bun-plugin-stx 0.2.155 → 0.2.156

package/dist/{chunk-5pnbtf0j.js → chunk-z66h8w4a.js}

@@ -12,31 +12,50 @@ import path4 from "path";
 // ../router/src/codegen.ts
 import fs from "fs";
 import path from "path";
+
+// ../router/src/page-routes.ts
+var NON_PAGE_DIRS = ["components", "layouts", "partials"];
+function isNonPageRoutePath(relativePath) {
+  const segments = relativePath.split(/[\\/]/).filter(Boolean);
+  return segments.slice(0, -1).some((segment) => NON_PAGE_DIRS.includes(segment));
+}
+function isNonPageRoutePattern(pattern) {
+  return isNonPageRoutePath(pattern.replace(/^\//, ""));
+}
+
+// ../router/src/codegen.ts
 function generateRouteTypes(routes, outputDir) {
-  const lines = [
-    "// Auto-generated by STX - do not edit",
-    'declare module "stx/routes" {',
-    "  interface RouteMap {"
-  ];
-  for (const route of routes) {
-    const paramEntries = [];
-    for (const p of route.params) {
-      const type = route.pattern.includes(`:${p}*`) ? "string[]" : "string";
-      paramEntries.push(`${p}: ${type}`);
+  const pageRoutes = routes.filter((r) => !isNonPageRoutePattern(r.pattern));
+  const lines = ["// Auto-generated by STX - do not edit"];
+  if (pageRoutes.length === 0) {
+    lines.push("// No page routes found \u2014 route paths stay typed as string.", "export {}", "");
+  } else {
+    lines.push(`declare module '@stacksjs/stx' {`, "  interface KnownRoutes {");
+    for (const route of pageRoutes) {
+      const paramEntries = [];
+      for (const p of route.params) {
+        const optional = route.pattern.includes(`:${p}?`) ? "?" : "";
+        paramEntries.push(`${p}${optional}: string`);
+      }
+      const paramsStr = paramEntries.join("; ");
+      lines.push(`    '${route.pattern}': { ${paramsStr} }`);
     }
-    const paramsStr = paramEntries.join("; ");
-    lines.push(`    '${route.pattern}': { ${paramsStr} }`);
+    lines.push("  }", "}", "", "export {}", "");
   }
-  lines.push("  }", "}", "");
-  fs.mkdirSync(outputDir, { recursive: true });
-  fs.writeFileSync(path.join(outputDir, "route-types.d.ts"), lines.join(`
-`));
+  const contents = lines.join(`
+`);
+  const target = path.join(outputDir, "route-types.d.ts");
+  try {
+    if (fs.existsSync(target) && fs.readFileSync(target, "utf8") === contents)
+      return;
+    fs.mkdirSync(outputDir, { recursive: true });
+    fs.writeFileSync(target, contents);
+  } catch {}
 }
 function generateRouteManifest(routes, outputDir, pagesDir) {
   const cwd = process.cwd();
   const relativePages = path.relative(cwd, pagesDir);
-  const excludeDirs = ["components", "layouts", "partials"];
-  const pageRoutes = routes.filter((r) => !excludeDirs.some((dir) => r.pattern.startsWith(`/${dir}/`) || r.pattern === `/${dir}`));
+  const pageRoutes = routes.filter((r) => !isNonPageRoutePattern(r.pattern));
   const lines = [
     "// Auto-generated by stx \u2014 do not edit",
     `// Source: ${relativePages || "pages"}/`,
@@ -155,6 +174,9 @@ function scanDirectory(dir, extensions) {
       if (entry.name.startsWith(".")) {
         continue;
       }
+      if (NON_PAGE_DIRS.includes(entry.name)) {
+        continue;
+      }
       files.push(...scanDirectory(fullPath, extensions));
     } else if (entry.isFile()) {
       const ext = path4.extname(entry.name);
@@ -525,8 +547,8 @@ function createRouteLocation(pathname, params, meta, search = "") {
     meta
   };
 }
-function createMiddlewareContext(to, from, request) {
-  const isServer = typeof window === "undefined";
+function createMiddlewareContext(to, from, request, options) {
+  const isServer = options?.isServer ?? typeof window === "undefined";
   const isClient = !isServer;
   const responseHeaders = new Headers;
   return {
@@ -547,13 +569,22 @@ async function runMiddleware(middlewareNames, context) {
   for (const name of names) {
     const middleware = getMiddleware(name);
     if (!middleware) {
-      console.warn(`Middleware '${name}' not found`);
-      continue;
+      console.error(`Route middleware '${name}' is not registered \u2014 failing the guard closed.`);
+      return {
+        passed: false,
+        abort: {
+          type: "abort",
+          error: {
+            statusCode: 500,
+            message: `Route middleware '${name}' is not registered`
+          }
+        },
+        state: context.state,
+        responseHeaders: context.responseHeaders
+      };
     }
     if (middleware.mode === "server" && !isServer)
       continue;
-    if (middleware.mode === "client" && isServer)
-      continue;
     try {
       const result = await middleware.handler(context);
       if (result) {
@@ -612,11 +643,11 @@ function getRouterScript() {
   const source = `
 ;(function(){
   'use strict';
-  var ROUTER_REV=3;
+  var ROUTER_REV=7;
   if(window.__stxRouter&&window.__stxRouter.__rev===ROUTER_REV)return;
 
   // \u2500\u2500 Configuration \u2500\u2500
-  var defaults={container:'main',loadingClass:'stx-navigating',viewTransitions:true,cache:true,scrollToTop:true,prefetch:true,progress:true,progressColor:'#78dce8',progressHeight:'2px',interceptAllLinks:false,prefetchCacheMax:50};
+  var defaults={container:'main',loadingClass:'stx-navigating',viewTransitions:true,cache:true,scrollToTop:true,prefetch:true,progress:true,progressColor:'#78dce8',progressHeight:'2px',interceptAllLinks:false,prefetchCacheMax:50,routeFocus:true,announceRoute:true,interceptForms:false};
   var o=Object.assign({},defaults,window.__stxRouterConfig||{},window.STX_ROUTER_OPTIONS||{});
   var containerSel=o.container;
   var debug=!!o.debug;
@@ -1127,6 +1158,23 @@ else {
       var wantsFragment=shouldUseFragmentResponse();
       return fetch(url,{headers:wantsFragment?{'X-STX-Router':'true','Accept':'text/html'}:{'Accept':'text/html'}}).then(function(r){
         if(!r.ok)throw new Error(r.status);
+        // A route guard answered with a redirect and fetch followed it
+        // transparently, so r.ok is the DESTINATION's 200 and this markup
+        // belongs to r.url \u2014 not to the path that was requested. Without
+        // retargeting, an auth guard's /login body is swapped in while the
+        // address bar, the history entry and the cache key all still read
+        // /dashboard: the user sees a login form at a URL that claims to be
+        // the page they asked for, and reloading bounces them again (#1849).
+        if(r.redirected&&r.url){
+          var rd=new URL(r.url,location.href);
+          // A guard that sends you off-origin (a hosted IdP) cannot be
+          // resolved by swapping a fragment \u2014 hand it to the browser.
+          if(rd.origin!==location.origin){location.href=r.url;return null}
+          log('[router] guard redirected:',url,'->',rd.pathname);
+          url=rd.pathname+rd.search+rd.hash;
+          targetPath=cacheKey(url);
+          targetHash=rd.hash;
+        }
         // Before anything is parsed or swapped: a fragment from a different
         // build must not be handed to this page's runtime (#1772).
         var incomingBuild=r.headers.get('X-STX-Build')||'';
@@ -1188,6 +1236,60 @@ else {
   // pendingContainerAttrs \u2014 see the note above writeHistory about the cost of
   // adding an argument to swap() and its three call sites (#1807).
   var pendingLayoutDecl=null;
+  // \u2500\u2500 Focus and route announcement \u2500\u2500
+  // A fragment swap replaces content without a document load, so the browser
+  // does none of what it normally does for a navigation. Focus stays on a link
+  // that no longer exists, which the browser resets to <body> \u2014 a keyboard user
+  // is silently returned to the top of the tab order \u2014 and a screen reader says
+  // nothing at all, so there is no signal the page changed. Neither is fixable
+  // from app code, because only the router knows a navigation happened (#1862).
+  function routeAnnouncer(){
+    var el=document.getElementById('stx-route-announcer');
+    if(el)return el;
+    el=document.createElement('div');
+    el.id='stx-route-announcer';
+    el.setAttribute('aria-live','polite');
+    el.setAttribute('role','status');
+    el.setAttribute('aria-atomic','true');
+    // Visually hidden but still ANNOUNCED. display:none and visibility:hidden
+    // are both skipped by screen readers, which would make this a silent no-op
+    // that looks correct in the DOM.
+    el.style.cssText='position:absolute;width:1px;height:1px;margin:-1px;padding:0;overflow:hidden;clip:rect(0 0 0 0);clip-path:inset(50%);white-space:nowrap;border:0';
+    document.body.appendChild(el);
+    return el;
+  }
+
+  function announceRoute(){
+    if(o.announceRoute===false)return;
+    var c=getContainer();
+    var h=c&&c.querySelector?c.querySelector('h1'):null;
+    // The heading names the destination better than the title, which often
+    // carries a site-name suffix. Falls back to the title, then gives up
+    // rather than announcing an empty string.
+    var label=(h&&(h.textContent||'').trim())||document.title||'';
+    if(!label)return;
+    var el=routeAnnouncer();
+    // Cleared first: several screen readers ignore a live-region update whose
+    // text is identical to what is already there, so navigating between two
+    // pages with the same heading would announce only the first.
+    el.textContent='';
+    el.textContent=label;
+  }
+
+  function focusAfterNavigation(hash){
+    if(o.routeFocus===false)return;
+    var target=null;
+    if(hash){try{target=document.querySelector(hash)}catch(e){target=null}}
+    if(!target)target=getContainer();
+    if(!target||!target.focus)return;
+    // The container is not naturally focusable. tabindex="-1" makes it
+    // programmatically focusable without inserting it into the tab order.
+    if(!target.hasAttribute('tabindex'))target.setAttribute('tabindex','-1');
+    // preventScroll because scroll position is already decided just above \u2014
+    // focusing would otherwise fight scrollToTop and the hash scrollIntoView.
+    try{target.focus({preventScroll:true})}catch(e){try{target.focus()}catch(e2){}}
+  }
+
   function swap(html,url,pushState,hash){
     var fragMark=/^<!--stx-fragment(?: rt=([01]))?-->/.exec(html);
     var isFragment=!!fragMark;
@@ -1310,6 +1412,12 @@ else {
         if(o.scrollToTop&&!hash)window.scrollTo({top:0,behavior:'instant'});
         else if(hash){var el=document.querySelector(hash);if(el)el.scrollIntoView({behavior:'smooth'})}
         window.dispatchEvent(new CustomEvent('stx:navigate',{detail:{url:url}}));
+        // Before page scripts run, so a page that focuses its own control on
+        // mount still wins \u2014 its script executes after this.
+        focusAfterNavigation(hash);
+        // Deferred a tick because the title is applied by the caller after this
+        // swap resolves, and the announcement should read the new one.
+        setTimeout(announceRoute,0);
         // Execute page scripts FIRST \u2014 they define setup functions and set _latestSetup
         log('[router] frag scripts:', fragScripts.length);
         document.querySelectorAll('script[data-stx-page]').forEach(function(s){s.remove()});
@@ -1782,16 +1890,66 @@ else {
   }
 
   // \u2500\u2500 Link interception \u2500\u2500
+  // Links the router must never touch, however it found them. This is the
+  // opt-out set, and it is deliberately separate from shouldIntercept's
+  // eligibility rules below: [data-stx-link] is an author saying "this is a
+  // router link", which answers eligibility but must NOT override an explicit
+  // opt-out or a non-navigational scheme.
+  function isRouterExcluded(link){
+    if(!link)return true;
+    var href=link.getAttribute('href');
+    if(!href)return true;
+    if(href.startsWith('http')||href.startsWith('#')||href.startsWith('mailto:')||href.startsWith('tel:')||href.startsWith('javascript:'))return true;
+    if(link.target==='_blank')return true;
+    if(link.hasAttribute('data-stx-no-router')||link.hasAttribute('data-no-router')||link.hasAttribute('download'))return true;
+    return false;
+  }
+
+  // Paths the router can actually render, compiled from the server's own route
+  // table and shipped as regex sources (#1864). Absent when discovery found
+  // nothing, which means UNKNOWN, not "owns nothing" \u2014 treating it as the
+  // latter would disable SPA navigation for a whole site.
+  var ownedRoutes=null;
+  (function(){
+    var raw=o.ownedRoutes;
+    if(!raw||!raw.length)return;
+    var compiled=[];
+    for(var i=0;i<raw.length;i++){
+      try{compiled.push(new RegExp(raw[i]))}
+      catch(e){}
+    }
+    if(compiled.length)ownedRoutes=compiled;
+  })();
+
+  // Does the router own this path? Only meaningful when the route table made it
+  // to the client; otherwise every path is treated as owned, preserving the old
+  // behaviour.
+  function routerOwns(pathname){
+    if(!ownedRoutes)return true;
+    for(var i=0;i<ownedRoutes.length;i++){
+      if(ownedRoutes[i].test(pathname))return true;
+    }
+    return false;
+  }
+
+  // Eligibility for auto-claiming an arbitrary same-origin anchor under
+  // interceptAllLinks. Only reached for anchors the author did not mark.
   function shouldIntercept(link){
-    if(!link)return false;
+    if(isRouterExcluded(link))return false;
     var href=link.getAttribute('href');
-    if(!href)return false;
-    if(href.startsWith('http')||href.startsWith('#')||href.startsWith('mailto:')||href.startsWith('tel:')||href.startsWith('javascript:'))return false;
-    if(link.target==='_blank')return false;
-    if(link.hasAttribute('data-stx-no-router')||link.hasAttribute('data-no-router')||link.hasAttribute('download'))return false;
     if(href.startsWith('?'))return true;
     if(href===location.pathname)return false;
     if(!getContainer())return false;
+    // An endpoint the router cannot render must go to the browser. Claiming it
+    // meant a failed fragment fetch, a fallback navigation, and the endpoint
+    // hit TWICE \u2014 on OAuth redirects, that mints state twice.
+    var path=href;
+    var q=path.indexOf('?');if(q!==-1)path=path.slice(0,q);
+    var h=path.indexOf('#');if(h!==-1)path=path.slice(0,h);
+    if(path.charAt(0)==='/'&&!routerOwns(path)){
+      log('[router] not a known route, leaving to the browser:',href);
+      return false;
+    }
     return true;
   }
 
@@ -1804,6 +1962,10 @@ else {
     if(e.metaKey||e.ctrlKey||e.shiftKey||e.altKey||e.button!==0)return;
     if(!e.target||!e.target.closest)return;
     var link=e.target.closest('[data-stx-link]');
+    // A marked link still has to clear the opt-out set. It used to skip it
+    // entirely, so data-no-router on a [data-stx-link] anchor was silently
+    // ignored and an OAuth redirect got claimed by the router.
+    if(link&&isRouterExcluded(link)){log('[router] excluded:',link.getAttribute('href'));return}
     if(!link&&o.interceptAllLinks){
       var anchor=e.target.closest('a[href]');
       if(anchor&&shouldIntercept(anchor))link=anchor;
@@ -1811,14 +1973,147 @@ else {
     if(!link){return}
     var href=link.getAttribute('href');
     log('[router] click intercepted:',href,'container:',!!getContainer(),'defaultPrevented:',e.defaultPrevented);
-    if(!href||href.startsWith('http')||href.startsWith('#')||href.startsWith('mailto:')||href.startsWith('tel:')){log('[router] skipped:',href);return}
-    if(link.target==='_blank'||link.hasAttribute('download'))return;
     e.preventDefault();
     e.stopPropagation();
     log('[router] navigating to:',href);
     navigate(withCurrentLocale(href));
   },true);
 
+  // \u2500\u2500 Form submission \u2500\u2500
+  // A submit IS a navigation, and the router only ever watched clicks. So any
+  // in-app form tore down the SPA with a full document load and discarded
+  // every signal on the page, and the only way out was a hand-written fetch in
+  // a @submit handler with its own loading and error state.
+  //
+  // Gated exactly like links: a form opts in with data-stx-form, or
+  // interceptForms claims them all \u2014 the same shape as [data-stx-link] /
+  // interceptAllLinks. Deliberately not on by default: a POST has side
+  // effects, so claiming one has to be a decision rather than something that
+  // starts happening on upgrade (#1863).
+  function formAttrOf(form,submitter,submitterAttr,formAttr){
+    // A submit button overrides the form: formaction / formmethod / formenctype.
+    var v=submitter&&submitter.getAttribute?submitter.getAttribute(submitterAttr):null;
+    return (v!==null&&v!==undefined)?v:form.getAttribute(formAttr);
+  }
+
+  function formTargetUrl(form,submitter){
+    return formAttrOf(form,submitter,'formaction','action')||(location.pathname+location.search);
+  }
+
+  function formMethodOf(form,submitter){
+    return String(formAttrOf(form,submitter,'formmethod','method')||'get').toLowerCase();
+  }
+
+  function formExcluded(form,submitter){
+    if(!form||form.tagName!=='FORM')return true;
+    if(form.hasAttribute('data-stx-no-router')||form.hasAttribute('data-no-router'))return true;
+    // A form aimed at another browsing context is not this page's navigation.
+    if(form.target&&form.target!=='_self')return true;
+    try{
+      // Resolving against location handles relative, absolute and foreign
+      // schemes in one step: mailto: parses to a null origin and is excluded.
+      if(new URL(formTargetUrl(form,submitter),location.href).origin!==location.origin)return true;
+    }
+    catch(e){return true}
+    return false;
+  }
+
+  function setFormPending(form,on){
+    if(on){form.classList.add('stx-submitting');form.setAttribute('aria-busy','true')}
+    else{form.classList.remove('stx-submitting');form.removeAttribute('aria-busy')}
+  }
+
+  function submitForm(form,submitter){
+    var method=formMethodOf(form,submitter);
+    var action=formTargetUrl(form,submitter);
+    var fd=new FormData(form);
+    // A named submit button contributes its value, exactly as a native submit
+    // would. FormData does not include it, so multi-button forms (Save vs
+    // Delete) would otherwise lose the one piece of state that distinguishes them.
+    if(submitter&&submitter.name)fd.append(submitter.name,submitter.value||'');
+
+    if(method==='get'){
+      // A GET form is a link whose href the user filled in. Serialise and hand
+      // it to the ordinary navigation path \u2014 no special swap handling, and it
+      // inherits caching, prefetch and the guard-redirect behaviour for free.
+      var qs=new URLSearchParams();
+      fd.forEach(function(v,k){if(typeof v==='string')qs.append(k,v)});
+      var gu=new URL(action,location.href);
+      gu.search=qs.toString();
+      return navigate(gu.pathname+gu.search+gu.hash);
+    }
+
+    setFormPending(form,true);
+    form.dispatchEvent(new CustomEvent('stx:form-submit',{bubbles:true,detail:{action:action,method:method}}));
+
+    var enctype=String(formAttrOf(form,submitter,'formenctype','enctype')||'').toLowerCase();
+    // Respect the declared encoding. Handing FormData to fetch always produces
+    // multipart, which a server expecting urlencoded will read as empty.
+    var body=enctype.indexOf('multipart')===0?fd:new URLSearchParams(fd);
+    var wantsFragment=shouldUseFragmentResponse();
+
+    return fetch(action,{
+      method:method.toUpperCase(),
+      body:body,
+      headers:wantsFragment?{'X-STX-Router':'true','Accept':'text/html'}:{'Accept':'text/html'},
+      credentials:'same-origin',
+    }).then(function(r){
+      // POST/redirect/GET. The server said where the result lives, so go there
+      // through the normal path rather than swapping the POST's body under the
+      // form's own URL \u2014 otherwise reloading re-submits.
+      if(r.redirected&&r.url){
+        var rd=new URL(r.url,location.href);
+        if(rd.origin!==location.origin){location.href=r.url;return}
+        return navigate(rd.pathname+rd.search+rd.hash);
+      }
+      return r.text().then(function(html){
+        var isFrag=wantsFragment&&r.headers.get('X-STX-Fragment')==='true';
+        pendingContainerAttrs=isFrag?(r.headers.get('X-STX-Container-Attrs')||''):'';
+        pendingLayoutDecl=isFrag?null:{layout:r.headers.get('X-STX-Layout')||'',group:r.headers.get('X-STX-Layout-Group')||''};
+        var marked=isFrag?fragmentMarker(r.headers.get('X-STX-Runtime')||'')+html:html;
+        // Deliberately NOT cached: this body is the answer to one POST, and
+        // serving it later for a GET of the same path would be a lie.
+        // 'replace' so re-rendered validation errors do not stack one history
+        // entry per attempt.
+        return Promise.resolve(swap(marked,cacheKey(action),'replace','')).then(function(){
+          applyTitle(r.headers.get('X-STX-Title')||'');
+        });
+      });
+    }).catch(function(err){
+      // No native re-submit on failure: that would send the POST a second time.
+      // The app is told instead, and the form is left intact for a retry.
+      console.error('[router] form submit failed:',err);
+      form.dispatchEvent(new CustomEvent('stx:form-error',{bubbles:true,detail:{error:err,action:action}}));
+    }).finally(function(){setFormPending(form,false)});
+  }
+
+  document.addEventListener('submit',function(e){
+    // Bubble phase, and defaultPrevented is honoured, so a page's own @submit
+    // handler always wins. This is a fallback for forms nobody else claimed,
+    // never an override of one that is already handled.
+    if(e.defaultPrevented)return;
+    var form=e.target;
+    if(!form||form.tagName!=='FORM')return;
+    if(!form.hasAttribute('data-stx-form')&&!form.hasAttribute('data-stx-link')&&!o.interceptForms)return;
+    var submitter=e.submitter||null;
+    if(formExcluded(form,submitter))return;
+    // Without a container there is nothing to swap into, so a native submit is
+    // the only thing that can work.
+    if(!getContainer())return;
+    // Constraint validation has already run by the time submit fires, so an
+    // invalid form never reaches here.
+    e.preventDefault();
+    // A synchronous throw in here would be swallowed by dispatchEvent, and
+    // preventDefault has already run \u2014 so the form would be silently dead with
+    // nothing in the console. Report it and clear the pending state instead.
+    try{submitForm(form,submitter)}
+    catch(err){
+      console.error('[router] form submit failed:',err);
+      setFormPending(form,false);
+      form.dispatchEvent(new CustomEvent('stx:form-error',{bubbles:true,detail:{error:err}}));
+    }
+  });
+
   // \u2500\u2500 Back/forward \u2500\u2500
   window.addEventListener('popstate',function(){
     navigate(location.pathname+location.search+location.hash,false);
@@ -1829,13 +2124,23 @@ else {
     document.addEventListener('mouseover',function(e){
       if(!e.target||!e.target.closest)return;
       var link=e.target.closest('[data-stx-link]');
-      if(!link)return;
+      // Same opt-out set as the click path. Without it, hovering a link the
+      // router is not allowed to claim still fired a real GET at it \u2014 a
+      // logout or OAuth URL was requested on hover alone.
+      if(isRouterExcluded(link))return;
       var href=withCurrentLocale(link.getAttribute('href'));
       var key=cacheKey(href);
       if(cache[key]||prefetching[key])return;
       prefetching[key]=true;
       var wantsFragment=shouldUseFragmentResponse();
       fetch(href,{headers:wantsFragment?{'X-STX-Router':'true','Accept':'text/html'}:{'Accept':'text/html'}}).then(function(r){
+        // Never cache a body that came from somewhere else. A guarded route
+        // prefetched while logged out answers with /login's markup, and
+        // storing it under the guarded key poisons the cache: the later real
+        // navigation is a cache hit, so it swaps the login page in without
+        // ever hitting the network, where the redirect check above would
+        // have caught it (#1849).
+        if(r.redirected)return null;
         var isFrag=wantsFragment&&r.headers.get('X-STX-Fragment')==='true';
         var pLayout=r.headers.get('X-STX-Layout')||'';
         var pGroup=r.headers.get('X-STX-Layout-Group')||'';
@@ -1843,7 +2148,7 @@ else {
         var pRuntime=r.headers.get('X-STX-Runtime')||'';
         return r.text().then(function(html){return{html:isFrag?fragmentMarker(pRuntime)+html:html,layout:pLayout,layoutGroup:pGroup,title:pTitle}});
       }).then(function(result){
-        if(o.cache)setCache(key,result.html,result.layout,result.layoutGroup,result.title);
+        if(result&&o.cache)setCache(key,result.html,result.layout,result.layoutGroup,result.title);
       }).catch(function(){}).finally(function(){delete prefetching[key]});
     },true);
   }
@@ -1943,6 +2248,27 @@ else {
         fetch(url,{headers:wantsFragment?{'X-STX-Router':'true'}:{'Accept':'text/html'}}).then(function(r){var isFrag=wantsFragment&&r.headers.get('X-STX-Fragment')==='true';var pLayout=r.headers.get('X-STX-Layout')||'';var pGroup=r.headers.get('X-STX-Layout-Group')||'';var pTitle=r.headers.get('X-STX-Title')||'';var pRuntime=r.headers.get('X-STX-Runtime')||'';return r.text().then(function(html){return{html:isFrag?fragmentMarker(pRuntime)+html:html,layout:pLayout,layoutGroup:pGroup,title:pTitle}})}).then(function(result){setCache(key,result.html,result.layout,result.layoutGroup,result.title)}).catch(function(){});
       }
     },
+    // Re-run the CURRENT route against the server and swap the result.
+    //
+    // There was no way to do this. invalidate() on a query only re-runs client
+    // fetches, so anything the server rendered \u2014 a list the mutation just
+    // changed, a count in the layout \u2014 could only be refreshed with a full
+    // document load, which discards every signal on the page. That is the
+    // exact thing the SPA exists to avoid, so apps reached for
+    // location.reload() and lost their state (#1850, #1858).
+    //
+    // force:true both evicts the cache entry and defeats navigate's
+    // same-URL early return, so this is exposing behaviour the router already
+    // had rather than adding a second code path. 'replace' because a refresh
+    // is not a new place \u2014 it must not add a history entry you can go Back to.
+    refresh:function(){
+      return navigate(location.pathname+location.search+location.hash,'replace',true);
+    },
+    // Expire ONE entry, so a mutation can invalidate just the page it affected
+    // and let the next visit re-fetch, instead of throwing the whole cache away.
+    invalidate:function(url){
+      evictCache(cacheKey(url||(location.pathname+location.search)));
+    },
     clearCache:function(){for(var k in cache)delete cache[k];for(var lk in layoutCache)delete layoutCache[lk];for(var gk in layoutGroupCache)delete layoutGroupCache[gk];cacheOrder.length=0},
     cache:cache,
     swap:swap,
@@ -1979,6 +2305,8 @@ export {
   navigateTo,
   matchRoute,
   loadMiddlewareFromDirectory,
+  isNonPageRoutePattern,
+  isNonPageRoutePath,
   hasMiddleware,
   getRouterScript,
   getMiddlewareNames,
@@ -2002,5 +2330,6 @@ export {
   clearMiddleware,
   bracketPathToRegex,
   abortNavigation,
-  Router
+  Router,
+  NON_PAGE_DIRS
 };

package/dist/serve.d.ts

@@ -98,7 +98,27 @@ export declare function render404Page(opts: {
   isProduction: boolean
 }): string;
 export declare function resolveServeOpenUrl(port: number, openPath?: string): string;
+/**
+ * Did rendering fail?
+ *
+ * processDirectives swallows a template error and returns an HTML comment as
+ * the entire document. That was then served with the page's own status — 200 —
+ * so a broken page looked healthy to every uptime check, CDN and browser cache
+ * that saw it, and the only evidence was a comment in a blank page
+ * (stacksjs/stx#1854).
+ *
+ * Both other stx servers already get this right: production-server.ts looks up
+ * a /500 route and dev-server/serve-app.ts calls renderErrorPage(500).
+ */
+export declare function isRenderFailure(html: string): boolean;
 export declare function isRenderableCacheCandidate(html: string): boolean;
+/**
+ * A rendered /500 page is usable as an error body only if it exists and did not
+ * ITSELF fail to render — otherwise serving it swaps one blank failure comment
+ * for another. Returns the page to serve, or null to fall through to the next
+ * candidate / the marker body (#1854).
+ */
+export declare function usableErrorPage(rendered: string | null): string | null;
 export declare function bundleBrowserAsset(entrypoint: string): Promise<Response>;
 /**
  * Start the STX development server
@@ -147,7 +167,10 @@ export declare interface ServeRequestContext {
   ip: string
   locale: string | null
   params: Record<string, string>
+  method: string
+  request?: Request
   responseStatus?: number
+  actionRedirect?: string
   [key: string]: unknown
 }
 export declare interface ServeOptions {

package/dist/serve.js

@@ -8718,7 +8718,9 @@ var defaultConfigDir4 = /* @__PURE__ */ resolve12(process20.cwd(), "config");
 var defaultGeneratedDir4 = /* @__PURE__ */ resolve12(process20.cwd(), "src/generated");
 
 // src/serve.ts
-import { BUILD_ID_HEADER, extractPageResponseStatus, getBuildId, stateDir, stateDirName } from "@stacksjs/stx";
+import { BUILD_ID_HEADER, extractPageResponseStatus, findContainerRegion, getBuildId, mergeCrosswindConfig, stateDir, stateDirName } from "@stacksjs/stx";
+import { buildCodeFrame, locateFailureLine } from "@stacksjs/stx/build-message";
+import { clearBundleFailures, getBundleFailures } from "@stacksjs/stx/client-script-bundler";
 var defaultStxModule = import("@stacksjs/stx");
 var REACTIVE_TEMPLATE_DIRECTIVE_RE = /@for|:for|@if|:if|@else|:else|x-for|x-if|x-else/;
 function extractServerScriptsFromTemplate(content) {
@@ -8926,8 +8928,14 @@ function resolveServeOpenUrl(port, openPath = "/") {
     return `${baseUrl}/`;
   }
 }
+function isRenderFailure(html) {
+  return html.includes("<!-- Template Processing failed:") || html.includes("<!-- stx rendering error -->");
+}
 function isRenderableCacheCandidate(html) {
-  return !html.includes("<!-- Template Processing failed:") && !html.includes("<!-- stx rendering error -->");
+  return !isRenderFailure(html);
+}
+function usableErrorPage(rendered) {
+  return rendered && !isRenderFailure(rendered) ? rendered : null;
 }
 var defaultStxConfig = {
   partialsDir: "partials",
@@ -9022,6 +9030,11 @@ async function serve(options) {
     checkEnv: false,
     verbose: false
   });
+  try {
+    const stxMod = options.stxModule ? options.stxModule : await defaultStxModule;
+    if (stxMod && typeof stxMod.resolveStxDirectories === "function")
+      stxMod.resolveStxDirectories(stxConfig, process19.cwd());
+  } catch {}
   try {
     const stxMod = options.stxModule ? options.stxModule : await defaultStxModule;
     if (stxMod && typeof stxMod.loadStxConfig === "function") {
@@ -9081,16 +9094,84 @@ After installing: bun add bun-plugin-stx`);
       }
     }
   }
-  const HMR_CLIENT_SCRIPT = `<script data-stx-hmr>(()=>{if(window.__stxHmr)return;window.__stxHmr=1;function bust(){var ls=document.querySelectorAll('link[rel="stylesheet"]');for(var i=0;i<ls.length;i++){var l=ls[i];var u=new URL(l.href,location.href);u.searchParams.set('v',Date.now().toString(36));l.href=u.toString()}}var es=new EventSource('/_stx/hmr');es.onmessage=function(e){try{var m=JSON.parse(e.data);if(m.type==='reload')location.reload();else if(m.type==='css')bust()}catch(_){}};es.onerror=function(){if(es.readyState===2){setTimeout(function(){location.reload()},400)}}})()</script>`;
+  const HMR_OVERLAY_JS = `
+function __stxEsc(s){return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;')}
+function __stxOverlay(errs){
+  var id='__stx_build_error';
+  var el=document.getElementById(id);
+  if(!errs||!errs.length){if(el&&el.parentNode)el.parentNode.removeChild(el);return}
+  if(!el){el=document.createElement('div');el.id=id;document.body.appendChild(el)}
+  el.setAttribute('style','position:fixed;top:0;left:0;right:0;bottom:0;z-index:2147483647;background:rgba(12,12,14,.98);color:#e8e8ea;font:13px/1.7 ui-monospace,SFMono-Regular,Menlo,monospace;padding:40px 32px;overflow:auto');
+  var w=0,i,j;
+  for(i=0;i<errs.length;i++){var fr=errs[i].frame||[];for(j=0;j<fr.length;j++){var ln=String(fr[j].number).length;if(ln>w)w=ln}}
+  var h='<div style="max-width:1040px;margin:0 auto">';
+  h+='<div style="color:#ff6b6b;font-size:15px;font-weight:600;margin-bottom:6px">Client script failed to bundle</div>';
+  h+='<div style="color:#8b8b95;margin-bottom:28px">The page rendered, but this script shipped unbundled &mdash; its imports did not resolve, so its bindings do nothing.</div>';
+  for(i=0;i<errs.length;i++){
+    var e=errs[i];
+    var where=__stxEsc(e.file||'')+(e.line?':'+e.line+(e.column?':'+e.column:''):'');
+    h+='<div style="margin-bottom:30px">';
+    h+='<div style="color:#ff6b6b;margin-bottom:10px">&#10006; <span style="color:#f2f2f4">'+where+'</span>&nbsp;&nbsp;'+__stxEsc(e.message)+'</div>';
+    var frame=e.frame||[];
+    if(frame.length){
+      h+='<pre style="margin:0;padding:14px 16px;background:#18181c;border-radius:6px;overflow-x:auto">';
+      for(j=0;j<frame.length;j++){
+        var f=frame[j];
+        var n=String(f.number);while(n.length<w)n=' '+n;
+        var style=f.isError?'color:#ffd7d7;background:#3b1e1e;display:block':'color:#8b8b95;display:block';
+        h+='<span style="'+style+'">'+(f.isError?'&gt; ':'&nbsp;&nbsp;')+n+' | '+__stxEsc(f.text)+'</span>';
+      }
+      h+='</pre>';
+    }
+    h+='</div>';
+  }
+  h+='<div style="color:#6b6b75">This clears itself when the bundle succeeds.</div></div>';
+  el.innerHTML=h;
+}
+`;
+  const HMR_CLIENT_SCRIPT = `<script data-stx-hmr>(()=>{if(window.__stxHmr)return;window.__stxHmr=1;${HMR_OVERLAY_JS}function bust(){var ls=document.querySelectorAll('link[rel="stylesheet"]');for(var i=0;i<ls.length;i++){var l=ls[i];var u=new URL(l.href,location.href);u.searchParams.set('v',Date.now().toString(36));l.href=u.toString()}}var es=new EventSource('/_stx/hmr');function swapFragment(){var r=window.stxRouter;if(r&&typeof r.refresh==='function'){try{return r.refresh().then(function(ok){if(!ok)location.reload()},function(){location.reload()})}catch(_){location.reload()}}else{location.reload()}}function reloadStores(){var s=window.stx;if(!s||typeof s.__hmrReplaceStores!=='function'){location.reload();return}fetch('/_stx/stores.js',{cache:'no-store'}).then(function(r){return r.ok?r.text():null}).then(function(code){if(code===null){location.reload();return}s.__hmrReplaceStores(code)}).catch(function(){location.reload()})}es.onmessage=function(e){try{var m=JSON.parse(e.data);if(m.type==='reload')location.reload();else if(m.type==='css')bust();else if(m.type==='fragment')swapFragment();else if(m.type==='store')reloadStores();else if(m.type==='build-error')__stxOverlay(m.errors)}catch(_){}};es.onerror=function(){if(es.readyState===2){setTimeout(function(){location.reload()},400)}}})()</script>`;
   function injectHmrClient(html) {
     if (!html)
       return html;
+    refreshBuildErrors();
     const closeBody = html.lastIndexOf("</body>");
     if (closeBody === -1) {
       return html + HMR_CLIENT_SCRIPT;
     }
     return html.slice(0, closeBody) + HMR_CLIENT_SCRIPT + html.slice(closeBody);
   }
+  let currentBuildErrors = [];
+  async function refreshBuildErrors() {
+    const failures = getBundleFailures();
+    clearBundleFailures();
+    const errors = [];
+    for (const failure of failures) {
+      const details = failure.details?.length ? failure.details : [{ file: failure.filePath, message: failure.message }];
+      for (const detail of details) {
+        let frame = [];
+        let line;
+        if (detail.file) {
+          try {
+            const source = await Bun.file(detail.file).text();
+            line = locateFailureLine(source, detail.lineText);
+            if (line)
+              frame = buildCodeFrame(source, line);
+          } catch {}
+        }
+        errors.push({
+          file: detail.file,
+          line,
+          column: line ? detail.column : undefined,
+          message: detail.message,
+          frame
+        });
+      }
+    }
+    if (JSON.stringify(errors) === JSON.stringify(currentBuildErrors))
+      return;
+    currentBuildErrors = errors;
+    broadcastHmr({ type: "build-error", errors });
+  }
   const watchersStarted = new Set;
   const startWatcher = (dir) => {
     if (watchersStarted.has(dir))
@@ -9114,19 +9195,44 @@ After installing: bun add bun-plugin-stx`);
           htmlCache.clear();
           crosswindCssCache.clear();
           resolvedStxModule?.clearDevCaches?.();
-        }
-        broadcastHmr(isCss && !isStxLike ? { type: "css", file: f } : { type: "reload", file: f });
+          resolvedStxModule?.clearStoreCache?.();
+          resolvedStxModule?.clearComposableCache?.();
+          if (layoutsDir && f.endsWith(".stx") && nodePath.resolve(f).startsWith(nodePath.resolve(layoutsDir)))
+            writeLayoutTypes();
+        }
+        const resolved = nodePath.resolve(dir, f);
+        const isStore = resolved.startsWith(nodePath.resolve(storesDir)) || composableDirs.some((d) => resolved.startsWith(nodePath.resolve(d)));
+        const isLayout = !!layoutsDir && resolved.startsWith(nodePath.resolve(layoutsDir));
+        if (isCss && !isStxLike)
+          broadcastHmr({ type: "css", file: f });
+        else if (isStore)
+          broadcastHmr({ type: "store", file: f });
+        else if (isStxLike && !isLayout)
+          broadcastHmr({ type: "fragment", file: f });
+        else
+          broadcastHmr({ type: "reload", file: f });
       });
       watcher.on("error", () => {});
       watchersStarted.add(dir);
     } catch {}
   };
+  const writeLayoutTypes = async () => {
+    try {
+      const stxMod = options.stxModule ? options.stxModule : await defaultStxModule;
+      stxMod?.generateLayoutTypes?.(layoutsDir, stxMod?.stateDir?.(process19.cwd()));
+    } catch {}
+  };
+  await writeLayoutTypes();
+  const storesDir = nodePath.resolve(stxConfig.root || ".", stxConfig.storesDir || "stores");
+  const composableDirs = stxConfig.composablesDir ? [nodePath.resolve(stxConfig.root || ".", stxConfig.composablesDir)] : ["composables", "functions"].map((d) => nodePath.resolve(stxConfig.root || ".", d));
   for (const dir of [
     componentsDir,
     layoutsDir,
     partialsDir,
     publicDir,
     "resources/assets",
+    storesDir,
+    ...composableDirs,
     ...options.watchDirs ?? []
   ]) {
     if (!dir)
@@ -9414,7 +9520,7 @@ After installing: bun add bun-plugin-stx`);
     pageMiddlewarePatterns.length = 0;
     await Promise.all(files.map((f) => detectPageMiddleware(f)));
     try {
-      const { Router } = await import("./chunk-5pnbtf0j.js");
+      const { Router } = await import("./chunk-z66h8w4a.js");
       const pagesDirs = patterns.map((p) => p.replace(/\/$/, "")).filter(Boolean);
       const router = new Router(process19.cwd(), { pagesDirs, stateDir: stateDirName() });
       if (!options.quiet)
@@ -9537,21 +9643,15 @@ After installing: bun add bun-plugin-stx`);
         });
       }
       const userConfig = await crosswindUserConfigPromise;
-      if (userConfig.safelist) {
-        for (const cls of userConfig.safelist)
-          classes.add(cls);
-      }
+      const merged = mergeCrosswindConfig(cw.config, userConfig);
+      const generatorConfig = merged.config;
+      const { includePreflight, minify } = merged;
+      for (const cls of merged.safelist)
+        classes.add(cls);
       const cacheKey = [...classes].sort().join(" ");
       const cached = crosswindCssCache.get(cacheKey);
       if (cached !== undefined)
         return cached;
-      const generatorConfig = { ...cw.config, preflight: true, minify: false };
-      if (userConfig.shortcuts) {
-        generatorConfig.shortcuts = { ...generatorConfig.shortcuts || {}, ...userConfig.shortcuts };
-      }
-      if (userConfig.theme) {
-        generatorConfig.theme = { ...generatorConfig.theme || {}, ...userConfig.theme };
-      }
       const generator = new cw.CSSGenerator(generatorConfig);
       for (const className of classes) {
         generator.generate(className);
@@ -9565,7 +9665,7 @@ After installing: bun add bun-plugin-stx`);
         for (const p of parts)
           generator.generate(p);
       }
-      const baseCss = generator.toCSS(true, false);
+      const baseCss = generator.toCSS(includePreflight, minify);
       for (const [name, classStr] of Object.entries(shortcuts)) {
         if (!classes.has(name))
           continue;
@@ -9600,12 +9700,65 @@ After installing: bun add bun-plugin-stx`);
       return "";
     }
   }
+  async function parseFormBody(request) {
+    const type = request.headers.get("content-type") || "";
+    const form = {};
+    const put = (key, value) => {
+      const existing = form[key];
+      if (existing === undefined)
+        form[key] = value;
+      else if (Array.isArray(existing))
+        existing.push(value);
+      else
+        form[key] = [existing, value];
+    };
+    if (type.includes("multipart/form-data")) {
+      const data = await request.formData();
+      for (const [key, value] of data.entries()) {
+        if (typeof value === "string")
+          put(key, value);
+      }
+      return form;
+    }
+    if (type.includes("application/x-www-form-urlencoded")) {
+      for (const [key, value] of new URLSearchParams(await request.text()).entries())
+        put(key, value);
+      return form;
+    }
+    return form;
+  }
+  async function runPageAction(context, reqCtx) {
+    if (!reqCtx || reqCtx.method === "GET" || reqCtx.method === "HEAD")
+      return;
+    if (typeof context.action !== "function" || !reqCtx.request)
+      return;
+    let form = {};
+    try {
+      form = await parseFormBody(reqCtx.request);
+    } catch {}
+    const result = await context.action({
+      request: reqCtx.request,
+      form,
+      params: reqCtx.params ?? {},
+      query: context.query ?? {},
+      cookies: reqCtx.cookies ?? {}
+    });
+    if (result && typeof result === "object") {
+      const to = result.redirect;
+      if (typeof to === "string" && to) {
+        reqCtx.actionRedirect = to;
+        return;
+      }
+      Object.assign(context, result);
+    }
+  }
   async function processTemplate(filePath, reqCtx) {
     const content = await Bun.file(filePath).text();
     if (reqCtx)
       reqCtx.responseStatus = extractPageResponseStatus(content) ?? 200;
     const skipCacheHint = /(?:^|[^\w$])__stx_skip_cache\s*=\s*true/.test(content);
-    if (ENABLE_HTML_CACHE && !skipCacheHint) {
+    const isMutating = !!reqCtx && reqCtx.method !== "GET" && reqCtx.method !== "HEAD";
+    if (ENABLE_HTML_CACHE && !skipCacheHint && !isMutating) {
       const cacheKey = htmlCacheKey(filePath, reqCtx);
       const cachedEntry = htmlCache.get(cacheKey);
       if (cachedEntry && await templateSignatureFresh(cachedEntry.signature)) {
@@ -9627,6 +9780,7 @@ After installing: bun add bun-plugin-stx`);
     for (const scriptBody of serverScripts) {
       await extractVariables(scriptBody, context, filePath);
     }
+    await runPageAction(context, reqCtx);
     context.__stx_head_preset = true;
     const config5 = {
       ...defaultConfig4,
@@ -9674,7 +9828,7 @@ After installing: bun add bun-plugin-stx`);
     } else {
       output = output.replace(/<template[^>]*>/gi, "").replace(/<\/template>/gi, "");
     }
-    if (ENABLE_HTML_CACHE && !context.__stx_skip_cache && !skipCacheHint && isRenderableCacheCandidate(output)) {
+    if (ENABLE_HTML_CACHE && !context.__stx_skip_cache && !skipCacheHint && !isMutating && isRenderableCacheCandidate(output)) {
       const signature = await buildTemplateSignature(filePath, dependencies);
       htmlCache.set(htmlCacheKey(filePath, reqCtx), { html: output, signature, status: reqCtx?.responseStatus ?? 200 });
     }
@@ -10046,7 +10200,9 @@ ${html}`;
               cookies: activeServeCookies,
               ip: activeServeIp,
               locale: activeServeLocale,
-              params: {}
+              params: {},
+              method: (req.method || "GET").toUpperCase(),
+              request: req
             };
             try {
               if (req.method === "OPTIONS") {
@@ -10062,6 +10218,11 @@ ${html}`;
                     c.enqueue(hmrEncoder.encode(`data: {"type":"connected"}
 
 `));
+                    if (currentBuildErrors.length > 0) {
+                      c.enqueue(hmrEncoder.encode(`data: ${JSON.stringify({ type: "build-error", errors: currentBuildErrors })}
+
+`));
+                    }
                     keepalive = setInterval(() => {
                       try {
                         c.enqueue(hmrEncoder.encode(`: keepalive
@@ -10102,6 +10263,18 @@ ${html}`;
                   return new Response(null, { headers });
                 return new Response(content2, { headers });
               }
+              if (path === "/_stx/stores.js") {
+                const stx = await stxModule;
+                const code = typeof stx.getStoreScript === "function" ? await stx.getStoreScript() : null;
+                return new Response(code ?? "", {
+                  status: code === null ? 404 : 200,
+                  headers: {
+                    "Content-Type": "application/javascript; charset=utf-8",
+                    "Cache-Control": "no-store",
+                    ...corsHeaders
+                  }
+                });
+              }
               const crosswindAsset = path.match(/^\/_stx\/crosswind\.([a-f0-9]{16})\.css$/);
               if (crosswindAsset) {
                 const stx = await stxModule;
@@ -10280,6 +10453,12 @@ ${html}`;
                 }
               }
               const content = await getRoute(path, reqCtx);
+              if (reqCtx.actionRedirect) {
+                return new Response(null, {
+                  status: 303,
+                  headers: { ...corsHeaders, Location: reqCtx.actionRedirect }
+                });
+              }
               if (content) {
                 const responseStatus = reqCtx.responseStatus ?? 200;
                 const isSpaNav = req.headers.get("X-STX-Router") === "true";
@@ -10319,8 +10498,13 @@ ${html}`;
                       headStyles.push(crosswindLinkMatch[0]);
                     }
                   }
-                  const mainOpenMatch = fragment.match(/<main\b[^>]*>/i);
-                  const mainCloseIdx = fragment.lastIndexOf("</main>");
+                  const containerSelector = stxConfig?.router?.container || "main";
+                  const containerRegion = findContainerRegion(fragment, containerSelector);
+                  if (!containerRegion) {
+                    console.warn(`[stx] No SPA swap container matching "${containerSelector}" in ${new URL(req.url).pathname}. SPA navigation is disabled for links on this page; the full document will load instead. Add a matching element, or point router.container at one this page has.`);
+                  }
+                  const mainOpenMatch = containerRegion ? { 0: containerRegion.openTag, index: containerRegion.openIndex } : null;
+                  const mainCloseIdx = containerRegion ? containerRegion.end : -1;
                   if (mainOpenMatch && mainCloseIdx !== -1) {
                     const bodyMatch = content.match(/<body\b[^>]*>/i);
                     if (bodyMatch) {
@@ -10333,7 +10517,7 @@ ${html}`;
                         headStyles.push(bodyStyleMatch[0]);
                       }
                     }
-                    containerAttrs = mainOpenMatch[0].replace(/^<main\b/i, "").replace(/\/?>$/, "").trim();
+                    containerAttrs = mainOpenMatch[0].replace(new RegExp(`^<${containerRegion.tagName}\\b`, "i"), "").replace(/\/?>$/, "").trim();
                     const mainStart = mainOpenMatch.index + mainOpenMatch[0].length;
                     mainContentStart = mainStart;
                     mainContentEnd = mainCloseIdx;
@@ -10383,7 +10567,7 @@ ${trailingPageScripts.join(`
                   const pageTitle = titleMatch ? titleMatch[1].trim() : "";
                   const shipsRuntime = content.includes("data-stx-runtime");
                   return new Response(fragment, {
-                    status: responseStatus,
+                    status: isRenderFailure(content) ? 500 : responseStatus,
                     headers: {
                       "Content-Type": "text/html; charset=utf-8",
                       "X-STX-Fragment": "true",
@@ -10404,8 +10588,28 @@ ${trailingPageScripts.join(`
                   runtimeCount++;
                   return runtimeCount === 1 ? match : "";
                 });
+                const pageRenderFailed = isRenderFailure(cleaned);
+                if (pageRenderFailed) {
+                  console.error(`[stx] render failed for ${new URL(req.url).pathname} \u2014 serving 500`);
+                  for (const custom500 of ["/500", "/errors/500"]) {
+                    try {
+                      const errorPage = usableErrorPage(await getRoute(custom500, reqCtx));
+                      if (errorPage) {
+                        const isProd2 = isProductionServe();
+                        return new Response(isProd2 ? errorPage : injectHmrClient(errorPage), {
+                          status: 500,
+                          headers: {
+                            "Content-Type": "text/html; charset=utf-8",
+                            "Cache-Control": "no-store",
+                            ...corsHeaders
+                          }
+                        });
+                      }
+                    } catch {}
+                  }
+                }
                 return new Response(injectHmrClient(cleaned), {
-                  status: responseStatus,
+                  status: pageRenderFailed ? 500 : responseStatus,
                   headers: {
                     "Content-Type": "text/html; charset=utf-8",
                     "Cache-Control": "no-store",
@@ -10664,6 +10868,7 @@ if (import.meta.main) {
   main().catch(console.error);
 }
 export {
+  usableErrorPage,
   staticCacheControl,
   serve,
   routeSpecificity,
@@ -10671,6 +10876,7 @@ export {
   render404Page,
   isStaticAssetPath,
   isRenderableCacheCandidate,
+  isRenderFailure,
   isProductionServe,
   extractServerScriptsFromTemplate,
   csrfTokenToMint,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "bun-plugin-stx",
   "type": "module",
-  "version": "0.2.155",
+  "version": "0.2.156",
   "description": "A Bun plugin that allows for using Laravel Blade-like syntax.",
   "author": "Chris Breuer <chris@stacksjs.org>",
   "license": "MIT",