@stacksjs/auth 0.72.102 → 0.73.0

package/dist/gate.d.ts

@@ -43,7 +43,7 @@ export declare function defineGates<const T extends GatesDefinition>(definition:
  * define('edit-settings', (user) => user?.isAdmin)
  * define('update-post', (user, post) => user?.id === post.userId)
  */
-export declare function define<T = any>(ability: string, callback: GateCallback<T>): void;
+export declare function define<T = any>(ability: Ability, callback: GateCallback<T>): void;
 /**
  * Register a policy for a model
  *
@@ -73,28 +73,34 @@ export declare function after(callback: GateAfterCallback): void;
  * if (await allows('edit-settings', user)) { ... }
  * if (await allows('update', user, post)) { ... }
  */
-export declare function allows(ability: Ability, user: UserModel | null, ...args: any[]): Promise<boolean>;
+export declare function allows<const A extends Ability>(ability: A, user: UserModel | null, ...args: AbilityArgs<A>): Promise<boolean>;
 /**
  * Check if the user is denied from performing an ability
  *
  * @example
  * if (await denies('delete', user, post)) { ... }
  */
-export declare function denies(ability: Ability, user: UserModel | null, ...args: any[]): Promise<boolean>;
+export declare function denies<const A extends Ability>(ability: A, user: UserModel | null, ...args: AbilityArgs<A>): Promise<boolean>;
 /**
  * Check if the user can perform an ability (alias for allows)
  */
-export declare function can(ability: Ability, user: UserModel | null, ...args: any[]): Promise<boolean>;
+export declare function can<const A extends Ability>(ability: A, user: UserModel | null, ...args: AbilityArgs<A>): Promise<boolean>;
 /**
  * Check if the user cannot perform an ability (alias for denies)
  */
-export declare function cannot(ability: Ability, user: UserModel | null, ...args: any[]): Promise<boolean>;
+export declare function cannot<const A extends Ability>(ability: A, user: UserModel | null, ...args: AbilityArgs<A>): Promise<boolean>;
 /**
  * Check if the user can perform any of the given abilities
  *
  * @example
  * if (await any(['update', 'delete'], user, post)) { ... }
  */
+/*
+ * `any` / `all` / `none` keep `any[]`: one argument list is checked against
+ * SEVERAL abilities, which may each declare different parameters, so there is
+ * no single tuple that is correct for the call. The single-ability functions
+ * above are where the declaration can be enforced.
+ */
 export declare function any(abilities: readonly Ability[], user: UserModel | null, ...args: any[]): Promise<boolean>;
 /**
  * Check if the user can perform all of the given abilities
@@ -113,11 +119,11 @@ export declare function none(abilities: readonly Ability[], user: UserModel | nu
  * @example
  * await authorize('update', user, post) // Throws if not allowed
  */
-export declare function authorize(ability: Ability, user: UserModel | null, ...args: any[]): Promise<AuthorizationResponse>;
+export declare function authorize<const A extends Ability>(ability: A, user: UserModel | null, ...args: AbilityArgs<A>): Promise<AuthorizationResponse>;
 /**
  * Get detailed inspection result for an ability check
  */
-export declare function inspect(ability: Ability, user: UserModel | null, ...args: any[]): Promise<AuthorizationResponse>;
+export declare function inspect<const A extends Ability>(ability: A, user: UserModel | null, ...args: AbilityArgs<A>): Promise<AuthorizationResponse>;
 /**
  * Get a policy instance for a model
  */
@@ -246,6 +252,17 @@ export type PolicyAbility = 'viewAny' | 'view' | 'create' | 'update' | 'delete'
  */
 // eslint-disable-next-line ts/ban-types -- `string & {}` keeps literal completions alive
 export type Ability = GateName | PolicyAbility | (string & {});
+/**
+ * The arguments an ability takes after the user.
+ *
+ * A gate the application declares contributes its own parameter list, so
+ * `Gate.allows('update-post', user, post)` is checked against how the gate was
+ * written. Anything else - a policy ability, or a name computed at runtime -
+ * keeps `any[]`, which is what it was for every ability before.
+ */
+export type AbilityArgs<A extends Ability> = A extends keyof AppGates
+    ? (AppGates[A] extends readonly unknown[] ? AppGates[A] : any[])
+    : any[];
 /** A policy class name, as narrow as the application has made it. */
 export type PolicyName = keyof PolicyClasses extends never ? string : keyof PolicyClasses & string;
 /** A model name a policy may be registered for. */

package/dist/magic-link.js

@@ -1,3 +1,3 @@
-import{createHash,randomBytes}from"node:crypto";import process from"node:process";import{config}from"@stacksjs/config";import{db,sqlDateTime}from"@stacksjs/database";import{mail,template}from"@stacksjs/email";import{log}from"@stacksjs/logging";import{RateLimiter}from"./rate-limiter";function hashToken(raw){return createHash("sha256").update(raw).digest("hex")}function expireMinutes(){return config.auth.magicLink?.expire??15}function safeRedirect(candidate){const fallback=config.auth.magicLink?.redirectDefault??"/";if(!candidate)return fallback;if(!candidate.startsWith("/")||candidate.startsWith("//"))return fallback;return candidate}async function linkBase(siteId){if(siteId){const primary=await db.selectFrom("site_domains").where("site_id","=",siteId).where("is_primary","=",!0).where("verified_at","is not",null).select(["domain"]).executeTakeFirst();if(primary?.domain)return`https://${primary.domain}`;const site=await db.selectFrom("sites").where("id","=",siteId).select(["subdomain"]).executeTakeFirst(),base=config.sites?.baseDomain;if(site?.subdomain&&base)return`https://${site.subdomain}.${base}`}return config.app.url?`https://${config.app.url}`:`http://localhost:${process.env.PORT||"3000"}`}export async function sendMagicLink(email,options={}){const normalized=email.trim().toLowerCase();if(await RateLimiter.isRateLimited(normalized))return;await RateLimiter.recordFailedAttempt(normalized);let user=await db.selectFrom("users").where("email","=",normalized).select(["id","email"]).executeTakeFirst();if(!user&&options.createUser){await db.insertInto("users").values({email:normalized,name:normalized.split("@")[0],password:null,created_at:sqlDateTime(new Date),updated_at:sqlDateTime(new Date)}).execute();user=await db.selectFrom("users").where("email","=",normalized).select(["id","email"]).executeTakeFirst()}if(!user)return;const raw=randomBytes(32).toString("base64url"),ttl=options.ttlMinutes??expireMinutes(),redirectTo=safeRedirect(options.redirectTo);await db.deleteFrom("magic_link_tokens").where("email","=",normalized).where("consumed_at","is",null).execute();await db.insertInto("magic_link_tokens").values({email:normalized,user_id:user.id,token:hashToken(raw),expires_at:sqlDateTime(new Date(Date.now()+ttl*60000)),redirect_to:redirectTo,site_id:options.siteId??null,created_at:sqlDateTime(new Date),updated_at:sqlDateTime(new Date)}).execute();const base=await linkBase(options.siteId),filled=(config.auth.magicLink?.url??"/auth/magic/{token}").replace("{token}",raw),linkUrl=/^https?:\/\//.test(filled)?filled:`${base}${filled.startsWith("/")?"":"/"}${filled}`,appName=config.app.name||"Stacks";let html,text;try{const rendered=await template("magic-link",{subject:`Sign in to ${appName}`,variables:{linkUrl,expireMinutes:ttl}});if(rendered.html||rendered.text){html=rendered.html;text=rendered.text}}catch{}try{await mail.sendOrFail({to:normalized,subject:`Sign in to ${appName}`,...html?{html}:{},text:text||`Sign in to ${appName}: ${linkUrl}
+import{createHash,randomBytes}from"node:crypto";import process from"node:process";import{config}from"@stacksjs/config";import{db,sqlDateTime}from"@stacksjs/database";import{mail,templateByName}from"@stacksjs/email";import{log}from"@stacksjs/logging";import{RateLimiter}from"./rate-limiter";function hashToken(raw){return createHash("sha256").update(raw).digest("hex")}function expireMinutes(){return config.auth.magicLink?.expire??15}function safeRedirect(candidate){const fallback=config.auth.magicLink?.redirectDefault??"/";if(!candidate)return fallback;if(!candidate.startsWith("/")||candidate.startsWith("//"))return fallback;return candidate}async function linkBase(siteId){if(siteId){const primary=await db.selectFrom("site_domains").where("site_id","=",siteId).where("is_primary","=",!0).where("verified_at","is not",null).select(["domain"]).executeTakeFirst();if(primary?.domain)return`https://${primary.domain}`;const site=await db.selectFrom("sites").where("id","=",siteId).select(["subdomain"]).executeTakeFirst(),base=config.sites?.baseDomain;if(site?.subdomain&&base)return`https://${site.subdomain}.${base}`}return config.app.url?`https://${config.app.url}`:`http://localhost:${process.env.PORT||"3000"}`}export async function sendMagicLink(email,options={}){const normalized=email.trim().toLowerCase();if(await RateLimiter.isRateLimited(normalized))return;await RateLimiter.recordFailedAttempt(normalized);let user=await db.selectFrom("users").where("email","=",normalized).select(["id","email"]).executeTakeFirst();if(!user&&options.createUser){await db.insertInto("users").values({email:normalized,name:normalized.split("@")[0],password:null,created_at:sqlDateTime(new Date),updated_at:sqlDateTime(new Date)}).execute();user=await db.selectFrom("users").where("email","=",normalized).select(["id","email"]).executeTakeFirst()}if(!user)return;const raw=randomBytes(32).toString("base64url"),ttl=options.ttlMinutes??expireMinutes(),redirectTo=safeRedirect(options.redirectTo);await db.deleteFrom("magic_link_tokens").where("email","=",normalized).where("consumed_at","is",null).execute();await db.insertInto("magic_link_tokens").values({email:normalized,user_id:user.id,token:hashToken(raw),expires_at:sqlDateTime(new Date(Date.now()+ttl*60000)),redirect_to:redirectTo,site_id:options.siteId??null,created_at:sqlDateTime(new Date),updated_at:sqlDateTime(new Date)}).execute();const base=await linkBase(options.siteId),filled=(config.auth.magicLink?.url??"/auth/magic/{token}").replace("{token}",raw),linkUrl=/^https?:\/\//.test(filled)?filled:`${base}${filled.startsWith("/")?"":"/"}${filled}`,appName=config.app.name||"Stacks";let html,text;try{const rendered=await templateByName("magic-link",{subject:`Sign in to ${appName}`,variables:{linkUrl,expireMinutes:ttl}});if(rendered.html||rendered.text){html=rendered.html;text=rendered.text}}catch{}try{await mail.sendOrFail({to:normalized,subject:`Sign in to ${appName}`,...html?{html}:{},text:text||`Sign in to ${appName}: ${linkUrl}
 
 This link works once and expires in ${ttl} minutes. If you didn't request it, ignore this email.`})}catch(error){log.error(`Magic-link email to ${normalized} failed: ${error.message}`)}}export async function consumeMagicLink(raw){if(!raw||raw.length>255)return{ok:!1,reason:"invalid"};const hashed=hashToken(raw),now=sqlDateTime(new Date),claim=await db.updateTable("magic_link_tokens").set({consumed_at:now,updated_at:now}).where("token","=",hashed).where("consumed_at","is",null).where("expires_at",">",now).execute(),updated=typeof claim==="number"?claim:Number(claim?.numUpdatedRows??claim?.changes??0),row=await db.selectFrom("magic_link_tokens").where("token","=",hashed).select(["user_id","email","expires_at","consumed_at","redirect_to"]).executeTakeFirst();if(!row)return{ok:!1,reason:"invalid"};if(updated<1){if(!row.consumed_at&&new Date(row.expires_at).getTime()<=Date.now())return{ok:!1,reason:"expired"};return{ok:!1,reason:"used"}}if(!row.user_id)return{ok:!1,reason:"no-user"};return{ok:!0,userId:Number(row.user_id),email:row.email,redirectTo:safeRedirect(row.redirect_to)}}export async function pruneMagicLinkTokens(olderThanDays=7){const cutoff=sqlDateTime(new Date(Date.now()-olderThanDays*86400000));await db.deleteFrom("magic_link_tokens").where("expires_at","<",cutoff).execute()}

package/dist/request-token.d.ts

@@ -1,3 +1,4 @@
+export declare function requestToken(request: TokenBearingRequest | null | undefined): string | null;
 /**
  * The access token a request carries, from the Authorization header or the
  * auth cookie.
@@ -13,4 +14,16 @@
  *
  * The header is checked first, so an API client behaves exactly as before.
  */
-export declare function requestToken(request: any): string | null;
+/**
+ * What this needs off a request, which is deliberately little.
+ *
+ * Both members are optional because the function is handed two different
+ * shapes: a Stacks request, which answers `bearerToken()`, and a plain
+ * `Request`, which only has headers. Written out rather than left as `any` so
+ * the optional chaining below is checked against something - as `any` it was
+ * indistinguishable from probing for members that do not exist on either.
+ */
+export declare interface TokenBearingRequest {
+  bearerToken?: () => string | undefined | null
+  headers?: Headers
+}

package/dist/request-token.js

@@ -1 +1 @@
-import{authCookieToken}from"./cookie";export function requestToken(request){let token=request?.bearerToken?.();if(!token){const header=request?.headers?.get?.("authorization")||request?.headers?.get?.("Authorization");if(typeof header==="string"&&header.startsWith("Bearer "))token=header.substring(7)}if(!token&&request?.headers)token=authCookieToken(request);return token||null}
+import{authCookieToken}from"./cookie";export function requestToken(request){let token=request?.bearerToken?.();if(!token){const header=request?.headers?.get?.("authorization")||request?.headers?.get?.("Authorization");if(typeof header==="string"&&header.startsWith("Bearer "))token=header.substring(7)}if(!token&&request?.headers)token=authCookieToken({headers:request.headers});return token||null}

package/dist/tokens.d.ts

@@ -1,19 +1,4 @@
 import type { AccessToken, CreateClientOptions, CreateClientResult, DatabaseDriver, OAuthClient, PersonalAccessTokenResult, RefreshTokenResult, TokenScopes } from '@stacksjs/types';
-/**
- * Read `users.password_changed_at` for a user.
- *
- * Binds a token's validity to the account's credential state: a token
- * issued before the user last changed their password is no longer
- * trusted, regardless of its own `revoked`/`expires_at` flags. This is
- * the durable, use-time backstop behind the post-reset revocation sweep
- * (#1947) — even a freshly minted pair that the sweep never saw is
- * rejected on first use.
- *
- * Returns `null` on ANY error (missing column / missing table) so a
- * not-yet-migrated database degrades to legacy-allow rather than locking
- * everyone out. Accepts an optional query runner so the refresh exchange
- * can read the stamp inside its own transaction.
- */
 export declare function getPasswordChangedAt(userId: unknown, q?: { unsafe: (sql: string, params?: any[]) => any }): Promise<Date | null>;
 /**
  * True when a credential issued at `createdAt` predates the user's last

package/dist/tokens.js

@@ -23,7 +23,7 @@ import{createHash,randomBytes}from"node:crypto";import{db}from"@stacksjs/databas
       VALUES (?, ?, ?, ?, ?, 0, ?, ?, ?, ${appNow()}, ${appNow()})
     `,[userId,client.id,hashedToken,name,JSON.stringify(scopes),sqlDateTime(expiresAt),agent,address]);const row=(await db.unsafe(`
     SELECT * FROM oauth_access_tokens WHERE token = ${param(1)} LIMIT 1
-  `,[hashedToken]))[0];if(!row)throw new HttpError(500,"Failed to create access token - inserted row not found");const accessToken={id:row.id,userId:row.user_id,clientId:row.oauth_client_id,name:row.name,scopes:parseScopes(row.scopes),revoked:!1,expiresAt,createdAt:new Date(row.created_at),updatedAt:new Date(row.updated_at)};let refreshTokenPlain;if(withRefreshToken){refreshTokenPlain=generateSecureToken(40);const hashedRefreshToken=hashToken(refreshTokenPlain),refreshExpiresAt=new Date;refreshExpiresAt.setDate(refreshExpiresAt.getDate()+refreshExpiresInDays);if(isPostgres)await db.unsafe(`
+  `,[hashedToken]))[0];if(!row)throw new HttpError(500,"Failed to create access token - inserted row not found");const accessToken={id:row.id,userId:row.user_id,clientId:row.oauth_client_id,name:row.name,scopes:parseScopes(row.scopes),revoked:!1,expiresAt,createdAt:new Date(row.created_at),updatedAt:row.updated_at?new Date(row.updated_at):new Date(row.created_at)};let refreshTokenPlain;if(withRefreshToken){refreshTokenPlain=generateSecureToken(40);const hashedRefreshToken=hashToken(refreshTokenPlain),refreshExpiresAt=new Date;refreshExpiresAt.setDate(refreshExpiresAt.getDate()+refreshExpiresInDays);if(isPostgres)await db.unsafe(`
         INSERT INTO oauth_refresh_tokens (access_token_id, token, revoked, expires_at, created_at)
         VALUES ($1, $2, false, $3, ${appNow()})
       `,[accessToken.id,hashedRefreshToken,sqlDateTime(refreshExpiresAt)]);else await db.unsafe(`
@@ -53,7 +53,7 @@ import{createHash,randomBytes}from"node:crypto";import{db}from"@stacksjs/databas
         VALUES (?, ?, ?, ?, ?, 0, ?, ${appNow()}, ${appNow()})
       `,[refreshRow.user_id,refreshRow.oauth_client_id,hashedToken,refreshRow.name,refreshRow.scopes,sqlDateTime(expiresAt)]);const row=(await trx.unsafe(`
       SELECT * FROM oauth_access_tokens WHERE token = ${param(1)} LIMIT 1
-    `,[hashedToken]))[0],accessToken={id:row.id,userId:row.user_id,clientId:row.oauth_client_id,name:row.name,scopes:parseScopes(row.scopes),revoked:!1,expiresAt,createdAt:new Date(row.created_at),updatedAt:new Date(row.updated_at)};if(isIssuedBeforePasswordChange(row.created_at,await getPasswordChangedAt(refreshRow.user_id,trx)))throw new HttpError(401,"Invalid or expired refresh token");const newRefreshTokenPlain=generateSecureToken(40),newHashedRefreshToken=hashToken(newRefreshTokenPlain),refreshExpiresAt=new Date;refreshExpiresAt.setDate(refreshExpiresAt.getDate()+refreshExpiresInDays);if(isPostgres)await trx.unsafe(`
+    `,[hashedToken]))[0];if(!row)throw new HttpError(500,"Failed to read back the access token that was just created.");const accessToken={id:row.id,userId:row.user_id,clientId:row.oauth_client_id,name:row.name||"access-token",scopes:parseScopes(row.scopes),revoked:!1,expiresAt,createdAt:new Date(row.created_at),updatedAt:row.updated_at?new Date(row.updated_at):new Date(row.created_at)};if(isIssuedBeforePasswordChange(row.created_at,await getPasswordChangedAt(refreshRow.user_id,trx)))throw new HttpError(401,"Invalid or expired refresh token");const newRefreshTokenPlain=generateSecureToken(40),newHashedRefreshToken=hashToken(newRefreshTokenPlain),refreshExpiresAt=new Date;refreshExpiresAt.setDate(refreshExpiresAt.getDate()+refreshExpiresInDays);if(isPostgres)await trx.unsafe(`
         INSERT INTO oauth_refresh_tokens (access_token_id, token, revoked, expires_at, created_at)
         VALUES ($1, $2, false, $3, ${appNow()})
       `,[accessToken.id,newHashedRefreshToken,sqlDateTime(refreshExpiresAt)]);else await trx.unsafe(`
@@ -75,13 +75,13 @@ import{createHash,randomBytes}from"node:crypto";import{db}from"@stacksjs/databas
     WHERE access_token_id IN (
       SELECT id FROM oauth_access_tokens WHERE user_id = ${param(1)}
     )
-  `,[userId])}export async function deleteExpiredRefreshTokens(){const result=await db.unsafe(`
+  `,[userId])}export async function deleteExpiredRefreshTokens(){const written=await db.unsafe(`
     DELETE FROM oauth_refresh_tokens
     WHERE expires_at < ${appNow()}
-  `);return result?.changes||result?.rowCount||0}export async function deleteRevokedRefreshTokens(daysOld=7){const cutoffDate=new Date;cutoffDate.setDate(cutoffDate.getDate()-daysOld);const result=await db.unsafe(`
+  `);return Number(written?.changes??written?.rowCount??0)}export async function deleteRevokedRefreshTokens(daysOld=7){const cutoffDate=new Date;cutoffDate.setDate(cutoffDate.getDate()-daysOld);const written=await db.unsafe(`
     DELETE FROM oauth_refresh_tokens
     WHERE revoked = ${boolTrue} AND created_at < ${param(1)}
-  `,[sqlDateTime(cutoffDate)]);return result?.changes||result?.rowCount||0}export async function revokeToken(plainTextToken){const hashedToken=bearerLookupHash(plainTextToken);await db.unsafe(`
+  `,[sqlDateTime(cutoffDate)]);return Number(written?.changes??written?.rowCount??0)}export async function revokeToken(plainTextToken){const hashedToken=bearerLookupHash(plainTextToken);await db.unsafe(`
     UPDATE oauth_refresh_tokens
     SET revoked = ${boolTrue}
     WHERE access_token_id IN (
@@ -128,18 +128,18 @@ import{createHash,randomBytes}from"node:crypto";import{db}from"@stacksjs/databas
     WHERE access_token_id IN (
       SELECT id FROM oauth_access_tokens WHERE expires_at < ${appNow()}
     )
-  `);const result=await db.unsafe(`
+  `);const written=await db.unsafe(`
     DELETE FROM oauth_access_tokens
     WHERE expires_at < ${appNow()}
-  `);return result?.changes||result?.rowCount||0}export async function deleteRevokedTokens(daysOld=7){const cutoffDate=new Date;cutoffDate.setDate(cutoffDate.getDate()-daysOld);await db.unsafe(`
+  `);return Number(written?.changes??written?.rowCount??0)}export async function deleteRevokedTokens(daysOld=7){const cutoffDate=new Date;cutoffDate.setDate(cutoffDate.getDate()-daysOld);await db.unsafe(`
     DELETE FROM oauth_refresh_tokens
     WHERE access_token_id IN (
       SELECT id FROM oauth_access_tokens WHERE revoked = ${boolTrue} AND updated_at < ${param(1)}
     )
-  `,[sqlDateTime(cutoffDate)]);const result=await db.unsafe(`
+  `,[sqlDateTime(cutoffDate)]);const written=await db.unsafe(`
     DELETE FROM oauth_access_tokens
     WHERE revoked = ${boolTrue} AND updated_at < ${param(1)}
-  `,[sqlDateTime(cutoffDate)]);return result?.changes||result?.rowCount||0}export async function clients(userId){return(await db.unsafe(`
+  `,[sqlDateTime(cutoffDate)]);return Number(written?.changes??written?.rowCount??0)}export async function clients(userId){return(await db.unsafe(`
     SELECT * FROM oauth_clients
     WHERE user_id = ${param(1)} AND revoked = ${boolFalse}
     ORDER BY created_at DESC
@@ -151,9 +151,9 @@ import{createHash,randomBytes}from"node:crypto";import{db}from"@stacksjs/databas
     `,[options.name,secret,options.redirect,options.personalAccessClient||!1,options.passwordClient||!1]);else await db.unsafe(`
       INSERT INTO oauth_clients (name, secret, provider, redirect, personal_access_client, password_client, revoked, created_at)
       VALUES (?, ?, 'local', ?, ?, ?, 0, ${appNow()})
-    `,[options.name,secret,options.redirect,options.personalAccessClient?1:0,options.passwordClient?1:0]);const inserted=await db.unsafe(`
+    `,[options.name,secret,options.redirect,options.personalAccessClient?1:0,options.passwordClient?1:0]);const createdClient=(await db.unsafe(`
     SELECT * FROM oauth_clients WHERE secret = ${param(1)} LIMIT 1
-  `,[secret]);return{client:mapToOAuthClient(inserted[0]),plainTextSecret:secret}}export async function revokeClient(clientId){await db.unsafe(`
+  `,[secret]))[0];if(!createdClient)throw new HttpError(500,"Failed to read back the OAuth client that was just created.");return{client:mapToOAuthClient(createdClient),plainTextSecret:secret}}export async function revokeClient(clientId){await db.unsafe(`
     UPDATE oauth_clients
     SET revoked = ${boolTrue}, updated_at = ${appNow()}
     WHERE id = ${param(1)}

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/auth",
   "type": "module",
   "sideEffects": false,
-  "version": "0.72.102",
+  "version": "0.73.0",
   "description": "A more simplistic way to authenticate.",
   "author": "Chris Breuer",
   "contributors": [
@@ -62,7 +62,7 @@
   },
   "devDependencies": {
     "better-dx": "^0.2.24",
-    "@stacksjs/error-handling": "0.72.102",
-    "@stacksjs/router": "0.72.102"
+    "@stacksjs/error-handling": "0.73.0",
+    "@stacksjs/router": "0.73.0"
   }
 }