@stacknet/stacks 0.2.0 → 0.2.2

package/src/proxy/route-handlers.ts

@@ -1,1107 +0,0 @@
-/**
- * Next.js API Route Handler Factories
- *
- * Create pre-configured route handlers for common patterns.
- *
- * SECURITY NOTES
- * - Every path-position parameter is run through `validateId` before being
- *   interpolated into the upstream path. Without this, characters like `?`,
- *   `&`, `#`, or `/` in an id would smuggle extra query params or escape
- *   the intended namespace.
- * - Every factory supports `extractAuth`; the forwarder receives an
- *   `Authorization` header so the upstream can attribute the request to
- *   the real caller instead of treating it as anonymous.
- */
-
-import { forwardRequest, forwardJSON, type ForwarderConfig } from './forwarder';
-
-export interface RouteHandlerConfig extends ForwarderConfig {
-  requireAuth?: boolean;
-  enrichResponse?: (data: unknown) => Promise<unknown>;
-  /** Extract the caller's bearer token from the incoming Request and
-   *  forward it upstream as `Authorization: Bearer <token>`. If unset,
-   *  the handler passes through any inbound `Authorization` header
-   *  verbatim. Without one of these the upstream sees no auth at all. */
-  extractAuth?: (request: Request) => string | null;
-}
-
-export type RouteHandler = (request: Request, context?: { params?: Record<string, string> }) => Promise<Response>;
-
-export interface CRUDRouteHandlers {
-  GET: RouteHandler;
-  POST: RouteHandler;
-  PUT?: RouteHandler;
-  DELETE?: RouteHandler;
-}
-
-/** Back-compat: `StackRouteHandlerConfig` used to be distinct; now every
- *  factory accepts `extractAuth`, so the two configs are identical. */
-export type StackRouteHandlerConfig = RouteHandlerConfig;
-
-// ----------------------------------------------------------------------------
-// Shared helpers
-// ----------------------------------------------------------------------------
-
-/** Validate that an id/param is a safe alphanumeric/dash/underscore/dot string.
- *  Blocks path traversal (`..`, `/`), query smuggling (`?`, `&`, `#`), and
- *  header injection (`\r`, `\n`) in one shot. */
-function validateId(id: string | null | undefined, name: string): string {
-  if (!id || typeof id !== 'string') {
-    throw new Error(`Missing required parameter: ${name}`);
-  }
-  if (!/^[\w.\-]+$/.test(id)) {
-    throw new Error(`Invalid ${name}: contains disallowed characters`);
-  }
-  return id;
-}
-
-/** Convert a thrown validation error into a 400 response so handlers don't
- *  have to pepper try/catch everywhere. */
-function badRequest(err: unknown): Response {
-  const message = err instanceof Error ? err.message : 'Bad request';
-  return Response.json({ error: message }, { status: 400 });
-}
-
-function authHeaders(config: RouteHandlerConfig, request: Request): Record<string, string> {
-  const headers: Record<string, string> = {};
-  if (config.extractAuth) {
-    const token = config.extractAuth(request);
-    if (token) headers['Authorization'] = `Bearer ${token}`;
-  } else {
-    const auth = request.headers.get('Authorization');
-    if (auth) headers['Authorization'] = auth;
-  }
-  return headers;
-}
-
-/** Pull an id from the Next-style context first, then fall back to the
- *  last path segment. Runs through validateId either way. */
-function idFromContext(
-  request: Request,
-  context: { params?: Record<string, string | undefined> } | undefined,
-  key: string,
-  segmentFromEnd = 1,
-): string {
-  const fromCtx = context?.params?.[key];
-  if (fromCtx) return validateId(fromCtx, key);
-  const segs = new URL(request.url).pathname.split('/').filter(Boolean);
-  const candidate = segs[segs.length - segmentFromEnd];
-  return validateId(candidate, key);
-}
-
-// ============================================================================
-// Agent Route Handlers
-// ============================================================================
-
-/**
- * Create agent route handlers
- */
-export function createAgentRoutes(config: RouteHandlerConfig = {}): CRUDRouteHandlers {
-  const baseUrl = config.baseUrl;
-
-  return {
-    GET: async (request: Request) => {
-      const url = new URL(request.url);
-      const userMid = url.searchParams.get('userMid');
-      const visibility = url.searchParams.get('visibility');
-
-      const path = userMid
-        ? `/agents?creator_mid=${encodeURIComponent(userMid)}`
-        : visibility
-          ? `/agents?visibility=${encodeURIComponent(visibility)}`
-          : '/agents';
-
-      const { data, status } = await forwardJSON(
-        path,
-        { headers: authHeaders(config, request) },
-        { baseUrl },
-      );
-
-      let responseData = data;
-      if (config.enrichResponse) {
-        responseData = await config.enrichResponse(data);
-      }
-
-      return Response.json(responseData, { status });
-    },
-
-    POST: async (request: Request) => {
-      const body = await request.json();
-      const { data, status } = await forwardJSON(
-        '/agents',
-        { method: 'POST', body, headers: authHeaders(config, request) },
-        { baseUrl }
-      );
-      return Response.json(data, { status });
-    },
-  };
-}
-
-/**
- * Create agent detail route handlers (for [id] routes)
- */
-export function createAgentDetailRoutes(config: RouteHandlerConfig = {}): CRUDRouteHandlers {
-  const baseUrl = config.baseUrl;
-
-  return {
-    GET: async (request: Request, context?: { params?: { id?: string } }) => {
-      let id: string;
-      try { id = idFromContext(request, context, 'id'); } catch (e) { return badRequest(e); }
-      const { data, status } = await forwardJSON(
-        `/agents/${id}`,
-        { headers: authHeaders(config, request) },
-        { baseUrl },
-      );
-
-      let responseData = data;
-      if (config.enrichResponse) {
-        responseData = await config.enrichResponse(data);
-      }
-
-      return Response.json(responseData, { status });
-    },
-
-    POST: async (request: Request, context?: { params?: { id?: string } }) => {
-      let id: string;
-      try { id = idFromContext(request, context, 'id'); } catch (e) { return badRequest(e); }
-      const body = await request.json();
-      const { data, status } = await forwardJSON(
-        `/agents/${id}`,
-        { method: 'POST', body, headers: authHeaders(config, request) },
-        { baseUrl }
-      );
-      return Response.json(data, { status });
-    },
-
-    PUT: async (request: Request, context?: { params?: { id?: string } }) => {
-      let id: string;
-      try { id = idFromContext(request, context, 'id'); } catch (e) { return badRequest(e); }
-      const body = await request.json();
-      const { data, status } = await forwardJSON(
-        `/agents/${id}`,
-        { method: 'PUT', body, headers: authHeaders(config, request) },
-        { baseUrl }
-      );
-      return Response.json(data, { status });
-    },
-
-    DELETE: async (request: Request, context?: { params?: { id?: string } }) => {
-      let id: string;
-      try { id = idFromContext(request, context, 'id'); } catch (e) { return badRequest(e); }
-      const { data, status } = await forwardJSON(
-        `/agents/${id}`,
-        { method: 'DELETE', headers: authHeaders(config, request) },
-        { baseUrl }
-      );
-      return Response.json(data, { status });
-    },
-  };
-}
-
-/**
- * Create agent execute route handler
- */
-export function createAgentExecuteRoute(config: RouteHandlerConfig = {}): { POST: RouteHandler } {
-  const baseUrl = config.baseUrl;
-
-  return {
-    POST: async (request: Request, context?: { params?: { id?: string } }) => {
-      let id: string;
-      try { id = idFromContext(request, context, 'id', 2); } catch (e) { return badRequest(e); }
-      const body = await request.json();
-
-      const response = await forwardRequest(
-        `/agents/${id}/execute`,
-        { method: 'POST', body, stream: true, headers: authHeaders(config, request) },
-        { baseUrl }
-      );
-
-      // Check if streaming
-      const contentType = response.headers.get('content-type') || '';
-      if (contentType.includes('text/event-stream') && response.body) {
-        return new Response(response.body, {
-          status: response.status,
-          headers: {
-            'Content-Type': 'text/event-stream',
-            'Cache-Control': 'no-cache',
-            'Connection': 'keep-alive',
-          },
-        });
-      }
-
-      const data = await response.json();
-      return Response.json(data, { status: response.status });
-    },
-  };
-}
-
-/**
- * Create agent enable/disable route handlers
- */
-export function createAgentToggleRoutes(config: RouteHandlerConfig = {}): {
-  enable: { POST: RouteHandler };
-  disable: { POST: RouteHandler };
-} {
-  const baseUrl = config.baseUrl;
-
-  return {
-    enable: {
-      POST: async (request: Request, context?: { params?: { id?: string } }) => {
-        let id: string;
-        try { id = idFromContext(request, context, 'id', 2); } catch (e) { return badRequest(e); }
-        const { data, status } = await forwardJSON(
-          `/agents/${id}/enable`,
-          { method: 'POST', headers: authHeaders(config, request) },
-          { baseUrl }
-        );
-        return Response.json(data, { status });
-      },
-    },
-    disable: {
-      POST: async (request: Request, context?: { params?: { id?: string } }) => {
-        let id: string;
-        try { id = idFromContext(request, context, 'id', 2); } catch (e) { return badRequest(e); }
-        const { data, status } = await forwardJSON(
-          `/agents/${id}/disable`,
-          { method: 'POST', headers: authHeaders(config, request) },
-          { baseUrl }
-        );
-        return Response.json(data, { status });
-      },
-    },
-  };
-}
-
-// ============================================================================
-// Skill Route Handlers
-// ============================================================================
-
-/**
- * Create skill route handlers
- */
-export function createSkillRoutes(config: RouteHandlerConfig = {}): CRUDRouteHandlers {
-  const baseUrl = config.baseUrl;
-
-  return {
-    GET: async (request: Request) => {
-      const url = new URL(request.url);
-      const scope = url.searchParams.get('scope');
-      const creatorMid = url.searchParams.get('creator_mid');
-
-      let path = '/skills';
-      if (scope) path += `?scope=${encodeURIComponent(scope)}`;
-      else if (creatorMid) path += `?creator_mid=${encodeURIComponent(creatorMid)}`;
-
-      const { data, status } = await forwardJSON(
-        path,
-        { headers: authHeaders(config, request) },
-        { baseUrl },
-      );
-      return Response.json(data, { status });
-    },
-
-    POST: async (request: Request) => {
-      const body = await request.json();
-      const { data, status } = await forwardJSON(
-        '/skills',
-        { method: 'POST', body, headers: authHeaders(config, request) },
-        { baseUrl }
-      );
-      return Response.json(data, { status });
-    },
-  };
-}
-
-/**
- * Create skill detail route handlers
- */
-export function createSkillDetailRoutes(config: RouteHandlerConfig = {}): CRUDRouteHandlers {
-  const baseUrl = config.baseUrl;
-
-  return {
-    GET: async (request: Request, context?: { params?: { id?: string } }) => {
-      let id: string;
-      try { id = idFromContext(request, context, 'id'); } catch (e) { return badRequest(e); }
-      const { data, status } = await forwardJSON(
-        `/skills/${id}`,
-        { headers: authHeaders(config, request) },
-        { baseUrl },
-      );
-      return Response.json(data, { status });
-    },
-
-    POST: async (request: Request, context?: { params?: { id?: string } }) => {
-      let id: string;
-      try { id = idFromContext(request, context, 'id'); } catch (e) { return badRequest(e); }
-      const body = await request.json();
-      const { data, status } = await forwardJSON(
-        `/skills/${id}`,
-        { method: 'POST', body, headers: authHeaders(config, request) },
-        { baseUrl }
-      );
-      return Response.json(data, { status });
-    },
-
-    PUT: async (request: Request, context?: { params?: { id?: string } }) => {
-      let id: string;
-      try { id = idFromContext(request, context, 'id'); } catch (e) { return badRequest(e); }
-      const body = await request.json();
-      const { data, status } = await forwardJSON(
-        `/skills/${id}`,
-        { method: 'PUT', body, headers: authHeaders(config, request) },
-        { baseUrl }
-      );
-      return Response.json(data, { status });
-    },
-
-    DELETE: async (request: Request, context?: { params?: { id?: string } }) => {
-      let id: string;
-      try { id = idFromContext(request, context, 'id'); } catch (e) { return badRequest(e); }
-      const { data, status } = await forwardJSON(
-        `/skills/${id}`,
-        { method: 'DELETE', headers: authHeaders(config, request) },
-        { baseUrl }
-      );
-      return Response.json(data, { status });
-    },
-  };
-}
-
-// ============================================================================
-// Widget Route Handlers
-// ============================================================================
-
-/**
- * Create widget route handlers (same pattern as skills)
- */
-export function createWidgetRoutes(config: RouteHandlerConfig = {}): CRUDRouteHandlers {
-  const baseUrl = config.baseUrl;
-
-  return {
-    GET: async (request: Request) => {
-      const url = new URL(request.url);
-      const scope = url.searchParams.get('scope');
-      const creatorMid = url.searchParams.get('creator_mid');
-
-      let path = '/widgets';
-      if (scope) path += `?scope=${encodeURIComponent(scope)}`;
-      else if (creatorMid) path += `?creator_mid=${encodeURIComponent(creatorMid)}`;
-
-      const { data, status } = await forwardJSON(
-        path,
-        { headers: authHeaders(config, request) },
-        { baseUrl },
-      );
-      return Response.json(data, { status });
-    },
-
-    POST: async (request: Request) => {
-      const body = await request.json();
-      const { data, status } = await forwardJSON(
-        '/widgets',
-        { method: 'POST', body, headers: authHeaders(config, request) },
-        { baseUrl }
-      );
-      return Response.json(data, { status });
-    },
-  };
-}
-
-/**
- * Create widget detail route handlers
- */
-export function createWidgetDetailRoutes(config: RouteHandlerConfig = {}): CRUDRouteHandlers {
-  const baseUrl = config.baseUrl;
-
-  return {
-    GET: async (request: Request, context?: { params?: { id?: string } }) => {
-      let id: string;
-      try { id = idFromContext(request, context, 'id'); } catch (e) { return badRequest(e); }
-      const { data, status } = await forwardJSON(
-        `/widgets/${id}`,
-        { headers: authHeaders(config, request) },
-        { baseUrl },
-      );
-      return Response.json(data, { status });
-    },
-
-    POST: async (request: Request, context?: { params?: { id?: string } }) => {
-      let id: string;
-      try { id = idFromContext(request, context, 'id'); } catch (e) { return badRequest(e); }
-      const body = await request.json();
-      const { data, status } = await forwardJSON(
-        `/widgets/${id}`,
-        { method: 'POST', body, headers: authHeaders(config, request) },
-        { baseUrl }
-      );
-      return Response.json(data, { status });
-    },
-
-    PUT: async (request: Request, context?: { params?: { id?: string } }) => {
-      let id: string;
-      try { id = idFromContext(request, context, 'id'); } catch (e) { return badRequest(e); }
-      const body = await request.json();
-      const { data, status } = await forwardJSON(
-        `/widgets/${id}`,
-        { method: 'PUT', body, headers: authHeaders(config, request) },
-        { baseUrl }
-      );
-      return Response.json(data, { status });
-    },
-
-    DELETE: async (request: Request, context?: { params?: { id?: string } }) => {
-      let id: string;
-      try { id = idFromContext(request, context, 'id'); } catch (e) { return badRequest(e); }
-      const { data, status } = await forwardJSON(
-        `/widgets/${id}`,
-        { method: 'DELETE', headers: authHeaders(config, request) },
-        { baseUrl }
-      );
-      return Response.json(data, { status });
-    },
-  };
-}
-
-// ============================================================================
-// Imagination Route Handlers
-// ============================================================================
-
-/**
- * Create imagination route handlers
- */
-export function createImaginationRoutes(config: RouteHandlerConfig = {}): CRUDRouteHandlers {
-  const baseUrl = config.baseUrl;
-
-  return {
-    GET: async (request: Request) => {
-      const url = new URL(request.url);
-      const idParam = url.searchParams.get('id');
-      const creatorMid = url.searchParams.get('creator_mid');
-
-      let path = '/imaginations';
-      if (idParam) {
-        try {
-          const id = validateId(idParam, 'id');
-          path = `/imaginations/${id}`;
-        } catch (e) {
-          return badRequest(e);
-        }
-      } else if (creatorMid) {
-        path += `?creator_mid=${encodeURIComponent(creatorMid)}`;
-      }
-
-      const { data, status } = await forwardJSON(
-        path,
-        { headers: authHeaders(config, request) },
-        { baseUrl },
-      );
-      return Response.json(data, { status });
-    },
-
-    POST: async (request: Request) => {
-      const body = await request.json();
-      const { data, status } = await forwardJSON(
-        '/imaginations',
-        { method: 'POST', body, headers: authHeaders(config, request) },
-        { baseUrl }
-      );
-      return Response.json(data, { status });
-    },
-  };
-}
-
-// ============================================================================
-// Coder Route Handlers
-// ============================================================================
-
-/**
- * Create coder session route handlers
- */
-export function createCoderSessionRoutes(config: RouteHandlerConfig = {}): CRUDRouteHandlers {
-  const baseUrl = config.baseUrl;
-
-  return {
-    GET: async (request: Request) => {
-      const url = new URL(request.url);
-      const status = url.searchParams.get('status');
-      const limit = url.searchParams.get('limit');
-
-      let path = '/coder/sessions';
-      const params: string[] = [];
-      if (status) params.push(`status=${encodeURIComponent(status)}`);
-      if (limit) params.push(`limit=${encodeURIComponent(limit)}`);
-      if (params.length) path += `?${params.join('&')}`;
-
-      const { data, status: resStatus } = await forwardJSON(
-        path,
-        { headers: authHeaders(config, request) },
-        { baseUrl },
-      );
-      return Response.json(data, { status: resStatus });
-    },
-
-    POST: async (request: Request) => {
-      const body = await request.json();
-      const { data, status } = await forwardJSON(
-        '/coder/sessions',
-        { method: 'POST', body, headers: authHeaders(config, request) },
-        { baseUrl }
-      );
-      return Response.json(data, { status });
-    },
-  };
-}
-
-/**
- * Create coder session detail route handlers
- */
-export function createCoderSessionDetailRoutes(config: RouteHandlerConfig = {}): CRUDRouteHandlers & {
-  abort: { POST: RouteHandler };
-} {
-  const baseUrl = config.baseUrl;
-
-  return {
-    GET: async (request: Request, context?: { params?: { id?: string } }) => {
-      let id: string;
-      try { id = idFromContext(request, context, 'id'); } catch (e) { return badRequest(e); }
-      const { data, status } = await forwardJSON(
-        `/coder/sessions/${id}`,
-        { headers: authHeaders(config, request) },
-        { baseUrl },
-      );
-      return Response.json(data, { status });
-    },
-
-    POST: async (request: Request, context?: { params?: { id?: string } }) => {
-      let id: string;
-      try { id = idFromContext(request, context, 'id'); } catch (e) { return badRequest(e); }
-      const body = await request.json();
-      const { data, status } = await forwardJSON(
-        `/coder/sessions/${id}`,
-        { method: 'POST', body, headers: authHeaders(config, request) },
-        { baseUrl }
-      );
-      return Response.json(data, { status });
-    },
-
-    DELETE: async (request: Request, context?: { params?: { id?: string } }) => {
-      let id: string;
-      try { id = idFromContext(request, context, 'id'); } catch (e) { return badRequest(e); }
-      const { data, status } = await forwardJSON(
-        `/coder/sessions/${id}`,
-        { method: 'DELETE', headers: authHeaders(config, request) },
-        { baseUrl }
-      );
-      return Response.json(data, { status });
-    },
-
-    abort: {
-      POST: async (request: Request, context?: { params?: { id?: string } }) => {
-        let id: string;
-        try { id = idFromContext(request, context, 'id', 2); } catch (e) { return badRequest(e); }
-        const { data, status } = await forwardJSON(
-          `/coder/sessions/${id}/abort`,
-          { method: 'POST', headers: authHeaders(config, request) },
-          { baseUrl }
-        );
-        return Response.json(data, { status });
-      },
-    },
-  };
-}
-
-/**
- * Create coder execute route handler (with streaming support)
- */
-export function createCoderExecuteRoute(config: RouteHandlerConfig = {}): { POST: RouteHandler } {
-  const baseUrl = config.baseUrl;
-
-  return {
-    POST: async (request: Request) => {
-      const body = await request.json();
-
-      const response = await forwardRequest(
-        '/coder/execute',
-        { method: 'POST', body, stream: body.stream, headers: authHeaders(config, request) },
-        { baseUrl }
-      );
-
-      // Check if streaming
-      const contentType = response.headers.get('content-type') || '';
-      if (contentType.includes('text/event-stream') && response.body) {
-        return new Response(response.body, {
-          status: response.status,
-          headers: {
-            'Content-Type': 'text/event-stream',
-            'Cache-Control': 'no-cache',
-            'Connection': 'keep-alive',
-          },
-        });
-      }
-
-      const data = await response.json();
-      return Response.json(data, { status: response.status });
-    },
-  };
-}
-
-/**
- * Create coder tools route handlers
- */
-export function createCoderToolsRoutes(config: RouteHandlerConfig = {}): {
-  GET: RouteHandler;
-  call: { POST: RouteHandler };
-} {
-  const baseUrl = config.baseUrl;
-
-  return {
-    GET: async (request: Request) => {
-      const { data, status } = await forwardJSON(
-        '/coder/tools',
-        { headers: authHeaders(config, request) },
-        { baseUrl },
-      );
-      return Response.json(data, { status });
-    },
-
-    call: {
-      POST: async (request: Request, context?: { params?: { tool?: string } }) => {
-        let tool: string;
-        try { tool = idFromContext(request, context, 'tool'); } catch (e) { return badRequest(e); }
-        const body = await request.json();
-        const { data, status } = await forwardJSON(
-          `/coder/tools/${tool}`,
-          { method: 'POST', body, headers: authHeaders(config, request) },
-          { baseUrl }
-        );
-        return Response.json(data, { status });
-      },
-    },
-  };
-}
-
-/**
- * Create coder file operation route handlers
- */
-export function createCoderFilesRoutes(config: RouteHandlerConfig = {}): {
-  read: { GET: RouteHandler };
-  write: { POST: RouteHandler };
-  list: { GET: RouteHandler };
-  search: { GET: RouteHandler };
-  diff: { POST: RouteHandler };
-} {
-  const baseUrl = config.baseUrl;
-
-  return {
-    read: {
-      GET: async (request: Request) => {
-        const url = new URL(request.url);
-        const path = url.searchParams.get('path') || '';
-        const sessionId = url.searchParams.get('sessionId');
-        const sandboxId = url.searchParams.get('sandboxId');
-
-        let apiPath = `/coder/files/read?path=${encodeURIComponent(path)}`;
-        if (sessionId) apiPath += `&sessionId=${encodeURIComponent(sessionId)}`;
-        if (sandboxId) apiPath += `&sandboxId=${encodeURIComponent(sandboxId)}`;
-
-        const { data, status } = await forwardJSON(
-          apiPath,
-          { headers: authHeaders(config, request) },
-          { baseUrl },
-        );
-        return Response.json(data, { status });
-      },
-    },
-
-    write: {
-      POST: async (request: Request) => {
-        const body = await request.json();
-        const { data, status } = await forwardJSON(
-          '/coder/files/write',
-          { method: 'POST', body, headers: authHeaders(config, request) },
-          { baseUrl }
-        );
-        return Response.json(data, { status });
-      },
-    },
-
-    list: {
-      GET: async (request: Request) => {
-        const url = new URL(request.url);
-        const path = url.searchParams.get('path') || '.';
-        const recursive = url.searchParams.get('recursive');
-        const maxDepth = url.searchParams.get('maxDepth');
-        const sessionId = url.searchParams.get('sessionId');
-        const sandboxId = url.searchParams.get('sandboxId');
-
-        let apiPath = `/coder/files/list?path=${encodeURIComponent(path)}`;
-        if (recursive) apiPath += `&recursive=${encodeURIComponent(recursive)}`;
-        if (maxDepth) apiPath += `&maxDepth=${encodeURIComponent(maxDepth)}`;
-        if (sessionId) apiPath += `&sessionId=${encodeURIComponent(sessionId)}`;
-        if (sandboxId) apiPath += `&sandboxId=${encodeURIComponent(sandboxId)}`;
-
-        const { data, status } = await forwardJSON(
-          apiPath,
-          { headers: authHeaders(config, request) },
-          { baseUrl },
-        );
-        return Response.json(data, { status });
-      },
-    },
-
-    search: {
-      GET: async (request: Request) => {
-        const url = new URL(request.url);
-        const pattern = url.searchParams.get('pattern') || '';
-        const path = url.searchParams.get('path');
-        const filePattern = url.searchParams.get('filePattern');
-        const sessionId = url.searchParams.get('sessionId');
-        const sandboxId = url.searchParams.get('sandboxId');
-
-        let apiPath = `/coder/files/search?pattern=${encodeURIComponent(pattern)}`;
-        if (path) apiPath += `&path=${encodeURIComponent(path)}`;
-        if (filePattern) apiPath += `&filePattern=${encodeURIComponent(filePattern)}`;
-        if (sessionId) apiPath += `&sessionId=${encodeURIComponent(sessionId)}`;
-        if (sandboxId) apiPath += `&sandboxId=${encodeURIComponent(sandboxId)}`;
-
-        const { data, status } = await forwardJSON(
-          apiPath,
-          { headers: authHeaders(config, request) },
-          { baseUrl },
-        );
-        return Response.json(data, { status });
-      },
-    },
-
-    diff: {
-      POST: async (request: Request) => {
-        const body = await request.json();
-        const { data, status } = await forwardJSON(
-          '/coder/files/diff',
-          { method: 'POST', body, headers: authHeaders(config, request) },
-          { baseUrl }
-        );
-        return Response.json(data, { status });
-      },
-    },
-  };
-}
-
-/**
- * Create coder sandbox route handlers
- */
-export function createCoderSandboxRoutes(config: RouteHandlerConfig = {}): {
-  create: { POST: RouteHandler };
-  get: { GET: RouteHandler };
-  exec: { POST: RouteHandler };
-  destroy: { DELETE: RouteHandler };
-} {
-  const baseUrl = config.baseUrl;
-
-  return {
-    create: {
-      POST: async (request: Request) => {
-        const body = await request.json();
-        const { data, status } = await forwardJSON(
-          '/coder/sandbox',
-          { method: 'POST', body, headers: authHeaders(config, request) },
-          { baseUrl }
-        );
-        return Response.json(data, { status });
-      },
-    },
-
-    get: {
-      GET: async (request: Request, context?: { params?: { id?: string } }) => {
-        let id: string;
-        try { id = idFromContext(request, context, 'id'); } catch (e) { return badRequest(e); }
-        const { data, status } = await forwardJSON(
-          `/coder/sandbox/${id}`,
-          { headers: authHeaders(config, request) },
-          { baseUrl },
-        );
-        return Response.json(data, { status });
-      },
-    },
-
-    exec: {
-      POST: async (request: Request, context?: { params?: { id?: string } }) => {
-        let id: string;
-        try { id = idFromContext(request, context, 'id', 2); } catch (e) { return badRequest(e); }
-        const body = await request.json();
-
-        const response = await forwardRequest(
-          `/coder/sandbox/${id}/exec`,
-          { method: 'POST', body, stream: body.stream, headers: authHeaders(config, request) },
-          { baseUrl }
-        );
-
-        // Check if streaming
-        const contentType = response.headers.get('content-type') || '';
-        if (contentType.includes('text/event-stream') && response.body) {
-          return new Response(response.body, {
-            status: response.status,
-            headers: {
-              'Content-Type': 'text/event-stream',
-              'Cache-Control': 'no-cache',
-              'Connection': 'keep-alive',
-            },
-          });
-        }
-
-        const data = await response.json();
-        return Response.json(data, { status: response.status });
-      },
-    },
-
-    destroy: {
-      DELETE: async (request: Request, context?: { params?: { id?: string } }) => {
-        let id: string;
-        try { id = idFromContext(request, context, 'id'); } catch (e) { return badRequest(e); }
-        const { data, status } = await forwardJSON(
-          `/coder/sandbox/${id}`,
-          { method: 'DELETE', headers: authHeaders(config, request) },
-          { baseUrl }
-        );
-        return Response.json(data, { status });
-      },
-    },
-  };
-}
-
-/**
- * Create coder command execution route handlers
- */
-export function createCoderExecRoutes(config: RouteHandlerConfig = {}): {
-  POST: RouteHandler;
-  stream: { POST: RouteHandler };
-} {
-  const baseUrl = config.baseUrl;
-
-  return {
-    POST: async (request: Request) => {
-      const body = await request.json();
-      const { data, status } = await forwardJSON(
-        '/coder/exec',
-        { method: 'POST', body, headers: authHeaders(config, request) },
-        { baseUrl }
-      );
-      return Response.json(data, { status });
-    },
-
-    stream: {
-      POST: async (request: Request) => {
-        const body = await request.json();
-
-        const response = await forwardRequest(
-          '/coder/exec/stream',
-          { method: 'POST', body, stream: true, headers: authHeaders(config, request) },
-          { baseUrl }
-        );
-
-        if (response.body) {
-          return new Response(response.body, {
-            status: response.status,
-            headers: {
-              'Content-Type': 'text/event-stream',
-              'Cache-Control': 'no-cache',
-              'Connection': 'keep-alive',
-            },
-          });
-        }
-
-        const data = await response.json();
-        return Response.json(data, { status: response.status });
-      },
-    },
-  };
-}
-
-// ============================================================================
-// Stack Management Route Handlers
-// ============================================================================
-
-/**
- * Create stack CRUD route handlers (list + create)
- */
-export function createStackRoutes(config: StackRouteHandlerConfig = {}): CRUDRouteHandlers {
-  const baseUrl = config.baseUrl;
-
-  return {
-    GET: async (request: Request) => {
-      const { data, status } = await forwardJSON(
-        '/api/v2/stacks',
-        { headers: authHeaders(config, request) },
-        { baseUrl }
-      );
-      return Response.json(data, { status });
-    },
-
-    POST: async (request: Request) => {
-      const body = await request.json();
-      const { data, status } = await forwardJSON(
-        '/api/v2/stacks',
-        { method: 'POST', body, headers: authHeaders(config, request) },
-        { baseUrl }
-      );
-      return Response.json(data, { status });
-    },
-  };
-}
-
-/**
- * Create stack detail route handlers (get, update, delete by [stackId])
- */
-export function createStackDetailRoutes(config: StackRouteHandlerConfig = {}): CRUDRouteHandlers {
-  const baseUrl = config.baseUrl;
-
-  return {
-    GET: async (request: Request, context?: { params?: { stackId?: string } }) => {
-      let stackId: string;
-      try { stackId = validateId(context?.params?.stackId, 'stackId'); } catch (e) { return badRequest(e); }
-      const { data, status } = await forwardJSON(
-        `/api/v2/stacks/${stackId}`,
-        { headers: authHeaders(config, request) },
-        { baseUrl }
-      );
-      return Response.json(data, { status });
-    },
-
-    POST: async () => Response.json({ error: 'Method not allowed' }, { status: 405 }),
-
-    PUT: async (request: Request, context?: { params?: { stackId?: string } }) => {
-      let stackId: string;
-      try { stackId = validateId(context?.params?.stackId, 'stackId'); } catch (e) { return badRequest(e); }
-      const body = await request.json();
-      const { data, status } = await forwardJSON(
-        `/api/v2/stacks/${stackId}`,
-        { method: 'PATCH', body, headers: authHeaders(config, request) },
-        { baseUrl }
-      );
-      return Response.json(data, { status });
-    },
-
-    DELETE: async (request: Request, context?: { params?: { stackId?: string } }) => {
-      let stackId: string;
-      try { stackId = validateId(context?.params?.stackId, 'stackId'); } catch (e) { return badRequest(e); }
-      const { data, status } = await forwardJSON(
-        `/api/v2/stacks/${stackId}`,
-        { method: 'DELETE', headers: authHeaders(config, request) },
-        { baseUrl }
-      );
-      return Response.json(data, { status });
-    },
-  };
-}
-
-/**
- * Create stack keys route handlers (list + create + revoke)
- */
-export function createStackKeysRoutes(config: StackRouteHandlerConfig = {}): CRUDRouteHandlers {
-  const baseUrl = config.baseUrl;
-
-  return {
-    GET: async (request: Request, context?: { params?: { stackId?: string } }) => {
-      let stackId: string;
-      try { stackId = validateId(context?.params?.stackId, 'stackId'); } catch (e) { return badRequest(e); }
-      const { data, status } = await forwardJSON(
-        `/api/v2/stacks/${stackId}/keys`,
-        { headers: authHeaders(config, request) },
-        { baseUrl }
-      );
-      return Response.json(data, { status });
-    },
-
-    POST: async (request: Request, context?: { params?: { stackId?: string } }) => {
-      let stackId: string;
-      try { stackId = validateId(context?.params?.stackId, 'stackId'); } catch (e) { return badRequest(e); }
-      const body = await request.json();
-      const { data, status } = await forwardJSON(
-        `/api/v2/stacks/${stackId}/keys`,
-        { method: 'POST', body, headers: authHeaders(config, request) },
-        { baseUrl }
-      );
-      return Response.json(data, { status });
-    },
-
-    DELETE: async (request: Request, context?: { params?: { stackId?: string; keyId?: string } }) => {
-      let stackId: string;
-      let keyId: string;
-      try {
-        stackId = validateId(context?.params?.stackId, 'stackId');
-        keyId = validateId(context?.params?.keyId, 'keyId');
-      } catch (e) { return badRequest(e); }
-      const { data, status } = await forwardJSON(
-        `/api/v2/stacks/${stackId}/keys/${keyId}`,
-        { method: 'DELETE', headers: authHeaders(config, request) },
-        { baseUrl }
-      );
-      return Response.json(data, { status });
-    },
-  };
-}
-
-/**
- * Create stack members route handlers
- */
-export function createStackMembersRoutes(config: StackRouteHandlerConfig = {}): {
-  GET: RouteHandler;
-  stats: { GET: RouteHandler };
-  updateRole: { PATCH: RouteHandler };
-} {
-  const baseUrl = config.baseUrl;
-
-  return {
-    GET: async (request: Request, context?: { params?: { stackId?: string } }) => {
-      let stackId: string;
-      try { stackId = validateId(context?.params?.stackId, 'stackId'); } catch (e) { return badRequest(e); }
-      const url = new URL(request.url);
-      const params = new URLSearchParams();
-      const limit = url.searchParams.get('limit');
-      const offset = url.searchParams.get('offset');
-      const role = url.searchParams.get('role');
-      if (limit) params.set('limit', limit);
-      if (offset) params.set('offset', offset);
-      if (role) params.set('role', role);
-      const qs = params.toString() ? `?${params}` : '';
-
-      const { data, status } = await forwardJSON(
-        `/api/v2/stacks/${stackId}/members${qs}`,
-        { headers: authHeaders(config, request) },
-        { baseUrl }
-      );
-      return Response.json(data, { status });
-    },
-
-    stats: {
-      GET: async (request: Request, context?: { params?: { stackId?: string } }) => {
-        let stackId: string;
-        try { stackId = validateId(context?.params?.stackId, 'stackId'); } catch (e) { return badRequest(e); }
-        const { data, status } = await forwardJSON(
-          `/api/v2/stacks/${stackId}/members/stats`,
-          { headers: authHeaders(config, request) },
-          { baseUrl }
-        );
-        return Response.json(data, { status });
-      },
-    },
-
-    updateRole: {
-      PATCH: async (request: Request, context?: { params?: { stackId?: string; userId?: string } }) => {
-        let stackId: string;
-        let userId: string;
-        try {
-          stackId = validateId(context?.params?.stackId, 'stackId');
-          userId = validateId(context?.params?.userId, 'userId');
-        } catch (e) { return badRequest(e); }
-        const body = await request.json();
-        const { data, status } = await forwardJSON(
-          `/api/v2/stacks/${stackId}/members/${userId}/role`,
-          { method: 'PATCH', body, headers: authHeaders(config, request) },
-          { baseUrl }
-        );
-        return Response.json(data, { status });
-      },
-    },
-  };
-}