@stacksjs/stx 0.2.170 → 0.2.172

package/dist/expressions.d.ts

@@ -84,27 +84,6 @@ export declare function escapeHtml(unsafe: string): string;
  * or has reactive attributes (@if, @for) with function call expressions
  */
 export declare function usesSignalsInScript(template: string): boolean;
-/**
- * Interpolate server-side `{{ expr }}` / `{!! expr !!}` expressions inside a
- * `<script>` body, using the same evaluator as the main template.
- *
- * This makes server data available to client scripts without manual data-island
- * plumbing — write `const PRICE = {{ car.price }}` and get `const PRICE = 42`.
- *
- * JavaScript-aware rules (different from HTML `{{ }}`):
- *   - `{{ expr }}` → `JSON.stringify(value)`. Strings become valid JS string
- *     literals, numbers/booleans pass through, objects/arrays become JSON
- *     literals. Safe to drop into any JS expression position.
- *   - `{!! expr !!}` → raw `String(value)`. Use when you want the value spliced
- *     verbatim (e.g. you've already serialized it yourself).
- *   - Expressions that fail to evaluate (reference a client-only signal, a
- *     loop variable, or anything not in context) are left **untouched** so the
- *     client runtime can process them later. This mirrors the "preserve for
- *     client" semantics of the main expression processor when signals are in use.
- *
- * Only the content strictly between `<script>` and `</script>` is touched —
- * attributes and surrounding HTML are left alone.
- */
 export declare function interpolateScriptExpressions(scriptBody: string, context: Record<string, any>): string;
 /**
  * Interpolate expressions in a `<script>` tag's ATTRIBUTES.

package/dist/expressions.js

@@ -1,3 +1,4 @@
+import { stripCommentsAndLiterals } from "./strip-literals.js";
 import { createSafeFunction, isExpressionSafe, safeEvaluate } from "./safe-evaluator.js";
 import { createDetailedErrorMessage } from "./utils.js";
 import { createPlaceholder } from "./placeholder.js";
@@ -298,6 +299,16 @@ function expressionUsesOnlyContextVars(expr, context) {
   }
   return !0;
 }
+function expressionReadsServerBinding(expr, context) {
+  const declared = context.__stx_serverDeclared;
+  if (!declared || declared.size === 0)
+    return !1;
+  const searchable = stripCommentsAndLiterals(expr);
+  for (const name of declared)
+    if (new RegExp(`(?<![.#\\w$])${name}(?![\\w$])`).test(searchable))
+      return !0;
+  return !1;
+}
 export function interpolateScriptExpressions(scriptBody, context) {
   let output = scriptBody;
   output = output.replace(/\{!!([\s\S]*?)!!\}/g, (match, expr) => {
@@ -426,7 +437,7 @@ export function processExpressions(template, context, filePath) {
         return match;
       if (hasSignals && !expressionUsesOnlyContextVars(trimmedExpr, context))
         return match;
-      if (value === void 0 && context.__stx_buildMode === "compile" && !hasSignals)
+      if (context.__stx_buildMode === "compile" && !hasSignals && (value === void 0 || expressionReadsServerBinding(trimmedExpr, context)))
         return createPlaceholder("expr", trimmedExpr);
       return value !== void 0 && value !== null ? escapeHtml(String(value)) : "";
     } catch (error) {

package/dist/find-body-tag.js

@@ -1,36 +1,48 @@
 const SKIP_REGIONS = [
-  { open: /<!--/, close: "-->" },
-  { open: /<script\b/i, close: "</script>" },
-  { open: /<style\b/i, close: "</style>" }
-];
+  { open: /<!--/g, close: /-->/g },
+  { open: /<script\b/gi, close: /<\/script\s*>/gi },
+  { open: /<style\b/gi, close: /<\/style\s*>/gi }
+], BODY_OPEN = /<body\b([^>]*)>/gi;
 export function findBodyOpenTag(html) {
-  let cursor = 0;
+  let cursor = 0, bodyMatch;
+  const opens = SKIP_REGIONS.map(() => {
+    return;
+  });
   while (cursor < html.length) {
-    const rest = html.slice(cursor), bodyMatch = /<body\b([^>]*)>/i.exec(rest);
+    if (bodyMatch === void 0 || bodyMatch !== null && bodyMatch.index < cursor) {
+      BODY_OPEN.lastIndex = cursor;
+      bodyMatch = BODY_OPEN.exec(html);
+    }
     if (!bodyMatch)
       return null;
-    const bodyAt = cursor + bodyMatch.index;
-    let nearestSkipAt = -1, nearestClose = "";
-    for (const region of SKIP_REGIONS) {
-      const found = region.open.exec(rest);
+    const bodyAt = bodyMatch.index;
+    let nearestSkipAt = -1, nearestClose = null;
+    for (let i = 0;i < SKIP_REGIONS.length; i++) {
+      const region = SKIP_REGIONS[i];
+      let found = opens[i];
+      if (found === void 0 || found !== null && found.index < cursor) {
+        region.open.lastIndex = cursor;
+        found = region.open.exec(html);
+        opens[i] = found;
+      }
       if (!found)
         continue;
-      const at = cursor + found.index;
-      if (at < bodyAt && (nearestSkipAt === -1 || at < nearestSkipAt)) {
-        nearestSkipAt = at;
+      if (found.index < bodyAt && (nearestSkipAt === -1 || found.index < nearestSkipAt)) {
+        nearestSkipAt = found.index;
         nearestClose = region.close;
       }
     }
-    if (nearestSkipAt === -1)
+    if (nearestSkipAt === -1 || !nearestClose)
       return {
         index: bodyAt,
         tag: bodyMatch[0],
         attrs: bodyMatch[1] ?? ""
       };
-    const closeAt = html.toLowerCase().indexOf(nearestClose, nearestSkipAt);
-    if (closeAt === -1)
+    nearestClose.lastIndex = nearestSkipAt;
+    const closed = nearestClose.exec(html);
+    if (!closed)
       return null;
-    cursor = closeAt + nearestClose.length;
+    cursor = closed.index + closed[0].length;
   }
   return null;
 }

package/dist/index.d.ts

@@ -85,6 +85,12 @@ export { type AnalysisResult } from './analyzer';
 export { type AnalyzeOptions, type ChunkInfo } from './production-build';
 // generateReport moved to stx/visual-testing
 export { fileExists } from './utils';
+// `CompressionOptions` is declared twice — the response compressor's options
+// (`./compression`, what a server tunes) and the production build's
+// (`./production-build`). A wildcard collision exports NEITHER, so the
+// user-facing one is named explicitly here; the build's is reachable from the
+// `stx/production-build` subpath.
+export { type CompressionOptions } from './compression';
 export { type StreamingConfig } from './types';
 export { type Middleware } from './ssr';
 // Re-export the Icon-collection preloader so dev servers (e.g.
@@ -160,6 +166,7 @@ export * from './keep-alive';
 export * from './loops';
 export * from './markdown';
 export * from './middleware';
+export * from './page-action';
 export * from './parser/index';
 export * from './manifest';
 export * from './placeholder';
@@ -196,6 +203,7 @@ export * from './loading-indicator';
 export * from './reactive-bindings';
 export * from './client-helpers';
 export * from './client-script';
+export * from './strip-literals';
 export * from './component-hmr';
 export * from './hydration';
 // ssg moved to stx/ssg

package/dist/index.js

@@ -79,6 +79,7 @@ export * from "./keep-alive.js";
 export * from "./loops.js";
 export * from "./markdown.js";
 export * from "./middleware.js";
+export * from "./page-action.js";
 export * from "./parser/index.js";
 export * from "./manifest.js";
 export * from "./placeholder.js";
@@ -111,6 +112,7 @@ export * from "./loading-indicator.js";
 export * from "./reactive-bindings.js";
 export * from "./client-helpers.js";
 export * from "./client-script.js";
+export * from "./strip-literals.js";
 export * from "./component-hmr.js";
 export * from "./hydration.js";
 export * from "./ssr.js";

package/dist/page-action.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Parse a form submission body into a plain object.
+ *
+ * Handles both encodings a browser form can send: `multipart/form-data` and
+ * `application/x-www-form-urlencoded`. A repeated field name collapses to an
+ * array, so `<input name="tag">` twice reads as `['a', 'b']` rather than
+ * silently keeping only the last one — checkbox groups are the common case.
+ *
+ * File parts are skipped: the value would be a `File`, and a page action that
+ * wants uploads should read `request.formData()` itself rather than have this
+ * hand it something that cannot round-trip into a re-rendered form field.
+ */
+export declare function parseFormBody(request: Request): Promise<Record<string, string | string[]>>;
+/**
+ * Whether this request should run a page action at all.
+ *
+ * GET and HEAD never do — a page action is for submissions, and running one on
+ * a GET would make every page load a mutation.
+ */
+export declare function isActionableMethod(method: string | undefined): boolean;
+/**
+ * Run a page's own `action`, if it declared one, and merge what it returned.
+ *
+ * The action is picked up off the render context rather than parsed out of the
+ * source: the server block has already run by this point, so a declared
+ * `action` is simply there — and it can close over anything else the block
+ * defined, which a regex-extracted function could not.
+ *
+ * Inert on GET and for any page without an action, so a page that does not opt
+ * in pays one `typeof` check.
+ */
+export declare function runPageAction(context: Record<string, any>, options?: RunPageActionOptions): Promise<PageActionResult>;
+/**
+ * The response a redirecting action should produce.
+ *
+ * 303 rather than 302 deliberately: it is the status that makes a browser
+ * follow up with a GET, so a reload or a Back does not resubmit the form.
+ */
+export declare function actionRedirectResponse(to: string): Response;
+/**
+ * A page handling its own form submission (stacksjs/stx#1847).
+ *
+ * A page that declares `action` in its `<script server>` block receives its own
+ * non-GET request. Whatever the action returns is merged into the render
+ * context, so `errors` and `values` repopulate the very same template that drew
+ * the form — one handler for the no-JS submit and the enhanced one, which is
+ * the half of the Laravel/Remix/SvelteKit contract stx was missing.
+ *
+ * ## Why this is a module rather than two implementations
+ *
+ * It shipped in `bun-plugin/src/serve.ts` only, so a form worked under
+ * `buddy dev` and silently did nothing in production — the request fell through
+ * to the ordinary render and answered 200 with the pre-submit markup, which is
+ * indistinguishable from the action having run and found nothing wrong. That is
+ * the same dev-only-correctness shape as `stx typecheck` being stricter than
+ * the editor, and this repo has been bitten repeatedly by two hand-maintained
+ * copies of one rule drifting apart. One module, both servers.
+ */
+/**
+ * Everything an action is given about the request.
+ *
+ * A plain object rather than the `Request` alone, so an action is a pure
+ * function of its inputs and unit-tests without a server around it.
+ */
+export declare interface PageActionContext {
+  request: Request
+  form: Record<string, string | string[]>
+  params: Record<string, string>
+  query: Record<string, unknown>
+  cookies: Record<string, string>
+}
+/** What running an action produced. */
+export declare interface PageActionResult {
+  redirect?: string
+  ran: boolean
+}
+/** Request data a caller has already parsed, if it has. */
+export declare interface RunPageActionOptions {
+  request?: Request
+  method?: string
+  params?: Record<string, string>
+  cookies?: Record<string, string>
+}

package/dist/page-action.js

@@ -0,0 +1,64 @@
+export async function parseFormBody(request) {
+  const type = request.headers.get("content-type") || "", form = {}, put = (key, value) => {
+    const existing = form[key];
+    if (existing === void 0)
+      form[key] = value;
+    else if (Array.isArray(existing))
+      existing.push(value);
+    else
+      form[key] = [existing, value];
+  };
+  if (type.includes("multipart/form-data")) {
+    const data = await request.formData();
+    for (const [key, value] of data.entries())
+      if (typeof value === "string")
+        put(key, value);
+    return form;
+  }
+  if (type.includes("application/x-www-form-urlencoded")) {
+    for (const [key, value] of new URLSearchParams(await request.text()).entries())
+      put(key, value);
+    return form;
+  }
+  return form;
+}
+export function isActionableMethod(method) {
+  if (!method)
+    return !1;
+  const verb = method.toUpperCase();
+  return verb !== "GET" && verb !== "HEAD";
+}
+export async function runPageAction(context, options = {}) {
+  const request = options.request, method = options.method ?? request?.method;
+  if (!request || !isActionableMethod(method))
+    return { ran: !1 };
+  if (typeof context.action !== "function")
+    return { ran: !1 };
+  let form = {};
+  try {
+    form = await parseFormBody(request);
+  } catch {}
+  const result = await context.action({
+    request,
+    form,
+    params: options.params ?? {},
+    query: context.query ?? {},
+    cookies: options.cookies ?? {}
+  });
+  if (result && typeof result === "object") {
+    const to = result.redirect;
+    if (typeof to === "string" && to)
+      return { redirect: to, ran: !0 };
+    Object.assign(context, result);
+  }
+  return { ran: !0 };
+}
+export function actionRedirectResponse(to) {
+  return new Response(null, {
+    status: 303,
+    headers: {
+      Location: to,
+      "Cache-Control": "no-store"
+    }
+  });
+}

package/dist/production-builder.js

@@ -21,6 +21,7 @@ function copyPublicAssets(srcDir, destDir) {
   let copied = 0, bytes = 0;
   if (!fs.existsSync(srcDir))
     return { copied, bytes };
+  fs.mkdirSync(destDir, { recursive: !0 });
   function walk(currentSrc, currentDest) {
     const entries = fs.readdirSync(currentSrc, { withFileTypes: !0 });
     for (const entry of entries) {

package/dist/production-server.js

@@ -7,6 +7,7 @@ import { extractLayoutMetadata } from "./app-shell.js";
 import { pageShipsSignalsRuntime } from "./runtime-injection.js";
 import { patternToRegex } from "stx-router";
 import { compressResponse } from "./compression.js";
+import { actionRedirectResponse, isActionableMethod } from "./page-action.js";
 const MIME_TYPES = {
   ".js": "application/javascript",
   ".mjs": "application/javascript",
@@ -143,7 +144,7 @@ export async function startProductionServer(options = {}) {
             });
           }
         }
-        const compiled = compiledTemplates.get(matchedRoute.pattern);
+        const isMutating = isActionableMethod(request.method), compiled = compiledTemplates.get(matchedRoute.pattern);
         if (!compiled) {
           const errorPage = exactRoutes.get("/500") || null;
           if (errorPage) {
@@ -156,7 +157,7 @@ export async function startProductionServer(options = {}) {
           }
           return new Response("Internal Server Error", { status: 500 });
         }
-        if (!compiled.hasServerScripts && Object.keys(compiled.placeholders).length === 0)
+        if (!isMutating && !compiled.hasServerScripts && Object.keys(compiled.placeholders).length === 0)
           return new Response(compiled.html, {
             headers: {
               "Content-Type": "text/html",
@@ -164,7 +165,13 @@ export async function startProductionServer(options = {}) {
             }
           });
         try {
-          const { html, boundaries } = await hydrateTemplateStream(compiled, { params, request });
+          const { html, boundaries, redirect } = await hydrateTemplateStream(compiled, {
+            params,
+            request,
+            method: request.method
+          });
+          if (redirect)
+            return actionRedirectResponse(redirect);
           if (boundaries && boundaries.length > 0) {
             const { renderStreamingPage, streamToResponse } = await import("./streaming.js");
             return streamToResponse(renderStreamingPage(html, boundaries, { timeoutMs: 30000 }), {