@stacksjs/stx 0.2.176 → 0.2.178

package/dist/crosswind-config.d.ts

@@ -46,6 +46,19 @@ export interface MergedCrosswindConfig {
     includePreflight: boolean;
     /** Honours the user's `minify` key (default false). */
     minify: boolean;
+    /**
+     * The `:root` / `.dark` declarations backing the role tokens (#1930).
+     *
+     * Returned rather than folded into `preflights` because a project can set
+     * `preflight: false`, and the tokens are not preflight — they are the values
+     * the generated utilities resolve against. Callers prepend this to the CSS
+     * they emit.
+     *
+     * Missing it degrades rather than breaks: every token carries its light value
+     * as the `var()` fallback, so light mode stays correct and dark mode reverts
+     * to the light colour.
+     */
+    tokenCSS: string;
 }
 /**
  * Merge a project's crosswind config over the package defaults.

package/dist/crosswind-config.js

@@ -1,3 +1,4 @@
+import { semanticColors, semanticTokenCSS } from "./theme-tokens.js";
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -8,7 +9,9 @@ export function deepMergeThemes(target, source) {
   return out;
 }
 export function mergeCrosswindConfig(base = {}, user = {}) {
-  const baseTheme = base.theme || {}, userTheme = user.theme || {}, { extend: userExtend, ...userThemeKeys } = userTheme, { extend: baseExtend, ...baseThemeKeys } = baseTheme, theme = deepMergeThemes(baseThemeKeys, userThemeKeys), extend = deepMergeThemes(baseExtend || {}, userExtend || {});
+  const baseTheme = base.theme || {}, userTheme = user.theme || {}, { extend: userExtend, ...userThemeKeys } = userTheme, { extend: baseExtend, ...baseThemeKeys } = baseTheme, basePalette = baseThemeKeys.colors || {};
+  baseThemeKeys.colors = { ...basePalette, ...semanticColors(basePalette) };
+  const theme = deepMergeThemes(baseThemeKeys, userThemeKeys), extend = deepMergeThemes(baseExtend || {}, userExtend || {});
   if (Object.keys(extend).length > 0)
     theme.extend = extend;
   const safelist = [
@@ -35,6 +38,7 @@ export function mergeCrosswindConfig(base = {}, user = {}) {
     safelist,
     shortcuts,
     includePreflight: user.preflight !== !1,
-    minify: user.minify === !0
+    minify: user.minify === !0,
+    tokenCSS: semanticTokenCSS(basePalette)
   };
 }

package/dist/dev-server/crosswind.js

@@ -324,7 +324,7 @@ export async function generateCrosswindCSS(htmlContent, appDir) {
         configFingerprint = "unhashable";
       }
     }
-    const baseConfig = hw.defaultConfig || hw.config, userConfig = cachedConfig || {}, merged = mergeCrosswindConfig(baseConfig, userConfig), { safelist, includePreflight, minify } = merged, crosswindConfig = merged.config, generator = new hw.CSSGenerator(crosswindConfig);
+    const baseConfig = hw.defaultConfig || hw.config, userConfig = cachedConfig || {}, merged = mergeCrosswindConfig(baseConfig, userConfig), { safelist, includePreflight, minify, tokenCSS } = merged, crosswindConfig = merged.config, generator = new hw.CSSGenerator(crosswindConfig);
     for (const cls of safelist)
       generator.generate(cls);
     for (const className of classes)
@@ -374,6 +374,7 @@ export async function generateCrosswindCSS(htmlContent, appDir) {
         css += `
 @media (prefers-color-scheme: dark) { .dark .${name} { ${darkDecls.join(" ")} } }`;
     }
+    css = tokenCSS + css;
     setLruCache(cacheKey, css);
     writeDiskCache(cacheKey, css);
     return css;

package/dist/edge-runtime.d.ts

@@ -1,3 +1,4 @@
+import { type SetCookieOptions } from './cookie-serialize';
 /**
  * Detect the current edge runtime platform.
  */
@@ -63,15 +64,7 @@ export declare function parseCookies(request: Request): Record<string, string>;
 /**
  * Create a Set-Cookie header value.
  */
-export declare function createCookie(name: string, value: string, options?: {
-    maxAge?: number
-    expires?: Date
-    path?: string
-    domain?: string
-    secure?: boolean
-    httpOnly?: boolean
-    sameSite?: 'Strict' | 'Lax' | 'None'
-  }): string;
+export declare function createCookie(name: string, value: string, options?: SetCookieOptions): string;
 /**
  * JSON response helper.
  */

package/dist/edge-runtime.js

@@ -1,3 +1,4 @@
+import { serializeSetCookie } from "./cookie-serialize.js";
 import nodeProcess from "node:process";
 export function detectRuntime() {
   if (typeof globalThis < "u" && "caches" in globalThis && "CF" in globalThis)
@@ -500,22 +501,7 @@ export function parseCookies(request) {
   return cookies;
 }
 export function createCookie(name, value, options) {
-  let cookie = `${encodeURIComponent(name)}=${encodeURIComponent(value)}`;
-  if (options?.maxAge !== void 0)
-    cookie += `; Max-Age=${options.maxAge}`;
-  if (options?.expires)
-    cookie += `; Expires=${options.expires.toUTCString()}`;
-  if (options?.path)
-    cookie += `; Path=${options.path}`;
-  if (options?.domain)
-    cookie += `; Domain=${options.domain}`;
-  if (options?.secure)
-    cookie += "; Secure";
-  if (options?.httpOnly)
-    cookie += "; HttpOnly";
-  if (options?.sameSite)
-    cookie += `; SameSite=${options.sameSite}`;
-  return cookie;
+  return serializeSetCookie(name, value, options);
 }
 export function jsonResponse(data, init) {
   const headers = new Headers(init?.headers);

package/dist/index.d.ts

@@ -205,6 +205,8 @@ export * from './client-helpers';
 export * from './client-script';
 export * from './strip-literals';
 export * from './resolve-stx-targets';
+export * from './cookie-serialize';
+export * from './cli-flags';
 export * from './component-hmr';
 export * from './hydration';
 // ssg moved to stx/ssg

package/dist/index.js

@@ -114,6 +114,8 @@ export * from "./client-helpers.js";
 export * from "./client-script.js";
 export * from "./strip-literals.js";
 export * from "./resolve-stx-targets.js";
+export * from "./cookie-serialize.js";
+export * from "./cli-flags.js";
 export * from "./component-hmr.js";
 export * from "./hydration.js";
 export * from "./ssr.js";

package/dist/page-action.d.ts

@@ -1,3 +1,4 @@
+import { type SetCookieOptions } from './cookie-serialize';
 /**
  * Parse a form submission body into a plain object.
  *
@@ -36,26 +37,7 @@ export declare function runPageAction(context: Record<string, any>, options?: Ru
  * 303 rather than 302 deliberately: it is the status that makes a browser
  * follow up with a GET, so a reload or a Back does not resubmit the form.
  */
-export declare function actionRedirectResponse(to: string): Response;
-/**
- * A page handling its own form submission (stacksjs/stx#1847).
- *
- * A page that declares `action` in its `<script server>` block receives its own
- * non-GET request. Whatever the action returns is merged into the render
- * context, so `errors` and `values` repopulate the very same template that drew
- * the form — one handler for the no-JS submit and the enhanced one, which is
- * the half of the Laravel/Remix/SvelteKit contract stx was missing.
- *
- * ## Why this is a module rather than two implementations
- *
- * It shipped in `bun-plugin/src/serve.ts` only, so a form worked under
- * `buddy dev` and silently did nothing in production — the request fell through
- * to the ordinary render and answered 200 with the pre-submit markup, which is
- * indistinguishable from the action having run and found nothing wrong. That is
- * the same dev-only-correctness shape as `stx typecheck` being stricter than
- * the editor, and this repo has been bitten repeatedly by two hand-maintained
- * copies of one rule drifting apart. One module, both servers.
- */
+export declare function actionRedirectResponse(to: string, cookies?: readonly string[]): Response;
 /**
  * Everything an action is given about the request.
  *
@@ -72,6 +54,7 @@ export declare interface PageActionContext {
 /** What running an action produced. */
 export declare interface PageActionResult {
   redirect?: string
+  cookies?: string[]
   ran: boolean
 }
 /** Request data a caller has already parsed, if it has. */
@@ -81,3 +64,10 @@ export declare interface RunPageActionOptions {
   params?: Record<string, string>
   cookies?: Record<string, string>
 }
+/**
+ * A cookie an action wants set on the response.
+ *
+ * A bare string is the whole cookie for the common case; the object form adds
+ * the attributes a session cookie needs.
+ */
+export type PageActionCookie = string | (SetCookieOptions & { value: string });

package/dist/page-action.js

@@ -1,3 +1,4 @@
+import { serializeSetCookie } from "./cookie-serialize.js";
 export async function parseFormBody(request) {
   const type = request.headers.get("content-type") || "", form = {}, put = (key, value) => {
     const existing = form[key];
@@ -46,19 +47,42 @@ export async function runPageAction(context, options = {}) {
     cookies: options.cookies ?? {}
   });
   if (result && typeof result === "object") {
-    const to = result.redirect;
+    const returned = result, cookies = serializeActionCookies(returned.cookies), to = returned.redirect;
     if (typeof to === "string" && to)
-      return { redirect: to, ran: !0 };
-    Object.assign(context, result);
+      return { redirect: to, ran: !0, ...cookies.length > 0 ? { cookies } : {} };
+    const { cookies: _cookies, redirect: _redirect, ...data } = returned;
+    Object.assign(context, data);
+    if (cookies.length > 0)
+      return { ran: !0, cookies };
   }
   return { ran: !0 };
 }
-export function actionRedirectResponse(to) {
-  return new Response(null, {
-    status: 303,
-    headers: {
-      Location: to,
-      "Cache-Control": "no-store"
+function serializeActionCookies(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return [];
+  const headers = [];
+  for (const [name, entry] of Object.entries(value)) {
+    if (!name)
+      continue;
+    if (typeof entry === "string") {
+      headers.push(serializeSetCookie(name, entry));
+      continue;
     }
+    if (entry && typeof entry === "object") {
+      const options = entry;
+      if (typeof options.value !== "string")
+        continue;
+      headers.push(serializeSetCookie(name, options.value, options));
+    }
+  }
+  return headers;
+}
+export function actionRedirectResponse(to, cookies = []) {
+  const headers = new Headers({
+    Location: to,
+    "Cache-Control": "no-store"
   });
+  for (const cookie of cookies)
+    headers.append("Set-Cookie", cookie);
+  return new Response(null, { status: 303, headers });
 }

package/dist/production-server.js

@@ -165,25 +165,26 @@ export async function startProductionServer(options = {}) {
             }
           });
         try {
-          const { html, boundaries, redirect } = await hydrateTemplateStream(compiled, {
+          const { html, boundaries, redirect, cookies } = await hydrateTemplateStream(compiled, {
             params,
             request,
             method: request.method
           });
           if (redirect)
-            return actionRedirectResponse(redirect);
+            return actionRedirectResponse(redirect, cookies);
           if (boundaries && boundaries.length > 0) {
             const { renderStreamingPage, streamToResponse } = await import("./streaming.js");
             return streamToResponse(renderStreamingPage(html, boundaries, { timeoutMs: 30000 }), {
               headers: { "Cache-Control": "no-cache" }
             });
           }
-          return new Response(html, {
-            headers: {
-              "Content-Type": "text/html",
-              "Cache-Control": "no-cache"
-            }
+          const headers = new Headers({
+            "Content-Type": "text/html",
+            "Cache-Control": "no-cache"
           });
+          for (const cookie of cookies ?? [])
+            headers.append("Set-Cookie", cookie);
+          return new Response(html, { headers });
         } catch (error) {
           console.error(`[stx] Hydration error for ${pathname}:`, error);
           return new Response(compiled.html, {