return { cart: null, items: [] }
+
+      const lines = db.query<CartSummaryRow, [number]>(`
+        SELECT product_name, quantity, total_price
+        FROM cart_items WHERE cart_id = ?1 ORDER BY id ASC
+      `).all(row.id).map((line: CartSummaryRow) => {
+        const qty = Number(line.quantity)
+        const lineTotal = Number(line.total_price)
+        return {
+          name: line.product_name,
+          qty,
+          lineTotal,
+          lineTotalLabel: `$${lineTotal.toFixed(2)}`,
+        }
+      })
+
+      return { cart: row, items: lines }
     })
-  }
-}
+  : { cart: null, items: [] }
+
+const cart = found.cart
+const items = found.items
 
 // Mirror the rule in PlaceOrderAction's _shipping helper so the running
 // totals on every checkout step match what gets charged.

package/resources/views/checkout/payment.stx

@@ -3,45 +3,60 @@
 @section('title', 'Checkout — Payment')
 
 <script server>
-const { cartTokenFromRequest } = require('../../../functions/storefront/cart-cookie')
-// The columns this query selects. bun:sqlite returns `any`, so nothing
-// downstream of the map was checked either.
+// The columns the line query selects.
 interface CartSummaryRow {
   product_name: string
   quantity: number | string
   total_price: number | string
 }
 
+// The columns of `carts` this page reads. The query selects `*`, and no
+// migration creates any but `id` (see app/Storefront/StorefrontDatabase.ts).
+interface CartRow {
+  id: number
+  email: string | null
+  shipping_name: string | null
+  shipping_address: string | null
+  shipping_city: string | null
+  shipping_state: string | null
+  shipping_zip: string | null
+}
+
 interface StorefrontLineItem { lineTotal: number }
 
-const Database = require('bun:sqlite').Database
-const path = require('path')
-
-const dbPath = path.resolve(process.cwd(), process.env.DB_DATABASE_PATH || 'database/stacks.sqlite')
-const db = new Database(dbPath, { readonly: true })
-
-const token = cartTokenFromRequest(request)
-let items = []
-let cart = null
-
-if (token) {
-  cart = db.query(`SELECT * FROM carts WHERE session_token = ?1 AND status = 'active' LIMIT 1`).get(token)
-  if (cart) {
-    items = db.query(`
-      SELECT product_name, quantity, total_price
-      FROM cart_items WHERE cart_id = ?1 ORDER BY id ASC
-    `).all(cart.id).map((row: CartSummaryRow) => {
-      const qty = Number(row.quantity)
-      const lineTotal = Number(row.total_price)
-      return {
-        name: row.product_name,
-        qty,
-        lineTotal,
-        lineTotalLabel: `$${lineTotal.toFixed(2)}`,
-      }
+const { verifyCartCookie } = require('../../../app/Storefront/CartCookie')
+const { readStorefront } = require('../../../app/Storefront/StorefrontDatabase')
+
+// Signed by the storefront actions as the token, a dot and its HMAC. An
+// unsigned or tampered cookie is no cart, and is never looked up.
+const token = verifyCartCookie(requestContext.cookie('stacks_cart'))
+
+const found = token
+  ? readStorefront('views/checkout/payment.stx', { cart: null, items: [] }, (db: import('bun:sqlite').Database) => {
+      const row = db.query<CartRow, [string]>(`SELECT * FROM carts WHERE session_token = ?1 AND status = 'active' LIMIT 1`).get(token)
+      if (!row)
+        return { cart: null, items: [] }
+
+      const lines = db.query<CartSummaryRow, [number]>(`
+        SELECT product_name, quantity, total_price
+        FROM cart_items WHERE cart_id = ?1 ORDER BY id ASC
+      `).all(row.id).map((line: CartSummaryRow) => {
+        const qty = Number(line.quantity)
+        const lineTotal = Number(line.total_price)
+        return {
+          name: line.product_name,
+          qty,
+          lineTotal,
+          lineTotalLabel: `$${lineTotal.toFixed(2)}`,
+        }
+      })
+
+      return { cart: row, items: lines }
     })
-  }
-}
+  : { cart: null, items: [] }
+
+const cart = found.cart
+const items = found.items
 
 const FREE_SHIPPING_THRESHOLD = Number(process.env.STOREFRONT_FREE_SHIPPING_THRESHOLD ?? 40) || 40
 const FLAT_SHIPPING = Number(process.env.STOREFRONT_FLAT_SHIPPING ?? 5) || 5

package/resources/views/checkout/shipping.stx

@@ -3,45 +3,60 @@
 @section('title', 'Checkout — Shipping')
 
 <script server>
-const { cartTokenFromRequest } = require('../../../functions/storefront/cart-cookie')
-// The columns this query selects. bun:sqlite returns `any`, so nothing
-// downstream of the map was checked either.
+// The columns the line query selects.
 interface CartSummaryRow {
   product_name: string
   quantity: number | string
   total_price: number | string
 }
 
+// The columns of `carts` this page reads. The query selects `*`, and no
+// migration creates any but `id` (see app/Storefront/StorefrontDatabase.ts).
+interface CartRow {
+  id: number
+  email: string | null
+  shipping_name: string | null
+  shipping_address: string | null
+  shipping_city: string | null
+  shipping_state: string | null
+  shipping_zip: string | null
+}
+
 interface StorefrontLineItem { lineTotal: number }
 
-const Database = require('bun:sqlite').Database
-const path = require('path')
-
-const dbPath = path.resolve(process.cwd(), process.env.DB_DATABASE_PATH || 'database/stacks.sqlite')
-const db = new Database(dbPath, { readonly: true })
-
-const token = cartTokenFromRequest(request)
-let items = []
-let cart = null
-
-if (token) {
-  cart = db.query(`SELECT * FROM carts WHERE session_token = ?1 AND status = 'active' LIMIT 1`).get(token)
-  if (cart) {
-    items = db.query(`
-      SELECT product_name, quantity, total_price
-      FROM cart_items WHERE cart_id = ?1 ORDER BY id ASC
-    `).all(cart.id).map((row: CartSummaryRow) => {
-      const qty = Number(row.quantity)
-      const lineTotal = Number(row.total_price)
-      return {
-        name: row.product_name,
-        qty,
-        lineTotal,
-        lineTotalLabel: `$${lineTotal.toFixed(2)}`,
-      }
+const { verifyCartCookie } = require('../../../app/Storefront/CartCookie')
+const { readStorefront } = require('../../../app/Storefront/StorefrontDatabase')
+
+// Signed by the storefront actions as the token, a dot and its HMAC. An
+// unsigned or tampered cookie is no cart, and is never looked up.
+const token = verifyCartCookie(requestContext.cookie('stacks_cart'))
+
+const found = token
+  ? readStorefront('views/checkout/shipping.stx', { cart: null, items: [] }, (db: import('bun:sqlite').Database) => {
+      const row = db.query<CartRow, [string]>(`SELECT * FROM carts WHERE session_token = ?1 AND status = 'active' LIMIT 1`).get(token)
+      if (!row)
+        return { cart: null, items: [] }
+
+      const lines = db.query<CartSummaryRow, [number]>(`
+        SELECT product_name, quantity, total_price
+        FROM cart_items WHERE cart_id = ?1 ORDER BY id ASC
+      `).all(row.id).map((line: CartSummaryRow) => {
+        const qty = Number(line.quantity)
+        const lineTotal = Number(line.total_price)
+        return {
+          name: line.product_name,
+          qty,
+          lineTotal,
+          lineTotalLabel: `$${lineTotal.toFixed(2)}`,
+        }
+      })
+
+      return { cart: row, items: lines }
     })
-  }
-}
+  : { cart: null, items: [] }
+
+const cart = found.cart
+const items = found.items
 
 const FREE_SHIPPING_THRESHOLD = Number(process.env.STOREFRONT_FREE_SHIPPING_THRESHOLD ?? 40) || 40
 const FLAT_SHIPPING = Number(process.env.STOREFRONT_FLAT_SHIPPING ?? 5) || 5

package/resources/functions/storefront/cart-cookie.ts

@@ -1,58 +0,0 @@
-/**
- * Read the storefront cart token out of the request.
- *
- * The cart and the three checkout steps each opened with
- *
- *     const token = (typeof requestContext !== 'undefined')
- *       ? requestContext.cookie('stacks_cart')
- *       : null
- *
- * and `requestContext` is not a binding stx has ever put in a server script's
- * scope. It is the NAME OF A PARAMETER inside the template hydrator, and the
- * page context a server assembles carries `params`, `request` and `method`.
- * So the `typeof` guard was always false, `token` was always null, and every
- * one of those pages rendered its empty-cart branch no matter what was in the
- * cart. The guard is what hid it: without it the pages would have thrown on
- * the first request instead of quietly showing nothing.
- *
- * `request` is really provided, so the cookie is read from its header.
- */
-
-/** The cookie the storefront stores its cart session token in. */
-export const CART_COOKIE = 'stacks_cart'
-
-/**
- * The value of `name` in a request's Cookie header, or null.
- *
- * Values are percent-encoded on the way in, so they are decoded here. A
- * malformed encoding yields the raw value rather than throwing, since a
- * cookie is attacker-supplied and a render must not fail on one.
- */
-export function cookieFromRequest(request: Request | undefined, name: string): string | null {
-  const header = request?.headers?.get('cookie')
-  if (!header)
-    return null
-
-  for (const part of header.split(';')) {
-    const index = part.indexOf('=')
-    if (index < 0)
-      continue
-    if (part.slice(0, index).trim() !== name)
-      continue
-
-    const raw = part.slice(index + 1).trim()
-    try {
-      return decodeURIComponent(raw)
-    }
-    catch {
-      return raw
-    }
-  }
-
-  return null
-}
-
-/** The storefront cart token carried by this request, or null. */
-export function cartTokenFromRequest(request: Request | undefined): string | null {
-  return cookieFromRequest(request, CART_COOKIE)
-}