@stacksjs/defaults 0.75.63 → 0.75.65

package/app/Actions/Storefront/PlaceOrderAction.ts

@@ -1,4 +1,4 @@
-import { Action } from '@stacksjs/actions'
+import { Action } from '@stacksjs/actions/runtime'
 import { config } from '@stacksjs/config'
 import { db } from '@stacksjs/database/runtime'
 import { response } from '@stacksjs/router'

package/app/Actions/Storefront/SubmitReviewAction.ts

@@ -1,4 +1,4 @@
-import { Action } from '@stacksjs/actions'
+import { Action } from '@stacksjs/actions/runtime'
 import { db } from '@stacksjs/database/runtime'
 import { rateLimit, response } from '@stacksjs/router'
 import { readCartCookie } from '../../Storefront/CartCookie'

package/app/Actions/Storefront/UpdateCartItemAction.ts

@@ -1,4 +1,4 @@
-import { Action } from '@stacksjs/actions'
+import { Action } from '@stacksjs/actions/runtime'
 import { db } from '@stacksjs/database/runtime'
 import { response } from '@stacksjs/router'
 import { readCartCookie } from '../../Storefront/CartCookie'

package/app/Actions/SubscriberEmailAction.ts

@@ -1,4 +1,4 @@
-import { Action } from '@stacksjs/actions'
+import { Action } from '@stacksjs/actions/runtime'
 import { isUniqueViolation, Subscriber, SubscriberEmail } from '@stacksjs/orm'
 import { rateLimit } from '@stacksjs/router'
 import { sendSubscriptionConfirmation } from '../Mail/SubscriptionConfirmation'

package/app/Actions/Teams/AcceptInvitationAction.ts

@@ -1,6 +1,6 @@
 import type { RequestInstance } from '@stacksjs/types'
 import { randomUUID } from 'node:crypto'
-import { Action } from '@stacksjs/actions'
+import { Action } from '@stacksjs/actions/runtime'
 import { resolveAuthenticatedUser } from '@stacksjs/auth'
 import { db } from '@stacksjs/database/runtime'
 import { response } from '@stacksjs/router'

package/app/Actions/Teams/ShowInvitationAction.ts

@@ -1,5 +1,5 @@
 import type { RequestInstance } from '@stacksjs/types'
-import { Action } from '@stacksjs/actions'
+import { Action } from '@stacksjs/actions/runtime'
 import { db } from '@stacksjs/database/runtime'
 import { response } from '@stacksjs/router'
 import { hashInvitationToken, invitationStatus } from '../Dashboard/Teams/team-records'

package/app/Actions/UnsubscribeAction.ts

@@ -1,4 +1,4 @@
-import { Action } from '@stacksjs/actions'
+import { Action } from '@stacksjs/actions/runtime'
 import { EmailList, EmailListSubscriber, Subscriber } from '@stacksjs/orm'
 
 export default new Action({

package/app/Actions/UploadTestAction.ts

@@ -1,4 +1,4 @@
-import { Action } from '@stacksjs/actions'
+import { Action } from '@stacksjs/actions/runtime'
 
 interface Request {
   file: (key: string) => any

package/app/Middleware/Throttle.ts

@@ -1,13 +1,40 @@
-import { createRateLimitMiddleware, Middleware, parseThrottleString } from '@stacksjs/router'
+import { clientAddress, createRateLimitMiddleware, Middleware, parseThrottleString } from '@stacksjs/router'
 
 // Cache for rate limiters to avoid creating new instances for each request
 const limiterCache = new Map<string, ReturnType<typeof createRateLimitMiddleware>>()
 
+const RATE_LIMIT_HEADERS = ['X-RateLimit-Limit', 'X-RateLimit-Remaining', 'X-RateLimit-Reset'] as const
+
+/**
+ * Whose budget a request spends.
+ *
+ * A signed-in request spends its user's: the Auth middleware stamps
+ * `_authenticatedUser`, and Throttle runs after it (priority 2 to Auth's 1),
+ * so people sharing an address - an office, a phone carrier's NAT, every test
+ * user on 127.0.0.1 - do not exhaust each other. bun-router's own default
+ * reads `request.user.id`, which on a Stacks request is the async `user()`
+ * accessor, so it never saw a user and every request fell through to an
+ * address.
+ *
+ * Anything else spends its client address's, as `clientAddress()` resolves
+ * it: the socket peer, or - only when that peer is a trusted proxy - the
+ * forwarding headers it vouches for (`CF-Connecting-IP` only when the hop
+ * that delivered the request is Cloudflare). A client-written
+ * `X-Forwarded-For` no longer buys a fresh budget.
+ */
+function throttleKey(request: { _authenticatedUser?: unknown }): string {
+  const user = request._authenticatedUser as { id?: unknown } | null | undefined
+  const id = user?.id
+  if ((typeof id === 'number' && Number.isFinite(id)) || (typeof id === 'string' && id !== ''))
+    return `user:${id}`
+  return `ip:${clientAddress(request as unknown as Request) ?? 'unknown'}`
+}
+
 /**
  * Throttle Middleware
  *
- * Rate limits requests based on IP address or authenticated user.
- * Uses Laravel-style throttle patterns.
+ * Rate limits requests per authenticated user, or per client address for
+ * anonymous requests (see `throttleKey`). Uses Laravel-style throttle patterns.
  *
  * Usage:
  *   .middleware('throttle:60,1')     // 60 requests per 1 minute
@@ -29,7 +56,7 @@ const limiterCache = new Map<string, ReturnType<typeof createRateLimitMiddleware
  *   "retryAfter": X
  * }
  *
- * Headers added to all responses:
+ * Headers added to all responses (successful ones via `_responseHeaders`):
  *   - X-RateLimit-Limit: Maximum requests allowed
  *   - X-RateLimit-Remaining: Remaining requests in current window
  *   - X-RateLimit-Reset: Unix timestamp when the limit resets
@@ -37,7 +64,9 @@ const limiterCache = new Map<string, ReturnType<typeof createRateLimitMiddleware
  */
 export default new Middleware({
   name: 'throttle',
-  priority: 1, // Run early, after maintenance but before auth
+  // After Auth (1), so an authenticated request is keyed on its user rather
+  // than on an address it may share with strangers.
+  priority: 2,
 
   async handle(request) {
     // Get throttle params from middleware params (e.g., '60,1' from 'throttle:60,1')
@@ -48,24 +77,25 @@ export default new Middleware({
     if (!limiter) {
       try {
         const config = parseThrottleString(params as Parameters<typeof parseThrottleString>[0])
-        limiter = createRateLimitMiddleware(config, `throttle:${params}`)
+        limiter = createRateLimitMiddleware({ ...config, keyGenerator: throttleKey }, `throttle:${params}`)
         limiterCache.set(params, limiter)
       }
       catch (error) {
         console.error(`[Throttle] Invalid throttle pattern: ${params}`, error)
         // Use default if pattern is invalid
         const defaultConfig = parseThrottleString('60,1')
-        limiter = createRateLimitMiddleware(defaultConfig, 'throttle:default')
+        limiter = createRateLimitMiddleware({ ...defaultConfig, keyGenerator: throttleKey }, 'throttle:default')
         limiterCache.set(params, limiter)
       }
     }
 
-    // Create a next function that continues the request
-    // The middleware will handle rate limiting and return 429 if needed
-    const result = await limiter(request as any, async () => null)
+    // The limiter stamps its X-RateLimit-* headers onto whatever `next()`
+    // answers, so hand it a placeholder and read them back. Passing `null`
+    // here meant a request that got through never learned its budget.
+    const result = await limiter(request as any, async () => new Response(null, { status: 204 }))
 
-    // If result is a Response (429), throw it to short-circuit the request
-    if (result instanceof Response) {
+    // A 429 short-circuits the request
+    if (result instanceof Response && result.status === 429) {
       // Transform the response to match stacks format
       const retryAfter = result.headers.get('Retry-After') || '60'
 
@@ -90,6 +120,15 @@ export default new Middleware({
       })
     }
 
-    // Continue normally - rate limit not exceeded
+    // Within the limit: ask the router to put the budget on the real response.
+    if (result instanceof Response) {
+      const headers: Record<string, string> = { ...request._responseHeaders }
+      for (const name of RATE_LIMIT_HEADERS) {
+        const value = result.headers.get(name)
+        if (value !== null)
+          headers[name] = value
+      }
+      request._responseHeaders = headers
+    }
   },
 })

package/app/Models/Activity.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'Activity',

package/app/Models/AnalyticsEvent.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'AnalyticsEvent',

package/app/Models/Automation.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'Automation',

package/app/Models/AutomationRun.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'AutomationRun',

package/app/Models/Board.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 /**
  * Kanban board (stacksjs/stacks#1846).

package/app/Models/BoardColumn.ts

@@ -1,5 +1,5 @@
 import { defineModel, parentOwnership } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 /**
  * Column on a kanban board (stacksjs/stacks#1846).

package/app/Models/Campaign.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'Campaign',

package/app/Models/CampaignSend.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'CampaignSend',

package/app/Models/CampaignVariant.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'CampaignVariant',

package/app/Models/Card.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 /**
  * Kanban card (stacksjs/stacks#1846).

package/app/Models/CardComment.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 /**
  * Card comment for the dashboard Kanban surface.

package/app/Models/Comment.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'Comment',

package/app/Models/CommunicationSuppression.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'CommunicationSuppression',

package/app/Models/ConsentEvent.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'ConsentEvent',

package/app/Models/Content/Author.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'Author', // defaults to the sanitized file name

package/app/Models/Content/Categorizable.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 // The CMS catalogue already exists in categorizables. Commerce's Category
 // model owns a different table and its IDs cannot be used by this pivot.

package/app/Models/Content/Menu.ts

@@ -1,5 +1,5 @@
 import { defineModel, siteOwnership } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 /**
  * A named navigation slot on a site - `main`, `footer`, `portal`. The items

package/app/Models/Content/MenuItem.ts

@@ -1,5 +1,5 @@
 import { defineModel, parentOwnership } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 /**
  * One entry in a Menu: either a link to a Page (`pageId`) or a raw `url` -

package/app/Models/Content/Page.ts

@@ -1,5 +1,5 @@
 import { defineModel, siteOwnership } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 /**
  * A real CMS page: a block document served publicly at `path` on its site.

package/app/Models/Content/PageRevision.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 /**
  * A snapshot of a Page's document taken just before an overwrite - restoring

package/app/Models/Content/Post.ts

@@ -1,5 +1,5 @@
 import { defineModel, siteOwnership } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'Post',

package/app/Models/Content/Redirect.ts

@@ -1,5 +1,5 @@
 import { defineModel, siteOwnership } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 /**
  * A path-level redirect on a site. Written automatically when a page's slug

package/app/Models/Deployment.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'Deployment',

package/app/Models/EmailIdempotency.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'EmailIdempotency',

package/app/Models/EmailList.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'EmailList',

package/app/Models/EmailListSubscriber.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 /**
  * Pivot row between Subscriber and EmailList.

package/app/Models/EmailSuppression.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'EmailSuppression',

package/app/Models/EmailWebhookEvent.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'EmailWebhookEvent',

package/app/Models/Error.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'Error',

package/app/Models/FailedJob.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'FailedJob',

package/app/Models/Forms/Form.ts

@@ -1,5 +1,5 @@
 import { defineModel, siteOwnership } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 /**
  * A user-defined form: inquiry, permission slip, event registration,

package/app/Models/Forms/FormField.ts

@@ -1,5 +1,5 @@
 import { defineModel, parentOwnership } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 /**
  * One field of a Form. `name` is the machine key submissions store values

package/app/Models/Forms/FormSubmission.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 /**
  * One submission of a Form. `values` is the validated field map; `email` and

package/app/Models/GdprRequest.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 /**
  * The ledger of data-subject requests (stacksjs/stacks#365).

package/app/Models/Job.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'Job',

package/app/Models/Label.ts

@@ -1,5 +1,5 @@
 import { defineModel, parentOwnership } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 /**
  * Card label / tag (stacksjs/stacks#1846).

package/app/Models/Log.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'Log',

package/app/Models/MagicLinkToken.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 /**
  * A single-use passwordless sign-in token. `token` stores the SHA-256 of the

package/app/Models/MailPreference.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'MailPreference',

package/app/Models/Notification.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'Notification',

package/app/Models/NotificationDelivery.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'NotificationDelivery',

package/app/Models/PaymentMethod.ts

@@ -1,7 +1,7 @@
 import { defineModel } from '@stacksjs/orm'
 import { collect } from '@stacksjs/collections'
 
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'PaymentMethod', // defaults to the sanitized file name

package/app/Models/PaymentProduct.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'PaymentProduct', // defaults to the sanitized file name

package/app/Models/PaymentTransaction.ts

@@ -1,7 +1,7 @@
 import { defineModel } from '@stacksjs/orm'
 import { collect } from '@stacksjs/collections'
 
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'PaymentTransaction', // defaults to the sanitized file name

package/app/Models/PersonalAccessToken.ts

@@ -1,5 +1,5 @@
 import { defineModel, selfOwnership } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 /**
  * A named API token belonging to a user - the Sanctum shape.

package/app/Models/QueryLog.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'QueryLog',

package/app/Models/Referral.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'Referral',

package/app/Models/ReferralCode.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'ReferralCode',

package/app/Models/Release.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'Release',

package/app/Models/Request.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'Request',

package/app/Models/SenderDomain.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 export default defineModel({
   name: 'SenderDomain',

package/app/Models/Site.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 /**
  * A public web property served by this app: one host (subdomain of

package/app/Models/SiteDomain.ts

@@ -1,5 +1,5 @@
 import { defineModel, siteOwnership } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 /**
  * A custom domain routed to a Site. Only rows with `verifiedAt` set resolve

package/app/Models/SmsOptOut.ts

@@ -1,5 +1,5 @@
 import { defineModel } from '@stacksjs/orm'
-import { schema } from '@stacksjs/validation'
+import { schema } from '@stacksjs/validation/runtime'
 
 /**
  * A phone number that texted STOP. Keyed by NUMBER, not user - the reply