@stacksjs/stx 0.2.169 → 0.2.171

package/dist/state-management.js

@@ -231,8 +231,8 @@ export function createAction(store, name, handler) {
   return async (...params) => {
     const currentState = store.get(), newState = await handler(currentState, ...params);
     store.set(newState);
-    if (typeof window < "u" && window.__STX_DEVTOOLS__)
-      window.__STX_DEVTOOLS__.onAction(store.name || "unnamed", name, params);
+    if (typeof window < "u")
+      window.__STX_DEVTOOLS__?.onAction?.(store.name || "unnamed", name, params);
   };
 }
 export function createActions(store, actions) {

package/dist/strip-literals.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Blank out comments and string literals, keeping every other character where
+ * it was.
+ *
+ * A name mentioned in a comment or inside a string is not a reference to it.
+ * The server-to-client bridge applies this before deciding what a client block
+ * mentions, and `stx typecheck` has to apply exactly the same rule before
+ * reporting what still crosses implicitly — a second copy that disagreed would
+ * make the warning and the runtime describe different sets (#1868 ask 4).
+ *
+ * Lives in its own module for that reason. It was defined inside
+ * `client-script.ts`, and the editor-facing `stx-virtual-ts.ts` cannot import
+ * that without pulling the bundler in behind it; the alternative was a
+ * second implementation, which is the failure this repo keeps repeating.
+ *
+ * Positions are preserved: every blanked character becomes a space and every
+ * newline stays a newline, so an offset into the result is an offset into the
+ * source.
+ *
+ * @module strip-literals
+ */
+/**
+ * Index of the `}` closing an interpolation whose body starts at `start`.
+ *
+ * Literals and comments are skipped whole, so a brace inside them cannot be
+ * mistaken for structure — `` `${ x ? "}" : y }` `` closes at the right place.
+ */
+export declare function findInterpolationEnd(code: string, start: number): number;
+/**
+ * Blank out comments and string literals, preserving length and line structure
+ * so offsets still line up, so that identifier detection only ever sees code.
+ *
+ * Template-literal INTERPOLATIONS are kept, because `${...}` is code, not text.
+ * Blanking them hid every identifier that appears only inside one — a helper
+ * called as `${formatDate(d)}` looked unused to the auto-import scanner, and a
+ * server value read as `` `/api/users/${userId}` `` looked unreferenced to the
+ * data bridge, which would have withheld it and left the client throwing on an
+ * undefined name.
+ */
+export declare function stripCommentsAndLiterals(code: string): string;

package/dist/strip-literals.js

@@ -0,0 +1,149 @@
+function skipQuoted(code, start) {
+  const quote = code[start];
+  let i = start + 1;
+  while (i < code.length) {
+    if (code[i] === "\\") {
+      i += 2;
+      continue;
+    }
+    if (code[i] === quote)
+      return i + 1;
+    i++;
+  }
+  return code.length;
+}
+function skipTemplate(code, start) {
+  let i = start + 1;
+  while (i < code.length) {
+    if (code[i] === "\\") {
+      i += 2;
+      continue;
+    }
+    if (code[i] === "`")
+      return i + 1;
+    if (code[i] === "$" && code[i + 1] === "{") {
+      i = findInterpolationEnd(code, i + 2);
+      if (i < code.length)
+        i++;
+      continue;
+    }
+    i++;
+  }
+  return code.length;
+}
+export function findInterpolationEnd(code, start) {
+  let depth = 1, i = start;
+  while (i < code.length) {
+    const ch = code[i];
+    if (ch === "\\") {
+      i += 2;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      i = skipQuoted(code, i);
+      continue;
+    }
+    if (ch === "`") {
+      i = skipTemplate(code, i);
+      continue;
+    }
+    if (ch === "/" && code[i + 1] === "/") {
+      while (i < code.length && code[i] !== `
+`)
+        i++;
+      continue;
+    }
+    if (ch === "/" && code[i + 1] === "*") {
+      i += 2;
+      while (i < code.length && code.slice(i, i + 2) !== "*/")
+        i++;
+      i += 2;
+      continue;
+    }
+    if (ch === "{") {
+      depth++;
+      i++;
+      continue;
+    }
+    if (ch === "}") {
+      depth--;
+      if (depth === 0)
+        return i;
+      i++;
+      continue;
+    }
+    i++;
+  }
+  return code.length;
+}
+export function stripCommentsAndLiterals(code) {
+  let out = "", i = 0;
+  while (i < code.length) {
+    const two = code.slice(i, i + 2);
+    if (two === "//") {
+      while (i < code.length && code[i] !== `
+`)
+        out += " ", i++;
+      continue;
+    }
+    if (two === "/*") {
+      while (i < code.length && code.slice(i, i + 2) !== "*/")
+        out += code[i] === `
+` ? `
+` : " ", i++;
+      out += "  ";
+      i += 2;
+      continue;
+    }
+    const ch = code[i];
+    if (ch === '"' || ch === "'") {
+      const quote = ch;
+      out += " ";
+      i++;
+      while (i < code.length && code[i] !== quote) {
+        if (code[i] === "\\") {
+          out += "  ";
+          i += 2;
+          continue;
+        }
+        out += code[i] === `
+` ? `
+` : " ";
+        i++;
+      }
+      out += " ";
+      i++;
+      continue;
+    }
+    if (ch === "`") {
+      out += " ";
+      i++;
+      while (i < code.length && code[i] !== "`") {
+        if (code[i] === "\\") {
+          out += "  ";
+          i += 2;
+          continue;
+        }
+        if (code[i] === "$" && code[i + 1] === "{") {
+          const bodyStart = i + 2, bodyEnd = findInterpolationEnd(code, bodyStart);
+          out += "  ";
+          out += stripCommentsAndLiterals(code.slice(bodyStart, bodyEnd));
+          if (bodyEnd < code.length)
+            out += " ";
+          i = bodyEnd + 1;
+          continue;
+        }
+        out += code[i] === `
+` ? `
+` : " ";
+        i++;
+      }
+      out += " ";
+      i++;
+      continue;
+    }
+    out += ch;
+    i++;
+  }
+  return out;
+}

package/dist/stx-virtual-ts.d.ts

@@ -24,6 +24,27 @@ export declare function maskNonTemplateRegions(source: string): string;
  */
 export declare function stripFilterChain(expression: string): string;
 export declare function substituteInterpolations(value: string): string;
+/**
+ * The same substitution, but the result occupies the same space as the source.
+ *
+ * A `<script client>` block may take a server value through an interpolation —
+ * `const duration = {{ duration }}` — and 48 of the framework's own 95
+ * components do exactly that. As TypeScript that is a syntax error, so
+ * `stx typecheck` reported 369 of them across the component library: a parse
+ * failure, which suppresses every real diagnostic in the same file. The gate
+ * was not strict there, it was blind.
+ *
+ * Position-preserving because these are script blocks, not attribute values.
+ * A diagnostic on the line after an interpolation has to keep pointing at the
+ * code the author wrote, so the replacement is padded to the original width and
+ * carries the original newline count. For a single-line interpolation — all but
+ * a handful — every column after it is preserved exactly.
+ *
+ * `0` rather than a named placeholder because it fits in `{{a}}`, the shortest
+ * interpolation anyone writes; a longer identifier could not be padded DOWN to
+ * fit and would shift the line.
+ */
+export declare function substituteInterpolationsInPlace(code: string): string;
 /**
  * Every checkable expression in the markup, with the position it occupies.
  *
@@ -42,6 +63,70 @@ export declare function collectBlockDeclarations(code: string): string[];
 /** Ambient declarations for the globals the stx runtime injects. */
 export declare function runtimeGlobalDeclarations(): string;
 export declare function serverContextDeclarations(): string;
+/**
+ * The names a `defineClientPayload({ … })` call publishes, or `null` when the
+ * page does not declare one.
+ *
+ * Only the keys matter. The runtime captures values, and `extractBridgeData`
+ * publishes the declared set in full and nothing else, so the key set IS the
+ * contract between the two blocks (#1868).
+ *
+ * `null` and `[]` mean different things: `null` is a page that never declared,
+ * and still gets the old name-scraping bridge; `[]` is a page that declared an
+ * empty payload and therefore publishes nothing.
+ */
+export declare function extractClientPayloadNames(serverCode: string): string[] | null;
+/** Top-level `import` statements, and everything else, separated. */
+export declare function splitTopLevelImports(code: string): { imports: string, body: string };
+/**
+ * Declarations that give a client block the server values it is actually given.
+ *
+ * A `<script client>` block is checked in its own buffer, so a name reaching it
+ * through the server-to-client bridge was simply "Cannot find name" — which
+ * means `stx typecheck` reported an error for every page that used the bridge
+ * at all. A checker that invents errors gets muted, and a muted gate catches
+ * nothing.
+ *
+ * The types are inferred rather than guessed. The server block is re-emitted
+ * inside a wrapper function that returns exactly the declared payload, and each
+ * published name is then declared as a lookup into that function's return type,
+ * so `const liveNow = await countLive()` reaches the client block as whatever
+ * `countLive` returns — not `any`, and not a hand-written annotation that can
+ * drift from the code above it (#1868 ask 2).
+ *
+ * Everything is emitted with `var`, `function` and `type`, all of which hoist,
+ * so this appends to the buffer and no line number moves.
+ *
+ * A page that declares nothing still gets its server bindings, as `any`. That
+ * is exactly what the scraping bridge does — publish any server name the client
+ * source mentions — and declaring `any` is the honest description of a value
+ * whose delivery depends on textual reference. Omitting them instead would make
+ * `stx typecheck` report "Cannot find name" on every page that uses the bridge
+ * at all, and a checker that invents errors gets muted.
+ *
+ * So the incentive runs the right way: declare a payload and the names are
+ * checked against the server block, or do not and they are `any`.
+ */
+export declare function clientPayloadDeclarations(serverCode: string): string;
+/**
+ * Server bindings a client block reaches for without a declared payload.
+ *
+ * The scraping bridge publishes a server binding when its name appears as a
+ * free identifier in the client source, so these DO arrive at runtime — they
+ * are just untyped, and their delivery depends on a textual coincidence rather
+ * than on anything the page states. Reporting them is #1868 ask 4, and it is
+ * only worth doing now that ask 2 gives them somewhere to go: warning people
+ * off the implicit path before the typed replacement existed would have been
+ * noise.
+ *
+ * A warning, not an error. These pages work; the fix is mechanical and the
+ * reward is types rather than correctness, so a gate that fails CI over it
+ * would be punishing an app for predating the feature.
+ *
+ * Empty once the page declares a payload, and empty when the client block does
+ * not actually mention any server name.
+ */
+export declare function scrapedBridgeNames(serverCode: string, clientCode: string): string[];
 /**
  * Names declared by both a server block and a client/plain block.
  *
@@ -103,7 +188,11 @@ export declare const UNWRAP_HELPER: '__StxTemplateValue';
  * Mirrors what `serve.ts` puts in scope. Declaring these is what lets the
  * checker report a genuine typo instead of suppressing every unresolved name.
  */
-export declare const STX_SERVER_CONTEXT: readonly ['params', 'query', 'cookies', 'host', 'ip', 'setResponseStatus', 'setResponseHeader', 'notFound', 'request', 'url', 'definePageMeta'];
+export declare const STX_SERVER_CONTEXT: readonly ['params', 'query', 'cookies', 'host', 'ip', 'setResponseStatus', 'setResponseHeader', 'notFound', 'request', 'url', 'definePageMeta', unknown, unknown, 'defineStore'];
+/** Marker comment so a generated preamble is recognisable in a dumped buffer. */
+export declare const PAYLOAD_COMMENT: 'stx: types for the declared client payload (#1868)';
+/** The same, for a page still relying on the name-scraping bridge. */
+export declare const SCRAPED_COMMENT: 'stx: untyped bridge names — declare a defineClientPayload to check these (#1868)';
 /**
  * Names the template engine puts in scope for every page.
  *

package/dist/stx-virtual-ts.js

@@ -1,3 +1,4 @@
+import { stripCommentsAndLiterals } from "./strip-literals.js";
 import { STX_RUNTIME_GLOBALS } from "./runtime-globals.js";
 const SCRIPT_RE = /<script(\s[^>]*)?>([\s\S]*?)<\/script>/gi;
 export function extractScriptBlocks(source) {
@@ -92,6 +93,14 @@ const UNWRAP_HELPER_DECL = `type ${UNWRAP_HELPER}<T> = T extends { readonly _isS
 export function substituteInterpolations(value) {
   return value.replace(/\{\{[\s\S]*?\}\}/g, INTERPOLATION_PLACEHOLDER).replace(/\{!![\s\S]*?!!\}/g, INTERPOLATION_PLACEHOLDER);
 }
+export function substituteInterpolationsInPlace(code) {
+  return code.replace(/\{\{[\s\S]*?\}\}|\{!![\s\S]*?!!\}/g, (match) => {
+    const newlines = match.split(`
+`).length - 1, width = match.length - newlines;
+    return `0${" ".repeat(Math.max(0, width - 1))}${`
+`.repeat(newlines)}`;
+  });
+}
 const NON_EXPRESSION_ATTRS = new Set([
   "x-cloak",
   "x-ref",
@@ -120,7 +129,7 @@ export function extractTemplateExpressions(source) {
   }
   DIRECTIVE_ATTR_RE.lastIndex = 0;
   while ((m = DIRECTIVE_ATTR_RE.exec(masked)) !== null) {
-    const name = m[1], value = m[3] ?? "", base = name.replace(/\..*$/, "");
+    const name = m[1], value = m[3] ?? "", base = name.replace(/\..*$/, "").replace(/^([^:].*?):.*$/, "$1");
     if (NON_EXPRESSION_ATTRS.has(base) || NON_EXPRESSION_ATTRS.has(name))
       continue;
     if (!value.trim())
@@ -229,12 +238,91 @@ export const STX_SERVER_CONTEXT = [
   "notFound",
   "request",
   "url",
-  "definePageMeta"
+  "definePageMeta",
+  "defineClientPayload",
+  "defineStore"
 ];
 export function serverContextDeclarations() {
   return STX_SERVER_CONTEXT.map((name) => `declare var ${name}: any`).join(`
 `);
 }
+export function extractClientPayloadNames(serverCode) {
+  const call = /\bdefineClientPayload\s*\(\s*\{([\s\S]*?)\}\s*\)/g;
+  let match, found = !1;
+  const names = new Set, searchable = stripCommentsAndLiterals(serverCode);
+  while ((match = call.exec(searchable)) !== null) {
+    found = !0;
+    for (const entry of splitPayloadEntries(match[1])) {
+      const name = entry.split(":")[0].trim();
+      if (/^[A-Za-z_$][\w$]*$/.test(name))
+        names.add(name);
+    }
+  }
+  return found ? [...names] : null;
+}
+function splitPayloadEntries(body) {
+  const entries = [];
+  let depth = 0, current = "";
+  for (const char of body) {
+    if (char === "," && depth === 0) {
+      entries.push(current);
+      current = "";
+      continue;
+    }
+    if (char === "(" || char === "[" || char === "{")
+      depth++;
+    else if (char === ")" || char === "]" || char === "}")
+      depth--;
+    current += char;
+  }
+  entries.push(current);
+  return entries.filter((entry) => entry.trim().length > 0);
+}
+export function splitTopLevelImports(code) {
+  const importLine = /^[ \t]*import\b[\s\S]*?(?:from\s*['"][^'"]*['"]|['"][^'"]*['"])[ \t]*;?[ \t]*$/gm, imports = [], body = code.replace(importLine, (statement) => {
+    imports.push(statement.trim());
+    return statement.split(`
+`).map(() => "").join(`
+`);
+  });
+  return { imports: imports.join(`
+`), body };
+}
+export function clientPayloadDeclarations(serverCode) {
+  const published = extractClientPayloadNames(serverCode);
+  if (!published) {
+    const scraped = collectBlockDeclarations(serverCode);
+    if (scraped.length === 0)
+      return "";
+    return [
+      "",
+      `// ${SCRAPED_COMMENT}`,
+      ...scraped.map((name) => `declare var ${name}: any`)
+    ].join(`
+`);
+  }
+  if (published.length === 0)
+    return "";
+  const { imports, body } = splitTopLevelImports(serverCode), scopeBody = body.replace(/^[ \t]*export[ \t]+(?=(?:const|let|var|function|async|class)\b)/gm, ""), parts = [
+    "",
+    `// ${PAYLOAD_COMMENT}`
+  ];
+  if (imports)
+    parts.push(imports);
+  parts.push(`async function ${PAYLOAD_SCOPE}() {`, scopeBody, `  return { ${published.join(", ")} }`, "}", `type ${PAYLOAD_TYPE} = Awaited<ReturnType<typeof ${PAYLOAD_SCOPE}>>`, ...published.map((name) => `declare var ${name}: ${PAYLOAD_TYPE}[${JSON.stringify(name)}]`));
+  return parts.join(`
+`);
+}
+export function scrapedBridgeNames(serverCode, clientCode) {
+  if (extractClientPayloadNames(serverCode) !== null)
+    return [];
+  const searchable = stripCommentsAndLiterals(clientCode);
+  return collectBlockDeclarations(serverCode).filter((name) => {
+    return new RegExp(`(?<![.#\\w$])${name}(?![\\w$])`).test(searchable);
+  });
+}
+export const PAYLOAD_COMMENT = "stx: types for the declared client payload (#1868)", SCRAPED_COMMENT = "stx: untyped bridge names \u2014 declare a defineClientPayload to check these (#1868)";
+const PAYLOAD_SCOPE = "__stxServerScope", PAYLOAD_TYPE = "__StxClientPayload", PAYLOAD_NAMESPACE = "__StxServerBlock";
 export const STX_TEMPLATE_GLOBALS = [
   "$env",
   "$user",

package/dist/template-compiler.js

@@ -5,6 +5,7 @@ import { extractVariables } from "./variable-extractor.js";
 import { createPlaceholder, resetPlaceholders, getPlaceholderRegistry } from "./placeholder.js";
 import { stripDocumentWrapper } from "./app-shell.js";
 import { createHash } from "node:crypto";
+import { collectBlockDeclarations } from "./stx-virtual-ts.js";
 function createRecordingContext(baseContext = {}) {
   const accessedKeys = new Set;
   return { context: new Proxy(baseContext, {
@@ -38,9 +39,10 @@ export async function compileTemplate(filePath, route, options = {}) {
     if (/\bserver\b/.test(attrs))
       serverScriptContent.push(scriptMatch[2]);
   }
-  const { context } = createRecordingContext({
+  const serverDeclared = new Set(serverScriptContent.flatMap((code) => collectBlockDeclarations(code))), { context } = createRecordingContext({
     __filename: absolutePath,
-    __dirname: path.dirname(absolutePath)
+    __dirname: path.dirname(absolutePath),
+    __stx_serverDeclared: serverDeclared
   }), dependencies = new Set, opts = {
     ...defaultConfig,
     ...projectConfig,

package/dist/template-hydrator.d.ts

@@ -20,7 +20,7 @@ export declare function hydrateTemplate(compiled: CompiledTemplate, requestConte
  * templates aren't serialized into the compiled template, so use the function
  * form in production.)
  */
-export declare function hydrateTemplateStream(compiled: CompiledTemplate, requestContext?: Record<string, any>): Promise<{ html: string, boundaries?: { id: string, render: () => Promise<string> }[] }>;
+export declare function hydrateTemplateStream(compiled: CompiledTemplate, requestContext?: Record<string, any>): Promise<{ html: string, boundaries?: { id: string, render: () => Promise<string> }[], redirect?: string }>;
 /**
  * Hydrate a fragment (for SPA navigation).
  * Same as hydrateTemplate but returns the fragment portion.

package/dist/template-hydrator.js

@@ -1,11 +1,15 @@
 import { extractVariables } from "./variable-extractor.js";
 import { evaluateExpression, escapeHtml } from "./expressions.js";
 import { replacePlaceholders, hasPlaceholders } from "./placeholder.js";
+import { runPageAction } from "./page-action.js";
 export async function hydrateTemplate(compiled, requestContext = {}) {
   return (await runHydration(compiled, requestContext)).html;
 }
 export async function hydrateTemplateStream(compiled, requestContext = {}) {
-  const { html, context } = await runHydration(compiled, requestContext), { extractStreamBoundaries } = await import("./streaming.js");
+  const { html, context, redirect } = await runHydration(compiled, requestContext);
+  if (redirect)
+    return { html, redirect };
+  const { extractStreamBoundaries } = await import("./streaming.js");
   let boundaries = extractStreamBoundaries(context);
   const templates = compiled.streamTemplates;
   if (templates && Object.keys(templates).length > 0) {
@@ -34,6 +38,14 @@ async function runHydration(compiled, requestContext) {
     } catch (error) {
       console.warn(`[stx] Server script error in ${compiled.sourceFile}:`, error);
     }
+  const action = await runPageAction(context, {
+    request: requestContext.request,
+    method: requestContext.method,
+    params: requestContext.params ?? {},
+    cookies: requestContext.cookies ?? {}
+  });
+  if (action.redirect)
+    return { html: compiled.html, context, redirect: action.redirect };
   if (!hasPlaceholders(compiled.html))
     return { html: compiled.html, context };
   const values = new Map;

package/dist/typecheck.d.ts

@@ -15,7 +15,7 @@ export type { ScriptBlock, ScriptKind } from './stx-virtual-ts';
  * variable", and those are ordinary names for server-rendered page data. It is
  * appended rather than prepended so the line numbers above it are untouched.
  */
-export declare function buildVirtualSource(block: ScriptBlock): string;
+export declare function buildVirtualSource(block: ScriptBlock, serverCode?: string): string;
 /** Virtual path for a block, stable and traceable back to its origin. */
 export declare function virtualPathFor(filePath: string, kind: DiagnosticOrigin, index: number): string;
 /** Map a virtual path back to the `.stx` file it came from. */

package/dist/typecheck.js

@@ -6,15 +6,20 @@ import {
   buildVirtualTypeScript,
   extractScriptBlocks,
   resolvePosition,
-  serverContextDeclarations
+  clientPayloadDeclarations,
+  scrapedBridgeNames,
+  serverContextDeclarations,
+  substituteInterpolationsInPlace
 } from "./stx-virtual-ts.js";
 export {
   extractScriptBlocks,
   extractTemplateExpressions
 } from "./stx-virtual-ts.js";
-export function buildVirtualSource(block) {
-  return `${(block.startLine > 1 ? `
-`.repeat(block.startLine - 1) : "") + block.code}
+export function buildVirtualSource(block, serverCode = "") {
+  const leadingNewlines = block.startLine > 1 ? `
+`.repeat(block.startLine - 1) : "", code = substituteInterpolationsInPlace(block.code), payload = block.kind === "client" || block.kind === "plain" ? clientPayloadDeclarations(serverCode) : "";
+  return `${leadingNewlines + code}
+${payload}
 export {}
 `;
 }
@@ -35,7 +40,7 @@ export function findRuntimeTypeDeclarations() {
 }
 const TSC_LINE_RE = /^(.*?)\((\d+),(\d+)\):\s+(error|warning)\s+TS(\d+):\s+(.*)$/;
 export async function typecheckStxFiles(files, options = {}) {
-  const checkClient = options.client !== !1, checkServer = options.server !== !1, checkTemplates = options.templates !== !1, virtualFiles = new Map, checkedFiles = [];
+  const checkClient = options.client !== !1, checkServer = options.server !== !1, checkTemplates = options.templates !== !1, virtualFiles = new Map, scrapedByFile = new Map, checkedFiles = [];
   let blockCount = 0, expressionCount = 0;
   const runtimeTypes = findRuntimeTypeDeclarations();
   for (const file of files) {
@@ -45,7 +50,14 @@ export async function typecheckStxFiles(files, options = {}) {
       if (b.kind === "client")
         return checkClient;
       return !1;
-    }), templateBuffer = checkTemplates ? buildVirtualTypeScript(source, { runtimeGlobals: !runtimeTypes }) : null, expressions = templateBuffer ? [...templateBuffer.lineMap.values()].filter((m) => m.expression).length : 0;
+    }), serverCode = extractScriptBlocks(source).filter((block) => block.kind === "server").map((block) => block.code).join(`
+`);
+    if (checkClient && serverCode) {
+      const clientBlocks = blocks.filter((block) => block.kind === "client"), names = [...new Set(clientBlocks.flatMap((block) => scrapedBridgeNames(serverCode, block.code)))];
+      if (names.length > 0)
+        scrapedByFile.set(file, { names, line: clientBlocks[0].startLine });
+    }
+    const templateBuffer = checkTemplates ? buildVirtualTypeScript(source, { runtimeGlobals: !runtimeTypes }) : null, expressions = templateBuffer ? [...templateBuffer.lineMap.values()].filter((m) => m.expression).length : 0;
     if (blocks.length === 0 && expressions === 0)
       continue;
     checkedFiles.push(file);
@@ -53,7 +65,7 @@ export async function typecheckStxFiles(files, options = {}) {
     expressionCount += expressions;
     blocks.forEach((block, i) => {
       virtualFiles.set(virtualPathFor(file, block.kind, i), {
-        source: buildVirtualSource(block),
+        source: buildVirtualSource(block, serverCode),
         origin: file,
         kind: block.kind
       });
@@ -122,6 +134,8 @@ export async function typecheckStxFiles(files, options = {}) {
       const at = resolvePosition(entry.virtual, line, column);
       if (!at?.expression)
         continue;
+      if (Number(code) === 2774)
+        continue;
       line = at.line;
       column = at.column;
       expression = at.expression.code.trim();
@@ -137,6 +151,20 @@ export async function typecheckStxFiles(files, options = {}) {
       expression
     });
   }
+  if (checkClient)
+    for (const [file, scraped] of scrapedByFile) {
+      if (scraped.names.length === 0)
+        continue;
+      diagnostics.push({
+        file,
+        line: scraped.line,
+        column: 1,
+        code: 0,
+        message: `${scraped.names.length === 1 ? "1 value reaches" : `${scraped.names.length} values reach`} this block on the implicit bridge and ${scraped.names.length === 1 ? "is" : "are"} untyped: ${scraped.names.join(", ")}. Declare them with defineClientPayload({ ${scraped.names.join(", ")} }) in the server block to have them checked.`,
+        category: "warning",
+        blockKind: "client"
+      });
+    }
   const seen = new Set, unique = diagnostics.filter((d) => {
     const key = `${d.file}:${d.line}:${d.column}:${d.code}:${d.message}`;
     if (seen.has(key))

package/dist/types/config-types.d.ts

@@ -344,6 +344,16 @@ export interface StrictModeConfig {
     failOnViolation?: boolean;
     /** Pattern strings to allow through validation (matched against message or regex source) */
     allowPatterns?: string[];
+    /**
+     * What to do when a `<script client>` block does not bundle.
+     *
+     * `'warn'` (default) ships the ORIGINAL, unbundled source so the page still
+     * renders — right for a dev server, and why the error overlay exists.
+     * `'error'` refuses instead, for anyone who would rather nothing rendered
+     * than a page whose bindings quietly do nothing. `stx build` fails on a
+     * bundle error either way. See #1884.
+     */
+    bundlerFallback?: 'warn' | 'error';
 }
 /**
  * Real-time broadcasting configuration.
@@ -655,9 +665,6 @@ export interface StxConfig {
      * rendered than a page whose bindings quietly do nothing. `stx build` fails on
      * a bundle error either way. See #1884.
      */
-    strict?: {
-        bundlerFallback?: 'warn' | 'error';
-    };
     /** Directory to store cached templates, defaults to `cache` inside `stateDir` */
     cachePath: string;
     /** Custom directives registered by the user */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@stacksjs/stx",
   "type": "module",
-  "version": "0.2.169",
+  "version": "0.2.171",
   "description": "A performant UI Framework. Powered by Bun.",
   "author": "Chris Breuer <chris@stacksjs.org>",
   "license": "MIT",
@@ -117,12 +117,12 @@
   "dependencies": {
     "@cwcss/crosswind": "^0.2.14",
     "@stacksjs/clapp": "^0.2.0",
-    "@stacksjs/desktop": "0.2.169",
-    "@stacksjs/sanitizer": "0.2.169",
+    "@stacksjs/desktop": "0.2.171",
+    "@stacksjs/sanitizer": "0.2.171",
     "@stacksjs/ts-i18n": "^0.1.11",
-    "bun-plugin-stx": "0.2.169",
+    "bun-plugin-stx": "0.2.171",
     "bunfig": "^0.15.17",
-    "stx-router": "0.2.169",
+    "stx-router": "0.2.171",
     "ts-broadcasting": "^0.0.9",
     "ts-images": "^0.1.9",
     "ts-syntax-highlighter": "^0.2.1"