@stacksjs/router 0.70.87 → 0.70.90

package/dist/api-shape.js

@@ -0,0 +1,11 @@
+export const JSON_CONTENT_TYPE = /^application\/(?:json|.+\+json)(?:;|$)/i;
+export function isApiRequest(req) {
+  const headers = req.headers, contentType = headers.get("content-type") || "";
+  if (JSON_CONTENT_TYPE.test(contentType))
+    return !0;
+  if (headers.get("sec-fetch-dest") === "document")
+    return !1;
+  if ((headers.get("accept") || "").includes("text/html"))
+    return !1;
+  return !0;
+}

package/dist/encrypted-session-store.js

@@ -0,0 +1,73 @@
+import { decrypt, encrypt } from "@stacksjs/security";
+
+export class EncryptedSessionStore {
+  inner;
+  opts;
+  constructor(inner, opts = {}) {
+    this.inner = inner;
+    this.opts = opts;
+  }
+  async set(sid, session, ttl) {
+    const envelope = await this.wrap(sid, session);
+    await this.inner.set(sid, envelope, ttl);
+  }
+  async touch(sid, session, ttl) {
+    const envelope = await this.wrap(sid, session);
+    if (this.inner.touch)
+      await this.inner.touch(sid, envelope, ttl);
+    else
+      await this.inner.set(sid, envelope, ttl);
+  }
+  async get(sid) {
+    const stored = await this.inner.get(sid);
+    if (!stored)
+      return null;
+    return this.unwrap(stored);
+  }
+  destroy(sid) {
+    return this.inner.destroy(sid);
+  }
+  async all() {
+    const wrapped = await this.inner.all?.() ?? {}, out = {};
+    for (const [sid, envelope] of Object.entries(wrapped)) {
+      const decrypted = await this.unwrap(envelope);
+      if (decrypted)
+        out[sid] = decrypted;
+    }
+    return out;
+  }
+  async length() {
+    if (this.inner.length)
+      return this.inner.length();
+    return Object.keys(await this.all()).length;
+  }
+  async clear() {
+    if (this.inner.clear)
+      return this.inner.clear();
+    const sessions = await this.inner.all?.() ?? {};
+    await Promise.all(Object.keys(sessions).map((sid) => this.inner.destroy(sid)));
+  }
+  async wrap(sid, session) {
+    const { id, ...rest } = session, ciphertext = await encrypt(JSON.stringify(rest), this.opts.appKey);
+    return {
+      _enc: !0,
+      id: id ?? sid,
+      data: ciphertext
+    };
+  }
+  async unwrap(stored) {
+    if (!stored || typeof stored !== "object")
+      return null;
+    const candidate = stored;
+    if (candidate._enc === !0 && typeof candidate.data === "string")
+      try {
+        const decrypted = await decrypt(candidate.data, this.opts.appKey), parsed = JSON.parse(decrypted);
+        if (candidate.id !== void 0)
+          parsed.id = candidate.id;
+        return parsed;
+      } catch {
+        return null;
+      }
+    return candidate;
+  }
+}

package/dist/error-handler.js

@@ -0,0 +1,310 @@
+import process from "node:process";
+import { log } from "@stacksjs/logging";
+import {
+  createErrorHandler,
+  renderProductionErrorPage
+} from "@stacksjs/error-handling";
+import { isApiRequest } from "./api-shape";
+import { getCurrentRequest } from "./request-context";
+function buildErrorJson(opts) {
+  const body = {
+    error: opts.error,
+    message: opts.message,
+    status: opts.status,
+    timestamp: new Date().toISOString()
+  };
+  if (opts.details)
+    body.details = opts.details;
+  return JSON.stringify(body);
+}
+function isDebugAllowed() {
+  const appEnv = (process.env.APP_ENV ?? "").toLowerCase();
+  if (appEnv === "development")
+    return !0;
+  if (!appEnv && process.env.NODE_ENV === "development")
+    return !0;
+  return !1;
+}
+function getJsonHeaders() {
+  return { "Content-Type": "application/json" };
+}
+function getJsonHeadersFull() {
+  return getJsonHeaders();
+}
+const MAX_QUERIES = 50, N1_THRESHOLD = 5;
+function newQueryTrack() {
+  return {
+    buffer: Array(MAX_QUERIES).fill(null),
+    writeIndex: 0,
+    count: 0,
+    shapeCounts: new Map,
+    n1Warned: new Set
+  };
+}
+const REQUEST_QUERY_TRACK_KEY = Symbol.for("stacks.queryTracking");
+let fallbackTrack = newQueryTrack();
+function getQueryTrack() {
+  const req = getCurrentRequest();
+  if (!req)
+    return fallbackTrack;
+  let track = req[REQUEST_QUERY_TRACK_KEY];
+  if (!track) {
+    track = newQueryTrack();
+    req[REQUEST_QUERY_TRACK_KEY] = track;
+  }
+  return track;
+}
+function normalizeQueryShape(query) {
+  return query.replace(/'(?:[^']|'')*'/g, "?").replace(/"(?:[^"]|"")*"/g, "?").replace(/\b\d+(?:\.\d+)?\b/g, "?").replace(/IN\s*\([^)]*\)/gi, "IN (?)").replace(/\s+/g, " ").trim().toUpperCase();
+}
+export function trackQuery(query, time, connection) {
+  const track = getQueryTrack();
+  track.buffer[track.writeIndex] = { query, time, connection };
+  track.writeIndex = (track.writeIndex + 1) % MAX_QUERIES;
+  if (track.count < MAX_QUERIES)
+    track.count++;
+  if (!isDebugAllowed())
+    return;
+  const shape = normalizeQueryShape(query);
+  if (shape.startsWith("INSERT INTO QUERY_LOGS") || shape.startsWith("EXPLAIN"))
+    return;
+  const next = (track.shapeCounts.get(shape) ?? 0) + 1;
+  track.shapeCounts.set(shape, next);
+  if (next === N1_THRESHOLD + 1 && !track.n1Warned.has(shape)) {
+    track.n1Warned.add(shape);
+    import("@stacksjs/logging").then(({ log }) => {
+      log.warn(`[orm] Possible N+1 \u2014 query shape ran ${next}\xD7 in this request:
+  ${shape}
+  Hint: load related rows with .with('relation') or eager-load via includes() before iterating.`);
+    }).catch(() => {});
+  }
+}
+function getRecentQueries() {
+  const track = getQueryTrack();
+  if (track.count === 0)
+    return [];
+  const result = [], start = track.count < MAX_QUERIES ? 0 : track.writeIndex;
+  for (let i = 0;i < track.count; i++) {
+    const entry = track.buffer[(start + i) % MAX_QUERIES];
+    if (entry)
+      result.push(entry);
+  }
+  return result;
+}
+export function getQueryShapeCounts() {
+  return new Map(getQueryTrack().shapeCounts);
+}
+export function clearTrackedQueries() {
+  const req = getCurrentRequest();
+  if (req && req[REQUEST_QUERY_TRACK_KEY]) {
+    req[REQUEST_QUERY_TRACK_KEY] = newQueryTrack();
+    return;
+  }
+  fallbackTrack = newQueryTrack();
+}
+function getErrorHandlerConfig() {
+  return {
+    appName: "Stacks",
+    theme: "auto",
+    showEnvironment: !0,
+    showQueries: !0,
+    showRequest: !0,
+    enableCopyMarkdown: !0,
+    snippetLines: 8,
+    basePaths: [process.cwd()]
+  };
+}
+const SENSITIVE_PATTERNS = [
+  "password",
+  "secret",
+  "token",
+  "api_key",
+  "apikey",
+  "access_key",
+  "accesskey",
+  "private_key",
+  "privatekey",
+  "credit_card",
+  "creditcard",
+  "card_number",
+  "cardnumber",
+  "cvv",
+  "ssn",
+  "authorization",
+  "credential",
+  "aws_secret",
+  "aws_access",
+  "database_password",
+  "db_password",
+  "encryption_key",
+  "signing_key",
+  "bearer",
+  "session_id",
+  "sessionid",
+  "cookie"
+], MAX_SANITIZE_DEPTH = 10, CIRCULAR_PLACEHOLDER = "[Circular]";
+function sanitizeData(data, depth = 0, seen = new WeakSet) {
+  if (!data || typeof data !== "object" || depth >= MAX_SANITIZE_DEPTH)
+    return data;
+  if (seen.has(data))
+    return CIRCULAR_PLACEHOLDER;
+  seen.add(data);
+  if (Array.isArray(data))
+    return data.map((item) => sanitizeData(item, depth + 1, seen));
+  const sanitized = {};
+  for (const [key, value] of Object.entries(data)) {
+    const lowerKey = key.toLowerCase();
+    if (SENSITIVE_PATTERNS.some((pattern) => lowerKey.includes(pattern)))
+      sanitized[key] = "********";
+    else if (typeof value === "object" && value !== null)
+      sanitized[key] = sanitizeData(value, depth + 1, seen);
+    else
+      sanitized[key] = value;
+  }
+  return sanitized;
+}
+function getRequestBody(request) {
+  const req = request;
+  if (req.jsonBody)
+    return sanitizeData(req.jsonBody);
+  if (req.formBody)
+    return sanitizeData(req.formBody);
+  return;
+}
+async function getUserContext(request) {
+  const authed = request._authenticatedUser;
+  if (authed)
+    return {
+      id: authed.id,
+      email: authed.email,
+      name: authed.name || authed.username
+    };
+  return;
+}
+export async function createErrorResponse(error, request, options) {
+  const status = options?.status || 500;
+  log.debug(`[error] ${status} ${error.message}`);
+  if (!isDebugAllowed()) {
+    if (isApiRequest(request)) {
+      const isClientError = status >= 400 && status < 500, errDetails = error.details;
+      return new Response(buildErrorJson({
+        error: isClientError ? error.name || "Client Error" : "Internal Server Error",
+        message: isClientError ? error.message : "An unexpected error occurred.",
+        status,
+        details: isClientError && errDetails && typeof errDetails === "object" ? errDetails : void 0
+      }), { status, headers: getJsonHeaders() });
+    }
+    return new Response(renderProductionErrorPage(status), {
+      status,
+      headers: { "Content-Type": "text/html; charset=utf-8" }
+    });
+  }
+  try {
+    const handler = createErrorHandler(getErrorHandlerConfig());
+    handler.setFramework("Stacks", "0.70.0");
+    const requestBody = getRequestBody(request);
+    if (requestBody) {
+      const url = new URL(request.url);
+      handler.setRequest({
+        method: request.method,
+        url: request.url,
+        headers: Object.fromEntries(request.headers.entries()),
+        queryParams: Object.fromEntries(url.searchParams.entries()),
+        body: requestBody
+      });
+    } else
+      handler.setRequest(request);
+    const userContext = await getUserContext(request);
+    if (userContext)
+      handler.setUser(userContext);
+    if (options?.routingContext)
+      handler.setRouting(options.routingContext);
+    else if (options?.handlerPath)
+      handler.setRouting({
+        controller: options.handlerPath
+      });
+    for (const query of getRecentQueries())
+      handler.addQuery(query.query, query.time, query.connection);
+    if (isApiRequest(request)) {
+      const details = { handler: options?.handlerPath };
+      if (isDebugAllowed()) {
+        details.stack = error.stack?.split(`
+`).slice(0, 10);
+        details.queries = getRecentQueries().slice(-10);
+      }
+      return new Response(buildErrorJson({
+        error: error.name || "Error",
+        message: error.message,
+        status,
+        details
+      }), { status, headers: getJsonHeadersFull() });
+    }
+    const corsOrigin = process.env.APP_URL ? process.env.APP_URL.startsWith("http") ? process.env.APP_URL : `https://${process.env.APP_URL}` : isDebugAllowed() ? "*" : request.headers.get("origin") ?? "null", html = await handler.render(error, status);
+    return new Response(html, {
+      status,
+      headers: {
+        "Content-Type": "text/html; charset=utf-8",
+        "Access-Control-Allow-Origin": corsOrigin
+      }
+    });
+  } catch (renderError) {
+    console.error("[Error Handler] Failed to render error page:", renderError);
+    const escapeHtml = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+    return new Response(`
+      <html>
+        <head><title>Error</title></head>
+        <body>
+          <h1>Error</h1>
+          <p>${escapeHtml(error.message)}</p>
+          <pre>${escapeHtml(error.stack || "")}</pre>
+        </body>
+      </html>
+    `, {
+      status,
+      headers: { "Content-Type": "text/html; charset=utf-8" }
+    });
+  }
+}
+export async function createMiddlewareErrorResponse(error, request) {
+  const status = error.statusCode ?? error.status ?? 500, isDevelopment = isDebugAllowed();
+  if (status >= 400 && status < 500) {
+    const headers = error.headers ? { ...error.headers, ...getJsonHeaders() } : getJsonHeaders();
+    return new Response(buildErrorJson({
+      error: error.name || "ClientError",
+      message: error.message,
+      status
+    }), { status, headers });
+  }
+  if (isDevelopment)
+    return await createErrorResponse(error, request, { status });
+  return new Response(buildErrorJson({
+    error: "Internal Server Error",
+    message: "An unexpected error occurred.",
+    status
+  }), { status, headers: getJsonHeaders() });
+}
+export function createValidationErrorResponse(errors, _request) {
+  return new Response(buildErrorJson({
+    error: "ValidationError",
+    message: "Validation failed",
+    status: 422,
+    details: { errors }
+  }), { status: 422, headers: getJsonHeaders() });
+}
+export async function createNotFoundResponse(path, request) {
+  if (isDebugAllowed()) {
+    const error = Error(`Route not found: ${path}`);
+    error.name = "NotFoundError";
+    return await createErrorResponse(error, request, { status: 404 });
+  }
+  if (isApiRequest(request))
+    return new Response(buildErrorJson({
+      error: "NotFound",
+      message: `Route not found: ${path}`,
+      status: 404
+    }), { status: 404, headers: getJsonHeaders() });
+  return new Response(renderProductionErrorPage(404), {
+    status: 404,
+    headers: { "Content-Type": "text/html; charset=utf-8" }
+  });
+}

package/dist/index.js

@@ -1,14 +1,37 @@
-// @bun
-var{defineProperty:K,getOwnPropertyNames:R,getOwnPropertyDescriptor:k}=Object,g=Object.prototype.hasOwnProperty;function h($){return this[$]}var E=($)=>{var F=(Y??=new WeakMap).get($),W;if(F)return F;if(F=K({},"__esModule",{value:!0}),$&&typeof $==="object"||typeof $==="function"){for(var V of R($))if(!g.call(F,V))K(F,V,{get:h.bind($,V),enumerable:!(W=k($,V))||W.enumerable})}return Y.set($,F),F},Y;var l=($)=>$;function q($,F){this[$]=l.bind(null,F)}var d=($,F)=>{for(var W in F)K($,W,{get:F[W],enumerable:!0,configurable:!0,set:q.bind(F,W)})};var f=($,F)=>()=>($&&(F=$($=0)),F);var D=import.meta.require;function z($){let F=$.headers,W=F.get("content-type")||"";if(i.test(W))return!0;if(F.get("sec-fetch-dest")==="document")return!1;if((F.get("accept")||"").includes("text/html"))return!1;return!0}var i;var b=f(()=>{i=/^application\/(?:json|.+\+json)(?:;|$)/i});import c from"process";import{AsyncLocalStorage as U}from"async_hooks";import{log as v0}from"@stacksjs/logging";function I(){return n.getStore()}var p,n,u,w0,x0;var H=f(()=>{p=Symbol.for("stacks.router.requestStorage"),n=globalThis[p]??=new U,u=Symbol.for("stacks.router.traceStorage"),w0=globalThis[u]??=new U;x0=new Proxy({},{get($,F){let W=I();if(!W){if(c.env.NODE_ENV!=="production")console.warn(`[RequestContext] Accessing request.${String(F)} outside of request context`);if(F==="bearerToken")return()=>null;if(F==="user"||F==="userToken")return async()=>{return};if(F==="tokenCan"||F==="tokenCant")return async()=>!1;if(F==="headers")return new Headers;if(F==="url")return"";if(F==="method")return"GET";return}let V=W[F];if(typeof V==="function")return V.bind(W);return V}})});var Q={};d(Q,{trackQuery:()=>e,getQueryShapeCounts:()=>$0,createValidationErrorResponse:()=>O0,createNotFoundResponse:()=>L0,createMiddlewareErrorResponse:()=>N0,createErrorResponse:()=>J,clearTrackedQueries:()=>F0});import N from"process";import{log as o}from"@stacksjs/logging";import{createErrorHandler as a,renderProductionErrorPage as A}from"@stacksjs/error-handling";function P($){let F={error:$.error,message:$.message,status:$.status,timestamp:new Date().toISOString()};if($.details)F.details=$.details;return JSON.stringify(F)}function M(){let $=(N.env.APP_ENV??"").toLowerCase();if($==="development")return!0;if(!$&&N.env.NODE_ENV==="development")return!0;return!1}function O(){return{"Content-Type":"application/json"}}function s(){return O()}function v(){return{buffer:Array(X).fill(null),writeIndex:0,count:0,shapeCounts:new Map,n1Warned:new Set}}function m(){let $=I();if(!$)return S;let F=$[w];if(!F)F=v(),$[w]=F;return F}function r($){return $.replace(/'(?:[^']|'')*'/g,"?").replace(/"(?:[^"]|"")*"/g,"?").replace(/\b\d+(?:\.\d+)?\b/g,"?").replace(/IN\s*\([^)]*\)/gi,"IN (?)").replace(/\s+/g," ").trim().toUpperCase()}function e($,F,W){let V=m();if(V.buffer[V.writeIndex]={query:$,time:F,connection:W},V.writeIndex=(V.writeIndex+1)%X,V.count<X)V.count++;if(!M())return;let G=r($);if(G.startsWith("INSERT INTO QUERY_LOGS")||G.startsWith("EXPLAIN"))return;let Z=(V.shapeCounts.get(G)??0)+1;if(V.shapeCounts.set(G,Z),Z===t+1&&!V.n1Warned.has(G))V.n1Warned.add(G),import("@stacksjs/logging").then(({log:B})=>{B.warn(`[orm] Possible N+1 \u2014 query shape ran ${Z}\xD7 in this request:
-  ${G}
-  Hint: load related rows with .with('relation') or eager-load via includes() before iterating.`)}).catch(()=>{})}function C(){let $=m();if($.count===0)return[];let F=[],W=$.count<X?0:$.writeIndex;for(let V=0;V<$.count;V++){let G=$.buffer[(W+V)%X];if(G)F.push(G)}return F}function $0(){return new Map(m().shapeCounts)}function F0(){let $=I();if($&&$[w]){$[w]=v();return}S=v()}function V0(){return{appName:"Stacks",theme:"auto",showEnvironment:!0,showQueries:!0,showRequest:!0,enableCopyMarkdown:!0,snippetLines:8,basePaths:[N.cwd()]}}function x($,F=0,W=new WeakSet){if(!$||typeof $!=="object"||F>=Z0)return $;if(W.has($))return G0;if(W.add($),Array.isArray($))return $.map((G)=>x(G,F+1,W));let V={};for(let[G,Z]of Object.entries($)){let B=G.toLowerCase();if(W0.some((L)=>B.includes(L)))V[G]="********";else if(typeof Z==="object"&&Z!==null)V[G]=x(Z,F+1,W);else V[G]=Z}return V}function B0($){let F=$;if(F.jsonBody)return x(F.jsonBody);if(F.formBody)return x(F.formBody);return}async function j0($){let W=$._authenticatedUser;if(W)return{id:W.id,email:W.email,name:W.name||W.username};return}async function J($,F,W){let V=W?.status||500;if(o.debug(`[error] ${V} ${$.message}`),!M()){if(z(F)){let Z=V>=400&&V<500,B=$.details;return new Response(P({error:Z?$.name||"Client Error":"Internal Server Error",message:Z?$.message:"An unexpected error occurred.",status:V,details:Z&&B&&typeof B==="object"?B:void 0}),{status:V,headers:O()})}return new Response(A(V),{status:V,headers:{"Content-Type":"text/html; charset=utf-8"}})}try{let Z=a(V0());Z.setFramework("Stacks","0.70.0");let B=B0(F);if(B){let j=new URL(F.url);Z.setRequest({method:F.method,url:F.url,headers:Object.fromEntries(F.headers.entries()),queryParams:Object.fromEntries(j.searchParams.entries()),body:B})}else Z.setRequest(F);let L=await j0(F);if(L)Z.setUser(L);if(W?.routingContext)Z.setRouting(W.routingContext);else if(W?.handlerPath)Z.setRouting({controller:W.handlerPath});for(let j of C())Z.addQuery(j.query,j.time,j.connection);if(z(F)){let j={handler:W?.handlerPath};if(M())j.stack=$.stack?.split(`
-`).slice(0,10),j.queries=C().slice(-10);return new Response(P({error:$.name||"Error",message:$.message,status:V,details:j}),{status:V,headers:s()})}let T=N.env.APP_URL?N.env.APP_URL.startsWith("http")?N.env.APP_URL:`https://${N.env.APP_URL}`:M()?"*":F.headers.get("origin")??"null",y=await Z.render($,V);return new Response(y,{status:V,headers:{"Content-Type":"text/html; charset=utf-8","Access-Control-Allow-Origin":T}})}catch(Z){console.error("[Error Handler] Failed to render error page:",Z);let B=(L)=>L.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;");return new Response(`
-      <html>
-        <head><title>Error</title></head>
-        <body>
-          <h1>Error</h1>
-          <p>${B($.message)}</p>
-          <pre>${B($.stack||"")}</pre>
-        </body>
-      </html>
-    `,{status:V,headers:{"Content-Type":"text/html; charset=utf-8"}})}}async function N0($,F){let W=$.statusCode??$.status??500,V=M();if(W>=400&&W<500){let G=$.headers?{...$.headers,...O()}:O();return new Response(P({error:$.name||"ClientError",message:$.message,status:W}),{status:W,headers:G})}if(V)return await J($,F,{status:W});return new Response(P({error:"Internal Server Error",message:"An unexpected error occurred.",status:W}),{status:W,headers:O()})}function O0($,F){return new Response(P({error:"ValidationError",message:"Validation failed",status:422,details:{errors:$}}),{status:422,headers:O()})}async function L0($,F){if(M()){let V=Error(`Route not found: ${$}`);return V.name="NotFoundError",await J(V,F,{status:404})}if(z(F))return new Response(P({error:"NotFound",message:`Route not found: ${$}`,status:404}),{status:404,headers:O()});return new Response(A(404),{status:404,headers:{"Content-Type":"text/html; charset=utf-8"}})}var X=50,t=5,w,S,W0,Z0=10,G0="[Circular]";var _=f(()=>{b();H();w=Symbol.for("stacks.queryTracking"),S=v();W0=["password","secret","token","api_key","apikey","access_key","accesskey","private_key","privatekey","credit_card","creditcard","card_number","cardnumber","cvv","ssn","authorization","credential","aws_secret","aws_access","database_password","db_password","encryption_key","signing_key","bearer","session_id","sessionid","cookie"]});export*from"@stacksjs/bun-router";import("@stacksjs/database").then(({setQueryTracker:$})=>{if(typeof $==="function"){let{trackQuery:F}=(_(),E(Q));$(F)}}).catch(()=>{});export{p0 as withTraceId,g0 as warnOnMultipleRouterInstances,D1 as verifySignedUrlMiddleware,Y1 as verifySignedUrl,k0 as url,W1 as trackQuery,K1 as stream,m1 as signedUrl,J1 as signUrl,c0 as setCurrentRequest,R0 as serverResponse,y0 as serve,w1 as sanitizePathParam,v1 as safePathParam,i0 as runWithRequest,B1 as routeParams,T0 as route,d0 as request,P1 as rateLimitStatus,M1 as rateLimit,a0 as loadRoutes,G1 as listRegisteredRoutes,N1 as isApiRequest,_0 as installMiddlewareHotReload,q0 as getTraceId,V1 as getQueryShapeCounts,l0 as getCurrentRequest,Q0 as findUnresolvableRouteMiddleware,F1 as createValidationErrorResponse,A1 as createStacksSessionStore,S0 as createStacksRouter,C1 as createSessionStore,$1 as createNotFoundResponse,e0 as createMiddlewareErrorResponse,r0 as createErrorResponse,t0 as clearTrackedQueries,X1 as clearRateLimit,A0 as clearMiddlewareCache,E0 as cacheRequestQuery,C0 as assertRouteMiddlewareResolvable,T1 as RedisSessionStore,I1 as PathParamError,u0 as Middleware,_1 as MemorySessionStore,O1 as JSON_CONTENT_TYPE,Q1 as FileSessionStore,U1 as EncryptedSessionStore,S1 as DatabaseSessionStore};
+var {require}=import.meta;import"./request-augmentation";
+
+export * from "@stacksjs/bun-router";
+export { assertRouteMiddlewareResolvable, clearMiddlewareCache, createStacksRouter, findUnresolvableRouteMiddleware, installMiddlewareHotReload, route, serve, serverResponse, url, warnOnMultipleRouterInstances } from "./stacks-router";
+export { cacheRequestQuery, getCurrentRequest, getTraceId, request, runWithRequest, setCurrentRequest, withTraceId } from "./request-context";
+export { Middleware } from "./middleware";
+export { loadRoutes } from "./route-loader";
+export {
+  clearTrackedQueries,
+  createErrorResponse,
+  createMiddlewareErrorResponse,
+  createNotFoundResponse,
+  createValidationErrorResponse,
+  getQueryShapeCounts,
+  trackQuery
+} from "./error-handler";
+export { listRegisteredRoutes, routeParams } from "./stacks-router";
+export { isApiRequest, JSON_CONTENT_TYPE } from "./api-shape";
+export { rateLimit, rateLimitStatus, clearRateLimit } from "./rate-limit";
+export { PathParamError, safePathParam, sanitizePathParam } from "./path-sanitize";
+export { stream } from "./stacks-router";
+export { signedUrl, signUrl, verifySignedUrl, verifySignedUrlMiddleware } from "./signed-url";
+export { EncryptedSessionStore } from "./encrypted-session-store";
+export {
+  createSessionStore,
+  createStacksSessionStore,
+  DatabaseSessionStore,
+  FileSessionStore,
+  MemorySessionStore,
+  RedisSessionStore
+} from "./session-factory";
+import("@stacksjs/database").then(({ setQueryTracker }) => {
+  if (typeof setQueryTracker === "function") {
+    const { trackQuery } = require("./error-handler");
+    setQueryTracker(trackQuery);
+  }
+}).catch(() => {});

package/dist/middleware.js

@@ -0,0 +1,23 @@
+export class Middleware {
+  name;
+  priority;
+  handle;
+  constructor(config) {
+    this.name = config.name;
+    this.priority = config.priority ?? 10;
+    this.handle = config.handle;
+  }
+  toRouterHandler() {
+    const handle = this.handle.bind(this);
+    return async (req, next) => {
+      try {
+        await handle(req);
+      } catch (thrown) {
+        if (thrown instanceof Response)
+          return thrown;
+        throw thrown;
+      }
+      return next();
+    };
+  }
+}

package/dist/path-sanitize.js

@@ -0,0 +1,37 @@
+export class PathParamError extends Error {
+  reason;
+  constructor(reason, value, context) {
+    const ctx = context ? ` in ${context}` : "";
+    super(`[router] Refusing to use ${JSON.stringify(value)} as a path parameter${ctx} \u2014 ${reason}`);
+    this.name = "PathParamError";
+    this.reason = reason;
+  }
+}
+const CONTROL_CHARS = /[\u0000-\u001F\u007F]/;
+export function sanitizePathParam(value, options = {}) {
+  if (typeof value !== "string")
+    throw new PathParamError("not-string", value, options.context);
+  if (value.length === 0)
+    throw new PathParamError("empty", value, options.context);
+  const maxLength = options.maxLength ?? 255;
+  if (value.length > maxLength)
+    throw new PathParamError("too-long", value, options.context);
+  if (value.includes("\x00"))
+    throw new PathParamError("null-byte", value, options.context);
+  if (CONTROL_CHARS.test(value))
+    throw new PathParamError("control-char", value, options.context);
+  if (value.startsWith("/") || /^[A-Z]:[\\/]/i.test(value))
+    throw new PathParamError("absolute-path", value, options.context);
+  if (/(^|[\\/])\.\.([\\/]|$)/.test(value))
+    throw new PathParamError("traversal", value, options.context);
+  if (!options.allowSlashes && /[\\/]/.test(value))
+    throw new PathParamError("traversal", value, options.context);
+  return value;
+}
+export function safePathParam(value, options = {}) {
+  try {
+    return sanitizePathParam(value, options);
+  } catch {
+    return null;
+  }
+}

package/dist/rate-limit.js

@@ -0,0 +1,73 @@
+import { HttpError } from "@stacksjs/error-handling";
+import { RateLimitError, RateLimiter, defaultIdentity } from "ts-rate-limiter";
+import { getCurrentRequest } from "./request-context";
+const PERIOD_SECONDS = {
+  second: 1,
+  minute: 60,
+  hour: 3600,
+  day: 86400
+}, limiterCache = new Map;
+function getLimiter(max, windowMs) {
+  const cacheKey = `${windowMs}:${max}`;
+  let limiter = limiterCache.get(cacheKey);
+  if (!limiter) {
+    limiter = new RateLimiter({
+      windowMs,
+      maxRequests: max,
+      algorithm: "fixed-window",
+      standardHeaders: !1,
+      legacyHeaders: !1
+    });
+    limiterCache.set(cacheKey, limiter);
+  }
+  return limiter;
+}
+function resolveIdentity(explicit) {
+  if (explicit !== void 0)
+    return explicit;
+  const req = getCurrentRequest();
+  return req ? defaultIdentity(req) : "anon";
+}
+export function rateLimit(key, max, options = {}) {
+  const id = resolveIdentity(options.identity), bucketKey = `${key}:${id}`, run = async (windowMs) => {
+    const limiter = getLimiter(max, windowMs);
+    try {
+      await limiter.enforce(bucketKey);
+    } catch (err) {
+      if (err instanceof RateLimitError)
+        throw Object.assign(new HttpError(429, "Too many requests", {
+          key,
+          max,
+          retryAfter: err.retryAfter
+        }), { headers: err.toHeaders() });
+      throw err;
+    }
+  };
+  return {
+    async per(period) {
+      const seconds = PERIOD_SECONDS[period];
+      if (!seconds)
+        throw Error(`rateLimit().per: unknown period '${period}'`);
+      await run(seconds * 1000);
+    },
+    async over(ttlSeconds) {
+      if (!Number.isFinite(ttlSeconds) || ttlSeconds <= 0)
+        throw Error(`rateLimit().over: ttl must be a positive number, got ${ttlSeconds}`);
+      await run(ttlSeconds * 1000);
+    }
+  };
+}
+export async function rateLimitStatus(key, max, windowSeconds, options = {}) {
+  const id = resolveIdentity(options.identity), bucketKey = `${key}:${id}`, result = await getLimiter(max, windowSeconds * 1000).peek(bucketKey);
+  if (!result)
+    return null;
+  return {
+    count: result.current,
+    limit: result.limit,
+    remaining: Math.max(0, result.limit - result.current)
+  };
+}
+export async function clearRateLimit(key, max, windowSeconds, options = {}) {
+  const id = resolveIdentity(options.identity), bucketKey = `${key}:${id}`;
+  await getLimiter(max, windowSeconds * 1000).reset(bucketKey);
+}

package/dist/request-context.js

@@ -0,0 +1,78 @@
+import process from "node:process";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { log } from "@stacksjs/logging";
+const REQUEST_STORAGE_KEY = Symbol.for("stacks.router.requestStorage"), requestStorage = globalThis[REQUEST_STORAGE_KEY] ??= new AsyncLocalStorage, TRACE_STORAGE_KEY = Symbol.for("stacks.router.traceStorage"), traceStorage = globalThis[TRACE_STORAGE_KEY] ??= new AsyncLocalStorage;
+export function getTraceId() {
+  const explicit = traceStorage.getStore();
+  if (explicit)
+    return explicit;
+  return requestStorage.getStore()?._requestId;
+}
+export function withTraceId(id, fn) {
+  return traceStorage.run(id, fn);
+}
+const REQUEST_QUERY_CACHE_KEY = Symbol.for("stacks.requestQueryCache");
+function getRequestCache() {
+  const req = requestStorage.getStore();
+  if (!req)
+    return;
+  let cache = req[REQUEST_QUERY_CACHE_KEY];
+  if (!cache) {
+    cache = { map: new Map };
+    req[REQUEST_QUERY_CACHE_KEY] = cache;
+  }
+  return cache;
+}
+export async function cacheRequestQuery(key, fetcher) {
+  const cache = getRequestCache();
+  if (!cache)
+    return fetcher();
+  const existing = cache.map.get(key);
+  if (existing)
+    return existing;
+  const promise = Promise.resolve().then(() => fetcher());
+  cache.map.set(key, promise);
+  promise.catch(() => cache.map.delete(key));
+  return promise;
+}
+export function setCurrentRequest(req) {
+  log.debug(`[request] ${req.method} ${new URL(req.url).pathname}`);
+  requestStorage.enterWith(req);
+}
+export function clearCurrentRequest() {
+  requestStorage.disable();
+}
+export function runWithRequest(req, fn) {
+  return requestStorage.run(req, fn);
+}
+export function getCurrentRequest() {
+  return requestStorage.getStore();
+}
+export const request = new Proxy({}, {
+  get(_target, prop) {
+    const currentRequest = getCurrentRequest();
+    if (!currentRequest) {
+      if (process.env.NODE_ENV !== "production")
+        console.warn(`[RequestContext] Accessing request.${String(prop)} outside of request context`);
+      if (prop === "bearerToken")
+        return () => null;
+      if (prop === "user" || prop === "userToken")
+        return async () => {
+          return;
+        };
+      if (prop === "tokenCan" || prop === "tokenCant")
+        return async () => !1;
+      if (prop === "headers")
+        return new Headers;
+      if (prop === "url")
+        return "";
+      if (prop === "method")
+        return "GET";
+      return;
+    }
+    const value = currentRequest[prop];
+    if (typeof value === "function")
+      return value.bind(currentRequest);
+    return value;
+  }
+});