@stacksjs/router 0.70.88 → 0.70.91

package/dist/action-paths.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Action path types for the Stacks router.
+ * This file is auto-generated or manually maintained to provide
+ * type-safe string paths for routing to actions and controllers.
+ */
+// Base type for all action paths - will be narrowed as actions are added
+export type StacksActionPath = string;

package/dist/api-shape.d.ts

@@ -0,0 +1,24 @@
+/*`,
+ * not `application/json`). This predicate fixes that asymmetry by making
+ * JSON the default unless the client explicitly opts into HTML.
+ */
+export declare function isApiRequest(req: Request | { headers: Headers }): boolean;
+/**
+ * "Is this request JSON-shaped?" — the single source of truth used across
+ * the framework to decide JSON vs HTML for responses (errors, primitives,
+ * empty results) and to widen request-body parsing to every JSON variant.
+ *
+ * The historical bug was scattered ad-hoc checks: `error-handler` looked at
+ * `Accept`, `formatResult` ignored the request entirely, `parseRequestBody`
+ * did `contentType.includes('application/json')` so `application/vnd.api+json`
+ * went unparsed. Centralizing the decision here means a future tweak (e.g.,
+ * treating an `apiResponse: true` route group as always-JSON) lands in one
+ * place and every response path picks it up.
+ */
+/**
+ * Matches `application/json` plus any RFC-6838 structured-suffix subtype:
+ * `application/vnd.api+json`, `application/ld+json`, `application/hal+json`,
+ * `application/problem+json`, etc. Case-insensitive; tolerates a trailing
+ * `;` (for `;charset=utf-8`) or end-of-string.
+ */
+export declare const JSON_CONTENT_TYPE: unknown;

package/dist/api-shape.js

@@ -0,0 +1,11 @@
+export const JSON_CONTENT_TYPE = /^application\/(?:json|.+\+json)(?:;|$)/i;
+export function isApiRequest(req) {
+  const headers = req.headers, contentType = headers.get("content-type") || "";
+  if (JSON_CONTENT_TYPE.test(contentType))
+    return !0;
+  if (headers.get("sec-fetch-dest") === "document")
+    return !1;
+  if ((headers.get("accept") || "").includes("text/html"))
+    return !1;
+  return !0;
+}

package/dist/encrypted-session-store.d.ts

@@ -0,0 +1,19 @@
+import type { SessionData, SessionStore } from '@stacksjs/bun-router';
+export declare interface EncryptedSessionStoreOptions {
+  appKey?: string
+}
+/**
+ * Wrap a bun-router `SessionStore<SessionData>` so all writes are
+ * encrypted on the way in and decrypted on the way out. Drop-in
+ * replacement for any of the built-in stores.
+ */
+export declare class EncryptedSessionStore implements SessionStore<SessionData> {
+  constructor(inner: SessionStore<SessionData>, opts?: EncryptedSessionStoreOptions);
+  set(sid: string, session: SessionData, ttl?: number): Promise<void>;
+  touch(sid: string, session: SessionData, ttl?: number): Promise<void>;
+  get(sid: string): Promise<SessionData | null>;
+  destroy(sid: string): Promise<void>;
+  all(): Promise<Record<string, SessionData>>;
+  length(): Promise<number>;
+  clear(): Promise<void>;
+}

package/dist/encrypted-session-store.js

@@ -0,0 +1,73 @@
+import { decrypt, encrypt } from "@stacksjs/security";
+
+export class EncryptedSessionStore {
+  inner;
+  opts;
+  constructor(inner, opts = {}) {
+    this.inner = inner;
+    this.opts = opts;
+  }
+  async set(sid, session, ttl) {
+    const envelope = await this.wrap(sid, session);
+    await this.inner.set(sid, envelope, ttl);
+  }
+  async touch(sid, session, ttl) {
+    const envelope = await this.wrap(sid, session);
+    if (this.inner.touch)
+      await this.inner.touch(sid, envelope, ttl);
+    else
+      await this.inner.set(sid, envelope, ttl);
+  }
+  async get(sid) {
+    const stored = await this.inner.get(sid);
+    if (!stored)
+      return null;
+    return this.unwrap(stored);
+  }
+  destroy(sid) {
+    return this.inner.destroy(sid);
+  }
+  async all() {
+    const wrapped = await this.inner.all?.() ?? {}, out = {};
+    for (const [sid, envelope] of Object.entries(wrapped)) {
+      const decrypted = await this.unwrap(envelope);
+      if (decrypted)
+        out[sid] = decrypted;
+    }
+    return out;
+  }
+  async length() {
+    if (this.inner.length)
+      return this.inner.length();
+    return Object.keys(await this.all()).length;
+  }
+  async clear() {
+    if (this.inner.clear)
+      return this.inner.clear();
+    const sessions = await this.inner.all?.() ?? {};
+    await Promise.all(Object.keys(sessions).map((sid) => this.inner.destroy(sid)));
+  }
+  async wrap(sid, session) {
+    const { id, ...rest } = session, ciphertext = await encrypt(JSON.stringify(rest), this.opts.appKey);
+    return {
+      _enc: !0,
+      id: id ?? sid,
+      data: ciphertext
+    };
+  }
+  async unwrap(stored) {
+    if (!stored || typeof stored !== "object")
+      return null;
+    const candidate = stored;
+    if (candidate._enc === !0 && typeof candidate.data === "string")
+      try {
+        const decrypted = await decrypt(candidate.data, this.opts.appKey), parsed = JSON.parse(decrypted);
+        if (candidate.id !== void 0)
+          parsed.id = candidate.id;
+        return parsed;
+      } catch {
+        return null;
+      }
+    return candidate;
+  }
+}

package/dist/error-handler.d.ts

@@ -0,0 +1,68 @@
+import type { EnhancedRequest } from '@stacksjs/bun-router';
+/**
+ * Add a query to the recent queries list for error context.
+ * Uses a circular buffer for O(1) insert instead of array.shift().
+ *
+ * Also runs N+1 detection: when the same query *shape* (with bound
+ * values normalized away) repeats more than `N1_THRESHOLD` times within
+ * a single request lifecycle, we warn once via `log.warn`. The signal
+ * is highly correlated with missing eager loading.
+ */
+export declare function trackQuery(query: string, time?: number, connection?: string): void;
+/**
+ * Snapshot of query shape counts for the active request. Useful for
+ * tests asserting that an action ran a single query for `posts`
+ * instead of one-per-user.
+ */
+export declare function getQueryShapeCounts(): ReadonlyMap<string, number>;
+/**
+ * Reset query tracking for the active scope.
+ *
+ * Inside a request, this clears the per-request tracking object — but
+ * the object is also auto-collected when the request goes out of scope,
+ * so the explicit call is mainly useful for tests that re-use a single
+ * request. Outside a request, this clears the process-wide fallback.
+ */
+export declare function clearTrackedQueries(): void;
+/**
+ * Create an Ignition-style error response for development
+ */
+export declare function createErrorResponse(error: Error, request: Request | EnhancedRequest, options?: {
+    status?: number
+    handlerPath?: string
+    routingContext?: {
+      controller?: string
+      routeName?: string
+      middleware?: string[]
+    }
+  }): Promise<Response>;
+/**
+ * Create a middleware error response (401, 403, etc.)
+ *
+ * Reads `statusCode` OR `status` off the error so both shapes are honored:
+ * - middleware that throws `Object.assign(new Error('msg'), { statusCode: 401 })`
+ * - framework HttpError instances where the field is named `status`
+ *
+ * Without the `status` fallback, every `HttpError(401, …)` throw from auth or
+ * validation middleware leaks out as a 500 with an Ignition error page —
+ * which is what we used to ship for `GET /api/me` without a token.
+ */
+export declare function createMiddlewareErrorResponse(error: Error & { statusCode?: number, status?: number, headers?: Record<string, string> }, request: Request | EnhancedRequest): Promise<Response>;
+/**
+ * Create a validation error response
+ */
+export declare function createValidationErrorResponse(errors: Record<string, string[]>, _request: Request | EnhancedRequest): Response;
+/**
+ * Create a 404 Not Found response
+ */
+export declare function createNotFoundResponse(path: string, request: Request | EnhancedRequest): Promise<Response>;
+/**
+ * Standard error response structure used across all JSON error responses.
+ */
+export declare interface ErrorResponseBody {
+  error: string
+  message: string
+  status: number
+  timestamp: string
+  details?: Record<string, unknown>
+}

package/dist/error-handler.js

@@ -0,0 +1,310 @@
+import process from "node:process";
+import { log } from "@stacksjs/logging";
+import {
+  createErrorHandler,
+  renderProductionErrorPage
+} from "@stacksjs/error-handling";
+import { isApiRequest } from "./api-shape";
+import { getCurrentRequest } from "./request-context";
+function buildErrorJson(opts) {
+  const body = {
+    error: opts.error,
+    message: opts.message,
+    status: opts.status,
+    timestamp: new Date().toISOString()
+  };
+  if (opts.details)
+    body.details = opts.details;
+  return JSON.stringify(body);
+}
+function isDebugAllowed() {
+  const appEnv = (process.env.APP_ENV ?? "").toLowerCase();
+  if (appEnv === "development")
+    return !0;
+  if (!appEnv && process.env.NODE_ENV === "development")
+    return !0;
+  return !1;
+}
+function getJsonHeaders() {
+  return { "Content-Type": "application/json" };
+}
+function getJsonHeadersFull() {
+  return getJsonHeaders();
+}
+const MAX_QUERIES = 50, N1_THRESHOLD = 5;
+function newQueryTrack() {
+  return {
+    buffer: Array(MAX_QUERIES).fill(null),
+    writeIndex: 0,
+    count: 0,
+    shapeCounts: new Map,
+    n1Warned: new Set
+  };
+}
+const REQUEST_QUERY_TRACK_KEY = Symbol.for("stacks.queryTracking");
+let fallbackTrack = newQueryTrack();
+function getQueryTrack() {
+  const req = getCurrentRequest();
+  if (!req)
+    return fallbackTrack;
+  let track = req[REQUEST_QUERY_TRACK_KEY];
+  if (!track) {
+    track = newQueryTrack();
+    req[REQUEST_QUERY_TRACK_KEY] = track;
+  }
+  return track;
+}
+function normalizeQueryShape(query) {
+  return query.replace(/'(?:[^']|'')*'/g, "?").replace(/"(?:[^"]|"")*"/g, "?").replace(/\b\d+(?:\.\d+)?\b/g, "?").replace(/IN\s*\([^)]*\)/gi, "IN (?)").replace(/\s+/g, " ").trim().toUpperCase();
+}
+export function trackQuery(query, time, connection) {
+  const track = getQueryTrack();
+  track.buffer[track.writeIndex] = { query, time, connection };
+  track.writeIndex = (track.writeIndex + 1) % MAX_QUERIES;
+  if (track.count < MAX_QUERIES)
+    track.count++;
+  if (!isDebugAllowed())
+    return;
+  const shape = normalizeQueryShape(query);
+  if (shape.startsWith("INSERT INTO QUERY_LOGS") || shape.startsWith("EXPLAIN"))
+    return;
+  const next = (track.shapeCounts.get(shape) ?? 0) + 1;
+  track.shapeCounts.set(shape, next);
+  if (next === N1_THRESHOLD + 1 && !track.n1Warned.has(shape)) {
+    track.n1Warned.add(shape);
+    import("@stacksjs/logging").then(({ log }) => {
+      log.warn(`[orm] Possible N+1 \u2014 query shape ran ${next}\xD7 in this request:
+  ${shape}
+  Hint: load related rows with .with('relation') or eager-load via includes() before iterating.`);
+    }).catch(() => {});
+  }
+}
+function getRecentQueries() {
+  const track = getQueryTrack();
+  if (track.count === 0)
+    return [];
+  const result = [], start = track.count < MAX_QUERIES ? 0 : track.writeIndex;
+  for (let i = 0;i < track.count; i++) {
+    const entry = track.buffer[(start + i) % MAX_QUERIES];
+    if (entry)
+      result.push(entry);
+  }
+  return result;
+}
+export function getQueryShapeCounts() {
+  return new Map(getQueryTrack().shapeCounts);
+}
+export function clearTrackedQueries() {
+  const req = getCurrentRequest();
+  if (req && req[REQUEST_QUERY_TRACK_KEY]) {
+    req[REQUEST_QUERY_TRACK_KEY] = newQueryTrack();
+    return;
+  }
+  fallbackTrack = newQueryTrack();
+}
+function getErrorHandlerConfig() {
+  return {
+    appName: "Stacks",
+    theme: "auto",
+    showEnvironment: !0,
+    showQueries: !0,
+    showRequest: !0,
+    enableCopyMarkdown: !0,
+    snippetLines: 8,
+    basePaths: [process.cwd()]
+  };
+}
+const SENSITIVE_PATTERNS = [
+  "password",
+  "secret",
+  "token",
+  "api_key",
+  "apikey",
+  "access_key",
+  "accesskey",
+  "private_key",
+  "privatekey",
+  "credit_card",
+  "creditcard",
+  "card_number",
+  "cardnumber",
+  "cvv",
+  "ssn",
+  "authorization",
+  "credential",
+  "aws_secret",
+  "aws_access",
+  "database_password",
+  "db_password",
+  "encryption_key",
+  "signing_key",
+  "bearer",
+  "session_id",
+  "sessionid",
+  "cookie"
+], MAX_SANITIZE_DEPTH = 10, CIRCULAR_PLACEHOLDER = "[Circular]";
+function sanitizeData(data, depth = 0, seen = new WeakSet) {
+  if (!data || typeof data !== "object" || depth >= MAX_SANITIZE_DEPTH)
+    return data;
+  if (seen.has(data))
+    return CIRCULAR_PLACEHOLDER;
+  seen.add(data);
+  if (Array.isArray(data))
+    return data.map((item) => sanitizeData(item, depth + 1, seen));
+  const sanitized = {};
+  for (const [key, value] of Object.entries(data)) {
+    const lowerKey = key.toLowerCase();
+    if (SENSITIVE_PATTERNS.some((pattern) => lowerKey.includes(pattern)))
+      sanitized[key] = "********";
+    else if (typeof value === "object" && value !== null)
+      sanitized[key] = sanitizeData(value, depth + 1, seen);
+    else
+      sanitized[key] = value;
+  }
+  return sanitized;
+}
+function getRequestBody(request) {
+  const req = request;
+  if (req.jsonBody)
+    return sanitizeData(req.jsonBody);
+  if (req.formBody)
+    return sanitizeData(req.formBody);
+  return;
+}
+async function getUserContext(request) {
+  const authed = request._authenticatedUser;
+  if (authed)
+    return {
+      id: authed.id,
+      email: authed.email,
+      name: authed.name || authed.username
+    };
+  return;
+}
+export async function createErrorResponse(error, request, options) {
+  const status = options?.status || 500;
+  log.debug(`[error] ${status} ${error.message}`);
+  if (!isDebugAllowed()) {
+    if (isApiRequest(request)) {
+      const isClientError = status >= 400 && status < 500, errDetails = error.details;
+      return new Response(buildErrorJson({
+        error: isClientError ? error.name || "Client Error" : "Internal Server Error",
+        message: isClientError ? error.message : "An unexpected error occurred.",
+        status,
+        details: isClientError && errDetails && typeof errDetails === "object" ? errDetails : void 0
+      }), { status, headers: getJsonHeaders() });
+    }
+    return new Response(renderProductionErrorPage(status), {
+      status,
+      headers: { "Content-Type": "text/html; charset=utf-8" }
+    });
+  }
+  try {
+    const handler = createErrorHandler(getErrorHandlerConfig());
+    handler.setFramework("Stacks", "0.70.0");
+    const requestBody = getRequestBody(request);
+    if (requestBody) {
+      const url = new URL(request.url);
+      handler.setRequest({
+        method: request.method,
+        url: request.url,
+        headers: Object.fromEntries(request.headers.entries()),
+        queryParams: Object.fromEntries(url.searchParams.entries()),
+        body: requestBody
+      });
+    } else
+      handler.setRequest(request);
+    const userContext = await getUserContext(request);
+    if (userContext)
+      handler.setUser(userContext);
+    if (options?.routingContext)
+      handler.setRouting(options.routingContext);
+    else if (options?.handlerPath)
+      handler.setRouting({
+        controller: options.handlerPath
+      });
+    for (const query of getRecentQueries())
+      handler.addQuery(query.query, query.time, query.connection);
+    if (isApiRequest(request)) {
+      const details = { handler: options?.handlerPath };
+      if (isDebugAllowed()) {
+        details.stack = error.stack?.split(`
+`).slice(0, 10);
+        details.queries = getRecentQueries().slice(-10);
+      }
+      return new Response(buildErrorJson({
+        error: error.name || "Error",
+        message: error.message,
+        status,
+        details
+      }), { status, headers: getJsonHeadersFull() });
+    }
+    const corsOrigin = process.env.APP_URL ? process.env.APP_URL.startsWith("http") ? process.env.APP_URL : `https://${process.env.APP_URL}` : isDebugAllowed() ? "*" : request.headers.get("origin") ?? "null", html = await handler.render(error, status);
+    return new Response(html, {
+      status,
+      headers: {
+        "Content-Type": "text/html; charset=utf-8",
+        "Access-Control-Allow-Origin": corsOrigin
+      }
+    });
+  } catch (renderError) {
+    console.error("[Error Handler] Failed to render error page:", renderError);
+    const escapeHtml = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+    return new Response(`
+      <html>
+        <head><title>Error</title></head>
+        <body>
+          <h1>Error</h1>
+          <p>${escapeHtml(error.message)}</p>
+          <pre>${escapeHtml(error.stack || "")}</pre>
+        </body>
+      </html>
+    `, {
+      status,
+      headers: { "Content-Type": "text/html; charset=utf-8" }
+    });
+  }
+}
+export async function createMiddlewareErrorResponse(error, request) {
+  const status = error.statusCode ?? error.status ?? 500, isDevelopment = isDebugAllowed();
+  if (status >= 400 && status < 500) {
+    const headers = error.headers ? { ...error.headers, ...getJsonHeaders() } : getJsonHeaders();
+    return new Response(buildErrorJson({
+      error: error.name || "ClientError",
+      message: error.message,
+      status
+    }), { status, headers });
+  }
+  if (isDevelopment)
+    return await createErrorResponse(error, request, { status });
+  return new Response(buildErrorJson({
+    error: "Internal Server Error",
+    message: "An unexpected error occurred.",
+    status
+  }), { status, headers: getJsonHeaders() });
+}
+export function createValidationErrorResponse(errors, _request) {
+  return new Response(buildErrorJson({
+    error: "ValidationError",
+    message: "Validation failed",
+    status: 422,
+    details: { errors }
+  }), { status: 422, headers: getJsonHeaders() });
+}
+export async function createNotFoundResponse(path, request) {
+  if (isDebugAllowed()) {
+    const error = Error(`Route not found: ${path}`);
+    error.name = "NotFoundError";
+    return await createErrorResponse(error, request, { status: 404 });
+  }
+  if (isApiRequest(request))
+    return new Response(buildErrorJson({
+      error: "NotFound",
+      message: `Route not found: ${path}`,
+      status: 404
+    }), { status: 404, headers: getJsonHeaders() });
+  return new Response(renderProductionErrorPage(404), {
+    status: 404,
+    headers: { "Content-Type": "text/html; charset=utf-8" }
+  });
+}

package/dist/index.d.ts

@@ -0,0 +1,81 @@
+import './request-augmentation';
+// Re-export the augmentation types so userland can refer to the marker
+// surface explicitly when needed.
+export type { StacksRequestExtensions, StacksRequestMacros, StacksRequestMarkers } from './request-augmentation';
+export type { MiddlewareConfig, Request } from './middleware';
+// Export route registry types — owned here rather than in app/Routes.ts
+// so the path doesn't depend on a 5-level relative reach across the
+// framework defaults tree (stacksjs/stacks#1863, T-10).
+export type { RouteDefinition, RouteRegistry } from './route-types';
+export type { PathParamRejection, SanitizePathParamOptions } from './path-sanitize';
+export type { StreamOptions } from './stacks-router';
+export type { SignedUrlOptions, SignedUrlVerifyResult } from './signed-url';
+export type { EncryptedSessionStoreOptions } from './encrypted-session-store';
+export type {
+  RedisClient,
+  SessionConfig,
+  SessionData,
+  SessionStore,
+  StacksSessionConfig,
+} from './session-factory';
+// Re-export everything from bun-router (includes response factory)
+export * from '@stacksjs/bun-router';
+// Export Stacks-specific action resolver and URL helper
+export { assertRouteMiddlewareResolvable, clearMiddlewareCache, createStacksRouter, findUnresolvableRouteMiddleware, installMiddlewareHotReload, route, serve, serverResponse, url, warnOnMultipleRouterInstances } from './stacks-router';
+// Export request context helpers
+export { cacheRequestQuery, getCurrentRequest, getTraceId, request, runWithRequest, setCurrentRequest, withTraceId } from './request-context';
+// Export Middleware class for defining route middleware
+export { Middleware } from './middleware';
+// Export route loader
+export { loadRoutes } from './route-loader';
+// Export error handler utilities
+export {
+  clearTrackedQueries,
+  createErrorResponse,
+  createMiddlewareErrorResponse,
+  createNotFoundResponse,
+  createValidationErrorResponse,
+  getQueryShapeCounts,
+  trackQuery,
+} from './error-handler';
+// Export route introspection helpers
+export { listRegisteredRoutes, routeParams } from './stacks-router';
+// Export JSON-vs-HTML negotiation predicate so userland can short-circuit
+// the same decision the framework makes in formatResult / error-handler.
+export { isApiRequest, JSON_CONTENT_TYPE } from './api-shape';
+// Export action-level rate limiting helpers
+export { rateLimit, rateLimitStatus, clearRateLimit } from './rate-limit';
+// Export path-param sanitization helper (stacksjs/stacks#1870 R-12).
+// Defense-in-depth for actions that interpolate route params into
+// filesystem paths; the helper enforces no-traversal / no-absolute /
+// no-null-byte / length ceiling at a single chokepoint.
+export { PathParamError, safePathParam, sanitizePathParam } from './path-sanitize';
+// Export the streaming-response helper for SSE / NDJSON / chunked
+// binary returns (stacksjs/stacks#1870 R-4). Actions can return
+// `stream(asyncGen, { type: 'sse' })` and the router pipes it back
+// with the right Content-Type + no-cache headers.
+export { stream } from './stacks-router';
+// Signed-URL helpers — HMAC over the URL + optional expiry so single-
+// use links (email verify, password reset, unsubscribe) can be handed
+// out without long-lived bearer tokens. Pair `signedUrl(...)` with the
+// `signed` middleware (or call `verifySignedUrl(req.url)` directly).
+// See stacksjs/stacks#1870 R-7.
+export { signedUrl, signUrl, verifySignedUrl, verifySignedUrlMiddleware } from './signed-url';
+// Encryption-at-rest wrapper for any bun-router SessionStore
+// (stacksjs/stacks#1878 Se-4). Opt-in: wrap your existing store
+// instance so session payloads are AES-GCM encrypted via APP_KEY
+// before being persisted.
+export { EncryptedSessionStore } from './encrypted-session-store';
+// Session driver factory (stacksjs/stacks#1889, F-2 from #1874).
+// Builds a SessionStore from the Stacks config — picks the right
+// driver from `config.session.driver`, optionally wraps with
+// EncryptedSessionStore. Re-exports all four bun-router store
+// classes so callers can assemble custom stacks manually too.
+export {
+  createSessionStore,
+  createStacksSessionStore,
+  DatabaseSessionStore,
+  FileSessionStore,
+  MemorySessionStore,
+  RedisSessionStore,
+} from './session-factory';

package/dist/index.js

@@ -0,0 +1,37 @@
+var {require}=import.meta;import"./request-augmentation";
+
+export * from "@stacksjs/bun-router";
+export { assertRouteMiddlewareResolvable, clearMiddlewareCache, createStacksRouter, findUnresolvableRouteMiddleware, installMiddlewareHotReload, route, serve, serverResponse, url, warnOnMultipleRouterInstances } from "./stacks-router";
+export { cacheRequestQuery, getCurrentRequest, getTraceId, request, runWithRequest, setCurrentRequest, withTraceId } from "./request-context";
+export { Middleware } from "./middleware";
+export { loadRoutes } from "./route-loader";
+export {
+  clearTrackedQueries,
+  createErrorResponse,
+  createMiddlewareErrorResponse,
+  createNotFoundResponse,
+  createValidationErrorResponse,
+  getQueryShapeCounts,
+  trackQuery
+} from "./error-handler";
+export { listRegisteredRoutes, routeParams } from "./stacks-router";
+export { isApiRequest, JSON_CONTENT_TYPE } from "./api-shape";
+export { rateLimit, rateLimitStatus, clearRateLimit } from "./rate-limit";
+export { PathParamError, safePathParam, sanitizePathParam } from "./path-sanitize";
+export { stream } from "./stacks-router";
+export { signedUrl, signUrl, verifySignedUrl, verifySignedUrlMiddleware } from "./signed-url";
+export { EncryptedSessionStore } from "./encrypted-session-store";
+export {
+  createSessionStore,
+  createStacksSessionStore,
+  DatabaseSessionStore,
+  FileSessionStore,
+  MemorySessionStore,
+  RedisSessionStore
+} from "./session-factory";
+import("@stacksjs/database").then(({ setQueryTracker }) => {
+  if (typeof setQueryTracker === "function") {
+    const { trackQuery } = require("./error-handler");
+    setQueryTracker(trackQuery);
+  }
+}).catch(() => {});

package/dist/middleware.d.ts

@@ -0,0 +1,37 @@
+import type { EnhancedRequest } from '@stacksjs/bun-router';
+export declare interface MiddlewareConfig {
+  name: string
+  priority?: number
+  handle: (request: EnhancedRequest) => void | Promise<void>
+}
+/**
+ * Middleware class for defining route middleware
+ *
+ * Provides a simple, structured way to define middleware handlers
+ * that can be attached to routes and route groups.
+ *
+ * The request object is an EnhancedRequest with helper methods like
+ * `bearerToken()`, `get()`, `input()`, `has()`, etc.
+ *
+ * @example
+ * ```ts
+ * import { Middleware } from '@stacksjs/router'
+ *
+ * export default new Middleware({
+ *   name: 'Auth',
+ *   priority: 1,
+ *   async handle(request) {
+ *     const token = request.bearerToken()
+ *     if (!token) throw new HttpError(401, 'Unauthorized')
+ *   },
+ * })
+ * ```
+ */
+export type Request = EnhancedRequest;
+export declare class Middleware {
+  readonly name: string;
+  readonly priority: number;
+  readonly handle: (request: EnhancedRequest) => void | Promise<void>;
+  constructor(config: MiddlewareConfig);
+  toRouterHandler(): (req: EnhancedRequest, next: () => Promise<Response>) => Promise<Response>;
+}