@stacksjs/database 0.75.14 → 0.75.16

package/dist/auth-tables.d.ts

@@ -42,6 +42,13 @@ export declare function usersTwoFactorColumnsSql(sql: SqlHelpers): string[];
  * stacksjs/status#1 Phase 9).
  */
 export declare function usersStripeIdSql(): string;
+/**
+ * Authorization-server registration policy stored on provider clients.
+ *
+ * Nullable upgrades preserve legacy personal/password clients. Provider
+ * registration requires the complete set and treats a partial row as invalid.
+ */
+export declare function oauthClientProviderColumnsSql(): string[];
 /**
  * The polymorphic owner columns on `oauth_access_tokens`.
  *
@@ -95,6 +102,17 @@ export declare function oauthAccessTokenTokenableBackfillSql(usersTable?: string
  * both schema paths have to be able to add to it idempotently.
  */
 export declare function oauthAccessTokenDeviceColumnsSql(): string[];
+/**
+ * Nullable delegation metadata for OAuth-provider access tokens.
+ *
+ * Personal access tokens deliberately leave every column null. A provider
+ * token fills all four from the immutable consent grant, which lets resource
+ * authorization distinguish delegated access from a first-party session
+ * without overloading token scopes or the polymorphic owner columns.
+ */
+export declare function oauthAccessTokenDelegationColumnsSql(): string[];
+/** Nullable rotation-family metadata used only by delegated refresh tokens. */
+export declare function oauthRefreshTokenDelegationColumnsSql(): string[];
 /**
  * Defensive ALTER guaranteeing `password_resets.expires_at`.
  *

package/dist/auth-tables.js

@@ -1,4 +1,4 @@
-import{randomBytes}from"node:crypto";import{log}from"@stacksjs/logging";import{env as envVars}from"@stacksjs/env";import{makeHash}from"@stacksjs/security";import{db}from"./utils";import{sqlHelpers}from"./sql-helpers";import{indexSqlForDialect,isDuplicateColumnError,isDuplicateIndexError}from"./dialect";function getDbDriver(){return envVars.DB_CONNECTION||"sqlite"}export const AUTH_TABLES=["oauth_clients","oauth_access_tokens","oauth_refresh_tokens","password_resets","email_verifications","passkeys","webauthn_challenges","two_factor_challenges","two_factor_pending_secrets"];export function usersEmailVerifiedAtSql(sql){return`ALTER TABLE users ADD COLUMN email_verified_at ${sql.nullableTimestamp}`}export function usersPasswordChangedAtSql(sql){return`ALTER TABLE users ADD COLUMN password_changed_at ${sql.nullableTimestamp}`}export function usersTwoFactorColumnsSql(sql){return["ALTER TABLE users ADD COLUMN two_factor_secret VARCHAR(255)",`ALTER TABLE users ADD COLUMN two_factor_enabled BOOLEAN NOT NULL DEFAULT ${sql.boolFalse}`,"ALTER TABLE users ADD COLUMN two_factor_last_used_step BIGINT"]}export function usersStripeIdSql(){return"ALTER TABLE users ADD COLUMN stripe_id VARCHAR(255)"}export function oauthAccessTokenTokenableColumnsSql(){return["ALTER TABLE oauth_access_tokens ADD COLUMN tokenable_type VARCHAR(255)","ALTER TABLE oauth_access_tokens ADD COLUMN tokenable_id INTEGER"]}export function oauthAccessTokenTokenableBackfillSql(usersTable="users"){return[`UPDATE oauth_access_tokens SET tokenable_type = '${usersTable}', tokenable_id = user_id WHERE tokenable_id IS NULL`]}export function oauthAccessTokenDeviceColumnsSql(){return["ALTER TABLE oauth_access_tokens ADD COLUMN user_agent VARCHAR(255)","ALTER TABLE oauth_access_tokens ADD COLUMN ip_address VARCHAR(45)"]}export function passwordResetsExpiresAtSql(){return["ALTER TABLE password_resets ADD COLUMN expires_at TIMESTAMP"]}export async function ensureUsersAuthColumns(sql,options={}){const alters=[usersEmailVerifiedAtSql(sql),usersPasswordChangedAtSql(sql),...usersTwoFactorColumnsSql(sql),usersStripeIdSql()];for(const alterSql of alters)try{await db.unsafe(alterSql).execute()}catch{if(options.verbose)log.debug(`[auth-tables] Skipped (already applied or users missing): ${alterSql}`)}try{await db.unsafe(indexSqlForDialect("CREATE UNIQUE INDEX IF NOT EXISTS idx_users_stripe_id ON users(stripe_id)",getDbDriver())).execute()}catch{if(options.verbose)log.debug("[auth-tables] Skipped users.stripe_id unique index (already applied or users missing)")}}export async function migrateAuthTables(options={}){const dbDriver=getDbDriver(),sql=sqlHelpers(dbDriver),{isPostgres,boolTrue,now,pkColumn,nullableTimestamp,datetime,utcNow}=sql;if(options.verbose)log.info(`Creating auth tables for ${dbDriver}...`);try{if(options.verbose)log.info("Creating oauth_clients table...");await db.unsafe(`
+import{randomBytes}from"node:crypto";import{log}from"@stacksjs/logging";import{env as envVars}from"@stacksjs/env";import{makeHash}from"@stacksjs/security";import{db}from"./utils";import{sqlHelpers}from"./sql-helpers";import{indexSqlForDialect,isDuplicateColumnError,isDuplicateIndexError}from"./dialect";function getDbDriver(){return envVars.DB_CONNECTION||"sqlite"}export const AUTH_TABLES=["oauth_clients","oauth_grants","oauth_auth_codes","oauth_authorization_requests","oauth_access_tokens","oauth_refresh_tokens","password_resets","email_verifications","passkeys","webauthn_challenges","two_factor_challenges","two_factor_pending_secrets"];export function usersEmailVerifiedAtSql(sql){return`ALTER TABLE users ADD COLUMN email_verified_at ${sql.nullableTimestamp}`}export function usersPasswordChangedAtSql(sql){return`ALTER TABLE users ADD COLUMN password_changed_at ${sql.nullableTimestamp}`}export function usersTwoFactorColumnsSql(sql){return["ALTER TABLE users ADD COLUMN two_factor_secret VARCHAR(255)",`ALTER TABLE users ADD COLUMN two_factor_enabled BOOLEAN NOT NULL DEFAULT ${sql.boolFalse}`,"ALTER TABLE users ADD COLUMN two_factor_last_used_step BIGINT"]}export function usersStripeIdSql(){return"ALTER TABLE users ADD COLUMN stripe_id VARCHAR(255)"}export function oauthClientProviderColumnsSql(){return["ALTER TABLE oauth_clients ADD COLUMN client_type VARCHAR(20)","ALTER TABLE oauth_clients ADD COLUMN redirect_uris TEXT","ALTER TABLE oauth_clients ADD COLUMN grant_types TEXT","ALTER TABLE oauth_clients ADD COLUMN token_endpoint_auth_method VARCHAR(32)","ALTER TABLE oauth_clients ADD COLUMN allowed_scopes TEXT","ALTER TABLE oauth_clients ADD COLUMN allowed_resources TEXT"]}export function oauthAccessTokenTokenableColumnsSql(){return["ALTER TABLE oauth_access_tokens ADD COLUMN tokenable_type VARCHAR(255)","ALTER TABLE oauth_access_tokens ADD COLUMN tokenable_id INTEGER"]}export function oauthAccessTokenTokenableBackfillSql(usersTable="users"){return[`UPDATE oauth_access_tokens SET tokenable_type = '${usersTable}', tokenable_id = user_id WHERE tokenable_id IS NULL`]}export function oauthAccessTokenDeviceColumnsSql(){return["ALTER TABLE oauth_access_tokens ADD COLUMN user_agent VARCHAR(255)","ALTER TABLE oauth_access_tokens ADD COLUMN ip_address VARCHAR(45)"]}export function oauthAccessTokenDelegationColumnsSql(){return["ALTER TABLE oauth_access_tokens ADD COLUMN oauth_grant_id VARCHAR(32)","ALTER TABLE oauth_access_tokens ADD COLUMN resources TEXT","ALTER TABLE oauth_access_tokens ADD COLUMN audiences TEXT","ALTER TABLE oauth_access_tokens ADD COLUMN workspace_id VARCHAR(255)"]}export function oauthRefreshTokenDelegationColumnsSql(){return["ALTER TABLE oauth_refresh_tokens ADD COLUMN family_id VARCHAR(64)","ALTER TABLE oauth_refresh_tokens ADD COLUMN parent_id BIGINT"]}export function passwordResetsExpiresAtSql(){return["ALTER TABLE password_resets ADD COLUMN expires_at TIMESTAMP"]}export async function ensureUsersAuthColumns(sql,options={}){const alters=[usersEmailVerifiedAtSql(sql),usersPasswordChangedAtSql(sql),...usersTwoFactorColumnsSql(sql),usersStripeIdSql()];for(const alterSql of alters)try{await db.unsafe(alterSql).execute()}catch{if(options.verbose)log.debug(`[auth-tables] Skipped (already applied or users missing): ${alterSql}`)}try{await db.unsafe(indexSqlForDialect("CREATE UNIQUE INDEX IF NOT EXISTS idx_users_stripe_id ON users(stripe_id)",getDbDriver())).execute()}catch{if(options.verbose)log.debug("[auth-tables] Skipped users.stripe_id unique index (already applied or users missing)")}}export async function migrateAuthTables(options={}){const dbDriver=getDbDriver(),sql=sqlHelpers(dbDriver),{isPostgres,boolTrue,now,pkColumn,nullableTimestamp,datetime,utcNow}=sql;if(options.verbose)log.info(`Creating auth tables for ${dbDriver}...`);try{if(options.verbose)log.info("Creating oauth_clients table...");await db.unsafe(`
       CREATE TABLE IF NOT EXISTS oauth_clients (
         ${pkColumn},
         user_id BIGINT,
@@ -6,13 +6,68 @@ import{randomBytes}from"node:crypto";import{log}from"@stacksjs/logging";import{e
         secret VARCHAR(100),
         provider VARCHAR(255),
         redirect VARCHAR(2000) NOT NULL,
+        client_type VARCHAR(20),
+        redirect_uris TEXT,
+        grant_types TEXT,
+        token_endpoint_auth_method VARCHAR(32),
+        allowed_scopes TEXT,
+        allowed_resources TEXT,
         personal_access_client BOOLEAN NOT NULL DEFAULT ${sql.boolFalse},
         password_client BOOLEAN NOT NULL DEFAULT ${sql.boolFalse},
         revoked BOOLEAN NOT NULL DEFAULT ${sql.boolFalse},
         created_at ${datetime} DEFAULT ${utcNow},
         updated_at ${nullableTimestamp}
       )
-    `).execute();try{await db.unsafe("ALTER TABLE oauth_clients ADD COLUMN user_id BIGINT").execute()}catch(error){if(!isDuplicateColumnError(error))throw error}if(options.verbose)log.info("Creating oauth_access_tokens table...");await db.unsafe(`
+    `).execute();try{await db.unsafe("ALTER TABLE oauth_clients ADD COLUMN user_id BIGINT").execute()}catch(error){if(!isDuplicateColumnError(error))throw error}for(const alterSql of oauthClientProviderColumnsSql())try{await db.unsafe(alterSql).execute()}catch(error){if(!isDuplicateColumnError(error))throw error}if(options.verbose)log.info("Creating oauth_grants table...");await db.unsafe(`
+      CREATE TABLE IF NOT EXISTS oauth_grants (
+        id VARCHAR(32) PRIMARY KEY,
+        client_id BIGINT NOT NULL,
+        subject_type VARCHAR(255) NOT NULL,
+        subject_id BIGINT NOT NULL,
+        scopes TEXT NOT NULL,
+        resources TEXT NOT NULL,
+        audiences TEXT NOT NULL,
+        workspace_id VARCHAR(255),
+        revoked_at ${nullableTimestamp},
+        created_at ${datetime} DEFAULT ${utcNow},
+        updated_at ${nullableTimestamp}
+      )
+    `).execute();try{await db.unsafe(indexSqlForDialect("CREATE INDEX IF NOT EXISTS idx_oauth_grants_subject ON oauth_grants(client_id, subject_type, subject_id)",dbDriver)).execute()}catch(error){if(!isDuplicateIndexError(error))throw error}if(options.verbose)log.info("Creating oauth_auth_codes table...");await db.unsafe(`
+      CREATE TABLE IF NOT EXISTS oauth_auth_codes (
+        code_hash VARCHAR(64) PRIMARY KEY,
+        grant_id VARCHAR(32) NOT NULL,
+        client_id BIGINT NOT NULL,
+        subject_type VARCHAR(255) NOT NULL,
+        subject_id BIGINT NOT NULL,
+        redirect_uri VARCHAR(2000) NOT NULL,
+        scopes TEXT NOT NULL,
+        resources TEXT NOT NULL,
+        audiences TEXT NOT NULL,
+        workspace_id VARCHAR(255),
+        code_challenge VARCHAR(43) NOT NULL,
+        code_challenge_method VARCHAR(10) NOT NULL,
+        expires_at ${datetime} NOT NULL,
+        consumed_at ${nullableTimestamp},
+        created_at ${datetime} DEFAULT ${utcNow}
+      )
+    `).execute();try{await db.unsafe("ALTER TABLE oauth_auth_codes ADD COLUMN grant_id VARCHAR(32)").execute()}catch(error){if(!isDuplicateColumnError(error))throw error}for(const statement of["CREATE INDEX IF NOT EXISTS idx_oauth_auth_codes_client_id ON oauth_auth_codes(client_id)","CREATE INDEX IF NOT EXISTS idx_oauth_auth_codes_grant_id ON oauth_auth_codes(grant_id)","CREATE INDEX IF NOT EXISTS idx_oauth_auth_codes_expires_at ON oauth_auth_codes(expires_at)"])try{await db.unsafe(indexSqlForDialect(statement,dbDriver)).execute()}catch(error){if(!isDuplicateIndexError(error))throw error}if(options.verbose)log.info("Creating oauth_authorization_requests table...");await db.unsafe(`
+      CREATE TABLE IF NOT EXISTS oauth_authorization_requests (
+        request_hash VARCHAR(64) PRIMARY KEY,
+        browser_session_hash VARCHAR(64) NOT NULL,
+        client_id BIGINT NOT NULL,
+        client_type VARCHAR(20) NOT NULL,
+        redirect_uri VARCHAR(2000) NOT NULL,
+        scopes TEXT NOT NULL,
+        resources TEXT NOT NULL,
+        audiences TEXT NOT NULL,
+        state TEXT,
+        code_challenge VARCHAR(43) NOT NULL,
+        code_challenge_method VARCHAR(10) NOT NULL,
+        expires_at ${datetime} NOT NULL,
+        consumed_at ${nullableTimestamp},
+        created_at ${datetime} DEFAULT ${utcNow}
+      )
+    `).execute();for(const statement of["CREATE INDEX IF NOT EXISTS idx_oauth_authorization_requests_client_id ON oauth_authorization_requests(client_id)","CREATE INDEX IF NOT EXISTS idx_oauth_authorization_requests_expires_at ON oauth_authorization_requests(expires_at)"])try{await db.unsafe(indexSqlForDialect(statement,dbDriver)).execute()}catch(error){if(!isDuplicateIndexError(error))throw error}if(options.verbose)log.info("Creating oauth_access_tokens table...");await db.unsafe(`
       CREATE TABLE IF NOT EXISTS oauth_access_tokens (
         ${pkColumn},
         -- The owner, polymorphically: users, authors, any table whose model
@@ -30,6 +85,10 @@ import{randomBytes}from"node:crypto";import{log}from"@stacksjs/logging";import{e
         token TEXT NOT NULL,
         name VARCHAR(255),
         scopes TEXT,
+        oauth_grant_id VARCHAR(32),
+        resources TEXT,
+        audiences TEXT,
+        workspace_id VARCHAR(255),
         revoked BOOLEAN NOT NULL DEFAULT ${sql.boolFalse},
         expires_at ${nullableTimestamp},
         -- What the browser called itself and where it came from, so a person
@@ -40,16 +99,18 @@ import{randomBytes}from"node:crypto";import{log}from"@stacksjs/logging";import{e
         created_at ${datetime} DEFAULT ${utcNow},
         updated_at ${nullableTimestamp}
       )
-    `).execute();await createTokenIndex("idx_oauth_access_tokens_token","oauth_access_tokens","token");for(const alterSql of oauthAccessTokenDeviceColumnsSql())try{await db.unsafe(alterSql).execute()}catch{if(options.verbose)log.debug(`[auth-tables] Skipped (already applied): ${alterSql}`)}for(const alterSql of oauthAccessTokenTokenableColumnsSql())try{await db.unsafe(alterSql).execute()}catch{if(options.verbose)log.debug(`[auth-tables] Skipped (already applied): ${alterSql}`)}for(const backfillSql of oauthAccessTokenTokenableBackfillSql())await db.unsafe(backfillSql).execute();if(options.verbose)log.info("Creating oauth_refresh_tokens table...");await db.unsafe(`
+    `).execute();await createTokenIndex("idx_oauth_access_tokens_token","oauth_access_tokens","token");for(const alterSql of oauthAccessTokenDeviceColumnsSql())try{await db.unsafe(alterSql).execute()}catch{if(options.verbose)log.debug(`[auth-tables] Skipped (already applied): ${alterSql}`)}for(const alterSql of oauthAccessTokenDelegationColumnsSql())try{await db.unsafe(alterSql).execute()}catch(error){if(!isDuplicateColumnError(error))throw error}for(const alterSql of oauthAccessTokenTokenableColumnsSql())try{await db.unsafe(alterSql).execute()}catch{if(options.verbose)log.debug(`[auth-tables] Skipped (already applied): ${alterSql}`)}for(const backfillSql of oauthAccessTokenTokenableBackfillSql())await db.unsafe(backfillSql).execute();if(options.verbose)log.info("Creating oauth_refresh_tokens table...");await db.unsafe(`
       CREATE TABLE IF NOT EXISTS oauth_refresh_tokens (
         ${pkColumn},
         access_token_id INTEGER NOT NULL,
         token TEXT NOT NULL,
+        family_id VARCHAR(64),
+        parent_id BIGINT,
         revoked BOOLEAN NOT NULL DEFAULT ${sql.boolFalse},
         expires_at ${nullableTimestamp},
         created_at ${datetime} DEFAULT ${utcNow}
       )
-    `).execute();await createTokenIndex("idx_oauth_refresh_tokens_token","oauth_refresh_tokens","token");for(const statement of["CREATE INDEX IF NOT EXISTS idx_oauth_access_tokens_owner ON oauth_access_tokens(tokenable_type, tokenable_id)","CREATE INDEX IF NOT EXISTS idx_oauth_refresh_tokens_access_token_id ON oauth_refresh_tokens(access_token_id)"])try{await db.unsafe(indexSqlForDialect(statement,dbDriver)).execute()}catch(error){if(!isDuplicateIndexError(error))throw error}if(options.verbose)log.info("Creating password_resets table...");await db.unsafe(`
+    `).execute();for(const alterSql of oauthRefreshTokenDelegationColumnsSql())try{await db.unsafe(alterSql).execute()}catch(error){if(!isDuplicateColumnError(error))throw error}await createTokenIndex("idx_oauth_refresh_tokens_token","oauth_refresh_tokens","token");for(const statement of["CREATE INDEX IF NOT EXISTS idx_oauth_access_tokens_owner ON oauth_access_tokens(tokenable_type, tokenable_id)","CREATE INDEX IF NOT EXISTS idx_oauth_access_tokens_grant_id ON oauth_access_tokens(oauth_grant_id)","CREATE INDEX IF NOT EXISTS idx_oauth_refresh_tokens_access_token_id ON oauth_refresh_tokens(access_token_id)","CREATE INDEX IF NOT EXISTS idx_oauth_refresh_tokens_family_id ON oauth_refresh_tokens(family_id)"])try{await db.unsafe(indexSqlForDialect(statement,dbDriver)).execute()}catch(error){if(!isDuplicateIndexError(error))throw error}if(options.verbose)log.info("Creating password_resets table...");await db.unsafe(`
       CREATE TABLE IF NOT EXISTS password_resets (
         ${pkColumn},
         email VARCHAR(255) NOT NULL,
@@ -107,10 +168,18 @@ import{randomBytes}from"node:crypto";import{log}from"@stacksjs/logging";import{e
         expires_at ${datetime} NOT NULL,
         created_at ${datetime} DEFAULT ${utcNow}
       )
-    `).execute();if(options.verbose)log.info("Ensuring users auth columns exist (users may not exist yet on a fresh install - see ensureUsersAuthColumns)...");await ensureUsersAuthColumns(sql,options);await db.unsafe(`SELECT id, user_id, name, secret, provider, redirect, personal_access_client,
-      password_client, revoked, created_at, updated_at FROM oauth_clients LIMIT 0`).execute();await db.unsafe(`SELECT id, tokenable_type, tokenable_id, user_id, oauth_client_id,
-      token, name, scopes, revoked, expires_at, user_agent, ip_address, created_at, updated_at
-      FROM oauth_access_tokens LIMIT 0`).execute();await db.unsafe(`SELECT id, access_token_id, token, revoked, expires_at, created_at
+    `).execute();if(options.verbose)log.info("Ensuring users auth columns exist (users may not exist yet on a fresh install - see ensureUsersAuthColumns)...");await ensureUsersAuthColumns(sql,options);await db.unsafe(`SELECT id, user_id, name, secret, provider, redirect, client_type, redirect_uris,
+      grant_types, token_endpoint_auth_method, allowed_scopes, allowed_resources,
+      personal_access_client, password_client, revoked, created_at, updated_at
+      FROM oauth_clients LIMIT 0`).execute();await db.unsafe(`SELECT id, client_id, subject_type, subject_id, scopes, resources, audiences,
+      workspace_id, revoked_at, created_at, updated_at FROM oauth_grants LIMIT 0`).execute();await db.unsafe(`SELECT code_hash, grant_id, client_id, subject_type, subject_id, redirect_uri, scopes,
+      resources, audiences, workspace_id, code_challenge, code_challenge_method, expires_at,
+      consumed_at, created_at FROM oauth_auth_codes LIMIT 0`).execute();await db.unsafe(`SELECT request_hash, browser_session_hash, client_id, client_type, redirect_uri,
+      scopes, resources, audiences, state, code_challenge, code_challenge_method,
+      expires_at, consumed_at, created_at FROM oauth_authorization_requests LIMIT 0`).execute();await db.unsafe(`SELECT id, tokenable_type, tokenable_id, user_id, oauth_client_id,
+      token, name, scopes, oauth_grant_id, resources, audiences, workspace_id, revoked, expires_at,
+      user_agent, ip_address, created_at, updated_at
+      FROM oauth_access_tokens LIMIT 0`).execute();await db.unsafe(`SELECT id, access_token_id, token, family_id, parent_id, revoked, expires_at, created_at
       FROM oauth_refresh_tokens LIMIT 0`).execute();if(options.verbose)log.info("Ensuring personal access client exists...");if((await db.unsafe(`
       SELECT id FROM oauth_clients
       WHERE personal_access_client = ${boolTrue} AND revoked = ${sql.boolFalse} LIMIT 1

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/database",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.14",
+  "version": "0.75.16",
   "description": "The Stacks database integration.",
   "author": "Chris Breuer",
   "contributors": [
@@ -66,26 +66,26 @@
     "prepublishOnly": "bun run build"
   },
   "dependencies": {
-    "@stacksjs/config": "0.75.14",
-    "@stacksjs/env": "0.75.14",
-    "@stacksjs/error-handling": "0.75.14",
-    "@stacksjs/faker": "^0.75.14",
-    "@stacksjs/features": "0.75.14",
-    "@stacksjs/logging": "0.75.14",
-    "@stacksjs/model-meta": "0.75.14",
-    "@stacksjs/path": "0.75.14",
-    "@stacksjs/query-builder": "^0.75.14",
-    "@stacksjs/security": "0.75.14",
-    "@stacksjs/storage": "0.75.14",
-    "@stacksjs/strings": "0.75.14",
+    "@stacksjs/config": "0.75.16",
+    "@stacksjs/env": "0.75.16",
+    "@stacksjs/error-handling": "0.75.16",
+    "@stacksjs/faker": "^0.75.16",
+    "@stacksjs/features": "0.75.16",
+    "@stacksjs/logging": "0.75.16",
+    "@stacksjs/model-meta": "0.75.16",
+    "@stacksjs/path": "0.75.16",
+    "@stacksjs/query-builder": "^0.75.16",
+    "@stacksjs/security": "0.75.16",
+    "@stacksjs/storage": "0.75.16",
+    "@stacksjs/strings": "0.75.16",
     "@stacksjs/ts-validation": "^0.5.6",
     "bun-query-builder": "^0.3.0",
     "dynamodb-tooling": "^0.3.2"
   },
   "devDependencies": {
-    "@stacksjs/cli": "0.75.14",
-    "@stacksjs/router": "0.75.14",
-    "@stacksjs/utils": "0.75.14",
+    "@stacksjs/cli": "0.75.16",
+    "@stacksjs/router": "0.75.16",
+    "@stacksjs/utils": "0.75.16",
     "better-dx": "^0.2.24"
   }
 }