@stacksjs/defaults 0.75.8 → 0.75.10

package/app/Actions/SitemapAction.ts

@@ -1,18 +1,23 @@
 import { Action } from '@stacksjs/actions'
-import { config } from '@stacksjs/config'
+import { resolveDefaultsResources } from '@stacksjs/actions/dev/defaults-resources'
+import { config, feature, overridesReady, resolveViewPatterns } from '@stacksjs/config'
 import { db } from '@stacksjs/database/runtime'
-import { response } from '@stacksjs/router'
+import { mountedDefaultRouteBundles, response } from '@stacksjs/router'
 import { existsSync, readdirSync, statSync } from 'node:fs'
-import { join } from 'node:path'
+import { join, resolve, sep } from 'node:path'
 
 /**
  * Generate the top-level sitemap.xml.
  *
  * Strategy:
- *   1. Walk resources/views and storage/framework/defaults/resources/views
- *      collecting static pages — file paths that don't contain `[`
- *      (dynamic) or `[...]` (catch-all). The static set covers the
- *      home page, /about, /faq, /products listing, etc.
+ *   1. Walk the view roots the views server serves - the app's views, and
+ *      whichever framework default views `ui.defaultViews` and the mounted
+ *      route bundles leave in (`resolveViewPatterns`) - collecting static
+ *      pages: file paths that don't contain `[` (dynamic) or `[...]`
+ *      (catch-all). The static set covers the home page, /about, /faq,
+ *      /products listing, etc. This walked the whole defaults tree whatever
+ *      the app had turned off, so a sitemap could advertise a page the
+ *      server answers 404 for.
  *   2. For dynamic patterns (e.g. resources/views/products/[slug].stx)
  *      fan out using the database — currently the storefront's
  *      `products` table by `slug`. Apps with other dynamic models
@@ -30,7 +35,6 @@ import { join } from 'node:path'
  */
 
 const PROJECT_VIEWS = 'resources/views'
-const FRAMEWORK_VIEWS = 'storage/framework/defaults/resources/views'
 
 // Path prefixes that should never be indexed. Matched as a literal
 // prefix on the URL path (so '/cart' matches '/cart' and '/cart/x').
@@ -151,12 +155,40 @@ async function discoverProducts(): Promise<SitemapEntry[]> {
   }
 }
 
-function staticEntries(): SitemapEntry[] {
+/**
+ * The view roots the views server serves, and the files under them it does
+ * not, resolved exactly as `dev/views.ts` and `production-server.ts` resolve
+ * them. Package view roots are left out: this sitemap never listed them.
+ */
+async function servedViewRoots(): Promise<{ roots: string[], isExcluded: (file: string) => boolean }> {
+  await overridesReady
+  const resolution = resolveViewPatterns(
+    PROJECT_VIEWS,
+    join(resolveDefaultsResources(), 'views'),
+    config.ui?.defaultViews,
+    existsSync,
+    [],
+    mountedDefaultRouteBundles(feature),
+  )
+  const excluded = resolution.exclude.map(entry => resolve(entry))
+  return {
+    roots: resolution.patterns,
+    isExcluded: (file) => {
+      const full = resolve(file)
+      return excluded.some(entry => full === entry || full.startsWith(`${entry}${sep}`))
+    },
+  }
+}
+
+async function staticEntries(): Promise<SitemapEntry[]> {
   const seen = new Set<string>()
   const entries: SitemapEntry[] = []
+  const { roots, isExcluded: isWithheld } = await servedViewRoots()
 
-  for (const root of [PROJECT_VIEWS, FRAMEWORK_VIEWS]) {
+  for (const root of roots) {
     for (const file of walkViews(root)) {
+      if (isWithheld(file))
+        continue
       const urlPath = fileToUrl(root, file)
       if (!urlPath)
         continue
@@ -223,7 +255,7 @@ export default new Action({
   async handle() {
     const siteUrl = (config as any).app?.url || 'http://localhost:3000'
     const all: SitemapEntry[] = [
-      ...staticEntries(),
+      ...(await staticEntries()),
       ...(await discoverProducts()),
     ]
 

package/bootstrap.ts

@@ -23,7 +23,7 @@
 
 import { feature } from '@stacksjs/config'
 import { frameworkPath } from '@stacksjs/path'
-import { route } from '@stacksjs/router'
+import { bundleMounts, DEFAULT_ROUTE_BUNDLE_FEATURES, route } from '@stacksjs/router'
 import MaintenanceMiddleware from './app/Middleware/Maintenance'
 
 // Global maintenance / coming-soon gate. Registered first so the
@@ -59,18 +59,16 @@ const selection = (globalThis as Record<string, unknown>).__stacksDefaultRouteBu
   { bundles: Set<string>, explicit: boolean } | undefined
 
 /**
- * Whether a bundle mounts.
+ * Whether a bundle mounts: named by the app, or, when the app named none, its
+ * feature flag is on.
  *
- * An app that NAMED its bundles has already answered the question, so the
- * feature flag does not get a second veto - otherwise `STACKS_DEFAULT_ROUTES=auth`
- * would still be withheld from an app running with `dashboard` off, which is
- * the exact case this exists for. When nothing was named, the flags gate
- * precisely as they did before.
+ * The rule and the flag each bundle rides on live in the router
+ * (`bundleMounts`, `DEFAULT_ROUTE_BUNDLE_FEATURES`), because the views server
+ * asks the same question from another process - it serves `/login` only when
+ * this file mounts `POST /login` - and two copies of one rule drift.
  */
-function mounts(bundle: string, featureEnabled: boolean): boolean {
-  if (selection && !selection.bundles.has(bundle))
-    return false
-  return selection?.explicit ? true : featureEnabled
+function mounts(bundle: keyof typeof DEFAULT_ROUTE_BUNDLE_FEATURES): boolean {
+  return bundleMounts(selection, bundle, feature(DEFAULT_ROUTE_BUNDLE_FEATURES[bundle]))
 }
 
 // Auth: login, registration, logout, refresh/revoke, passkeys, TOTP 2FA and
@@ -88,7 +86,7 @@ function mounts(bundle: string, featureEnabled: boolean): boolean {
 // `/generate-two-factor-secret`, `/logout-all` and `/auth/tokens` — in apps
 // currently running with `dashboard` off. Widening an app's public surface on
 // upgrade is not something a refactor gets to do silently.
-if (mounts('auth', feature('dashboard')))
+if (mounts('auth'))
   await route.register(frameworkPath('defaults/routes/auth.ts'))
 
 // The rest of dashboard.ts: email subscribe, storefront cart/checkout,
@@ -100,7 +98,7 @@ if (mounts('auth', feature('dashboard')))
 // Apps that need only a slice can also define the routes they want directly
 // in `routes/api.ts` — first-registration-wins means the user version takes
 // priority.
-if (mounts('dashboard', feature('dashboard'))) {
+if (mounts('dashboard')) {
   await route.register(frameworkPath('defaults/routes/dashboard.ts'))
   // JSON endpoints for the dev dashboard UI. Kept separate from the view
   // routes above so the data layer is one obvious file to grep.
@@ -137,21 +135,21 @@ if (mounts('dashboard', feature('dashboard'))) {
 // non-default mount path register their own routes in `routes/api.ts`
 // and the framework's mount silently no-ops since user routes
 // register first.
-if (mounts('email', feature('email'))) {
+if (mounts('email')) {
   await route.register(frameworkPath('defaults/routes/email.ts'))
 }
 
 // Form-builder public endpoints (`@stacksjs/forms`). Gated on the `forms`
 // feature, which defaults OFF - an app opts in with config/forms.ts
 // (`buddy forms:install`) and only then do the public submit routes exist.
-if (mounts('forms', feature('forms'))) {
+if (mounts('forms')) {
   await route.register(frameworkPath('defaults/routes/forms.ts'))
 }
 
 // Courier delivery endpoints: position ingest and the stop/route lifecycle a
 // courier's device drives. Gated with the rest of the commerce surface, since
 // they are meaningless without the delivery models behind them.
-if (mounts('delivery', feature('commerce'))) {
+if (mounts('delivery')) {
   await route.register(frameworkPath('defaults/routes/delivery.ts'))
 }
 

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.75.8",
+  "version": "0.75.10",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.8",
+  "version": "0.75.10",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.27",
-    "@stacksjs/mobile": "^0.75.8",
+    "@stacksjs/mobile": "^0.75.10",
     "@stacksjs/sanitizer": "^0.2.113",
     "ts-qr-codes": "^0.1.8"
   }

package/resources/views/errors/tester.stx

@@ -1,3 +1,19 @@
+<script server>
+/**
+ * A development tool: it lists scenarios that throw on purpose. The routes
+ * that fill it (`/test-error/*`, TestErrorAction) are only mounted for a local
+ * deployment, but the view fallback served this file on its own, so every
+ * deployed app answered 200 at /errors/tester with an empty "Error Page
+ * Tester" shell. Same gate as those routes.
+ */
+import { isLocalDeployment } from '@stacksjs/env'
+
+if (!isLocalDeployment())
+  notFound()
+
+const scenarios = typeof context !== 'undefined' && Array.isArray(context?.scenarios) ? context.scenarios : []
+</script>
+
 <div class="mx-auto px-6 py-12 max-w-3xl">
   <h1 class="mb-2 font-semibold text-3xl text-neutral-950 dark:text-white">Error Page Tester</h1>
   <p class="mb-8 text-neutral-500 text-sm dark:text-neutral-400">