@stacksjs/router 0.74.26 → 0.74.28

package/dist/api-shape.js

@@ -1 +1 @@
-export const JSON_CONTENT_TYPE=/^application\/(?:json|.+\+json)(?:;|$)/i;export function isApiRequest(req){const headers=req.headers,contentType=headers.get("content-type")||"";if(JSON_CONTENT_TYPE.test(contentType))return!0;if(headers.get("sec-fetch-dest")==="document")return!1;if((headers.get("accept")||"").includes("text/html"))return!1;return!0}
+export const JSON_CONTENT_TYPE=/^application\/(?:json|.+\+json)(?:;|$)/i;export function isApiRequest(req){const headers=req.headers,contentType=headers.get("content-type")||"";if(contentType==="application/json"||JSON_CONTENT_TYPE.test(contentType))return!0;if(headers.get("sec-fetch-dest")==="document")return!1;if((headers.get("accept")||"").includes("text/html"))return!1;return!0}

package/dist/index.d.ts

@@ -28,7 +28,7 @@ export type {
 export * from '@stacksjs/bun-router';
 // Export Stacks-specific action resolver and URL helper
 export { assertRouteMiddlewareResolvable,
-  configureViewDirectories, clearCsrfModuleCache, clearMiddlewareCache, createStacksRouter, disableViewRouting, findUnresolvableRouteMiddleware, installMiddlewareHotReload, resetBootHooks, route, runBootHooks, serve, serverResponse, url, warnOnMultipleRouterInstances } from './stacks-router';
+  configureViewDirectories, clearCsrfModuleCache, clearMiddlewareCache, createStacksRouter, disableViewRouting, enhanceRequest, findUnresolvableRouteMiddleware, installMiddlewareHotReload, loadMiddlewareHandlers, resetBootHooks, route, runBootHooks, serve, serverResponse, url, warnOnMultipleRouterInstances } from './stacks-router';
 // Export request context helpers
 export { cacheRequestQuery, clearCurrentRequest, getCurrentRequest, getTraceId, request, runWithRequest, setCurrentRequest, withTraceId } from './request-context';
 // Export Middleware class for defining route middleware

package/dist/index.js

@@ -1 +1 @@
-import"./request-augmentation";export*from"@stacksjs/bun-router";export{assertRouteMiddlewareResolvable,configureViewDirectories,clearCsrfModuleCache,clearMiddlewareCache,createStacksRouter,disableViewRouting,findUnresolvableRouteMiddleware,installMiddlewareHotReload,resetBootHooks,route,runBootHooks,serve,serverResponse,url,warnOnMultipleRouterInstances}from"./stacks-router";export{cacheRequestQuery,clearCurrentRequest,getCurrentRequest,getTraceId,request,runWithRequest,setCurrentRequest,withTraceId}from"./request-context";export{defineMiddleware,Middleware}from"./middleware";export{listRootMountedAppRoutes,loadRoutes}from"./route-loader";export{clearTrackedQueries,createErrorResponse,createMiddlewareErrorResponse,createNotFoundResponse,createValidationErrorResponse,getQueryShapeCounts,trackQuery}from"./error-handler";export{listNamedRoutes,listRegisteredRoutes,routeParams}from"./stacks-router";export{isRouterAction,wrapAction}from"./stacks-router";export{createTypedRouter}from"./typed-router";export{clearRouteModelBindings,defineRouteModelBinding,resolveRouteModel,routeModelBindings,setRouteModelFallback}from"./route-model-binding";export{isApiRequest,JSON_CONTENT_TYPE}from"./api-shape";export{rateLimit,rateLimitStatus,clearRateLimit}from"./rate-limit";export{PathParamError,safePathParam,sanitizePathParam}from"./path-sanitize";export{checkApplicationHealth,runHealthProbes}from"./health";export{stream}from"./stacks-router";export{signedUrl,signUrl,verifySignedUrl,verifySignedUrlMiddleware}from"./signed-url";export{EncryptedSessionStore}from"./encrypted-session-store";export{createSessionStore,createStacksSessionStore,DatabaseSessionStore,FileSessionStore,MemorySessionStore,RedisSessionStore}from"./session-factory";
+import"./request-augmentation";export*from"@stacksjs/bun-router";export{assertRouteMiddlewareResolvable,configureViewDirectories,clearCsrfModuleCache,clearMiddlewareCache,createStacksRouter,disableViewRouting,enhanceRequest,findUnresolvableRouteMiddleware,installMiddlewareHotReload,loadMiddlewareHandlers,resetBootHooks,route,runBootHooks,serve,serverResponse,url,warnOnMultipleRouterInstances}from"./stacks-router";export{cacheRequestQuery,clearCurrentRequest,getCurrentRequest,getTraceId,request,runWithRequest,setCurrentRequest,withTraceId}from"./request-context";export{defineMiddleware,Middleware}from"./middleware";export{listRootMountedAppRoutes,loadRoutes}from"./route-loader";export{clearTrackedQueries,createErrorResponse,createMiddlewareErrorResponse,createNotFoundResponse,createValidationErrorResponse,getQueryShapeCounts,trackQuery}from"./error-handler";export{listNamedRoutes,listRegisteredRoutes,routeParams}from"./stacks-router";export{isRouterAction,wrapAction}from"./stacks-router";export{createTypedRouter}from"./typed-router";export{clearRouteModelBindings,defineRouteModelBinding,resolveRouteModel,routeModelBindings,setRouteModelFallback}from"./route-model-binding";export{isApiRequest,JSON_CONTENT_TYPE}from"./api-shape";export{rateLimit,rateLimitStatus,clearRateLimit}from"./rate-limit";export{PathParamError,safePathParam,sanitizePathParam}from"./path-sanitize";export{checkApplicationHealth,runHealthProbes}from"./health";export{stream}from"./stacks-router";export{signedUrl,signUrl,verifySignedUrl,verifySignedUrlMiddleware}from"./signed-url";export{EncryptedSessionStore}from"./encrypted-session-store";export{createSessionStore,createStacksSessionStore,DatabaseSessionStore,FileSessionStore,MemorySessionStore,RedisSessionStore}from"./session-factory";

package/dist/request-augmentation.d.ts

@@ -23,6 +23,7 @@ export declare interface StacksRequestMarkers {
   _authenticatedUser?: unknown
   _currentAccessToken?: unknown
   _bodyParsed?: boolean
+  _rawBodyContentType?: string
   _responseHeaders?: Record<string, string>
   _afterResponse?: Array<(outcome: { status: number, durationMs: number }) => void>
 }

package/dist/request-context.d.ts

@@ -65,6 +65,10 @@ export declare function clearCurrentRequest(): void;
  * All code executed within the callback will have access to the request
  */
 export declare function runWithRequest<T>(req: EnhancedRequest, fn: () => T): T;
+/** Run a synchronous dispatcher without allocating a callback closure. */
+export declare function runWithRequestArgument<T, A>(req: EnhancedRequest, fn: (arg: A) => T, arg: A): T;
+/** Run a dispatcher with three arguments without allocating a callback closure. */
+export declare function runWithRequestArguments<T, A, B, C>(req: EnhancedRequest, fn: (first: A, second: B, third: C) => T, first: A, second: B, third: C): T;
 /**
  * Get the current request from context
  */

package/dist/request-context.js

@@ -1 +1 @@
-import process from"node:process";import{AsyncLocalStorage}from"node:async_hooks";import{log}from"@stacksjs/logging";const REQUEST_STORAGE_KEY=Symbol.for("stacks.router.requestStorage"),requestStorage=globalThis[REQUEST_STORAGE_KEY]??=new AsyncLocalStorage,TRACE_STORAGE_KEY=Symbol.for("stacks.router.traceStorage"),traceStorage=globalThis[TRACE_STORAGE_KEY]??=new AsyncLocalStorage;export function getTraceId(){const explicit=traceStorage.getStore();if(explicit)return explicit;return requestStorage.getStore()?._requestId}export function withTraceId(id,fn){return traceStorage.run(id,fn)}const REQUEST_QUERY_CACHE_KEY=Symbol.for("stacks.requestQueryCache");function getRequestCache(){const req=requestStorage.getStore();if(!req)return;let cache=req[REQUEST_QUERY_CACHE_KEY];if(!cache){cache={map:new Map};req[REQUEST_QUERY_CACHE_KEY]=cache}return cache}export async function cacheRequestQuery(key,fetcher){const cache=getRequestCache();if(!cache)return fetcher();const existing=cache.map.get(key);if(existing)return existing;const promise=Promise.resolve().then(()=>fetcher());cache.map.set(key,promise);promise.catch(()=>cache.map.delete(key));return promise}export function setCurrentRequest(req){log.debug(`[request] ${req.method} ${new URL(req.url).pathname}`);requestStorage.enterWith(req)}export function clearCurrentRequest(){requestStorage.enterWith(void 0)}export function runWithRequest(req,fn){return requestStorage.run(req,fn)}export function getCurrentRequest(){return requestStorage.getStore()}export const request=new Proxy({},{get(_target,prop){const currentRequest=getCurrentRequest();if(!currentRequest){if(process.env.NODE_ENV!=="production")console.warn(`[RequestContext] Accessing request.${String(prop)} outside of request context`);if(prop==="bearerToken")return()=>null;if(prop==="user"||prop==="userToken")return async()=>{return};if(prop==="tokenCan"||prop==="tokenCant")return async()=>!1;if(prop==="headers")return new Headers;if(prop==="url")return"";if(prop==="method")return"GET";return}const value=currentRequest[prop];if(typeof value==="function")return value.bind(currentRequest);return value}});
+import process from"node:process";import{AsyncLocalStorage}from"node:async_hooks";import{log}from"@stacksjs/logging";const REQUEST_STORAGE_KEY=Symbol.for("stacks.router.requestStorage"),requestStorage=globalThis[REQUEST_STORAGE_KEY]??=new AsyncLocalStorage,TRACE_STORAGE_KEY=Symbol.for("stacks.router.traceStorage"),traceStorage=globalThis[TRACE_STORAGE_KEY]??=new AsyncLocalStorage;export function getTraceId(){const explicit=traceStorage.getStore();if(explicit)return explicit;return requestStorage.getStore()?._requestId}export function withTraceId(id,fn){return traceStorage.run(id,fn)}const REQUEST_QUERY_CACHE_KEY=Symbol.for("stacks.requestQueryCache");function getRequestCache(){const req=requestStorage.getStore();if(!req)return;let cache=req[REQUEST_QUERY_CACHE_KEY];if(!cache){cache={map:new Map};req[REQUEST_QUERY_CACHE_KEY]=cache}return cache}export async function cacheRequestQuery(key,fetcher){const cache=getRequestCache();if(!cache)return fetcher();const existing=cache.map.get(key);if(existing)return existing;const promise=Promise.resolve().then(()=>fetcher());cache.map.set(key,promise);promise.catch(()=>cache.map.delete(key));return promise}export function setCurrentRequest(req){log.debug(`[request] ${req.method} ${new URL(req.url).pathname}`);requestStorage.enterWith(req)}export function clearCurrentRequest(){requestStorage.enterWith(void 0)}export function runWithRequest(req,fn){return requestStorage.run(req,fn)}export function runWithRequestArgument(req,fn,arg){return requestStorage.run(req,fn,arg)}export function runWithRequestArguments(req,fn,first,second,third){return requestStorage.run(req,fn,first,second,third)}export function getCurrentRequest(){return requestStorage.getStore()}export const request=new Proxy({},{get(_target,prop){const currentRequest=getCurrentRequest();if(!currentRequest){if(process.env.NODE_ENV!=="production")console.warn(`[RequestContext] Accessing request.${String(prop)} outside of request context`);if(prop==="bearerToken")return()=>null;if(prop==="user"||prop==="userToken")return async()=>{return};if(prop==="tokenCan"||prop==="tokenCant")return async()=>!1;if(prop==="headers")return new Headers;if(prop==="url")return"";if(prop==="method")return"GET";return}const value=currentRequest[prop];if(typeof value==="function")return value.bind(currentRequest);return value}});

package/dist/security-headers.d.ts

@@ -14,7 +14,17 @@
  *
  * Skips overwriting any header that's already set — explicit userland
  * config wins. Skips entirely when `STACKS_SECURITY_HEADERS_DISABLE=true`.
+ * `knownMissing` is reserved for router-created responses whose security
+ * headers are known to be absent, avoiding redundant native lookups.
  */
-export declare function applySecurityHeaders(headers: Headers): void;
+export declare function applySecurityHeaders(headers: Headers, knownMissing?: boolean): void;
+/** Add the defaults to a fresh response-init record before Response creation. */
+export declare function applySecurityHeadersToRecord(headers: Record<string, string>): void;
+/** Clone the resolved defaults without rebuilding their JS record each time. */
+export declare function createSecurityHeaders(): Headers;
+/** Clone the resolved defaults with the invariant JSON content type included. */
+export declare function createJsonSecurityHeaders(): Headers;
+/** Create an already-serialized JSON response from the cached template. */
+export declare function secureSerializedJsonResponse(body: string, bodyLength?: number, requestId?: string, csrfCookie?: string): Response;
 /** Test helper — reset the cached env-derived flags. */
 export declare function __resetSecurityHeadersCache(): void;

package/dist/security-headers.js

@@ -1 +1 @@
-import process from"node:process";let _isProductionCache,_isDisabledCache,_cspCache;function isProduction(){if(_isProductionCache!==void 0)return _isProductionCache;_isProductionCache=(process.env.APP_ENV??process.env.NODE_ENV??"").toLowerCase()==="production";return _isProductionCache}function isDisabled(){if(_isDisabledCache!==void 0)return _isDisabledCache;_isDisabledCache=process.env.STACKS_SECURITY_HEADERS_DISABLE==="true";return _isDisabledCache}function resolveCsp(){if(_cspCache!==void 0)return _cspCache;const enforce=process.env.STACKS_CSP,report=process.env.STACKS_CSP_REPORT_ONLY;if(enforce)_cspCache={header:"Content-Security-Policy",value:enforce};else if(report)_cspCache={header:"Content-Security-Policy-Report-Only",value:report};else _cspCache=null;return _cspCache}export function applySecurityHeaders(headers){if(isDisabled())return;if(!headers.has("X-Content-Type-Options"))headers.set("X-Content-Type-Options","nosniff");if(!headers.has("X-Frame-Options"))headers.set("X-Frame-Options","SAMEORIGIN");if(!headers.has("Referrer-Policy"))headers.set("Referrer-Policy","strict-origin-when-cross-origin");if(isProduction()&&!headers.has("Strict-Transport-Security"))headers.set("Strict-Transport-Security","max-age=31536000; includeSubDomains");const csp=resolveCsp();if(csp&&!headers.has(csp.header))headers.set(csp.header,csp.value)}export function __resetSecurityHeadersCache(){_isProductionCache=void 0;_isDisabledCache=void 0;_cspCache=void 0}
+import process from"node:process";let _isProductionCache,_isDisabledCache,_cspCache,_headerTemplateCache,_jsonHeaderTemplateCache,_jsonLengthHeaderTemplateCache;const JSON_LENGTH_HEADER_CACHE_LIMIT=64;function isProduction(){if(_isProductionCache!==void 0)return _isProductionCache;_isProductionCache=(process.env.APP_ENV??process.env.NODE_ENV??"").toLowerCase()==="production";return _isProductionCache}function isDisabled(){if(_isDisabledCache!==void 0)return _isDisabledCache;_isDisabledCache=process.env.STACKS_SECURITY_HEADERS_DISABLE==="true";return _isDisabledCache}function resolveCsp(){if(_cspCache!==void 0)return _cspCache;const enforce=process.env.STACKS_CSP,report=process.env.STACKS_CSP_REPORT_ONLY;if(enforce)_cspCache={header:"Content-Security-Policy",value:enforce};else if(report)_cspCache={header:"Content-Security-Policy-Report-Only",value:report};else _cspCache=null;return _cspCache}export function applySecurityHeaders(headers,knownMissing=!1){if(isDisabled())return;if(knownMissing||headers.get("X-Content-Type-Options")===null)headers.set("X-Content-Type-Options","nosniff");if(knownMissing||headers.get("X-Frame-Options")===null)headers.set("X-Frame-Options","SAMEORIGIN");if(knownMissing||headers.get("Referrer-Policy")===null)headers.set("Referrer-Policy","strict-origin-when-cross-origin");if(isProduction()&&(knownMissing||headers.get("Strict-Transport-Security")===null))headers.set("Strict-Transport-Security","max-age=31536000; includeSubDomains");const csp=resolveCsp();if(csp&&(knownMissing||headers.get(csp.header)===null))headers.set(csp.header,csp.value)}export function applySecurityHeadersToRecord(headers){if(isDisabled())return;headers["X-Content-Type-Options"]="nosniff";headers["X-Frame-Options"]="SAMEORIGIN";headers["Referrer-Policy"]="strict-origin-when-cross-origin";if(isProduction())headers["Strict-Transport-Security"]="max-age=31536000; includeSubDomains";const csp=resolveCsp();if(csp)headers[csp.header]=csp.value}function securityHeadersTemplate(){if(!_headerTemplateCache){_headerTemplateCache=new Headers;applySecurityHeaders(_headerTemplateCache,!0)}return _headerTemplateCache}export function createSecurityHeaders(){return new Headers(securityHeadersTemplate())}function jsonSecurityHeadersTemplate(){if(!_jsonHeaderTemplateCache){_jsonHeaderTemplateCache=new Headers(securityHeadersTemplate());_jsonHeaderTemplateCache.set("Content-Type","application/json;charset=utf-8");_jsonHeaderTemplateCache.set("Vary","Accept-Encoding")}return _jsonHeaderTemplateCache}export function createJsonSecurityHeaders(){return new Headers(jsonSecurityHeadersTemplate())}export function secureSerializedJsonResponse(body,bodyLength,requestId,csrfCookie){const baseHeaders=jsonSecurityHeadersTemplate();if(bodyLength===void 0)return new Response(body,{headers:baseHeaders});const templates=_jsonLengthHeaderTemplateCache??=new Map;let lengthTemplates=templates.get(bodyLength);if(!lengthTemplates&&templates.size<JSON_LENGTH_HEADER_CACHE_LIMIT){const headers=new Headers(baseHeaders);headers.set("Content-Length",String(bodyLength));lengthTemplates={plain:{headers}};templates.set(bodyLength,lengthTemplates)}if(lengthTemplates){if(csrfCookie){const responseInit=requestId?lengthTemplates.withCsrfAndRequestId??={headers:new Headers(lengthTemplates.plain.headers)}:lengthTemplates.withCsrf??={headers:new Headers(lengthTemplates.plain.headers)};responseInit.headers.set("Set-Cookie",csrfCookie);if(requestId)responseInit.headers.set("X-Request-ID",requestId);return new Response(body,responseInit)}if(!requestId)return new Response(body,lengthTemplates.plain);const responseInit=lengthTemplates.withRequestId??={headers:new Headers(lengthTemplates.plain.headers)};responseInit.headers.set("X-Request-ID",requestId);return new Response(body,responseInit)}const response=new Response(body,{headers:baseHeaders});response.headers.set("Content-Length",String(bodyLength));if(requestId)response.headers.set("X-Request-ID",requestId);if(csrfCookie)response.headers.append("Set-Cookie",csrfCookie);return response}export function __resetSecurityHeadersCache(){_isProductionCache=void 0;_isDisabledCache=void 0;_cspCache=void 0;_headerTemplateCache=void 0;_jsonHeaderTemplateCache=void 0;_jsonLengthHeaderTemplateCache=void 0}

package/dist/stacks-router.d.ts

@@ -1,5 +1,6 @@
 import type { Server } from 'bun';
 import './request-augmentation';
+import { response } from '@stacksjs/bun-router';
 import { Router } from '@stacksjs/bun-router';
 import type { ActionHandler, ActionPath, EnhancedRequest, ExtractRouteParams, KnownRouteName, MiddlewareHandler as BunMiddlewareHandler, MiddlewareReference, PathForRouteName, RequestFor, Route, ServerOptions } from '@stacksjs/bun-router';
 import type { ActionResult, ActionValidations, ValidationResult } from '@stacksjs/actions';
@@ -16,6 +17,13 @@ export declare function runBootHooks(): Promise<void>;
 /** For tests, and for a process that genuinely re-boots. */
 export declare function resetBootHooks(): void;
 export declare function warnOnMultipleRouterInstances(): boolean;
+/**
+ * Production defaults to Bun's native matcher only when every eligible route
+ * can keep the same semantics. One incompatible route keeps the whole table on
+ * bun-router, since a native route can otherwise intercept a request that an
+ * overlapping constrained, domain-scoped, or mixed-parameter route expected.
+ */
+export declare function shouldUseNativeRoutesByDefault(routes: readonly Route[]): boolean;
 // False positive: this is an overload signature, which has no body for its
 // parameters to be used in. The implementation below uses them.
 // eslint-disable-next-line unused-imports/no-unused-vars
@@ -61,6 +69,10 @@ export declare function listRegisteredRoutes(): Array<{ method: string, path: st
  * cached map out from under the router.
  */
 export declare function middlewareAliases(): Promise<Record<string, string>>;
+/*.ts` as the single middleware registry instead of asking
+ * the application to define a second set of anonymous page-only functions.
+ */
+export declare function loadMiddlewareHandlers(): Promise<Record<string, MiddlewareHandler>>;
 /**
  * Clear the middleware cache (useful for hot-reload in development).
  *
@@ -135,7 +147,7 @@ export declare function assertRouteMiddlewareResolvable(): Promise<void>;
  * submission or a `<script client>` block using a bare fetch shorthand, and
  * requiring one would have put this out of reach of the simplest caller.
  */
-export declare function precognitionRequest(req: EnhancedRequest): { only: string[] } | null;
+export declare function precognitionRequest(req: EnhancedRequest, knownHeader?: string | null): { only: string[] } | null;
 /**
  * The "nothing to report" answer to a precognition request. 204 rather than an
  * empty 200 so a client cannot mistake it for the action's real result.
@@ -162,18 +174,11 @@ export declare function isRouterAction(handler: unknown): handler is RouterActio
  * otherwise.
  */
 export declare function wrapAction(action: RouterAction, handlerKey: string): RouteHandlerFn;
-/**
- * Run an action's declarative `validations:` against the request.
- *
- * @internal Exported for regression coverage of path-param coercion
- * (stacksjs/stacks#1865). Production callers should rely on the
- * router's action-resolution path, which invokes this for you.
- */
 export declare function validateActionInput(req: EnhancedRequest, validations: ActionValidations): Promise<ValidationResult>;
 export declare function stream(source: ReadableStream | AsyncIterable<string | Uint8Array>, options?: StreamOptions): Response;
 /** Test / hot-reload seam: forget the resolved module. */
 export declare function clearCsrfModuleCache(): void;
-export declare function enhanceRequest(req: EnhancedRequest): EnhancedRequest;
+export declare function enhanceRequest(req: EnhancedRequest, initializeRequestId?: boolean): EnhancedRequest;
 /**
  * Create a Stacks-enhanced router
  */
@@ -227,6 +232,9 @@ export declare function disableViewRouting(bunRouter: Router): boolean;
 export declare function serverResponse(request: Request, _body?: string): Promise<Response>;
 // Export serve function that uses the default router
 export declare function serve(options?: ServerOptions): Promise<Server<unknown>>;
+declare const CSRF_DEFAULT: 0;
+declare const CSRF_SKIPPED: 1;
+declare const CSRF_REQUIRED: 2;
 export declare const route: StacksRouterInstance;
 /**
  * Warn (once per process) when more than one @stacksjs/router module has loaded
@@ -269,6 +277,8 @@ export declare interface BootHook {
 declare interface StacksRouterConfig {
   verbose?: boolean
   apiPrefix?: string
+  requestIds?: boolean
+  csrf?: boolean
 }
 declare interface GroupOptions {
   prefix?: string
@@ -293,6 +303,11 @@ export declare interface ChainableRoute {
   requireCsrf: () => ChainableRoute
   rateLimit: (max: number, window: 'second' | 'minute' | 'hour' | 'day' | number) => ChainableRoute
 }
+/** Represents a middleware module with a handle method */
+declare interface MiddlewareHandler {
+  handle: (req: EnhancedRequest) => Promise<void> | void
+  priority?: number
+}
 /**
  * Anything the router is willing to treat as an action.
  *
@@ -461,6 +476,7 @@ declare type MissingResourceActions<TBase extends string, TActive extends Resour
 declare type ResourceBaseCheck<TBase extends string, TActive extends ResourceAction> = [MissingResourceActions<TBase, TActive>] extends [never]
     ? unknown
     : { 'these actions do not exist': MissingResourceActions<TBase, TActive> }
+declare type RouteCsrfMode = typeof CSRF_DEFAULT | typeof CSRF_SKIPPED | typeof CSRF_REQUIRED;
 /**
  * Generate a full URL for a named route, like Laravel's route() helper.
  *
@@ -505,6 +521,15 @@ declare type RequiredParamKeys<T> = { [K in keyof T]-?: object extends Pick<T, K
  * the type getting in the way of the truth.
  */
 declare type RequiresUrlParams<TName extends string> = [RequiredParamKeys<ExtractRouteParams<PathForRouteName<TName>>>] extends [never] ? false : true;
+/**
+ * Run an action's declarative `validations:` against the request.
+ *
+ * The action path uses this synchronous core because input collection and the
+ * validator contract are synchronous. The exported wrapper below stays
+ * Promise-based for compatibility with callers that chain or await it.
+ */
+declare type ActionRuleTest = (value: unknown) => boolean;
+declare type ActionValidationEntry = [string, ActionValidations[string], ActionRuleTest[]?];
 /**
  * Per-request read-routing context.
  *
@@ -522,7 +547,10 @@ declare type RequiresUrlParams<TName extends string> = [RequiredParamKeys<Extrac
  * is a plain pass-through so a build without the database package (or an
  * older one) still serves requests.
  */
-declare type ContextRunner = <T>(fn: () => T) => T;
+declare type ContextDispatcher = <T, A>(fn: (arg: A) => T, arg: A) => T;
+declare type NativeRouteHandler = (request: Request) => Response | Promise<Response>;
+declare type NativeRouteTable = Record<string, Record<string, NativeRouteHandler>>;
+declare type NativeResponseFinalizer = (response: Response, request: Request) => Response | Promise<Response>;
 /**
  * FIFO-bounded Map. Wraps `Map` with a hard size cap; on overflow,
  * the oldest entry (Map insertion order) is evicted. Used for the

package/dist/stacks-router.js

@@ -1,6 +1,6 @@
-import{response}from"@stacksjs/bun-router";import{Middleware}from"./middleware";import"./request-augmentation";import process from"node:process";import{Buffer}from"node:buffer";import{existsSync}from"node:fs";import{timingSafeEqual}from"node:crypto";import{collect}from"@stacksjs/collections";import{log,report}from"@stacksjs/logging";import{path as p}from"@stacksjs/path";import{UploadedFile}from"@stacksjs/storage/uploaded-file";import{applyRequestEnhancements,Router}from"@stacksjs/bun-router";import{checkApplicationHealth}from"./health";const ROUTER_INSTANCES_KEY=Symbol.for("@stacksjs/router:loaded-instances"),loadedRouterInstances=globalThis[ROUTER_INSTANCES_KEY]??=new Set;loadedRouterInstances.add(import.meta.path);const MULTI_INSTANCE_WARNED_KEY=Symbol.for("@stacksjs/router:multi-instance-warned"),bootHooks=[];let bootHooksRun=!1;export async function runBootHooks(){if(bootHooksRun)return;bootHooksRun=!0;for(const hook of bootHooks)try{await hook.run()}catch(error){log.error(`[router] boot hook "${hook.name}" failed:`,error)}}export function resetBootHooks(){bootHooks.length=0;bootHooksRun=!1}export function warnOnMultipleRouterInstances(){if(loadedRouterInstances.size<=1)return!1;const g=globalThis;if(!g[MULTI_INSTANCE_WARNED_KEY]){g[MULTI_INSTANCE_WARNED_KEY]=!0;const paths=[...loadedRouterInstances].map((p)=>`    - ${p}`).join(`
+import{response}from"@stacksjs/bun-router";import{Middleware}from"./middleware";import"./request-augmentation";import process from"node:process";import{Buffer}from"node:buffer";import{existsSync}from"node:fs";import{timingSafeEqual}from"node:crypto";import{collect}from"@stacksjs/collections";import{log,report}from"@stacksjs/logging";import{path as p}from"@stacksjs/path";import{UploadedFile}from"@stacksjs/storage/uploaded-file";import{applyRequestEnhancements,applyResponseCompression,Router,runWithRequest as runWithBunRouterRequest}from"@stacksjs/bun-router";import{checkApplicationHealth}from"./health";const ROUTER_INSTANCES_KEY=Symbol.for("@stacksjs/router:loaded-instances"),loadedRouterInstances=globalThis[ROUTER_INSTANCES_KEY]??=new Set;loadedRouterInstances.add(import.meta.path);const MULTI_INSTANCE_WARNED_KEY=Symbol.for("@stacksjs/router:multi-instance-warned"),bootHooks=[];let bootHooksRun=!1;export async function runBootHooks(){if(bootHooksRun)return;bootHooksRun=!0;for(const hook of bootHooks)try{await hook.run()}catch(error){log.error(`[router] boot hook "${hook.name}" failed:`,error)}}export function resetBootHooks(){bootHooks.length=0;bootHooksRun=!1}export function warnOnMultipleRouterInstances(){if(loadedRouterInstances.size<=1)return!1;const g=globalThis;if(!g[MULTI_INSTANCE_WARNED_KEY]){g[MULTI_INSTANCE_WARNED_KEY]=!0;const paths=[...loadedRouterInstances].map((p)=>`    - ${p}`).join(`
 `);log.warn(`${loadedRouterInstances.size} distinct @stacksjs/router modules loaded in one process; they now share one route table (stacksjs/stacks#1982) so routing still works, but this is a duplicated install worth fixing. It usually means an app vendors storage/framework/core AND installs the published @stacksjs/* dist, and a tsconfig \`paths\` mapping (\`@stacksjs/* -> ./*/src\`) splits module resolution between core files and root files. See stacksjs/stacks#1975.
 Loaded instances:
-${paths}`)}return!0}let __defaultsPkgRoot;const __defaultsPathCache=new Map;function resolveDefaultsPath(rel){const cached=__defaultsPathCache.get(rel);if(cached!==void 0)return cached;if(rel.startsWith("app/")){const published=p.appPath(rel.slice(4));if(existsSync(published)){__defaultsPathCache.set(rel,published);return published}}const vendored=p.storagePath(`framework/defaults/${rel}`);let resolved;if(existsSync(vendored))resolved=vendored;else{if(__defaultsPkgRoot===void 0)try{const pkgJson=Bun.resolveSync("@stacksjs/defaults/package.json",process.cwd());__defaultsPkgRoot=pkgJson.slice(0,pkgJson.lastIndexOf("/"))}catch{__defaultsPkgRoot=null}resolved=__defaultsPkgRoot?`${__defaultsPkgRoot}/${rel}`:vendored}__defaultsPathCache.set(rel,resolved);return resolved}import{runWithRequest}from"./request-context";import{isApiRequest,JSON_CONTENT_TYPE}from"./api-shape";import{clearTrackedQueries,createErrorResponse,createMiddlewareErrorResponse}from"./error-handler";import{applySecurityHeaders}from"./security-headers";import{isCursorPaginator,isPaginator,isSimplePaginator}from"@stacksjs/pagination";const csrfSkipRegistry=new Set,csrfRequireRegistry=new Set,routeRateLimitRegistry=new Map;function rateLimitWindowToSeconds(window){if(typeof window==="number"){if(!Number.isFinite(window)||window<=0)throw Error(`[Router] .rateLimit(): window must be a positive number of seconds, got ${window}`);return Math.floor(window)}switch(window){case"second":return 1;case"minute":return 60;case"hour":return 3600;case"day":return 86400;default:throw Error(`[Router] .rateLimit(): unknown period '${String(window)}'`)}}class BoundedMap{max;map=new Map;constructor(max){this.max=max}get(key){return this.map.get(key)}has(key){return this.map.has(key)}set(key,value){if(this.map.has(key))this.map.delete(key);this.map.set(key,value);if(this.map.size>this.max){const oldest=this.map.keys().next().value;if(oldest!==void 0)this.map.delete(oldest)}return this}delete(key){return this.map.delete(key)}clear(){this.map.clear()}get size(){return this.map.size}}function isExposeRoutesAuthorized(req){const flag=process.env.STACKS_EXPOSE_ROUTES??"";if(!flag)return!((process.env.APP_ENV??"").toLowerCase()==="production"||process.env.NODE_ENV==="production");if(flag==="1")return!((process.env.APP_ENV??"").toLowerCase()==="production"||process.env.NODE_ENV==="production");const url=new URL(req.url),submitted=req.headers.get("x-stacks-routes-token")||req.headers.get("X-Stacks-Routes-Token")||url.searchParams.get("token")||"";if(typeof submitted!=="string"||submitted.length===0||submitted.length!==flag.length)return!1;try{return timingSafeEqual(Buffer.from(submitted),Buffer.from(flag))}catch{return!1}}async function applyCorsIfConfigured(req,response){if(!req._corsConfig||!response)return response;try{const{applyCorsHeaders}=await import(resolveDefaultsPath("app/Middleware/Cors.ts"));return applyCorsHeaders(req,response,req._corsConfig)}catch(err){log.warn("[router] CORS header injection failed",{error:err});return response}}const ACTION_CACHE_MAX=5000,actionSkipsCsrfCache=new BoundedMap(ACTION_CACHE_MAX),routeHandlerKeyRegistry=new BoundedMap(ACTION_CACHE_MAX),routeActionRegistry=new Map,CSRF_PROTECTED_METHODS=new Set(["POST","PUT","PATCH","DELETE"]),CSRF_SEEDED_BY_HANDLE_REQUEST=Symbol.for("stacks.router.csrfSeededByHandleRequest"),EMPTY_RESOLVED_MIDDLEWARE=[],EMPTY_MIDDLEWARE_TIMINGS=[],namedRouteRegistry=new Map;function compileNamedRoute(path){const paramNames=extractRouteParamNames(path),colonRegex=new Map;for(const name of paramNames)colonRegex.set(name,new RegExp(`(^|/):${name}(?=$|/)`,"g"));return{path,paramNames,colonRegex}}function extractRouteParamNames(routePath){const names=new Set;for(const m of routePath.matchAll(/\{(\w+)\}/g))if(m[1])names.add(m[1]);for(const m of routePath.matchAll(/(?:^|\/):(\w+)(?=$|\/)/g))if(m[1])names.add(m[1]);return[...names]}export function url(routeName,params={}){const named=namedRouteRegistry.get(routeName);if(!named)throw Error(`Route '${routeName}' is not defined. Available routes: ${[...namedRouteRegistry.keys()].join(", ")}`);const missing=named.paramNames.filter((name)=>!(name in params)||params[name]===void 0);if(missing.length>0)throw Error(`url('${routeName}'): missing required path param${missing.length>1?"s":""} [${missing.join(", ")}] for path '${named.path}'. Pass them as the second argument: url('${routeName}', { ${named.paramNames.join(", ")} })`);let appUrl;try{appUrl=process.env.APP_URL||"https://localhost"}catch{appUrl="https://localhost"}appUrl=appUrl.replace(/\/$/,"");if(!appUrl.startsWith("http"))appUrl=`https://${appUrl}`;let resolvedPath=named.path;const queryParams={};for(const[key,value]of Object.entries(params)){const curly=`{${key}}`;if(resolvedPath.includes(curly))resolvedPath=resolvedPath.replaceAll(curly,encodeURIComponent(String(value)));else{const re=named.colonRegex.get(key);if(re&&re.test(resolvedPath)){re.lastIndex=0;resolvedPath=resolvedPath.replace(re,`$1${encodeURIComponent(String(value))}`)}else queryParams[key]=String(value)}}const queryString=Object.keys(queryParams).length>0?`?${new URLSearchParams(queryParams).toString()}`:"";return`${appUrl}${resolvedPath}${queryString}`}export function routeParams(routeName){const named=namedRouteRegistry.get(routeName);return named?[...named.paramNames]:[]}export function listNamedRoutes(){const out={};for(const[name,named]of namedRouteRegistry.entries())out[name]=named.path;return out}export function listRegisteredRoutes(){const out=[],seen=new Set;for(const key of routeMiddlewareRegistry.keys()){if(seen.has(key))continue;seen.add(key);const idx=key.indexOf(":");if(idx===-1)continue;const method=key.slice(0,idx),path=key.slice(idx+1);let routeName;for(const[n,named]of namedRouteRegistry.entries())if(named.path===path){routeName=n;break}out.push({method,path,name:routeName,handler:routeHandlerKeyRegistry.get(key),action:routeActionRegistry.get(key)})}return out.sort((a,b)=>a.path.localeCompare(b.path))}const MIDDLEWARE_TIMEOUT_MS=30000;let _debugLoggingCache;function isDebugLogging(){if(_debugLoggingCache===void 0){const level=(process.env.LOG_LEVEL||"info").toLowerCase();_debugLoggingCache=level!=="info"&&level!=="warn"&&level!=="error"}return _debugLoggingCache}const DEFAULT_MIDDLEWARE_PRIORITY=10,_warnedInvalidPriorities=new Set;function warnInvalidMiddlewarePriority(name,raw){const key=`${name}:${String(raw)}`;if(_warnedInvalidPriorities.has(key))return;_warnedInvalidPriorities.add(key);log.warn(`[Router] Middleware '${name}' declared an invalid priority (${String(raw)}). Priorities must be a finite non-negative number; falling back to default ${DEFAULT_MIDDLEWARE_PRIORITY}.`)}function adaptMiddlewareForBunRouter(middleware){if(middleware instanceof Middleware)return middleware.toRouterHandler();if(middleware&&typeof middleware==="object"&&typeof middleware.handle==="function"&&typeof middleware!=="function"){const handle=middleware.handle.bind(middleware);return async(req,next)=>{try{await handle(req)}catch(thrown){if(thrown instanceof Response)return thrown;throw thrown}return next()}}return middleware}const middlewareCache=new Map;let middlewareAliasesPromise=null;async function getMiddlewareAliases(){if(middlewareAliasesPromise)return middlewareAliasesPromise;middlewareAliasesPromise=(async()=>{const merged={};for(const load of[()=>import(resolveDefaultsPath("app/Middleware.ts")),()=>import(p.appPath("Middleware.ts"))])try{const module=await load();Object.assign(merged,module.default??{})}catch{}return merged})();return middlewareAliasesPromise}const PASCAL_SPLIT_REGEX=/[-_\s]+/,pascalCaseCache=new Map;function toPascalCase(input){if(!input)return input;const cached=pascalCaseCache.get(input);if(cached!==void 0)return cached;const out=input.split(PASCAL_SPLIT_REGEX).filter(Boolean).map((part)=>part.charAt(0).toUpperCase()+part.slice(1)).join("");pascalCaseCache.set(input,out);return out}async function resolveMiddlewareName(name){const resolved=(await getMiddlewareAliases())[name]||toPascalCase(name);log.debug(`[middleware] Resolved: ${name} \u2192 ${resolved}`);return resolved}let middlewareRegistryPromise=null;async function getMiddlewareRegistry(){if(middlewareRegistryPromise)return middlewareRegistryPromise;middlewareRegistryPromise=(async()=>{try{const dir=p.storagePath("framework/auto-imports"),module=await import(`${dir}/middleware.ts`);if(!module.middleware)return null;const{resolve}=await import("node:path");return Object.fromEntries(Object.entries(module.middleware).map(([name,file])=>[name,resolve(dir,file)]))}catch{return null}})();return middlewareRegistryPromise}async function loadMiddleware(name){if(middlewareCache.has(name))return middlewareCache.get(name)??null;const className=await resolveMiddlewareName(name),registered=(await getMiddlewareRegistry())?.[className];if(registered)try{const handler=(await import(registered)).default??null;if(!handler||typeof handler.handle!=="function"){log.error(`[Router] Middleware '${name}' resolved to ${registered}, but the file has no default export with a handle() method`);middlewareCache.set(name,null);return null}middlewareCache.set(name,handler);return handler}catch(err){log.error(`[Router] Failed to load middleware '${name}' from ${registered}:`,err);return null}let userPathError;try{const userPath=p.appPath(`Middleware/${className}.ts`),handler=(await import(userPath)).default??null;if(!handler||typeof handler.handle!=="function"){log.error(`[Router] Middleware '${name}' resolved to ${userPath}, but the file has no default export with a handle() method`);middlewareCache.set(name,null);return null}middlewareCache.set(name,handler);return handler}catch(err){userPathError=err}try{const defaultPath=resolveDefaultsPath(`app/Middleware/${className}.ts`),handler=(await import(defaultPath)).default??null;if(!handler||typeof handler.handle!=="function"){log.error(`[Router] Middleware '${name}' resolved to ${defaultPath}, but the file has no default export with a handle() method`);middlewareCache.set(name,null);return null}middlewareCache.set(name,handler);return handler}catch(err){const userMsg=userPathError instanceof Error?userPathError.message:String(userPathError);log.error(`[Router] Failed to load middleware '${name}' (resolved to '${className}'). app/Middleware: ${userMsg}; defaults:`,err);return null}}export async function middlewareAliases(){return{...await getMiddlewareAliases()}}const negatedMiddlewareCache=new Map;function isShortCircuit(thrown){if(thrown instanceof Response)return!0;return typeof thrown==="object"&&thrown!==null&&(("status"in thrown)||("statusCode"in thrown))}function negateMiddleware(name,inner){const cached=negatedMiddlewareCache.get(name);if(cached)return cached;const negated={priority:inner.priority,async handle(req){try{await inner.handle(req)}catch(thrown){if(isShortCircuit(thrown))return;throw thrown}const{HttpError}=await import("@stacksjs/error-handling");throw new HttpError(403,`Access denied. This route requires "${name}" not to apply.`)}};negatedMiddlewareCache.set(name,negated);return negated}function loadParsedMiddleware(parsed){const cached=middlewareCache.get(parsed.name);if(cached!==void 0)return cached&&parsed.negated?negateMiddleware(parsed.name,cached):cached;return loadMiddleware(parsed.name).then((handler)=>handler&&parsed.negated?negateMiddleware(parsed.name,handler):handler)}export function clearMiddlewareCache(){middlewareCache.clear();negatedMiddlewareCache.clear();parsedMiddlewareCache=new Map;middlewareAliasesPromise=null;middlewareRegistryPromise=null;actionRegistryPromise=null;actionSkipsCsrfCache.clear();routeHandlerKeyRegistry.clear();routeActionRegistry.clear();clearCsrfModuleCache()}export function installMiddlewareHotReload(){if(process.env.APP_ENV==="production"||process.env.NODE_ENV==="production")return()=>{};let fsWatchers=[];(async()=>{try{const fs=await import("node:fs"),targets=[p.appPath("Middleware"),p.appPath("Middleware.ts")];for(const target of targets)try{if(!fs.existsSync(target))continue;const w=fs.watch(target,{recursive:!0},()=>{log.debug("[middleware] hot-reload: clearing cache");clearMiddlewareCache()});fsWatchers.push(w)}catch{}}catch{}})();return()=>{for(const w of fsWatchers)try{w.close()}catch{}fsWatchers=[]}}const routeMiddlewareRegistry=new Map;export function clearRouteMiddlewareRegistry(){routeMiddlewareRegistry.clear()}const routeApiResponseRegistry=new Set;let parsedMiddlewareCache=new Map;function parseMiddlewareEntry(middleware){const cache=parsedMiddlewareCache;let parsed=cache.get(middleware);if(!parsed){parsed=parseMiddlewareEntryUncached(middleware).then((resolved)=>{cache.set(middleware,resolved);return resolved},(error)=>{cache.delete(middleware);throw error});cache.set(middleware,parsed)}return parsed}async function parseMiddlewareEntryUncached(middleware){const timingName=middleware.replace(/[^A-Za-z0-9_-]/g,"_").slice(0,32),negated=middleware.startsWith("!"),bare=negated?middleware.slice(1):middleware,aliases=await getMiddlewareAliases();if(Object.hasOwn(aliases,bare))return{name:bare,negated,timingName};const colonIndex=bare.indexOf(":");if(colonIndex===-1)return{name:bare,negated,timingName};return{name:bare.substring(0,colonIndex),negated,timingName,params:bare.substring(colonIndex+1)}}export async function findUnresolvableRouteMiddleware(){const usage=new Map;for(const[routeKey,entries]of routeMiddlewareRegistry)for(const entry of entries){const parsed=await parseMiddlewareEntry(entry),alias=parsed.negated?`!${parsed.name}`:parsed.name,seen=usage.get(alias)??{parsed,routes:[]};seen.routes.push(routeKey);usage.set(alias,seen)}if(!usage.has("csrf"))usage.set("csrf",{parsed:{name:"csrf",negated:!1,timingName:"csrf"},routes:["(auto-injected on POST/PUT/PATCH/DELETE)"]});const unresolvable=[];for(const[alias,{parsed,routes}]of usage){const handler=await loadParsedMiddleware(parsed);if(!handler||typeof handler.handle!=="function")unresolvable.push({alias,routes})}return unresolvable}export async function assertRouteMiddlewareResolvable(){const unresolvable=await findUnresolvableRouteMiddleware();if(unresolvable.length===0)return;const detail=unresolvable.map((u)=>`"${u.alias}" (used by ${u.routes.join(", ")})`).join("; ");throw Error(`[Router] Unresolvable middleware alias(es): ${detail}. Check the alias map in app/Middleware.ts or add app/Middleware/<Class>.ts.`)}function createMiddlewareHandler(routeKey,handler){const wrappedBase=wrapHandler(handler,!0,routeKey),routeMethod=routeKey.slice(0,routeKey.indexOf(":")).toUpperCase(),routeAcceptsCsrf=CSRF_PROTECTED_METHODS.has(routeMethod),routeMayHaveBody=routeMethod!=="GET"&&routeMethod!=="HEAD",routeSeedsCsrf=routeMethod==="GET"||routeMethod==="HEAD"||routeMethod==="OPTIONS",forcesJsonByGroup=routeApiResponseRegistry.has(routeKey),handlerKey=typeof handler==="string"?handler:isRouterAction(handler)?routeKey:void 0;let actionPrefetch=null;if(typeof handler==="string"&&routeAcceptsCsrf){const pending=resolveStringHandler(handler);if(pending instanceof Promise){const settled=()=>{actionPrefetch=null};actionPrefetch=pending.then(settled,settled)}}return async(req)=>{if(routeMayHaveBody)try{await parseRequestBody(req)}catch(err){const error=err instanceof Error?err:Error(String(err));return createMiddlewareErrorResponse(error,req)}const enhancedReq=enhanceRequest(req),csrfHandledByOuter=enhancedReq[CSRF_SEEDED_BY_HANDLE_REQUEST]===!0;if(!csrfHandledByOuter){const renderTokenSeeding=seedCsrfTokenForRender(enhancedReq);if(renderTokenSeeding)await renderTokenSeeding}if(actionPrefetch)await actionPrefetch;if(forcesJsonByGroup)req._forceJson=!0;return runWithRequest(enhancedReq,async()=>{const rl=routeRateLimitRegistry.get(routeKey);if(rl)try{const{rateLimit:enforceRateLimit}=await import("./rate-limit");await enforceRateLimit(routeKey,rl.max).over(rl.windowSeconds)}catch(err){return createMiddlewareErrorResponse(err,req)}const userMiddleware=routeMiddlewareRegistry.get(routeKey)||[];let shouldInjectCsrf=!1;if(routeAcceptsCsrf){const alreadyHasCsrf=userMiddleware.some((m)=>m==="csrf"||m.startsWith("csrf:")),routeSkipped=csrfSkipRegistry.has(routeKey),routeRequired=csrfRequireRegistry.has(routeKey),actionSkipped=handlerKey?actionSkipsCsrfCache.get(handlerKey)===!0:!1;shouldInjectCsrf=!alreadyHasCsrf&&(routeRequired||!routeSkipped&&!actionSkipped)}const middlewareEntries=shouldInjectCsrf?["csrf",...userMiddleware]:userMiddleware;if(middlewareEntries.length>0&&isDebugLogging()){const schemeEnd=req.url.indexOf("://"),pathStart=schemeEnd===-1?0:req.url.indexOf("/",schemeEnd+3),q=req.url.indexOf("?",pathStart<0?0:pathStart),urlPath=pathStart<0?"/":req.url.slice(pathStart,q===-1?void 0:q);log.debug(`[middleware] Executing chain: [${middlewareEntries.join(", ")}] for ${routeMethod} ${urlPath}`)}const resolved=middlewareEntries.length===0?EMPTY_RESOLVED_MIDDLEWARE:[];for(const middlewareEntry of middlewareEntries){const pending=parseMiddlewareEntry(middlewareEntry),parsed=pending instanceof Promise?await pending:pending,{name:middlewareName,params}=parsed;if(params){enhancedReq._middlewareParams=enhancedReq._middlewareParams||{};enhancedReq._middlewareParams[middlewareName]=params}const loaded=loadParsedMiddleware(parsed),middleware=loaded instanceof Promise?await loaded:loaded;if(!middleware||typeof middleware.handle!=="function"){log.error(`[Router] Middleware '${middlewareEntry}' on ${routeKey} could not be resolved - failing closed`);const failClosedError=Error(`Middleware '${middlewareEntry}' could not be resolved`),failClosedResponse=await createErrorResponse(failClosedError,enhancedReq,{status:500});return await applyCorsIfConfigured(enhancedReq,failClosedResponse)}const rawPriority=middleware.priority;let priority=DEFAULT_MIDDLEWARE_PRIORITY;if(typeof rawPriority==="number"&&Number.isFinite(rawPriority)&&rawPriority>=0)priority=rawPriority;else if(rawPriority!==void 0)warnInvalidMiddlewarePriority(middlewareEntry,rawPriority);resolved.push({name:middlewareEntry,timingName:parsed.timingName,handler:middleware,priority})}if(resolved.length>1)resolved.sort((a,b)=>a.priority-b.priority);const middlewareTimings=resolved.length===0?EMPTY_MIDDLEWARE_TIMINGS:[];let chainTimer,chainBudget,runningMiddleware="",armChainBudget;if(resolved.length>0)armChainBudget=()=>{if(!chainBudget){chainBudget=new Promise((_,reject)=>{chainTimer=setTimeout(()=>reject(Error(`Middleware '${runningMiddleware}' exceeded ${MIDDLEWARE_TIMEOUT_MS}ms`)),MIDDLEWARE_TIMEOUT_MS)});chainBudget.catch(()=>{})}return chainBudget};try{for(const{name:middlewareName,timingName,handler:middleware}of resolved){const mwStart=process.hrtime.bigint();runningMiddleware=middlewareName;try{const outcome=middleware.handle(enhancedReq);if(outcome&&typeof outcome.then==="function")await Promise.race([outcome,armChainBudget()]);const elapsedMs=Number(process.hrtime.bigint()-mwStart)/1e6;middlewareTimings.push({name:timingName,ms:elapsedMs})}catch(error){const elapsedMs=Number(process.hrtime.bigint()-mwStart)/1e6;middlewareTimings.push({name:timingName,ms:elapsedMs});log.debug(`[middleware] Blocked by: ${middlewareName}`);if(error instanceof Response){try{const{_requestId:reqId,_startNs:startNs}=enhancedReq,total=startNs!=null?Number(process.hrtime.bigint()-startNs)/1e6:null,parts=total!=null?[`total;dur=${total.toFixed(1)}`]:[];for(const t of middlewareTimings)parts.push(`mw_${t.name};dur=${t.ms.toFixed(1)}`);if(parts.length>0)error.headers.set("Server-Timing",parts.join(", "));if(reqId)error.headers.set("X-Request-ID",reqId)}catch{}return await applyCorsIfConfigured(enhancedReq,error)}const err=error instanceof Error?error:Error(String(error)),errorResponse="statusCode"in err||"status"in err?await createMiddlewareErrorResponse(err,enhancedReq):await(()=>{log.error(`[Router] Middleware '${middlewareName}' threw an unexpected error:`,err);return createErrorResponse(err,enhancedReq,{status:500})})();try{const{_requestId:reqId,_startNs:startNs}=enhancedReq,total=startNs!=null?Number(process.hrtime.bigint()-startNs)/1e6:null,parts=total!=null?[`total;dur=${total.toFixed(1)}`]:[];for(const t of middlewareTimings)parts.push(`mw_${t.name};dur=${t.ms.toFixed(1)}`);if(parts.length>0)errorResponse.headers.set("Server-Timing",parts.join(", "));if(reqId)errorResponse.headers.set("X-Request-ID",reqId)}catch{}return await applyCorsIfConfigured(enhancedReq,errorResponse)}}}finally{if(chainTimer)clearTimeout(chainTimer)}const baseResult=wrappedBase(enhancedReq);let response=baseResult instanceof Response?baseResult:await baseResult;clearTrackedQueries();if(response){if(routeSeedsCsrf&&!csrfHandledByOuter)try{const mod=loadCsrfModule(),csrf=mod instanceof Promise?await mod:mod;if(csrf)response=csrf.seedCsrfCookieIfMissing(enhancedReq,response,enhancedReq._csrfToken)}catch(err){log.warn("[router] CSRF cookie seeding failed",{error:err})}}if(response&&enhancedReq._corsConfig)response=await applyCorsIfConfigured(enhancedReq,response);const{_requestId:reqId,_startNs:startNs}=enhancedReq,durMs=startNs!=null?Number(process.hrtime.bigint()-startNs)/1e6:null,setHeaders=(h)=>{const after=enhancedReq._afterResponse;if(Array.isArray(after))for(const callback of after)try{if(typeof callback==="function")callback({status:response?.status??0,durationMs:durMs??0})}catch{}const requested=enhancedReq._responseHeaders;if(requested&&typeof requested==="object"){for(const[name,value]of Object.entries(requested))if(typeof value==="string")h.set(name,value)}if(reqId)h.set("X-Request-ID",reqId);if(durMs!=null){let timing=`total;dur=${durMs.toFixed(1)}`;for(const t of middlewareTimings)timing+=`, mw_${t.name};dur=${t.ms.toFixed(1)}`;h.set("Server-Timing",timing)}applySecurityHeaders(h)};if(response&&typeof response.headers?.set==="function"){if(response.status>=400&&(response.headers.get("content-type")||"").includes("json")&&reqId)try{const text=await response.clone().text(),parsed=JSON.parse(text);if(parsed&&typeof parsed==="object"){const newHeaders=new Headers(response.headers);setHeaders(newHeaders);return new Response(JSON.stringify({...parsed,request_id:reqId}),{status:response.status,statusText:response.statusText,headers:newHeaders})}}catch{}try{setHeaders(response.headers)}catch{try{const cloned=response.clone(),newHeaders=new Headers(response.headers);setHeaders(newHeaders);return new Response(cloned.body,{status:response.status,statusText:response.statusText,headers:newHeaders})}catch{}}}if(enhancedReq._compress===!0&&response)try{const{applyCompression}=await import(resolveDefaultsPath("app/Middleware/Compress.ts"));return await applyCompression(enhancedReq,response)}catch(err){log.warn(`[router] Compression failed; sending uncompressed response: ${err instanceof Error?err.message:String(err)}`)}return response})}}function createInertRoute(){const inert={middleware:()=>inert,name:()=>inert,skipCsrf:()=>inert,requireCsrf:()=>inert,rateLimit:()=>inert};return inert}function createChainableRoute(routeKey,shadowed=!1){if(shadowed)return createInertRoute();if(!routeMiddlewareRegistry.has(routeKey))routeMiddlewareRegistry.set(routeKey,[]);const routePath=routeKey.includes(":")?routeKey.substring(routeKey.indexOf(":")+1):routeKey,chain={middleware(name){const middlewareList=routeMiddlewareRegistry.get(routeKey);if(!middlewareList)return chain;for(const entry of Array.isArray(name)?name:[name]){if(typeof entry!=="string")throw TypeError(`[Router] middleware() on ${routeKey} was given a ${typeof entry}; it takes an alias or an array of aliases`);middlewareList.push(entry)}return chain},name(routeName){namedRouteRegistry.set(routeName,compileNamedRoute(routePath));return chain},skipCsrf(){csrfSkipRegistry.add(routeKey);csrfRequireRegistry.delete(routeKey);return chain},requireCsrf(){csrfRequireRegistry.add(routeKey);csrfSkipRegistry.delete(routeKey);return chain},rateLimit(max,window){if(!Number.isFinite(max)||max<=0)throw Error(`[Router] .rateLimit(): max must be a positive number, got ${String(max)}`);const windowSeconds=rateLimitWindowToSeconds(window);routeRateLimitRegistry.set(routeKey,{max:Math.floor(max),windowSeconds});return chain}};return chain}async function fileExists(path){try{return await Bun.file(path).exists()}catch{return!1}}function assertSafeHandlerPath(handlerPath){if(typeof handlerPath!=="string"||handlerPath.length===0)throw Error(`[Router] Refusing to resolve handler '${String(handlerPath)}': empty or non-string`);if(handlerPath.includes("\x00"))throw Error("[Router] Refusing to resolve handler with null byte");if(handlerPath.startsWith("/")||/^[A-Za-z]:[\\/]/.test(handlerPath))throw Error(`[Router] Refusing to resolve absolute handler path '${handlerPath}'`);if(handlerPath.split(/[/\\]/).some((s)=>s===".."))throw Error(`[Router] Refusing to resolve handler path '${handlerPath}' (contains '..' segment)`)}const _moduleImportCache=new Map;function cachedImport(fullPath){let p=_moduleImportCache.get(fullPath);if(!p){p=import(fullPath);_moduleImportCache.set(fullPath,p)}return p}const _resolvedHandlerCache=new Map;function resolveStringHandler(handlerPath){let resolved=_resolvedHandlerCache.get(handlerPath);if(!resolved){resolved=resolveStringHandlerUncached(handlerPath).then((handler)=>{_resolvedHandlerCache.set(handlerPath,handler);return handler},(error)=>{_resolvedHandlerCache.delete(handlerPath);throw error});_resolvedHandlerCache.set(handlerPath,resolved)}return resolved}function validationFailureResponse(errors){return response.validationError(errors)}export function precognitionRequest(req){const header=req.headers?.get?.("Precognition"),viaHeader=typeof header==="string"&&header.toLowerCase()==="true";let viaQuery=!1;try{if(!viaHeader&&req.url.includes("?"))viaQuery=new URL(req.url).searchParams.get("_validate")==="1"}catch{viaQuery=!1}if(!viaHeader&&!viaQuery)return null;return{only:(req.headers?.get?.("Precognition-Validate-Only")??"").split(",").map((field)=>field.trim()).filter(Boolean)}}export function precognitionSuccess(){return new Response(null,{status:204,headers:{Precognition:"true","Precognition-Success":"true",Vary:"Precognition, Precognition-Validate-Only"}})}let actionRegistryPromise=null;async function getActionRegistry(){if(actionRegistryPromise)return actionRegistryPromise;actionRegistryPromise=(async()=>{try{const dir=p.storagePath("framework/auto-imports"),module=await import(`${dir}/actions.ts`);if(!module.actions)return null;const{resolve}=await import("node:path");return Object.fromEntries(Object.entries(module.actions).map(([name,file])=>[name,resolve(dir,file)]))}catch{return null}})();return actionRegistryPromise}async function resolveStringHandlerUncached(handlerPath){assertSafeHandlerPath(handlerPath);let modulePath=handlerPath;modulePath=modulePath.endsWith(".ts")?modulePath.slice(0,-3):modulePath;if(modulePath.includes("Controller")){const[controllerPath,methodName="index"]=modulePath.split("@"),userPath=p.appPath(`${controllerPath}.ts`),defaultPath=resolveDefaultsPath(`app/${controllerPath}.ts`),fullPath=await fileExists(userPath)?userPath:defaultPath;try{const controller=await cachedImport(fullPath);if(!controller.default||typeof controller.default!=="function")throw Error(`Controller ${controllerPath} does not export a default class`);const instance=new controller.default;if(typeof instance[methodName]!=="function")throw Error(`Method ${methodName} not found in controller ${controllerPath}`);return async(req)=>{const result=await instance[methodName](req);return formatResult(result,req)}}catch(error){log.error(`[Router] Failed to load controller '${fullPath}':`,error);throw error}}let fullPath;if(modulePath.includes("storage/framework/orm"))fullPath=modulePath;else if(modulePath.includes("OrmAction"))fullPath=p.storagePath(`framework/actions/src/${modulePath}.ts`);else if(modulePath.includes("Actions")){const registered=(await getActionRegistry())?.[modulePath];if(registered)fullPath=registered;else{const userPath=p.projectPath(`app/${modulePath}.ts`),defaultPath=resolveDefaultsPath(`app/${modulePath}.ts`);fullPath=await fileExists(userPath)?userPath:defaultPath}}else{const userPath=p.appPath(`${modulePath}.ts`),defaultPath=resolveDefaultsPath(`app/${modulePath}.ts`);fullPath=await fileExists(userPath)?userPath:defaultPath}try{const action=(await cachedImport(fullPath)).default;if(!action)throw Error(`Action '${handlerPath}' has no default export`);if(typeof action.handle!=="function"){log.error(`[Router] Action '${handlerPath}' structure:`,Object.keys(action));throw Error(`Action '${handlerPath}' has no handle() method. Got: ${typeof action.handle}`)}return wrapAction(action,handlerPath)}catch(importError){log.error(`[Router] Failed to import action '${fullPath}':`,importError);throw importError}}export function isRouterAction(handler){return typeof handler==="object"&&handler!==null&&typeof handler.handle==="function"}export function wrapAction(action,handlerKey){const actionSkipsCsrf=action.skipCsrf===!0||action.csrf===!1;actionSkipsCsrfCache.set(handlerKey,actionSkipsCsrf);const actionForcesJson=action.apiResponse===!0,requestValidationRules=action.validations??modelValidationRules(action.modelDefinition??action.model);return async(req)=>{if(actionSkipsCsrf)req._skipCsrf=!0;if(actionForcesJson)req._forceJson=!0;req._requestValidationRules=requestValidationRules;try{const precognition=precognitionRequest(req);if(precognition){if(!action.validations)return precognitionSuccess();const rules=precognition.only.length>0?Object.fromEntries(Object.entries(action.validations).filter(([field])=>precognition.only.includes(field))):action.validations,precognitionResult=await validateActionInput(req,rules);return precognitionResult.valid?precognitionSuccess():validationFailureResponse(precognitionResult.errors)}if(action.validations){const validationResult=await validateActionInput(req,action.validations);if(!validationResult.valid)return validationFailureResponse(validationResult.errors)}if(typeof action.authorize==="function"){const auth=await action.authorize(req);if(auth instanceof Response)return auth;if(auth===!1)return Response.json({error:"Forbidden"},{status:403})}if(typeof action.before==="function"){const pre=await action.before(req);if(pre instanceof Response)return pre}const result=await action.handle(req);return formatResult(result,req)}catch(handleError){report(handleError,{label:`[Router] action.handle() for '${handlerKey}'`});throw handleError}}}export async function validateActionInput(req,validations){const errors={},input=await getRequestInput(req,validations);for(const[field,validation]of Object.entries(validations)){const value=input[field];let result;try{result=validation.rule.validate(value)}catch{result={valid:!1,errors:[{message:`${field} validation failed`}]}}if(!result.valid){const fieldErrors=[],label=field.replace(/[-_]+/g," ").replace(/([a-z])([A-Z])/g,"$1 $2").replace(/^./,(c)=>c.toUpperCase()),decorate=(msg)=>msg.toLowerCase().startsWith(field.toLowerCase())||msg.includes(label)?msg:`${label} ${msg}`;if(result.errors&&result.errors.length>0)if(validation.message){const firstMessage=result.errors[0]?.message??"";fieldErrors.push(typeof validation.message==="string"?validation.message:validation.message[field]||decorate(firstMessage))}else result.errors.forEach((err)=>fieldErrors.push(decorate(err.message)));else fieldErrors.push(validation.message?typeof validation.message==="string"?validation.message:`${label} is invalid`:`${label} is invalid`);errors[field]=fieldErrors}}const valid=Object.keys(errors).length===0;if(valid){const validated={};for(const field of Object.keys(validations))if(input[field]!==void 0)validated[field]=input[field];req._validatedInput=validated}return{valid,errors}}function modelValidationRules(model){if(!model?.attributes||typeof model.attributes!=="object")return;const rules={};for(const[field,attribute]of Object.entries(model.attributes)){const validation=attribute?.validation;if(validation?.rule)rules[field]=validation}return Object.keys(rules).length>0?rules:void 0}async function getRequestInput(req,validations){const input={},q=req.query;if(q)for(const key in q)input[key]=q[key];else new URL(req.url).searchParams.forEach((value,key)=>{input[key]=value});if(req.params)Object.assign(input,req.params);if(req.jsonBody&&typeof req.jsonBody==="object")Object.assign(input,req.jsonBody);else if(req.formBody&&typeof req.formBody==="object")Object.assign(input,req.formBody);if(typeof req.allFiles==="function")try{const files=req.allFiles();for(const key of Object.keys(files??{}))if(!(key in input))input[key]=files[key]}catch{}if(!validations)return input;for(const[field,validation]of Object.entries(validations)){const value=input[field];if(typeof value!=="string")continue;const validatorName=validation.rule?.name;if(validatorName==="number"){const n=Number(value);if(Number.isFinite(n))input[field]=n}else if(validatorName==="boolean"){if(value==="true"||value==="1")input[field]=!0;else if(value==="false"||value==="0")input[field]=!1}}return input}function formatResult(result,req){if(result instanceof Response)return result;if(result instanceof ReadableStream)return new Response(result,{headers:{"Content-Type":"application/octet-stream"}});if(result!==null&&typeof result==="object"){const linkHeader=buildPaginatorLinkHeader(result);return formatJsonResult(result,req,linkHeader)}const apiShaped=req._forceJson===!0||isApiRequest(req);if(result===null||result===void 0)return apiShaped?new Response(null,{status:204}):new Response("",{status:200});if(apiShaped){if(typeof result==="string"||typeof result==="number"||typeof result==="boolean")return formatJsonResult(result,req);return Response.json(result)}return new Response(String(result),{headers:{"Content-Type":"text/plain; charset=utf-8"}})}function formatJsonResult(result,req,linkHeader){const encoding=req.headers.get("accept-encoding");if(!encoding||encoding==="identity")return linkHeader?Response.json(result,{headers:{Link:linkHeader}}):Response.json(result);const body=JSON.stringify(result)??"",headers={"Content-Type":"application/json;charset=utf-8","Content-Length":String(Buffer.byteLength(body))};if(linkHeader)headers.Link=linkHeader;return new Response(body,{headers})}function buildPaginatorLinkHeader(value){if(!isPaginator(value)&&!isSimplePaginator(value)&&!isCursorPaginator(value))return null;const v=value,parts=[];if(v.prev_page_url)parts.push(`<${v.prev_page_url}>; rel="prev"`);if(v.next_page_url)parts.push(`<${v.next_page_url}>; rel="next"`);if(v.first_page_url)parts.push(`<${v.first_page_url}>; rel="first"`);if(v.last_page_url)parts.push(`<${v.last_page_url}>; rel="last"`);return parts.length>0?parts.join(", "):null}export function stream(source,options={}){const baseHeaders={};if(options.type==="sse"){baseHeaders["Content-Type"]="text/event-stream; charset=utf-8";baseHeaders["Cache-Control"]="no-cache";baseHeaders.Connection="keep-alive"}else if(options.type==="ndjson")baseHeaders["Content-Type"]="application/x-ndjson; charset=utf-8";else baseHeaders["Content-Type"]=options.contentType??"application/octet-stream";const body=source instanceof ReadableStream?source:new ReadableStream({async start(controller){try{for await(const chunk of source)controller.enqueue(typeof chunk==="string"?new TextEncoder().encode(chunk):chunk);controller.close()}catch(err){controller.error(err)}}}),merged=new Headers(baseHeaders);if(options.headers)new Headers(options.headers).forEach((value,key)=>merged.set(key,value));return new Response(body,{status:options.status??200,headers:merged})}function getAllInputFor(req){const cached=req._allInputCache;if(cached)return cached;const input={},query=req.query;if(query)for(const key in query)input[key]=query[key];if(req.jsonBody&&typeof req.jsonBody==="object")Object.assign(input,req.jsonBody);if(req.formBody&&typeof req.formBody==="object")Object.assign(input,req.formBody);if(req.params&&typeof req.params==="object")Object.assign(input,req.params);req._allInputCache=input;return input}function flashInputFor(req,keys){const input=getAllInputFor(req);req._oldInput=keys?Object.fromEntries(keys.filter((key)=>(key in input)).map((key)=>[key,input[key]])):{...input}}const REQUEST_METHODS={get(key,defaultValue){const value=getAllInputFor(this)[key];return value!==void 0?value:defaultValue},input(key,defaultValue){const value=getAllInputFor(this)[key];return value!==void 0?value:defaultValue},all(){return getAllInputFor(this)},only(keys){const input=getAllInputFor(this),result={};for(const key of keys)if(key in input)result[key]=input[key];return result},except(keys){const result={...getAllInputFor(this)};for(const key of keys)delete result[key];return result},has(key){const input=getAllInputFor(this);if(Array.isArray(key))return key.every((k)=>(k in input)&&input[k]!==void 0);return key in input&&input[key]!==void 0},hasAny(keys){const input=getAllInputFor(this);return keys.some((k)=>(k in input)&&input[k]!==void 0)},filled(key){const input=getAllInputFor(this),isFilled=(k)=>{const value=input[k];return value!==void 0&&value!==null&&value!==""&&!(Array.isArray(value)&&value.length===0)};if(Array.isArray(key))return key.every(isFilled);return isFilled(key)},missing(key){const input=getAllInputFor(this);if(Array.isArray(key))return key.every((k)=>!(k in input)||input[k]===void 0);return!(key in input)||input[key]===void 0},merge(data){Object.assign(getAllInputFor(this),data)},keys(){return Object.keys(getAllInputFor(this))},string(key,defaultValue=""){const value=getAllInputFor(this)[key];return value!==void 0&&value!==null?String(value):defaultValue},integer(key,defaultValue=0){const value=getAllInputFor(this)[key];if(value===void 0||value===null||value==="")return defaultValue;if(typeof value==="number")return Number.isFinite(value)?Math.trunc(value):defaultValue;const str=String(value).trim();if(!/^-?\d+$/.test(str))return defaultValue;const parsed=Number.parseInt(str,10);return Number.isFinite(parsed)?parsed:defaultValue},float(key,defaultValue=0){const value=getAllInputFor(this)[key];if(value===void 0||value===null||value==="")return defaultValue;if(typeof value==="number")return Number.isFinite(value)?value:defaultValue;const str=String(value).trim();if(!/^-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?$/.test(str))return defaultValue;const parsed=Number.parseFloat(str);return Number.isFinite(parsed)?parsed:defaultValue},boolean(key,defaultValue=!1){const value=getAllInputFor(this)[key];if(value===void 0||value===null)return defaultValue;if(typeof value==="boolean")return value;if(value==="true"||value==="1"||value===1)return!0;if(value==="false"||value==="0"||value===0)return!1;return defaultValue},array(key){const value=getAllInputFor(this)[key];if(Array.isArray(value))return value;return value!==void 0&&value!==null?[value]:[]},date(key){const value=getAllInputFor(this)[key];if(value===void 0||value===null||value==="")return null;const parsed=new Date(value);return Number.isNaN(parsed.getTime())?null:parsed},enum(key,enumType){const value=getAllInputFor(this)[key];if(value===void 0||value===null)return null;if(Object.values(enumType).includes(value))return value;const enumKey=String(value);return enumKey in enumType?enumType[enumKey]:null},collect(key){const value=getAllInputFor(this)[key];if(Array.isArray(value))return collect(value);return collect(value===void 0||value===null?[]:[value])},whenHas(key,callback,defaultCallback){const input=getAllInputFor(this);if(key in input&&input[key]!==void 0)callback(input[key]);else defaultCallback?.()},whenFilled(key,callback,defaultCallback){const value=getAllInputFor(this)[key];if(value!==void 0&&value!==null&&value!==""&&!(Array.isArray(value)&&value.length===0))callback(value);else defaultCallback?.()},isValue(key,value){return getAllInputFor(this)[key]===value},async validate(rules,messages={}){const selectedRules=rules??this._requestValidationRules;if(!selectedRules||Object.keys(selectedRules).length===0){const input=getAllInputFor(this);this._validatedInput=input;return input}const normalized={};for(const[field,definition]of Object.entries(selectedRules)){if(typeof definition==="string")throw TypeError(`String validation rules are not supported for "${field}". Use schema validators.`);if(definition&&typeof definition==="object"&&"rule"in definition){const message=messages[field];normalized[field]=message?{...definition,message}:definition}else normalized[field]=definition}const{validate}=await import("@stacksjs/validation"),validated=await validate(this,normalized);this._validatedInput=validated;return validated},getValidated(){return this._validatedInput??{}},safe(){const data=this._validatedInput??{};return{all:()=>({...data}),get:(key,defaultValue)=>(key in data)?data[key]:defaultValue,only:(keys)=>Object.fromEntries(keys.filter((key)=>(key in data)).map((key)=>[key,data[key]])),except:(keys)=>Object.fromEntries(Object.entries(data).filter(([key])=>!keys.includes(key)))}},old(key,defaultValue){return this._oldInput?.[key]??defaultValue},flashInput(keys){flashInputFor(this,keys)},flashInputOnly(keys){flashInputFor(this,keys)},flashInputExcept(keys){const input=getAllInputFor(this);this._oldInput=Object.fromEntries(Object.entries(input).filter(([key])=>!keys.includes(key)))},file(key){const file=(this.files||{})[key];if(!file)return null;const rawFile=Array.isArray(file)?file[0]:file;return rawFile?new UploadedFile(rawFile):null},getFiles(key){const file=(this.files||{})[key];if(!file)return[];return(Array.isArray(file)?file:[file]).map((f)=>new UploadedFile(f))},hasFile(key){const files=this.files||{};return key in files&&files[key]!==void 0},allFiles(){const files=this.files||{},result={};for(const[key,value]of Object.entries(files))if(Array.isArray(value))result[key]=value.map((f)=>new UploadedFile(f));else result[key]=new UploadedFile(value);return result},getParams(){return{...this.params}},isEmpty(){return Object.keys(getAllInputFor(this)).length===0},browser(){return this.headers.get("sec-ch-ua")||this.headers.get("user-agent")},ipForRateLimit(){const ip=this.ip;if(typeof ip==="function")return ip.call(this)||null;return typeof ip==="string"&&ip?ip:null},getMethod(){return this.method.toUpperCase()},async user(){return this._authenticatedUser},async userToken(){return this._currentAccessToken},async tokenCan(ability){if(typeof ability!=="string"||ability.length===0)return!1;const token=this._currentAccessToken;if(!token||typeof token!=="object")return!1;const abilities=token.abilities;if(!Array.isArray(abilities))return!1;if(abilities.includes("*"))return!0;return abilities.includes(ability)},async tokenCant(ability){return!await this.tokenCan(ability)},async can(ability,...args){if(typeof ability!=="string"||ability.length===0)return!1;const{Gate}=await import("@stacksjs/auth"),user=this._authenticatedUser??null;return Gate.allows(ability,user,...args)},async cannot(ability,...args){return!await this.can(ability,...args)},async authorize(ability,...args){const{Gate}=await import("@stacksjs/auth"),user=this._authenticatedUser??null;await Gate.authorize(ability,user,...args)}},stacksRequestPrototypes=new WeakMap;let csrfModule,csrfModuleLoad;function loadCsrfModule(){if(csrfModule!==void 0)return csrfModule;csrfModuleLoad??=import(resolveDefaultsPath("app/Middleware/Csrf.ts")).then((mod)=>{csrfModule=mod;return csrfModule}).catch(()=>{csrfModule=null;return null});return csrfModuleLoad}export function clearCsrfModuleCache(){csrfModule=void 0;csrfModuleLoad=void 0}function applyCsrfRenderToken(req,cookieHeader,mod){const token=mod.generateCsrfToken();req._csrfToken=token;try{const merged=cookieHeader?`${cookieHeader}; ${mod.CSRF_COOKIE_NAME}=${token}`:`${mod.CSRF_COOKIE_NAME}=${token}`;req.headers.set("cookie",merged)}catch{}}function seedCsrfTokenForRender(req){const method=req.method?.toUpperCase?.()??"GET";if(method!=="GET"&&method!=="HEAD")return;const cookieHeader=req.headers?.get?.("cookie")??"";if(cookieHeader.includes("X-CSRF-Token=")||cookieHeader.includes("csrf-token="))return;const mod=loadCsrfModule();if(mod===null)return;if(mod instanceof Promise)return mod.then((resolved)=>{if(resolved)applyCsrfRenderToken(req,cookieHeader,resolved)});applyCsrfRenderToken(req,cookieHeader,mod)}export function enhanceRequest(req){const routeParams=req.params??{};req.params=routeParams;applyRequestEnhancements(req,routeParams);if(!req._requestId)req._requestId=incomingRequestId(req)??crypto.randomUUID();const routerPrototype=Object.getPrototypeOf(req);let stacksPrototype=stacksRequestPrototypes.get(routerPrototype);if(!stacksPrototype){stacksPrototype=Object.assign(Object.create(routerPrototype),REQUEST_METHODS);stacksRequestPrototypes.set(routerPrototype,stacksPrototype)}Object.setPrototypeOf(req,stacksPrototype);return req}function incomingRequestId(req){try{const supplied=req.headers?.get?.("x-request-id")?.trim();if(supplied&&/^[\w.:-]{8,200}$/.test(supplied))return supplied}catch{}return}function wrapHandler(handler,skipParsing=!1,handlerKey=""){if(isRouterAction(handler))return wrapAction(handler,handlerKey);if(typeof handler==="string"){const handlerPath=handler;return async(req)=>{try{if(!skipParsing){await parseRequestBody(req);req=enhanceRequest(req)}const pending=resolveStringHandler(handlerPath);return await(pending instanceof Promise?await pending:pending)(req)}catch(error){report(error,{label:`[Router] ${handlerPath}`});const rawStatus=error?.statusCode??error?.status,status=typeof rawStatus==="number"&&Number.isInteger(rawStatus)&&rawStatus>=400&&rawStatus<600?rawStatus:void 0;return await createErrorResponse(error instanceof Error?error:Error(String(error)),req,{handlerPath,status})}}}const fn=handler;return(req)=>{const result=fn(req);if(result instanceof Promise)return result.then((value)=>formatResult(value,req));return formatResult(result,req)}}async function readJsonBodyOnce(req,contentType){const raw=await req.text();req._rawBody=raw;const target=req;target.text=()=>Promise.resolve(raw);target.json=()=>{try{return Promise.resolve(raw.length===0?null:JSON.parse(raw))}catch(err){return Promise.reject(err)}};target.bytes=()=>Promise.resolve(new TextEncoder().encode(raw));target.arrayBuffer=()=>{const bytes=new TextEncoder().encode(raw);return Promise.resolve(bytes.buffer.slice(bytes.byteOffset,bytes.byteOffset+bytes.byteLength))};target.blob=()=>Promise.resolve(new Blob([raw],{type:contentType}));target.clone=()=>new Request(req.url,{method:req.method,headers:req.headers,body:raw});return raw}async function parseRequestBody(req){if(req._bodyParsed)return;req._bodyParsed=!0;const contentType=req.headers.get("content-type")||"";try{if(JSON_CONTENT_TYPE.test(contentType)){const raw=await readJsonBodyOnce(req,contentType);if(raw.length===0)req.jsonBody={};else try{const body=JSON.parse(raw);req.jsonBody=body&&typeof body==="object"?body:{}}catch(parseErr){const message=parseErr instanceof Error?parseErr.message:"Invalid JSON",{HttpError}=await import("@stacksjs/error-handling");throw new HttpError(400,`Invalid JSON body: ${message}`)}}else if(contentType.includes("application/x-www-form-urlencoded")){const text=await req.clone().text(),params=new URLSearchParams(text),formBody={};params.forEach((value,key)=>{formBody[key]=value});req.formBody=formBody}else if(contentType.includes("multipart/form-data")){const formData=await req.clone().formData(),formBody={},files={};formData.forEach((value,key)=>{if(value instanceof File)if(files[key])if(Array.isArray(files[key]))files[key].push(value);else files[key]=[files[key],value];else files[key]=value;else formBody[key]=value});Reflect.set(req,"formBody",formBody);Reflect.set(req,"files",files)}}catch(e){if(typeof(e?.status??e?.statusCode)==="number")throw e;log.debug("[stacks-router] Body parsing failed:",e)}}export function createStacksRouter(config={}){const bunRouter=new Router({verbose:config.verbose??!1});let currentPrefix="",currentGroupMiddleware=[],currentGroupApiResponse=!1;const registeredRouteKeys=new Set;function registerRoute(method,path,_handler){const fullPath=currentPrefix+path,routeKey=`${method}:${fullPath}`;log.debug(`[router] ${method} ${fullPath} \u2192 ${typeof _handler==="string"?_handler:"function"}`);const shadowed=registeredRouteKeys.has(routeKey);if(!shadowed)registeredRouteKeys.add(routeKey);if(!shadowed&&currentGroupMiddleware.length>0)routeMiddlewareRegistry.set(routeKey,[...currentGroupMiddleware]);if(!shadowed&&currentGroupApiResponse)routeApiResponseRegistry.add(routeKey);if(!shadowed&&typeof _handler==="string")routeHandlerKeyRegistry.set(routeKey,_handler);if(!shadowed&&isRouterAction(_handler))routeActionRegistry.set(routeKey,_handler);return{fullPath,routeKey,shadowed}}const stacksRouter={bunRouter,get routes(){return bunRouter.routes},get(path,handler){const{fullPath,routeKey,shadowed}=registerRoute("GET",path,handler);bunRouter.get(fullPath,createMiddlewareHandler(routeKey,handler));return createChainableRoute(routeKey,shadowed)},post(path,handler){const{fullPath,routeKey,shadowed}=registerRoute("POST",path,handler);bunRouter.post(fullPath,createMiddlewareHandler(routeKey,handler));return createChainableRoute(routeKey,shadowed)},put(path,handler){const{fullPath,routeKey,shadowed}=registerRoute("PUT",path,handler);bunRouter.put(fullPath,createMiddlewareHandler(routeKey,handler));return createChainableRoute(routeKey,shadowed)},patch(path,handler){const{fullPath,routeKey,shadowed}=registerRoute("PATCH",path,handler);bunRouter.patch(fullPath,createMiddlewareHandler(routeKey,handler));return createChainableRoute(routeKey,shadowed)},delete(path,handler){const{fullPath,routeKey,shadowed}=registerRoute("DELETE",path,handler);bunRouter.delete(fullPath,createMiddlewareHandler(routeKey,handler));return createChainableRoute(routeKey,shadowed)},options(path,handler){const{fullPath,routeKey,shadowed}=registerRoute("OPTIONS",path,handler);bunRouter.options(fullPath,createMiddlewareHandler(routeKey,handler));return createChainableRoute(routeKey,shadowed)},group(options,callback){const previousPrefix=currentPrefix,previousMiddleware=[...currentGroupMiddleware],previousApiResponse=currentGroupApiResponse;if(options.prefix)currentPrefix=previousPrefix+options.prefix;const middlewareList=options.middleware?Array.isArray(options.middleware)?options.middleware:[options.middleware]:void 0;if(middlewareList)currentGroupMiddleware=[...currentGroupMiddleware,...middlewareList];if(options.apiResponse===!0)currentGroupApiResponse=!0;log.debug(`[router] Entering group: prefix=${options.prefix||"/"} middleware=[${middlewareList?.join(", ")||""}]${currentGroupApiResponse?" apiResponse=true":""}`);const result=callback();if(result instanceof Promise)return result.then(()=>{currentPrefix=previousPrefix;currentGroupMiddleware=previousMiddleware;currentGroupApiResponse=previousApiResponse;return stacksRouter}).catch((err)=>{currentPrefix=previousPrefix;currentGroupMiddleware=previousMiddleware;currentGroupApiResponse=previousApiResponse;throw err});currentPrefix=previousPrefix;currentGroupMiddleware=previousMiddleware;currentGroupApiResponse=previousApiResponse;return stacksRouter},resource(name,handler,options){const actions=["index","store","show","update","destroy"],activeActions=options?.only?actions.filter((a)=>options.only.includes(a)):options?.except?actions.filter((a)=>!options.except.includes(a)):actions,stripped=handler.replace(/Action$/,""),handlerBase=stripped.startsWith("Actions/")?stripped:`Actions/${stripped}`;log.debug(`[router] Resource: /${name} \u2192 ${handlerBase}*Action [${activeActions.join(", ")}]`);const sibling=(suffix)=>`${handlerBase}${suffix}`,registerResourceRoutes=()=>{for(const action of activeActions)switch(action){case"index":stacksRouter.get(`/${name}`,sibling("IndexAction"));break;case"store":stacksRouter.post(`/${name}`,sibling("StoreAction"));break;case"show":stacksRouter.get(`/${name}/:id`,sibling("ShowAction"));break;case"update":stacksRouter.put(`/${name}/:id`,sibling("UpdateAction"));break;case"destroy":stacksRouter.delete(`/${name}/:id`,sibling("DestroyAction"));break}};if(options?.middleware)stacksRouter.group({middleware:options.middleware},registerResourceRoutes);else registerResourceRoutes();return stacksRouter},match(methods,path,handler){log.debug(`[router] Match: [${methods.join(", ")}] ${path} \u2192 ${typeof handler==="string"?handler:"function"}`);let firstShadowed=!1;for(const[index,method]of methods.entries()){const m=method.toUpperCase(),{fullPath,routeKey,shadowed}=registerRoute(m,path,handler);if(index===0)firstShadowed=shadowed;const wrappedHandler=createMiddlewareHandler(routeKey,handler);switch(m){case"GET":bunRouter.get(fullPath,wrappedHandler);break;case"POST":bunRouter.post(fullPath,wrappedHandler);break;case"PUT":bunRouter.put(fullPath,wrappedHandler);break;case"PATCH":bunRouter.patch(fullPath,wrappedHandler);break;case"DELETE":bunRouter.delete(fullPath,wrappedHandler);break;case"OPTIONS":bunRouter.options(fullPath,wrappedHandler);break}}return createChainableRoute(`${methods[0]}:${currentPrefix}${path}`,firstShadowed)},health(){bunRouter.get("/api/health",async()=>{const health=await checkApplicationHealth();return Response.json(health,{status:health.status==="healthy"?200:503})});bunRouter.get("/__routes",(req)=>{if(!isExposeRoutesAuthorized(req))return Response.json({error:"disabled"},{status:404});return Response.json(listRegisteredRoutes())});bunRouter.get("/__storage/:path",async(req)=>{const url=new URL(req.url),token=url.searchParams.get("token"),params=req.params,rawPath=params?.path?decodeURIComponent(params.path):decodeURIComponent(url.pathname.replace(/^\/__storage\//,""));if(!token||typeof rawPath!=="string"||rawPath.length===0)return new Response("Forbidden",{status:403});const{verifySignedStorageToken,Storage}=await import("@stacksjs/storage");if(!verifySignedStorageToken(token,rawPath).valid)return new Response("Forbidden",{status:403});try{const adapter=Storage.disk();if(!await adapter.fileExists(rawPath))return new Response("Not Found",{status:404});const buf=await adapter.readToBuffer(rawPath),mime=await adapter.mimeType(rawPath).catch(()=>"application/octet-stream");return new Response(buf,{status:200,headers:{"Content-Type":mime,"Cache-Control":"private, max-age=60","X-Content-Type-Options":"nosniff"}})}catch(err){log.error("[storage] signed-url fetch failed:",err);return new Response("Internal Error",{status:500})}});bunRouter.get("/__openapi.json",async(req)=>{if(!isExposeRoutesAuthorized(req))return Response.json({error:"disabled"},{status:404});try{const{generateOpenApi}=await import("@stacksjs/api"),spec=await generateOpenApi({write:!1,portable:!1});return Response.json(spec)}catch(err){return Response.json({error:"OpenAPI generation failed",message:err instanceof Error?err.message:String(err)},{status:500})}});return stacksRouter},use(middleware){const adapted=adaptMiddlewareForBunRouter(middleware);bunRouter.globalMiddleware.push(adapted);return stacksRouter},booting(name,run){bootHooks.push({name,run});return stacksRouter},async serve(options={}){warnOnMultipleRouterInstances();configureViewDirectories(bunRouter);wrapHandleRequestForCsrf(bunRouter);await wrapHandleRequestForDatabaseContext(bunRouter);await runBootHooks();return bunRouter.serve(options)},async handleRequest(req){return bunRouter.handleRequest(req)},getAllowedMethods(pathname,domain){return bunRouter.getAllowedMethods(pathname,domain)},async register(routePath,options){log.debug(`[router] Register: ${routePath} prefix=${options?.prefix||"none"}`);const callback=async()=>{await import(routePath)};if(options?.prefix||options?.middleware)await stacksRouter.group({prefix:options.prefix,middleware:options.middleware},callback);else await callback();return stacksRouter},async importRoutes(){log.debug("[router] Loading user routes from registry...");try{const{loadRoutes}=await import("./route-loader"),{appPath}=await import("@stacksjs/path"),routeRegistry=(await import(appPath("Routes.ts"))).default;await loadRoutes(routeRegistry)}catch(error){log.error("Failed to load route registry:",error);throw error}log.debug("[router] Loading ORM routes...");const ormRoutesPackage="@stacksjs/orm/routes";let ormRoutesLoaded=!1;try{await import(ormRoutesPackage);ormRoutesLoaded=!0;log.debug(`[router] ORM routes loaded from ${ormRoutesPackage}`)}catch(error){log.debug(`[router] ORM routes not available from the package, trying the vendored copy
+${paths}`)}return!0}let __defaultsPkgRoot;const __defaultsPathCache=new Map;function resolveDefaultsPath(rel){const cached=__defaultsPathCache.get(rel);if(cached!==void 0)return cached;if(rel.startsWith("app/")){const published=p.appPath(rel.slice(4));if(existsSync(published)){__defaultsPathCache.set(rel,published);return published}}const vendored=p.storagePath(`framework/defaults/${rel}`);let resolved;if(existsSync(vendored))resolved=vendored;else{if(__defaultsPkgRoot===void 0)try{const pkgJson=Bun.resolveSync("@stacksjs/defaults/package.json",process.cwd());__defaultsPkgRoot=pkgJson.slice(0,pkgJson.lastIndexOf("/"))}catch{__defaultsPkgRoot=null}resolved=__defaultsPkgRoot?`${__defaultsPkgRoot}/${rel}`:vendored}__defaultsPathCache.set(rel,resolved);return resolved}const NATIVE_ROUTE_METHODS=new Set(["GET","POST","PUT","PATCH","DELETE","OPTIONS","HEAD"]),NATIVE_ROUTE_PARAM=/^\{[A-Z_$][\w$]*\}$/i;function hasNativeCompatiblePath(path){if(path==="*")return!0;const segments=path.split("/");for(let index=0;index<segments.length;index++){const segment=segments[index];if(segment===""||NATIVE_ROUTE_PARAM.test(segment))continue;if(segment==="*"&&index===segments.length-1)continue;if(segment.includes("{")||segment.includes(":")||segment.includes("*"))return!1}return!0}export function shouldUseNativeRoutesByDefault(routes){let hasEligibleRoute=!1;for(const route of routes){if(!NATIVE_ROUTE_METHODS.has(route.method)||route.handler instanceof Response)continue;hasEligibleRoute=!0;if(route.nativeDispatch===!1||route.domain||route.constraints&&Object.keys(route.constraints).length>0||!hasNativeCompatiblePath(route.path))return!1}return hasEligibleRoute}import{runWithRequestArgument,runWithRequestArguments}from"./request-context";import{isApiRequest,JSON_CONTENT_TYPE}from"./api-shape";import{createErrorResponse,createMiddlewareErrorResponse}from"./error-handler";import{applySecurityHeaders,createJsonSecurityHeaders,secureSerializedJsonResponse}from"./security-headers";import{isCursorPaginator,isPaginator,isSimplePaginator}from"@stacksjs/pagination";const stacksRouteHandlers=new WeakSet;function rememberStacksRouteHandler(handler){stacksRouteHandlers.add(handler);return handler}const CSRF_DEFAULT=0,CSRF_SKIPPED=1,CSRF_REQUIRED=2,routeCsrfRegistry=new Map,routeRateLimitRegistry=new Map;function rateLimitWindowToSeconds(window){if(typeof window==="number"){if(!Number.isFinite(window)||window<=0)throw Error(`[Router] .rateLimit(): window must be a positive number of seconds, got ${window}`);return Math.floor(window)}switch(window){case"second":return 1;case"minute":return 60;case"hour":return 3600;case"day":return 86400;default:throw Error(`[Router] .rateLimit(): unknown period '${String(window)}'`)}}class BoundedMap{max;map=new Map;constructor(max){this.max=max}get(key){return this.map.get(key)}has(key){return this.map.has(key)}set(key,value){if(this.map.has(key))this.map.delete(key);this.map.set(key,value);if(this.map.size>this.max){const oldest=this.map.keys().next().value;if(oldest!==void 0)this.map.delete(oldest)}return this}delete(key){return this.map.delete(key)}clear(){this.map.clear()}get size(){return this.map.size}}function isExposeRoutesAuthorized(req){const flag=process.env.STACKS_EXPOSE_ROUTES??"";if(!flag)return!((process.env.APP_ENV??"").toLowerCase()==="production"||process.env.NODE_ENV==="production");if(flag==="1")return!((process.env.APP_ENV??"").toLowerCase()==="production"||process.env.NODE_ENV==="production");const url=new URL(req.url),submitted=req.headers.get("x-stacks-routes-token")||req.headers.get("X-Stacks-Routes-Token")||url.searchParams.get("token")||"";if(typeof submitted!=="string"||submitted.length===0||submitted.length!==flag.length)return!1;try{return timingSafeEqual(Buffer.from(submitted),Buffer.from(flag))}catch{return!1}}async function applyCorsIfConfigured(req,response){if(!req._corsConfig||!response)return response;try{const{applyCorsHeaders}=await import(resolveDefaultsPath("app/Middleware/Cors.ts"));return applyCorsHeaders(req,response,req._corsConfig)}catch(err){log.warn("[router] CORS header injection failed",{error:err});return response}}const ACTION_CACHE_MAX=5000,actionSkipsCsrfCache=new BoundedMap(ACTION_CACHE_MAX),routeHandlerKeyRegistry=new BoundedMap(ACTION_CACHE_MAX),routeActionRegistry=new Map,CSRF_PROTECTED_METHODS=new Set(["POST","PUT","PATCH","DELETE"]),CSRF_SEEDED_BY_HANDLE_REQUEST=Symbol.for("stacks.router.csrfSeededByHandleRequest"),FRAMEWORK_RESPONSE_METADATA_APPLIED=Symbol("stacks.router.frameworkResponseMetadataApplied"),FRAMEWORK_RESPONSE_BODY_LENGTH=Symbol("stacks.router.frameworkResponseBodyLength"),CSRF_SECURE_TRANSPORT=Symbol.for("@stacksjs/router:csrf-secure-transport"),secureNativeRouteRouters=new WeakSet,csrfEnabledNativeRouteRouters=new WeakSet,EMPTY_MIDDLEWARE_TIMINGS=[],EMPTY_MIDDLEWARE_ENTRIES=[],CSRF_ONLY_MIDDLEWARE=["csrf"];let resolvedMiddlewareEntryCache=new Map,resolvedCsrfOnlyMiddleware;const namedRouteRegistry=new Map;function compileNamedRoute(path){const paramNames=extractRouteParamNames(path),colonRegex=new Map;for(const name of paramNames)colonRegex.set(name,new RegExp(`(^|/):${name}(?=$|/)`,"g"));return{path,paramNames,colonRegex}}function extractRouteParamNames(routePath){const names=new Set;for(const m of routePath.matchAll(/\{(\w+)\}/g))if(m[1])names.add(m[1]);for(const m of routePath.matchAll(/(?:^|\/):(\w+)(?=$|\/)/g))if(m[1])names.add(m[1]);return[...names]}export function url(routeName,params={}){const named=namedRouteRegistry.get(routeName);if(!named)throw Error(`Route '${routeName}' is not defined. Available routes: ${[...namedRouteRegistry.keys()].join(", ")}`);const missing=named.paramNames.filter((name)=>!(name in params)||params[name]===void 0);if(missing.length>0)throw Error(`url('${routeName}'): missing required path param${missing.length>1?"s":""} [${missing.join(", ")}] for path '${named.path}'. Pass them as the second argument: url('${routeName}', { ${named.paramNames.join(", ")} })`);let appUrl;try{appUrl=process.env.APP_URL||"https://localhost"}catch{appUrl="https://localhost"}appUrl=appUrl.replace(/\/$/,"");if(!appUrl.startsWith("http"))appUrl=`https://${appUrl}`;let resolvedPath=named.path;const queryParams={};for(const[key,value]of Object.entries(params)){const curly=`{${key}}`;if(resolvedPath.includes(curly))resolvedPath=resolvedPath.replaceAll(curly,encodeURIComponent(String(value)));else{const re=named.colonRegex.get(key);if(re&&re.test(resolvedPath)){re.lastIndex=0;resolvedPath=resolvedPath.replace(re,`$1${encodeURIComponent(String(value))}`)}else queryParams[key]=String(value)}}const queryString=Object.keys(queryParams).length>0?`?${new URLSearchParams(queryParams).toString()}`:"";return`${appUrl}${resolvedPath}${queryString}`}export function routeParams(routeName){const named=namedRouteRegistry.get(routeName);return named?[...named.paramNames]:[]}export function listNamedRoutes(){const out={};for(const[name,named]of namedRouteRegistry.entries())out[name]=named.path;return out}export function listRegisteredRoutes(){const out=[],seen=new Set;for(const key of routeMiddlewareRegistry.keys()){if(seen.has(key))continue;seen.add(key);const idx=key.indexOf(":");if(idx===-1)continue;const method=key.slice(0,idx),path=key.slice(idx+1);let routeName;for(const[n,named]of namedRouteRegistry.entries())if(named.path===path){routeName=n;break}out.push({method,path,name:routeName,handler:routeHandlerKeyRegistry.get(key),action:routeActionRegistry.get(key)})}return out.sort((a,b)=>a.path.localeCompare(b.path))}const MIDDLEWARE_TIMEOUT_MS=30000;let _debugLoggingCache;function isDebugLogging(){if(_debugLoggingCache===void 0){const level=(process.env.LOG_LEVEL||"info").toLowerCase();_debugLoggingCache=level!=="info"&&level!=="warn"&&level!=="error"}return _debugLoggingCache}const DEFAULT_MIDDLEWARE_PRIORITY=10,_warnedInvalidPriorities=new Set;function warnInvalidMiddlewarePriority(name,raw){const key=`${name}:${String(raw)}`;if(_warnedInvalidPriorities.has(key))return;_warnedInvalidPriorities.add(key);log.warn(`[Router] Middleware '${name}' declared an invalid priority (${String(raw)}). Priorities must be a finite non-negative number; falling back to default ${DEFAULT_MIDDLEWARE_PRIORITY}.`)}function adaptMiddlewareForBunRouter(middleware){if(middleware instanceof Middleware)return middleware.toRouterHandler();if(middleware&&typeof middleware==="object"&&typeof middleware.handle==="function"&&typeof middleware!=="function"){const handle=middleware.handle.bind(middleware);return async(req,next)=>{try{await handle(req)}catch(thrown){if(thrown instanceof Response)return thrown;throw thrown}return next()}}return middleware}const middlewareCache=new Map;let middlewareAliasesPromise=null;async function getMiddlewareAliases(){if(middlewareAliasesPromise)return middlewareAliasesPromise;middlewareAliasesPromise=(async()=>{const merged={};for(const load of[()=>import(resolveDefaultsPath("app/Middleware.ts")),()=>import(p.appPath("Middleware.ts"))])try{const module=await load();Object.assign(merged,module.default??{})}catch{}return merged})();return middlewareAliasesPromise}const PASCAL_SPLIT_REGEX=/[-_\s]+/,pascalCaseCache=new Map;function toPascalCase(input){if(!input)return input;const cached=pascalCaseCache.get(input);if(cached!==void 0)return cached;const out=input.split(PASCAL_SPLIT_REGEX).filter(Boolean).map((part)=>part.charAt(0).toUpperCase()+part.slice(1)).join("");pascalCaseCache.set(input,out);return out}async function resolveMiddlewareName(name){const resolved=(await getMiddlewareAliases())[name]||toPascalCase(name);log.debug(`[middleware] Resolved: ${name} \u2192 ${resolved}`);return resolved}let middlewareRegistryPromise=null;async function getMiddlewareRegistry(){if(middlewareRegistryPromise)return middlewareRegistryPromise;middlewareRegistryPromise=(async()=>{try{const dir=p.storagePath("framework/auto-imports"),module=await import(`${dir}/middleware.ts`);if(!module.middleware)return null;const{resolve}=await import("node:path");return Object.fromEntries(Object.entries(module.middleware).map(([name,file])=>[name,resolve(dir,file)]))}catch{return null}})();return middlewareRegistryPromise}async function loadMiddleware(name){if(middlewareCache.has(name))return middlewareCache.get(name)??null;const className=await resolveMiddlewareName(name),registered=(await getMiddlewareRegistry())?.[className];if(registered)try{const handler=(await import(registered)).default??null;if(!handler||typeof handler.handle!=="function"){log.error(`[Router] Middleware '${name}' resolved to ${registered}, but the file has no default export with a handle() method`);middlewareCache.set(name,null);return null}middlewareCache.set(name,handler);return handler}catch(err){log.error(`[Router] Failed to load middleware '${name}' from ${registered}:`,err);return null}let userPathError;try{const userPath=p.appPath(`Middleware/${className}.ts`),handler=(await import(userPath)).default??null;if(!handler||typeof handler.handle!=="function"){log.error(`[Router] Middleware '${name}' resolved to ${userPath}, but the file has no default export with a handle() method`);middlewareCache.set(name,null);return null}middlewareCache.set(name,handler);return handler}catch(err){userPathError=err}try{const defaultPath=resolveDefaultsPath(`app/Middleware/${className}.ts`),handler=(await import(defaultPath)).default??null;if(!handler||typeof handler.handle!=="function"){log.error(`[Router] Middleware '${name}' resolved to ${defaultPath}, but the file has no default export with a handle() method`);middlewareCache.set(name,null);return null}middlewareCache.set(name,handler);return handler}catch(err){const userMsg=userPathError instanceof Error?userPathError.message:String(userPathError);log.error(`[Router] Failed to load middleware '${name}' (resolved to '${className}'). app/Middleware: ${userMsg}; defaults:`,err);return null}}export async function middlewareAliases(){return{...await getMiddlewareAliases()}}export async function loadMiddlewareHandlers(){const aliases=await getMiddlewareAliases(),generated=await getMiddlewareRegistry(),references=new Set([...Object.keys(aliases),...Object.values(aliases),...Object.keys(generated??{})]),handlers={};await Promise.all([...references].map(async(reference)=>{const handler=await loadMiddleware(reference);if(handler)handlers[reference]=handler}));return handlers}const negatedMiddlewareCache=new Map;function isShortCircuit(thrown){if(thrown instanceof Response)return!0;return typeof thrown==="object"&&thrown!==null&&(("status"in thrown)||("statusCode"in thrown))}function negateMiddleware(name,inner){const cached=negatedMiddlewareCache.get(name);if(cached)return cached;const negated={priority:inner.priority,async handle(req){try{await inner.handle(req)}catch(thrown){if(isShortCircuit(thrown))return;throw thrown}const{HttpError}=await import("@stacksjs/error-handling");throw new HttpError(403,`Access denied. This route requires "${name}" not to apply.`)}};negatedMiddlewareCache.set(name,negated);return negated}function loadParsedMiddleware(parsed){const cached=middlewareCache.get(parsed.name);if(cached!==void 0)return cached&&parsed.negated?negateMiddleware(parsed.name,cached):cached;return loadMiddleware(parsed.name).then((handler)=>handler&&parsed.negated?negateMiddleware(parsed.name,handler):handler)}export function clearMiddlewareCache(){middlewareCache.clear();negatedMiddlewareCache.clear();resolvedMiddlewareEntryCache=new Map;resolvedCsrfOnlyMiddleware=void 0;parsedMiddlewareCache=new Map;middlewareAliasesPromise=null;middlewareRegistryPromise=null;actionRegistryPromise=null;actionSkipsCsrfCache.clear();routeHandlerKeyRegistry.clear();routeActionRegistry.clear();clearCsrfModuleCache()}export function installMiddlewareHotReload(){if(process.env.APP_ENV==="production"||process.env.NODE_ENV==="production")return()=>{};let fsWatchers=[];(async()=>{try{const fs=await import("node:fs"),targets=[p.appPath("Middleware"),p.appPath("Middleware.ts")];for(const target of targets)try{if(!fs.existsSync(target))continue;const w=fs.watch(target,{recursive:!0},()=>{log.debug("[middleware] hot-reload: clearing cache");clearMiddlewareCache()});fsWatchers.push(w)}catch{}}catch{}})();return()=>{for(const w of fsWatchers)try{w.close()}catch{}fsWatchers=[]}}const routeMiddlewareRegistry=new Map;export function clearRouteMiddlewareRegistry(){for(const middleware of routeMiddlewareRegistry.values())middleware.length=0;routeMiddlewareRegistry.clear()}const routeApiResponseRegistry=new Set;let parsedMiddlewareCache=new Map;function parseMiddlewareEntry(middleware){const cache=parsedMiddlewareCache;let parsed=cache.get(middleware);if(!parsed){parsed=parseMiddlewareEntryUncached(middleware).then((resolved)=>{cache.set(middleware,resolved);return resolved},(error)=>{cache.delete(middleware);throw error});cache.set(middleware,parsed)}return parsed}async function parseMiddlewareEntryUncached(middleware){const timingName=middleware.replace(/[^A-Za-z0-9_-]/g,"_").slice(0,32),negated=middleware.startsWith("!"),bare=negated?middleware.slice(1):middleware,aliases=await getMiddlewareAliases();if(Object.hasOwn(aliases,bare))return{name:bare,negated,timingName};const colonIndex=bare.indexOf(":");if(colonIndex===-1)return{name:bare,negated,timingName};return{name:bare.substring(0,colonIndex),negated,timingName,params:bare.substring(colonIndex+1)}}export async function findUnresolvableRouteMiddleware(){const usage=new Map;for(const[routeKey,entries]of routeMiddlewareRegistry)for(const entry of entries){const parsed=await parseMiddlewareEntry(entry),alias=parsed.negated?`!${parsed.name}`:parsed.name,seen=usage.get(alias)??{parsed,routes:[]};seen.routes.push(routeKey);usage.set(alias,seen)}if(!usage.has("csrf"))usage.set("csrf",{parsed:{name:"csrf",negated:!1,timingName:"csrf"},routes:["(auto-injected on POST/PUT/PATCH/DELETE)"]});const unresolvable=[];for(const[alias,{parsed,routes}]of usage){const handler=await loadParsedMiddleware(parsed);if(!handler||typeof handler.handle!=="function")unresolvable.push({alias,routes})}return unresolvable}export async function assertRouteMiddlewareResolvable(){const unresolvable=await findUnresolvableRouteMiddleware();if(unresolvable.length===0)return;const detail=unresolvable.map((u)=>`"${u.alias}" (used by ${u.routes.join(", ")})`).join("; ");throw Error(`[Router] Unresolvable middleware alias(es): ${detail}. Check the alias map in app/Middleware.ts or add app/Middleware/<Class>.ts.`)}function createMiddlewareHandler(routeKey,handler,csrfEnabled=!0){const wrappedBase=wrapHandler(handler,!0,routeKey),routeMiddleware=routeMiddlewareRegistry.get(routeKey)??EMPTY_MIDDLEWARE_ENTRIES,routeCsrf=routeCsrfRegistry.get(routeKey),routeRateLimit=routeRateLimitRegistry.get(routeKey),routeMethod=routeKey.slice(0,routeKey.indexOf(":")).toUpperCase(),routeAcceptsCsrf=csrfEnabled&&CSRF_PROTECTED_METHODS.has(routeMethod),routeMayHaveBody=routeMethod!=="GET"&&routeMethod!=="HEAD",routeRendersCsrf=csrfEnabled&&(routeMethod==="GET"||routeMethod==="HEAD"),routeSeedsCsrf=csrfEnabled&&(routeMethod==="GET"||routeMethod==="HEAD"||routeMethod==="OPTIONS"),forcesJsonByGroup=routeApiResponseRegistry.has(routeKey),directActionSkipsCsrf=isRouterAction(handler)&&(handler.skipCsrf===!0||handler.csrf===!1),handlerKey=typeof handler==="string"?handler:void 0,synchronousInlineHandler=typeof handler==="function"&&handler.constructor.name!=="AsyncFunction",asynchronousInlineHandler=typeof handler==="function"&&handler.constructor.name==="AsyncFunction"?handler:void 0;let actionPrefetch=null;if(typeof handler==="string"&&routeAcceptsCsrf){const pending=resolveStringHandler(handler);if(pending instanceof Promise){const settled=()=>{actionPrefetch=null};actionPrefetch=pending.then(settled,settled)}}const finishSynchronousResult=(req,response,csrfHandledByOuter)=>{const frameworkMetadataApplied=response[FRAMEWORK_RESPONSE_METADATA_APPLIED]===!0;if(response.status>=400||req._corsConfig||req._compress===!0||req._startNs!=null||Array.isArray(req._afterResponse)||req._responseHeaders)return;if(frameworkMetadataApplied&&!routeSeedsCsrf)return response;let finalized=response;const csrfSeededDuringFormatting=req[CSRF_SEEDED_BY_HANDLE_REQUEST]===!0;if(routeSeedsCsrf&&!csrfHandledByOuter&&!csrfSeededDuringFormatting){const mod=loadCsrfModule();if(mod instanceof Promise)return;if(mod)finalized=mod.seedCsrfCookieIfMissing(req,finalized,req._csrfToken,frameworkMetadataApplied)}if(!frameworkMetadataApplied)try{const requestId=req._requestId;if(requestId)finalized.headers.set("X-Request-ID",requestId);applySecurityHeaders(finalized.headers)}catch{return}return finalized},handleAsyncInContext=async(req,preparedBaseResult,hasPreparedBaseResult=!1)=>{if(routeMayHaveBody)try{await parseRequestBody(req)}catch(err){const error=err instanceof Error?err:Error(String(err));return createMiddlewareErrorResponse(error,req)}const enhancedReq=req,csrfHandledByOuter=enhancedReq[CSRF_SEEDED_BY_HANDLE_REQUEST]===!0;if(!csrfHandledByOuter&&routeRendersCsrf&&requestMayRenderHtml(enhancedReq)){const renderTokenSeeding=seedCsrfTokenForRender(enhancedReq);if(renderTokenSeeding)await renderTokenSeeding}if(actionPrefetch)await actionPrefetch;if(forcesJsonByGroup)req._forceJson=!0;if(!hasPreparedBaseResult&&synchronousInlineHandler&&!routeAcceptsCsrf&&routeMiddleware.length===0&&!routeRateLimit?.config){preparedBaseResult=runWithRequestArgument(enhancedReq,wrappedBase,enhancedReq);hasPreparedBaseResult=!0;if(preparedBaseResult instanceof Response){const finished=finishSynchronousResult(enhancedReq,preparedBaseResult,csrfHandledByOuter);if(finished)return finished}}const rl=routeRateLimit?.config;if(rl)try{const{rateLimit:enforceRateLimit}=await import("./rate-limit");await enforceRateLimit(routeKey,rl.max).over(rl.windowSeconds)}catch(err){return createMiddlewareErrorResponse(err,req)}const userMiddleware=routeMiddleware;let shouldInjectCsrf=!1;if(routeAcceptsCsrf){const alreadyHasCsrf=userMiddleware.some((m)=>m==="csrf"||m.startsWith("csrf:")),routeCsrfMode=routeCsrf?.mode??CSRF_DEFAULT,routeSkipped=routeCsrfMode===CSRF_SKIPPED,routeRequired=routeCsrfMode===CSRF_REQUIRED,actionSkipped=directActionSkipsCsrf||(handlerKey?actionSkipsCsrfCache.get(handlerKey)===!0:!1);shouldInjectCsrf=!alreadyHasCsrf&&(routeRequired||!routeSkipped&&!actionSkipped)}const middlewareEntries=shouldInjectCsrf?userMiddleware.length===0?CSRF_ONLY_MIDDLEWARE:["csrf",...userMiddleware]:userMiddleware;let middlewareTimings=EMPTY_MIDDLEWARE_TIMINGS;if(middlewareEntries.length>0){if(isDebugLogging()){const schemeEnd=req.url.indexOf("://"),pathStart=schemeEnd===-1?0:req.url.indexOf("/",schemeEnd+3),q=req.url.indexOf("?",pathStart<0?0:pathStart),urlPath=pathStart<0?"/":req.url.slice(pathStart,q===-1?void 0:q);log.debug(`[middleware] Executing chain: [${middlewareEntries.join(", ")}] for ${routeMethod} ${urlPath}`)}const cachedCsrfOnlyMiddleware=middlewareEntries===CSRF_ONLY_MIDDLEWARE?resolvedCsrfOnlyMiddleware:void 0,resolved=cachedCsrfOnlyMiddleware??[],unresolvedEntries=cachedCsrfOnlyMiddleware?EMPTY_MIDDLEWARE_ENTRIES:middlewareEntries;for(const middlewareEntry of unresolvedEntries){let resolvedEntry=resolvedMiddlewareEntryCache.get(middlewareEntry);if(!resolvedEntry){const pending=parseMiddlewareEntry(middlewareEntry),parsed=pending instanceof Promise?await pending:pending,loaded=loadParsedMiddleware(parsed),middleware=loaded instanceof Promise?await loaded:loaded;if(middleware&&typeof middleware.handle==="function"){const rawPriority=middleware.priority;let priority=DEFAULT_MIDDLEWARE_PRIORITY;if(typeof rawPriority==="number"&&Number.isFinite(rawPriority)&&rawPriority>=0)priority=rawPriority;else if(rawPriority!==void 0)warnInvalidMiddlewarePriority(middlewareEntry,rawPriority);resolvedEntry={name:middlewareEntry,timingName:parsed.timingName,handler:middleware,priority,parameterName:parsed.params?parsed.name:void 0,params:parsed.params};resolvedMiddlewareEntryCache.set(middlewareEntry,resolvedEntry)}}if(!resolvedEntry){log.error(`[Router] Middleware '${middlewareEntry}' on ${routeKey} could not be resolved - failing closed`);const failClosedError=Error(`Middleware '${middlewareEntry}' could not be resolved`),failClosedResponse=await createErrorResponse(failClosedError,enhancedReq,{status:500});return await applyCorsIfConfigured(enhancedReq,failClosedResponse)}if(resolvedEntry.params&&resolvedEntry.parameterName){enhancedReq._middlewareParams=enhancedReq._middlewareParams||{};enhancedReq._middlewareParams[resolvedEntry.parameterName]=resolvedEntry.params}resolved.push(resolvedEntry)}if(middlewareEntries===CSRF_ONLY_MIDDLEWARE&&!cachedCsrfOnlyMiddleware&&resolved.length===1)resolvedCsrfOnlyMiddleware=resolved;if(resolved.length>1)resolved.sort((a,b)=>a.priority-b.priority);const collectsMiddlewareTimings=enhancedReq._startNs!=null;if(collectsMiddlewareTimings)middlewareTimings=[];let chainTimer,chainBudget,runningMiddleware="";try{for(const{name:middlewareName,timingName,handler:middleware}of resolved){const mwStart=collectsMiddlewareTimings?performance.now():0;runningMiddleware=middlewareName;try{const outcome=middleware.handle(enhancedReq);if(outcome&&typeof outcome.then==="function"){if(!chainBudget){chainBudget=new Promise((_,reject)=>{chainTimer=setTimeout(()=>reject(Error(`Middleware '${runningMiddleware}' exceeded ${MIDDLEWARE_TIMEOUT_MS}ms`)),MIDDLEWARE_TIMEOUT_MS)});chainBudget.catch(()=>{})}await Promise.race([outcome,chainBudget])}if(collectsMiddlewareTimings){const elapsedMs=performance.now()-mwStart;middlewareTimings.push({name:timingName,ms:elapsedMs})}}catch(error){if(collectsMiddlewareTimings){const elapsedMs=performance.now()-mwStart;middlewareTimings.push({name:timingName,ms:elapsedMs})}log.debug(`[middleware] Blocked by: ${middlewareName}`);if(error instanceof Response){try{const{_requestId:reqId,_startNs:startNs}=enhancedReq,total=startNs!=null?Number(process.hrtime.bigint()-startNs)/1e6:null,parts=total!=null?[`total;dur=${total.toFixed(1)}`]:[];for(const t of middlewareTimings)parts.push(`mw_${t.name};dur=${t.ms.toFixed(1)}`);if(parts.length>0)error.headers.set("Server-Timing",parts.join(", "));if(reqId)error.headers.set("X-Request-ID",reqId)}catch{}return await applyCorsIfConfigured(enhancedReq,error)}const err=error instanceof Error?error:Error(String(error)),errorResponse="statusCode"in err||"status"in err?await createMiddlewareErrorResponse(err,enhancedReq):await(()=>{log.error(`[Router] Middleware '${middlewareName}' threw an unexpected error:`,err);return createErrorResponse(err,enhancedReq,{status:500})})();try{const{_requestId:reqId,_startNs:startNs}=enhancedReq,total=startNs!=null?Number(process.hrtime.bigint()-startNs)/1e6:null,parts=total!=null?[`total;dur=${total.toFixed(1)}`]:[];for(const t of middlewareTimings)parts.push(`mw_${t.name};dur=${t.ms.toFixed(1)}`);if(parts.length>0)errorResponse.headers.set("Server-Timing",parts.join(", "));if(reqId)errorResponse.headers.set("X-Request-ID",reqId)}catch{}return await applyCorsIfConfigured(enhancedReq,errorResponse)}}}finally{if(chainTimer)clearTimeout(chainTimer)}}const formatsResolvedInlineResult=asynchronousInlineHandler!==void 0&&!hasPreparedBaseResult,baseResult=hasPreparedBaseResult?preparedBaseResult:asynchronousInlineHandler?asynchronousInlineHandler(enhancedReq):wrappedBase(enhancedReq),resolvedResult=baseResult instanceof Response?baseResult:await baseResult;let response=formatsResolvedInlineResult?formatResult(resolvedResult,enhancedReq):resolvedResult;if(response){const csrfSeededDuringFormatting=enhancedReq[CSRF_SEEDED_BY_HANDLE_REQUEST]===!0;if(routeSeedsCsrf&&!csrfHandledByOuter&&!csrfSeededDuringFormatting)try{const mod=loadCsrfModule(),csrf=mod instanceof Promise?await mod:mod;if(csrf)response=csrf.seedCsrfCookieIfMissing(enhancedReq,response,enhancedReq._csrfToken,response[FRAMEWORK_RESPONSE_METADATA_APPLIED]===!0)}catch(err){log.warn("[router] CSRF cookie seeding failed",{error:err})}}if(response&&enhancedReq._corsConfig)response=await applyCorsIfConfigured(enhancedReq,response);const{_requestId:reqId,_startNs:startNs}=enhancedReq,durMs=startNs!=null?Number(process.hrtime.bigint()-startNs)/1e6:null,{_afterResponse:after,_responseHeaders:requested}=enhancedReq,frameworkMetadataApplied=response&&response[FRAMEWORK_RESPONSE_METADATA_APPLIED]===!0;if(response&&(response.status>=400||Array.isArray(after)||requested&&typeof requested==="object"||durMs!=null||!frameworkMetadataApplied)&&typeof response.headers?.set==="function"){const setHeaders=(h)=>{if(Array.isArray(after))for(const callback of after)try{if(typeof callback==="function")callback({status:response.status,durationMs:durMs??0})}catch{}if(requested&&typeof requested==="object"){for(const[name,value]of Object.entries(requested))if(typeof value==="string")h.set(name,value)}if(reqId&&!frameworkMetadataApplied)h.set("X-Request-ID",reqId);if(durMs!=null){let timing=`total;dur=${durMs.toFixed(1)}`;for(const t of middlewareTimings)timing+=`, mw_${t.name};dur=${t.ms.toFixed(1)}`;h.set("Server-Timing",timing)}if(!frameworkMetadataApplied)applySecurityHeaders(h)};if(response.status>=400&&(response.headers.get("content-type")||"").includes("json")&&reqId)try{const text=await response.clone().text(),parsed=JSON.parse(text);if(parsed&&typeof parsed==="object"){const newHeaders=new Headers(response.headers);setHeaders(newHeaders);return new Response(JSON.stringify({...parsed,request_id:reqId}),{status:response.status,statusText:response.statusText,headers:newHeaders})}}catch{}try{setHeaders(response.headers)}catch{try{const cloned=response.clone(),newHeaders=new Headers(response.headers);setHeaders(newHeaders);return new Response(cloned.body,{status:response.status,statusText:response.statusText,headers:newHeaders})}catch{}}}if(enhancedReq._compress===!0&&response)try{const{applyCompression}=await import(resolveDefaultsPath("app/Middleware/Compress.ts"));return await applyCompression(enhancedReq,response)}catch(err){log.warn(`[router] Compression failed; sending uncompressed response: ${err instanceof Error?err.message:String(err)}`)}return response},handleAsync=(req,preparedBaseResult,hasPreparedBaseResult=!1)=>runWithRequestArguments(req,handleAsyncInContext,req,preparedBaseResult,hasPreparedBaseResult);if(!synchronousInlineHandler||routeMayHaveBody)return rememberStacksRouteHandler(handleAsync);return rememberStacksRouteHandler((req)=>{if(routeMiddleware.length!==0||routeRateLimit?.config)return handleAsync(req);const csrfHandledByOuter=req[CSRF_SEEDED_BY_HANDLE_REQUEST]===!0;if(routeRendersCsrf&&!csrfHandledByOuter&&requestMayRenderHtml(req)){const renderTokenSeeding=seedCsrfTokenForRender(req);if(renderTokenSeeding)return renderTokenSeeding.then(()=>handleAsync(req))}if(forcesJsonByGroup)req._forceJson=!0;let preparedBaseResult;try{preparedBaseResult=runWithRequestArgument(req,wrappedBase,req)}catch(error){return Promise.reject(error)}if(preparedBaseResult instanceof Response){const finished=finishSynchronousResult(req,preparedBaseResult,csrfHandledByOuter);if(finished)return finished}return handleAsync(req,preparedBaseResult,!0)})}function createInertRoute(){const inert={middleware:()=>inert,name:()=>inert,skipCsrf:()=>inert,requireCsrf:()=>inert,rateLimit:()=>inert};return inert}function createChainableRoute(routeKey,shadowed=!1){if(shadowed)return createInertRoute();if(!routeMiddlewareRegistry.has(routeKey))routeMiddlewareRegistry.set(routeKey,[]);const routePath=routeKey.includes(":")?routeKey.substring(routeKey.indexOf(":")+1):routeKey,routeCsrf=routeCsrfRegistry.get(routeKey),routeRateLimit=routeRateLimitRegistry.get(routeKey),chain={middleware(name){const middlewareList=routeMiddlewareRegistry.get(routeKey);if(!middlewareList)return chain;for(const entry of Array.isArray(name)?name:[name]){if(typeof entry!=="string")throw TypeError(`[Router] middleware() on ${routeKey} was given a ${typeof entry}; it takes an alias or an array of aliases`);middlewareList.push(entry)}return chain},name(routeName){namedRouteRegistry.set(routeName,compileNamedRoute(routePath));return chain},skipCsrf(){if(routeCsrf)routeCsrf.mode=CSRF_SKIPPED;return chain},requireCsrf(){if(routeCsrf)routeCsrf.mode=CSRF_REQUIRED;return chain},rateLimit(max,window){if(!Number.isFinite(max)||max<=0)throw Error(`[Router] .rateLimit(): max must be a positive number, got ${String(max)}`);const windowSeconds=rateLimitWindowToSeconds(window);if(routeRateLimit)routeRateLimit.config={max:Math.floor(max),windowSeconds};return chain}};return chain}async function fileExists(path){try{return await Bun.file(path).exists()}catch{return!1}}function assertSafeHandlerPath(handlerPath){if(typeof handlerPath!=="string"||handlerPath.length===0)throw Error(`[Router] Refusing to resolve handler '${String(handlerPath)}': empty or non-string`);if(handlerPath.includes("\x00"))throw Error("[Router] Refusing to resolve handler with null byte");if(handlerPath.startsWith("/")||/^[A-Za-z]:[\\/]/.test(handlerPath))throw Error(`[Router] Refusing to resolve absolute handler path '${handlerPath}'`);if(handlerPath.split(/[/\\]/).some((s)=>s===".."))throw Error(`[Router] Refusing to resolve handler path '${handlerPath}' (contains '..' segment)`)}const _moduleImportCache=new Map;function cachedImport(fullPath){let p=_moduleImportCache.get(fullPath);if(!p){p=import(fullPath);_moduleImportCache.set(fullPath,p)}return p}const _resolvedHandlerCache=new Map;function resolveStringHandler(handlerPath){let resolved=_resolvedHandlerCache.get(handlerPath);if(!resolved){resolved=resolveStringHandlerUncached(handlerPath).then((handler)=>{_resolvedHandlerCache.set(handlerPath,handler);return handler},(error)=>{_resolvedHandlerCache.delete(handlerPath);throw error});_resolvedHandlerCache.set(handlerPath,resolved)}return resolved}function validationFailureResponse(errors){return response.validationError(errors)}export function precognitionRequest(req,knownHeader){const header=knownHeader===void 0?req.headers?.get?.("Precognition"):knownHeader,viaHeader=typeof header==="string"&&header.toLowerCase()==="true";let viaQuery=!1;try{if(!viaHeader&&req.url.includes("?"))viaQuery=new URL(req.url).searchParams.get("_validate")==="1"}catch{viaQuery=!1}if(!viaHeader&&!viaQuery)return null;return{only:(req.headers?.get?.("Precognition-Validate-Only")??"").split(",").map((field)=>field.trim()).filter(Boolean)}}export function precognitionSuccess(){return new Response(null,{status:204,headers:{Precognition:"true","Precognition-Success":"true",Vary:"Precognition, Precognition-Validate-Only"}})}let actionRegistryPromise=null;async function getActionRegistry(){if(actionRegistryPromise)return actionRegistryPromise;actionRegistryPromise=(async()=>{try{const dir=p.storagePath("framework/auto-imports"),module=await import(`${dir}/actions.ts`);if(!module.actions)return null;const{resolve}=await import("node:path");return Object.fromEntries(Object.entries(module.actions).map(([name,file])=>[name,resolve(dir,file)]))}catch{return null}})();return actionRegistryPromise}async function resolveStringHandlerUncached(handlerPath){assertSafeHandlerPath(handlerPath);let modulePath=handlerPath;modulePath=modulePath.endsWith(".ts")?modulePath.slice(0,-3):modulePath;if(modulePath.includes("Controller")){const[controllerPath,methodName="index"]=modulePath.split("@"),userPath=p.appPath(`${controllerPath}.ts`),defaultPath=resolveDefaultsPath(`app/${controllerPath}.ts`),fullPath=await fileExists(userPath)?userPath:defaultPath;try{const controller=await cachedImport(fullPath);if(!controller.default||typeof controller.default!=="function")throw Error(`Controller ${controllerPath} does not export a default class`);const instance=new controller.default;if(typeof instance[methodName]!=="function")throw Error(`Method ${methodName} not found in controller ${controllerPath}`);return async(req)=>{const result=await instance[methodName](req);return formatResult(result,req)}}catch(error){log.error(`[Router] Failed to load controller '${fullPath}':`,error);throw error}}let fullPath;if(modulePath.includes("storage/framework/orm"))fullPath=modulePath;else if(modulePath.includes("OrmAction"))fullPath=p.storagePath(`framework/actions/src/${modulePath}.ts`);else if(modulePath.includes("Actions")){const registered=(await getActionRegistry())?.[modulePath];if(registered)fullPath=registered;else{const userPath=p.projectPath(`app/${modulePath}.ts`),defaultPath=resolveDefaultsPath(`app/${modulePath}.ts`);fullPath=await fileExists(userPath)?userPath:defaultPath}}else{const userPath=p.appPath(`${modulePath}.ts`),defaultPath=resolveDefaultsPath(`app/${modulePath}.ts`);fullPath=await fileExists(userPath)?userPath:defaultPath}try{const action=(await cachedImport(fullPath)).default;if(!action)throw Error(`Action '${handlerPath}' has no default export`);if(typeof action.handle!=="function"){log.error(`[Router] Action '${handlerPath}' structure:`,Object.keys(action));throw Error(`Action '${handlerPath}' has no handle() method. Got: ${typeof action.handle}`)}return wrapAction(action,handlerPath)}catch(importError){log.error(`[Router] Failed to import action '${fullPath}':`,importError);throw importError}}export function isRouterAction(handler){return typeof handler==="object"&&handler!==null&&typeof handler.handle==="function"}export function wrapAction(action,handlerKey){const actionSkipsCsrf=action.skipCsrf===!0||action.csrf===!1;actionSkipsCsrfCache.set(handlerKey,actionSkipsCsrf);const actionForcesJson=action.apiResponse===!0,requestValidationRules=action.validations??modelValidationRules(action.modelDefinition??action.model),actionValidationEntries=action.validations?compileActionValidationEntries(action.validations):void 0,routeSeparator=handlerKey.indexOf(":"),actionMayHaveRouteParams=routeSeparator===-1||handlerKey.indexOf("{",routeSeparator+1)!==-1,prepareRequest=(req)=>{const precognitionHeader=req.headers.get("Precognition"),requestHasQuery=req.url.includes("?"),precognition=precognitionHeader===null&&!requestHasQuery?null:precognitionRequest(req,precognitionHeader);if(precognition){if(!action.validations)return precognitionSuccess();const rules=precognition.only.length>0?Object.fromEntries(Object.entries(action.validations).filter(([field])=>precognition.only.includes(field))):action.validations,precognitionResult=validateActionInputSync(req,rules,rules===action.validations?actionValidationEntries:void 0,actionMayHaveRouteParams,!0,requestHasQuery);return precognitionResult.valid?precognitionSuccess():validationFailureResponse(precognitionResult.errors)}if(action.validations){const validationResult=validateActionInputSync(req,action.validations,actionValidationEntries,actionMayHaveRouteParams,!0,requestHasQuery);if(!validationResult.valid)return validationFailureResponse(validationResult.errors)}},rethrowActionError=(handleError)=>{report(handleError,{label:`[Router] action.handle() for '${handlerKey}'`});throw handleError};if(typeof action.authorize!=="function"&&typeof action.before!=="function")return(req)=>{if(actionSkipsCsrf)req._skipCsrf=!0;if(actionForcesJson)req._forceJson=!0;req._requestValidationRules=requestValidationRules;try{const earlyResponse=prepareRequest(req);if(earlyResponse)return earlyResponse;const result=action.handle(req);return result instanceof Promise?result.then((value)=>{try{return formatResult(value,req)}catch(error){return rethrowActionError(error)}},rethrowActionError):formatResult(result,req)}catch(handleError){return rethrowActionError(handleError)}};return async(req)=>{if(actionSkipsCsrf)req._skipCsrf=!0;if(actionForcesJson)req._forceJson=!0;req._requestValidationRules=requestValidationRules;try{const earlyResponse=prepareRequest(req);if(earlyResponse)return earlyResponse;if(typeof action.authorize==="function"){const auth=await action.authorize(req);if(auth instanceof Response)return auth;if(auth===!1)return Response.json({error:"Forbidden"},{status:403})}if(typeof action.before==="function"){const pre=await action.before(req);if(pre instanceof Response)return pre}const pendingResult=action.handle(req),result=pendingResult instanceof Promise?await pendingResult:pendingResult;return formatResult(result,req)}catch(handleError){return rethrowActionError(handleError)}}}const EMPTY_VALIDATION_ERRORS=Object.freeze({}),VALID_ACTION_VALIDATION_RESULT=Object.freeze({valid:!0,errors:EMPTY_VALIDATION_ERRORS});function propertyOwner(value,property){let current=value;while(current){if(Object.hasOwn(current,property))return current;current=Object.getPrototypeOf(current)}}function compileActionValidationEntries(validations){return Object.entries(validations).map(([field,validation])=>{const rule=validation.rule;if(typeof rule.getRules!=="function"||propertyOwner(rule,"validate")!==propertyOwner(rule,"getRules"))return[field,validation];const rules=rule.getRules();if(!Array.isArray(rules)||rules.some((entry)=>typeof entry?.test!=="function"))return[field,validation];return[field,validation,rules.map((entry)=>entry.test)]})}function validateActionInputSync(req,validations,compiledEntries,mayHaveRouteParams=!0,reuseSuccessResult=!1,requestHasQuery=req.url.includes("?")){let errors;const validated={};let valid=!0;const entries=compiledEntries??Object.entries(validations),input=getRequestInput(req,entries,mayHaveRouteParams,requestHasQuery);for(const[field,validation,ruleTests]of entries){const value=input[field];let result;try{const rule=validation.rule;let passedCompiledRules=!1;if(ruleTests){const empty=value===void 0||value===null||value==="";passedCompiledRules=empty&&rule.isRequired!==!0;if(!empty){passedCompiledRules=!0;for(let i=0;i<ruleTests.length;i++)if(!ruleTests[i](value)){passedCompiledRules=!1;break}}}if(!passedCompiledRules)result=rule.validate(value)}catch{result={valid:!1,errors:[{message:`${field} validation failed`}]}}if(result&&!result.valid){valid=!1;const fieldErrors=[],label=field.replace(/[-_]+/g," ").replace(/([a-z])([A-Z])/g,"$1 $2").replace(/^./,(c)=>c.toUpperCase()),decorate=(msg)=>msg.toLowerCase().startsWith(field.toLowerCase())||msg.includes(label)?msg:`${label} ${msg}`;if(result.errors&&result.errors.length>0)if(validation.message){const firstMessage=result.errors[0]?.message??"";fieldErrors.push(typeof validation.message==="string"?validation.message:validation.message[field]||decorate(firstMessage))}else result.errors.forEach((err)=>fieldErrors.push(decorate(err.message)));else fieldErrors.push(validation.message?typeof validation.message==="string"?validation.message:`${label} is invalid`:`${label} is invalid`);(errors??={})[field]=fieldErrors}else if(value!==void 0)validated[field]=value}if(valid)req._validatedInput=validated;if(valid&&reuseSuccessResult)return VALID_ACTION_VALIDATION_RESULT;return{valid,errors:errors??{}}}export async function validateActionInput(req,validations){return validateActionInputSync(req,validations)}function modelValidationRules(model){if(!model?.attributes||typeof model.attributes!=="object")return;const rules={};for(const[field,attribute]of Object.entries(model.attributes)){const validation=attribute?.validation;if(validation?.rule)rules[field]=validation}return Object.keys(rules).length>0?rules:void 0}function getRequestInput(req,validationEntries,mayHaveRouteParams=!0,requestHasQuery=req.url.includes("?")){let input,mayNeedCoercion=!1;if(requestHasQuery){const q=req.query;if(q)for(const key in q){(input??={})[key]=q[key];mayNeedCoercion=!0}else new URL(req.url).searchParams.forEach((value,key)=>{(input??={})[key]=value;mayNeedCoercion=!0})}let hasRouteParams=!1;if(mayHaveRouteParams&&req.params)for(const key in req.params){if(!Object.hasOwn(req.params,key))continue;(input??={})[key]=req.params[key];hasRouteParams=!0;mayNeedCoercion=!0}if(req.jsonBody&&typeof req.jsonBody==="object")input=mayNeedCoercion?Object.assign(input??{},req.jsonBody):req.jsonBody;else if(req.formBody&&typeof req.formBody==="object"){input=mayNeedCoercion?Object.assign(input??{},req.formBody):{...req.formBody};mayNeedCoercion=!0}if(!requestHasQuery&&!mayHaveRouteParams&&req.jsonBody&&typeof req.jsonBody==="object"&&!Array.isArray(req.jsonBody)&&!req.formBody&&!req.files)req._allInputCache=input;if(req.files&&typeof req.allFiles==="function")try{const files=req.allFiles();for(const key of Object.keys(files??{})){const values=input??={};if(!(key in values))values[key]=files[key]}}catch{}if(!validationEntries)return input??{};input??={};let coerced=!1;if(mayNeedCoercion)for(const[field,validation]of validationEntries){const value=input[field];if(typeof value!=="string")continue;const validatorName=validation.rule?.name;if(validatorName==="number"){const n=Number(value);if(Number.isFinite(n)){input[field]=n;coerced=!0}}else if(validatorName==="boolean"){if(value==="true"||value==="1"){input[field]=!0;coerced=!0}else if(value==="false"||value==="0"){input[field]=!1;coerced=!0}}}if(!coerced&&!req.formBody&&!req.files&&!hasRouteParams)req._allInputCache=input;return input}function formatResult(result,req){if(result instanceof Response)return result;if(result instanceof ReadableStream)return new Response(result,{headers:{"Content-Type":"application/octet-stream"}});if(result!==null&&typeof result==="object"){const linkHeader="data"in result?buildPaginatorLinkHeader(result):null;return formatJsonResult(result,req,linkHeader)}const apiShaped=req._forceJson===!0||isApiRequest(req);if(result===null||result===void 0)return apiShaped?new Response(null,{status:204}):new Response("",{status:200});if(apiShaped){if(typeof result==="string"||typeof result==="number"||typeof result==="boolean")return formatJsonResult(result,req);return Response.json(result)}return new Response(String(result),{headers:{"Content-Type":"text/plain; charset=utf-8"}})}function formatJsonResult(result,req,linkHeader){const canPreapplyMetadata=!req._responseHeaders,body=JSON.stringify(result)??"",bodyLength=Buffer.byteLength(body),requestMarkers=req,csrf=requestMarkers[CSRF_SEEDED_BY_HANDLE_REQUEST]!==!0&&typeof requestMarkers[CSRF_SECURE_TRANSPORT]==="boolean"?loadCsrfModule():null,csrfCookie=canPreapplyMetadata&&csrf&&!(csrf instanceof Promise)&&typeof csrf.createCsrfCookie==="function"?csrf.createCsrfCookie(req,req._csrfToken):void 0,response=canPreapplyMetadata?secureSerializedJsonResponse(body,bodyLength,req._requestId,csrfCookie):new Response(body,{headers:createJsonSecurityHeaders()});if(!canPreapplyMetadata)response.headers.set("Content-Length",String(bodyLength));if(linkHeader)response.headers.set("Link",linkHeader);if(canPreapplyMetadata){const frameworkResponse=response;frameworkResponse[FRAMEWORK_RESPONSE_METADATA_APPLIED]=!0;frameworkResponse[FRAMEWORK_RESPONSE_BODY_LENGTH]=bodyLength}if(csrfCookie)requestMarkers[CSRF_SEEDED_BY_HANDLE_REQUEST]=!0;return response}function buildPaginatorLinkHeader(value){if(!isPaginator(value)&&!isSimplePaginator(value)&&!isCursorPaginator(value))return null;const v=value,parts=[];if(v.prev_page_url)parts.push(`<${v.prev_page_url}>; rel="prev"`);if(v.next_page_url)parts.push(`<${v.next_page_url}>; rel="next"`);if(v.first_page_url)parts.push(`<${v.first_page_url}>; rel="first"`);if(v.last_page_url)parts.push(`<${v.last_page_url}>; rel="last"`);return parts.length>0?parts.join(", "):null}export function stream(source,options={}){const baseHeaders={};if(options.type==="sse"){baseHeaders["Content-Type"]="text/event-stream; charset=utf-8";baseHeaders["Cache-Control"]="no-cache";baseHeaders.Connection="keep-alive"}else if(options.type==="ndjson")baseHeaders["Content-Type"]="application/x-ndjson; charset=utf-8";else baseHeaders["Content-Type"]=options.contentType??"application/octet-stream";const body=source instanceof ReadableStream?source:new ReadableStream({async start(controller){try{for await(const chunk of source)controller.enqueue(typeof chunk==="string"?new TextEncoder().encode(chunk):chunk);controller.close()}catch(err){controller.error(err)}}}),merged=new Headers(baseHeaders);if(options.headers)new Headers(options.headers).forEach((value,key)=>merged.set(key,value));return new Response(body,{status:options.status??200,headers:merged})}function getAllInputFor(req){const cached=req._allInputCache;if(cached)return cached;const input={},query=req.query;if(query)for(const key in query)input[key]=query[key];if(req.jsonBody&&typeof req.jsonBody==="object")Object.assign(input,req.jsonBody);if(req.formBody&&typeof req.formBody==="object")Object.assign(input,req.formBody);if(req.params&&typeof req.params==="object")Object.assign(input,req.params);req._allInputCache=input;return input}function flashInputFor(req,keys){const input=getAllInputFor(req);req._oldInput=keys?Object.fromEntries(keys.filter((key)=>(key in input)).map((key)=>[key,input[key]])):{...input}}const nativeRequestText=Request.prototype.text,nativeRequestJson=Request.prototype.json,nativeRequestBytes=Request.prototype.bytes,nativeRequestArrayBuffer=Request.prototype.arrayBuffer,nativeRequestBlob=Request.prototype.blob,nativeRequestClone=Request.prototype.clone,requestBodyEncoder=new TextEncoder,REQUEST_METHODS={text(){return this._rawBody===void 0?nativeRequestText.call(this):Promise.resolve(this._rawBody)},json(){if(this._rawBody===void 0)return nativeRequestJson.call(this);try{return Promise.resolve(this._rawBody.length===0?null:JSON.parse(this._rawBody))}catch(error){return Promise.reject(error)}},bytes(){return this._rawBody===void 0?nativeRequestBytes.call(this):Promise.resolve(requestBodyEncoder.encode(this._rawBody))},arrayBuffer(){if(this._rawBody===void 0)return nativeRequestArrayBuffer.call(this);const bytes=requestBodyEncoder.encode(this._rawBody);return Promise.resolve(bytes.buffer.slice(bytes.byteOffset,bytes.byteOffset+bytes.byteLength))},blob(){return this._rawBody===void 0?nativeRequestBlob.call(this):Promise.resolve(new Blob([this._rawBody],{type:this._rawBodyContentType}))},clone(){if(this._rawBody===void 0)return nativeRequestClone.call(this);return new Request(this.url,{method:this.method,headers:this.headers,body:this._rawBody})},get(key,defaultValue){const value=getAllInputFor(this)[key];return value!==void 0?value:defaultValue},input(key,defaultValue){const value=getAllInputFor(this)[key];return value!==void 0?value:defaultValue},all(){return getAllInputFor(this)},only(keys){const input=getAllInputFor(this),result={};for(const key of keys)if(key in input)result[key]=input[key];return result},except(keys){const result={...getAllInputFor(this)};for(const key of keys)delete result[key];return result},has(key){const input=getAllInputFor(this);if(Array.isArray(key))return key.every((k)=>(k in input)&&input[k]!==void 0);return key in input&&input[key]!==void 0},hasAny(keys){const input=getAllInputFor(this);return keys.some((k)=>(k in input)&&input[k]!==void 0)},filled(key){const input=getAllInputFor(this),isFilled=(k)=>{const value=input[k];return value!==void 0&&value!==null&&value!==""&&!(Array.isArray(value)&&value.length===0)};if(Array.isArray(key))return key.every(isFilled);return isFilled(key)},missing(key){const input=getAllInputFor(this);if(Array.isArray(key))return key.every((k)=>!(k in input)||input[k]===void 0);return!(key in input)||input[key]===void 0},merge(data){Object.assign(getAllInputFor(this),data)},keys(){return Object.keys(getAllInputFor(this))},string(key,defaultValue=""){const value=getAllInputFor(this)[key];return value!==void 0&&value!==null?String(value):defaultValue},integer(key,defaultValue=0){const value=getAllInputFor(this)[key];if(value===void 0||value===null||value==="")return defaultValue;if(typeof value==="number")return Number.isFinite(value)?Math.trunc(value):defaultValue;const str=String(value).trim();if(!/^-?\d+$/.test(str))return defaultValue;const parsed=Number.parseInt(str,10);return Number.isFinite(parsed)?parsed:defaultValue},float(key,defaultValue=0){const value=getAllInputFor(this)[key];if(value===void 0||value===null||value==="")return defaultValue;if(typeof value==="number")return Number.isFinite(value)?value:defaultValue;const str=String(value).trim();if(!/^-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?$/.test(str))return defaultValue;const parsed=Number.parseFloat(str);return Number.isFinite(parsed)?parsed:defaultValue},boolean(key,defaultValue=!1){const value=getAllInputFor(this)[key];if(value===void 0||value===null)return defaultValue;if(typeof value==="boolean")return value;if(value==="true"||value==="1"||value===1)return!0;if(value==="false"||value==="0"||value===0)return!1;return defaultValue},array(key){const value=getAllInputFor(this)[key];if(Array.isArray(value))return value;return value!==void 0&&value!==null?[value]:[]},date(key){const value=getAllInputFor(this)[key];if(value===void 0||value===null||value==="")return null;const parsed=new Date(value);return Number.isNaN(parsed.getTime())?null:parsed},enum(key,enumType){const value=getAllInputFor(this)[key];if(value===void 0||value===null)return null;if(Object.values(enumType).includes(value))return value;const enumKey=String(value);return enumKey in enumType?enumType[enumKey]:null},collect(key){const value=getAllInputFor(this)[key];if(Array.isArray(value))return collect(value);return collect(value===void 0||value===null?[]:[value])},whenHas(key,callback,defaultCallback){const input=getAllInputFor(this);if(key in input&&input[key]!==void 0)callback(input[key]);else defaultCallback?.()},whenFilled(key,callback,defaultCallback){const value=getAllInputFor(this)[key];if(value!==void 0&&value!==null&&value!==""&&!(Array.isArray(value)&&value.length===0))callback(value);else defaultCallback?.()},isValue(key,value){return getAllInputFor(this)[key]===value},async validate(rules,messages={}){const selectedRules=rules??this._requestValidationRules;if(!selectedRules||Object.keys(selectedRules).length===0){const input=getAllInputFor(this);this._validatedInput=input;return input}const normalized={};for(const[field,definition]of Object.entries(selectedRules)){if(typeof definition==="string")throw TypeError(`String validation rules are not supported for "${field}". Use schema validators.`);if(definition&&typeof definition==="object"&&"rule"in definition){const message=messages[field];normalized[field]=message?{...definition,message}:definition}else normalized[field]=definition}const{validate}=await import("@stacksjs/validation"),validated=await validate(this,normalized);this._validatedInput=validated;return validated},getValidated(){return this._validatedInput??{}},safe(){const data=this._validatedInput??{};return{all:()=>({...data}),get:(key,defaultValue)=>(key in data)?data[key]:defaultValue,only:(keys)=>Object.fromEntries(keys.filter((key)=>(key in data)).map((key)=>[key,data[key]])),except:(keys)=>Object.fromEntries(Object.entries(data).filter(([key])=>!keys.includes(key)))}},old(key,defaultValue){return this._oldInput?.[key]??defaultValue},flashInput(keys){flashInputFor(this,keys)},flashInputOnly(keys){flashInputFor(this,keys)},flashInputExcept(keys){const input=getAllInputFor(this);this._oldInput=Object.fromEntries(Object.entries(input).filter(([key])=>!keys.includes(key)))},file(key){const file=(this.files||{})[key];if(!file)return null;const rawFile=Array.isArray(file)?file[0]:file;return rawFile?new UploadedFile(rawFile):null},getFiles(key){const file=(this.files||{})[key];if(!file)return[];return(Array.isArray(file)?file:[file]).map((f)=>new UploadedFile(f))},hasFile(key){const files=this.files||{};return key in files&&files[key]!==void 0},allFiles(){const files=this.files||{},result={};for(const[key,value]of Object.entries(files))if(Array.isArray(value))result[key]=value.map((f)=>new UploadedFile(f));else result[key]=new UploadedFile(value);return result},getParams(){return{...this.params}},isEmpty(){return Object.keys(getAllInputFor(this)).length===0},browser(){return this.headers.get("sec-ch-ua")||this.headers.get("user-agent")},ipForRateLimit(){const ip=this.ip;if(typeof ip==="function")return ip.call(this)||null;return typeof ip==="string"&&ip?ip:null},getMethod(){return this.method.toUpperCase()},async user(){return this._authenticatedUser},async userToken(){return this._currentAccessToken},async tokenCan(ability){if(typeof ability!=="string"||ability.length===0)return!1;const token=this._currentAccessToken;if(!token||typeof token!=="object")return!1;const abilities=token.abilities;if(!Array.isArray(abilities))return!1;if(abilities.includes("*"))return!0;return abilities.includes(ability)},async tokenCant(ability){return!await this.tokenCan(ability)},async can(ability,...args){if(typeof ability!=="string"||ability.length===0)return!1;const{Gate}=await import("@stacksjs/auth"),user=this._authenticatedUser??null;return Gate.allows(ability,user,...args)},async cannot(ability,...args){return!await this.can(ability,...args)},async authorize(ability,...args){const{Gate}=await import("@stacksjs/auth"),user=this._authenticatedUser??null;await Gate.authorize(ability,user,...args)}},stacksRequestPrototypes=new WeakMap,STACKS_REQUEST_ENHANCED=Symbol.for("stacks.router.requestEnhanced");function fuseRequestEnhancements(router,initializeRequestIds=!0){const original=router.enhanceRequest.bind(router),combinedPrototypes=new WeakMap;router.enhanceRequest=(request,params={})=>{const basePrototype=Object.getPrototypeOf(request),combined=combinedPrototypes.get(basePrototype);if(combined){const enhanced=request;if(enhanced.params!==params)if("params"in request)Object.defineProperty(enhanced,"params",{value:params,writable:!0,configurable:!0,enumerable:!1});else enhanced.params=params;Object.setPrototypeOf(enhanced,combined);if(initializeRequestIds&&!enhanced._requestId)enhanced._requestId=incomingRequestId(enhanced)??generateRequestId();return enhanced}const enhanced=enhanceRequest(original(request,params),initializeRequestIds);combinedPrototypes.set(basePrototype,Object.getPrototypeOf(enhanced));return enhanced}}let csrfModule,csrfModuleLoad;function loadCsrfModule(){if(csrfModule!==void 0)return csrfModule;csrfModuleLoad??=import(resolveDefaultsPath("app/Middleware/Csrf.ts")).then((mod)=>{csrfModule=mod;return csrfModule}).catch(()=>{csrfModule=null;return null});return csrfModuleLoad}export function clearCsrfModuleCache(){csrfModule=void 0;csrfModuleLoad=void 0}function applyCsrfRenderToken(req,cookieHeader,mod){const token=mod.generateCsrfToken();req._csrfToken=token;try{const merged=cookieHeader?`${cookieHeader}; ${mod.CSRF_COOKIE_NAME}=${token}`:`${mod.CSRF_COOKIE_NAME}=${token}`;req.headers.set("cookie",merged)}catch{}}function requestMayRenderHtml(req){return req.headers.get("accept")?.includes("text/html")===!0||req.headers.get("sec-fetch-dest")==="document"}function seedCsrfTokenForRender(req,cookieHeader=req.headers?.get?.("cookie")??""){if(cookieHeader.includes("X-CSRF-Token=")||cookieHeader.includes("csrf-token="))return;const mod=loadCsrfModule();if(mod===null)return;if(mod instanceof Promise)return mod.then((resolved)=>{if(resolved)applyCsrfRenderToken(req,cookieHeader,resolved)});applyCsrfRenderToken(req,cookieHeader,mod)}export function enhanceRequest(req,initializeRequestId=!0){const routeParams=req.params??{};req.params=routeParams;if(initializeRequestId&&!req._requestId)req._requestId=incomingRequestId(req)??generateRequestId();if(req[STACKS_REQUEST_ENHANCED]===!0)return req;applyRequestEnhancements(req,routeParams);const routerPrototype=Object.getPrototypeOf(req);let stacksPrototype=stacksRequestPrototypes.get(routerPrototype);if(!stacksPrototype){stacksPrototype=Object.assign(Object.create(routerPrototype),REQUEST_METHODS);Object.defineProperty(stacksPrototype,STACKS_REQUEST_ENHANCED,{value:!0});stacksRequestPrototypes.set(routerPrototype,stacksPrototype)}Object.setPrototypeOf(req,stacksPrototype);return req}function incomingRequestId(req){try{const supplied=req.headers?.get?.("x-request-id")?.trim();if(supplied&&/^[\w.:-]{8,200}$/.test(supplied))return supplied}catch{}return}const requestIdPrefix=crypto.randomUUID().replaceAll("-","").slice(0,16),REQUEST_ID_DIGITS="0123456789abcdefghijklmnopqrstuvwxyz",REQUEST_ID_SUFFIX_COUNT=1296,requestIdSuffixes=Array.from({length:REQUEST_ID_SUFFIX_COUNT},(_,value)=>REQUEST_ID_DIGITS[Math.floor(value/36)]+REQUEST_ID_DIGITS[value%36]);let requestIdBlock=0,requestIdSuffix=0,requestIdBlockPrefix=`${requestIdPrefix}-0`;function generateRequestId(){requestIdSuffix++;if(requestIdSuffix===REQUEST_ID_SUFFIX_COUNT){requestIdSuffix=0;requestIdBlockPrefix=`${requestIdPrefix}-${(++requestIdBlock).toString(36)}`}return requestIdBlockPrefix+requestIdSuffixes[requestIdSuffix]}function wrapHandler(handler,skipParsing=!1,handlerKey=""){if(isRouterAction(handler))return wrapAction(handler,handlerKey);if(typeof handler==="string"){const handlerPath=handler;return async(req)=>{try{if(!skipParsing){await parseRequestBody(req);req=enhanceRequest(req)}const pending=resolveStringHandler(handlerPath);return await(pending instanceof Promise?await pending:pending)(req)}catch(error){report(error,{label:`[Router] ${handlerPath}`});const rawStatus=error?.statusCode??error?.status,status=typeof rawStatus==="number"&&Number.isInteger(rawStatus)&&rawStatus>=400&&rawStatus<600?rawStatus:void 0;return await createErrorResponse(error instanceof Error?error:Error(String(error)),req,{handlerPath,status})}}}const fn=handler;return(req)=>{const result=fn(req);if(result instanceof Promise)return result.then((value)=>formatResult(value,req));return formatResult(result,req)}}async function parseRequestBody(req){if(req._bodyParsed)return;req._bodyParsed=!0;const contentType=req.headers.get("content-type")||"";try{if(contentType==="application/json"||JSON_CONTENT_TYPE.test(contentType)){const raw=await req.text();req._rawBody=raw;req._rawBodyContentType=contentType;if(raw.length===0)req.jsonBody={};else try{const body=JSON.parse(raw);req.jsonBody=body&&typeof body==="object"?body:{}}catch(parseErr){const message=parseErr instanceof Error?parseErr.message:"Invalid JSON",{HttpError}=await import("@stacksjs/error-handling");throw new HttpError(400,`Invalid JSON body: ${message}`)}}else if(contentType.includes("application/x-www-form-urlencoded")){const text=await req.clone().text(),params=new URLSearchParams(text),formBody={};params.forEach((value,key)=>{formBody[key]=value});req.formBody=formBody}else if(contentType.includes("multipart/form-data")){const formData=await req.clone().formData(),formBody={},files={};formData.forEach((value,key)=>{if(value instanceof File)if(files[key])if(Array.isArray(files[key]))files[key].push(value);else files[key]=[files[key],value];else files[key]=value;else formBody[key]=value});Reflect.set(req,"formBody",formBody);Reflect.set(req,"files",files)}}catch(e){if(typeof(e?.status??e?.statusCode)==="number")throw e;log.debug("[stacks-router] Body parsing failed:",e)}}export function createStacksRouter(config={}){const bunRouter=new Router({verbose:config.verbose??!1}),csrfEnabled=config.csrf!==!1;if(csrfEnabled)csrfEnabledNativeRouteRouters.add(bunRouter);fuseRequestEnhancements(bunRouter,config.requestIds!==!1);let currentPrefix="",currentGroupMiddleware=[],currentGroupApiResponse=!1;const registeredRouteKeys=new Set;function registerRoute(method,path,_handler){const fullPath=currentPrefix+path,routeKey=`${method}:${fullPath}`;log.debug(`[router] ${method} ${fullPath} \u2192 ${typeof _handler==="string"?_handler:"function"}`);const shadowed=registeredRouteKeys.has(routeKey);if(!shadowed)registeredRouteKeys.add(routeKey);if(!shadowed)routeMiddlewareRegistry.set(routeKey,[...currentGroupMiddleware]);if(!shadowed)routeCsrfRegistry.set(routeKey,{mode:CSRF_DEFAULT});if(!shadowed)routeRateLimitRegistry.set(routeKey,{});if(!shadowed&&currentGroupApiResponse)routeApiResponseRegistry.add(routeKey);if(!shadowed&&typeof _handler==="string")routeHandlerKeyRegistry.set(routeKey,_handler);if(!shadowed&&isRouterAction(_handler))routeActionRegistry.set(routeKey,_handler);return{fullPath,routeKey,shadowed}}const stacksRouter={bunRouter,get routes(){return bunRouter.routes},get(path,handler){const{fullPath,routeKey,shadowed}=registerRoute("GET",path,handler);bunRouter.get(fullPath,createMiddlewareHandler(routeKey,handler,csrfEnabled));return createChainableRoute(routeKey,shadowed)},post(path,handler){const{fullPath,routeKey,shadowed}=registerRoute("POST",path,handler);bunRouter.post(fullPath,createMiddlewareHandler(routeKey,handler,csrfEnabled));return createChainableRoute(routeKey,shadowed)},put(path,handler){const{fullPath,routeKey,shadowed}=registerRoute("PUT",path,handler);bunRouter.put(fullPath,createMiddlewareHandler(routeKey,handler,csrfEnabled));return createChainableRoute(routeKey,shadowed)},patch(path,handler){const{fullPath,routeKey,shadowed}=registerRoute("PATCH",path,handler);bunRouter.patch(fullPath,createMiddlewareHandler(routeKey,handler,csrfEnabled));return createChainableRoute(routeKey,shadowed)},delete(path,handler){const{fullPath,routeKey,shadowed}=registerRoute("DELETE",path,handler);bunRouter.delete(fullPath,createMiddlewareHandler(routeKey,handler,csrfEnabled));return createChainableRoute(routeKey,shadowed)},options(path,handler){const{fullPath,routeKey,shadowed}=registerRoute("OPTIONS",path,handler);bunRouter.options(fullPath,createMiddlewareHandler(routeKey,handler,csrfEnabled));return createChainableRoute(routeKey,shadowed)},group(options,callback){const previousPrefix=currentPrefix,previousMiddleware=[...currentGroupMiddleware],previousApiResponse=currentGroupApiResponse;if(options.prefix)currentPrefix=previousPrefix+options.prefix;const middlewareList=options.middleware?Array.isArray(options.middleware)?options.middleware:[options.middleware]:void 0;if(middlewareList)currentGroupMiddleware=[...currentGroupMiddleware,...middlewareList];if(options.apiResponse===!0)currentGroupApiResponse=!0;log.debug(`[router] Entering group: prefix=${options.prefix||"/"} middleware=[${middlewareList?.join(", ")||""}]${currentGroupApiResponse?" apiResponse=true":""}`);const result=callback();if(result instanceof Promise)return result.then(()=>{currentPrefix=previousPrefix;currentGroupMiddleware=previousMiddleware;currentGroupApiResponse=previousApiResponse;return stacksRouter}).catch((err)=>{currentPrefix=previousPrefix;currentGroupMiddleware=previousMiddleware;currentGroupApiResponse=previousApiResponse;throw err});currentPrefix=previousPrefix;currentGroupMiddleware=previousMiddleware;currentGroupApiResponse=previousApiResponse;return stacksRouter},resource(name,handler,options){const actions=["index","store","show","update","destroy"],activeActions=options?.only?actions.filter((a)=>options.only.includes(a)):options?.except?actions.filter((a)=>!options.except.includes(a)):actions,stripped=handler.replace(/Action$/,""),handlerBase=stripped.startsWith("Actions/")?stripped:`Actions/${stripped}`;log.debug(`[router] Resource: /${name} \u2192 ${handlerBase}*Action [${activeActions.join(", ")}]`);const sibling=(suffix)=>`${handlerBase}${suffix}`,registerResourceRoutes=()=>{for(const action of activeActions)switch(action){case"index":stacksRouter.get(`/${name}`,sibling("IndexAction"));break;case"store":stacksRouter.post(`/${name}`,sibling("StoreAction"));break;case"show":stacksRouter.get(`/${name}/:id`,sibling("ShowAction"));break;case"update":stacksRouter.put(`/${name}/:id`,sibling("UpdateAction"));break;case"destroy":stacksRouter.delete(`/${name}/:id`,sibling("DestroyAction"));break}};if(options?.middleware)stacksRouter.group({middleware:options.middleware},registerResourceRoutes);else registerResourceRoutes();return stacksRouter},match(methods,path,handler){log.debug(`[router] Match: [${methods.join(", ")}] ${path} \u2192 ${typeof handler==="string"?handler:"function"}`);let firstShadowed=!1;for(const[index,method]of methods.entries()){const m=method.toUpperCase(),{fullPath,routeKey,shadowed}=registerRoute(m,path,handler);if(index===0)firstShadowed=shadowed;const wrappedHandler=createMiddlewareHandler(routeKey,handler,csrfEnabled);switch(m){case"GET":bunRouter.get(fullPath,wrappedHandler);break;case"POST":bunRouter.post(fullPath,wrappedHandler);break;case"PUT":bunRouter.put(fullPath,wrappedHandler);break;case"PATCH":bunRouter.patch(fullPath,wrappedHandler);break;case"DELETE":bunRouter.delete(fullPath,wrappedHandler);break;case"OPTIONS":bunRouter.options(fullPath,wrappedHandler);break}}return createChainableRoute(`${methods[0]}:${currentPrefix}${path}`,firstShadowed)},health(){bunRouter.get("/api/health",async()=>{const health=await checkApplicationHealth();return Response.json(health,{status:health.status==="healthy"?200:503})});bunRouter.get("/__routes",(req)=>{if(!isExposeRoutesAuthorized(req))return Response.json({error:"disabled"},{status:404});return Response.json(listRegisteredRoutes())});bunRouter.get("/__storage/:path",async(req)=>{const url=new URL(req.url),token=url.searchParams.get("token"),params=req.params,rawPath=params?.path?decodeURIComponent(params.path):decodeURIComponent(url.pathname.replace(/^\/__storage\//,""));if(!token||typeof rawPath!=="string"||rawPath.length===0)return new Response("Forbidden",{status:403});const{verifySignedStorageToken,Storage}=await import("@stacksjs/storage");if(!verifySignedStorageToken(token,rawPath).valid)return new Response("Forbidden",{status:403});try{const adapter=Storage.disk();if(!await adapter.fileExists(rawPath))return new Response("Not Found",{status:404});const buf=await adapter.readToBuffer(rawPath),mime=await adapter.mimeType(rawPath).catch(()=>"application/octet-stream");return new Response(buf,{status:200,headers:{"Content-Type":mime,"Cache-Control":"private, max-age=60","X-Content-Type-Options":"nosniff"}})}catch(err){log.error("[storage] signed-url fetch failed:",err);return new Response("Internal Error",{status:500})}});bunRouter.get("/__openapi.json",async(req)=>{if(!isExposeRoutesAuthorized(req))return Response.json({error:"disabled"},{status:404});try{const{generateOpenApi}=await import("@stacksjs/api"),spec=await generateOpenApi({write:!1,portable:!1});return Response.json(spec)}catch(err){return Response.json({error:"OpenAPI generation failed",message:err instanceof Error?err.message:String(err)},{status:500})}});return stacksRouter},use(middleware){const adapted=adaptMiddlewareForBunRouter(middleware);bunRouter.globalMiddleware.push(adapted);return stacksRouter},booting(name,run){bootHooks.push({name,run});return stacksRouter},async serve(options={}){warnOnMultipleRouterInstances();configureViewDirectories(bunRouter);if(csrfEnabled)wrapHandleRequestForCsrf(bunRouter);await wrapHandleRequestForDatabaseContext(bunRouter);await runBootHooks();const production=(process.env.APP_ENV??"").toLowerCase()==="production"||process.env.NODE_ENV==="production",callerSuppliedRoutes=Object.prototype.hasOwnProperty.call(options,"routes"),nativeRoutes=options.nativeRoutes??(production&&!callerSuppliedRoutes&&shouldUseNativeRoutesByDefault(bunRouter.routes));if(options.tls)secureNativeRouteRouters.add(bunRouter);else secureNativeRouteRouters.delete(bunRouter);return bunRouter.serve(nativeRoutes===options.nativeRoutes?options:{...options,nativeRoutes})},handleRequest(req){return bunRouter.handleRequest(req)},getAllowedMethods(pathname,domain){return bunRouter.getAllowedMethods(pathname,domain)},async register(routePath,options){log.debug(`[router] Register: ${routePath} prefix=${options?.prefix||"none"}`);const callback=async()=>{await import(routePath)};if(options?.prefix||options?.middleware)await stacksRouter.group({prefix:options.prefix,middleware:options.middleware},callback);else await callback();return stacksRouter},async importRoutes(){log.debug("[router] Loading user routes from registry...");try{const{loadRoutes}=await import("./route-loader"),{appPath}=await import("@stacksjs/path"),routeRegistry=(await import(appPath("Routes.ts"))).default;await loadRoutes(routeRegistry)}catch(error){log.error("Failed to load route registry:",error);throw error}log.debug("[router] Loading ORM routes...");const ormRoutesPackage="@stacksjs/orm/routes";let ormRoutesLoaded=!1;try{await import(ormRoutesPackage);ormRoutesLoaded=!0;log.debug(`[router] ORM routes loaded from ${ormRoutesPackage}`)}catch(error){log.debug(`[router] ORM routes not available from the package, trying the vendored copy
 `,error)}const ormRoutesCandidates=ormRoutesLoaded?[]:[p.frameworkPath("orm/routes.ts"),p.frameworkPath("core/orm/routes.ts")];for(const candidate of ormRoutesCandidates)try{if(await Bun.file(candidate).exists()){await import(candidate);ormRoutesLoaded=!0;log.info(`[router] ORM routes loaded from the vendored copy at ${candidate}. This file is not refreshed by upgrading @stacksjs/orm - delete it to use the package.`);break}}catch(error){log.warn(`[router] ORM routes candidate failed to load, falling back to next: ${candidate}
-`,error)}if(!ormRoutesLoaded)log.warn("[router] No ORM routes candidate loaded - model useApi endpoints are unavailable.");log.debug("[router] Loading discovered package routes...");try{await stacksRouter.loadDiscoveredRoutes()}catch(error){log.debug("Package route discovery skipped:",error)}await assertRouteMiddlewareResolvable()},async loadDiscoveredRoutes(){try{const manifestPath=p.storagePath("framework/discovered-packages.json"),file=Bun.file(manifestPath);if(!await file.exists())return;const packages=(await file.json())?.packages;if(!packages)return;for(const[pkgName,meta]of Object.entries(packages)){const routes=meta?.routes;if(!routes)continue;const routeList=Array.isArray(routes)?routes:[routes],pkgDir=meta?.root?p.projectPath(meta.root):`${p.projectPath("pantry")}/${pkgName}`;for(const routeFile of routeList){log.debug(`[router] Discovered route: ${pkgName} \u2192 ${routeFile}`);const fullPath=routeFile.startsWith("/")?routeFile:`${pkgDir}/${routeFile}`,prefix=meta?.routePrefix,middleware=meta?.routeMiddleware;try{await stacksRouter.register(fullPath,{prefix,middleware})}catch(err){log.warn(`Failed to load routes from package '${pkgName}': ${err}`)}}}}catch{}}};return stacksRouter}function wrapHandleRequestForCsrf(bunRouter){const router=bunRouter;if(router._csrfSeedingWrapped)return;const original=router.handleRequest.bind(router);router.handleRequest=async(request)=>{const method=request.method?.toUpperCase?.()??"GET",safe=method==="GET"||method==="HEAD"||method==="OPTIONS";if(safe){const seeding=seedCsrfTokenForRender(request);if(seeding)await seeding;request[CSRF_SEEDED_BY_HANDLE_REQUEST]=!0}const response=await original(request);if(!safe||!response)return response;try{const mod=loadCsrfModule(),csrf=mod instanceof Promise?await mod:mod;if(!csrf)return response;return csrf.seedCsrfCookieIfMissing(request,response,request._csrfToken)}catch(err){log.warn("[router] CSRF cookie seeding failed on the view path",{error:err});return response}};router._csrfSeedingWrapped=!0}export function configureViewDirectories(bunRouter){const router=bunRouter;if(typeof router.views!=="function")return;const existing=router._fileRoutingConfig;if(existing&&Object.keys(existing).length>0)return;if(!existsSync(p.projectPath("resources/views")))return;const layouts=[p.projectPath("resources/views/layouts"),p.projectPath("resources/layouts")].find(existsSync),partials=[p.projectPath("resources/views/partials"),p.projectPath("resources/partials")].find(existsSync),components=[p.projectPath("resources/components"),p.projectPath("resources/views/components")].find(existsSync);router.views({...components?{componentsDir:components}:{},...layouts?{layoutsDir:layouts}:{},...partials?{partialsDir:partials}:{}})}export function disableViewRouting(bunRouter){const router=bunRouter;if(typeof router.disableFileRouting!=="function")return!1;const existing=router._fileRoutingConfig;if(existing&&Object.keys(existing).length>0)return!1;router.disableFileRouting();return!0}const ROUTE_SINGLETON_KEY=Symbol.for("@stacksjs/router:route-singleton");export const route=globalThis[ROUTE_SINGLETON_KEY]??=createStacksRouter();let routesLoadPromise=null,routingContextRunner=null;const databaseContextWrappedRouters=new WeakSet;async function wrapHandleRequestForDatabaseContext(router){if(databaseContextWrappedRouters.has(router))return;const runInRoutingContext=await getRoutingContextRunner();if(databaseContextWrappedRouters.has(router))return;const original=router.handleRequest.bind(router);router.handleRequest=(request)=>runInRoutingContext(()=>original(request));databaseContextWrappedRouters.add(router)}async function getRoutingContextRunner(){if(!routingContextRunner)try{const{withRoutingContext}=await import("@stacksjs/database");routingContextRunner=typeof withRoutingContext==="function"?withRoutingContext:(fn)=>fn()}catch{routingContextRunner=(fn)=>fn()}return routingContextRunner}export async function serverResponse(request,_body){return(await getRoutingContextRunner())(()=>handleServerRequest(request))}async function handleServerRequest(request){if(!routesLoadPromise){log.debug("[router] Loading routes for first time...");routesLoadPromise=route.importRoutes().catch((err)=>{routesLoadPromise=null;throw err})}await routesLoadPromise;const response=await route.handleRequest(request);if(response.status===404&&response.headers.get("content-type")?.includes("json"))try{const body=await response.clone().json();if(body?.message==="Not Found"||body?.error==="Not Found"){const url=new URL(request.url),enriched={...body,path:url.pathname,method:request.method};return new Response(JSON.stringify(enriched),{status:404,headers:response.headers})}}catch{}return response}export async function serve(options={}){return route.serve(options)}
+`,error)}if(!ormRoutesLoaded)log.warn("[router] No ORM routes candidate loaded - model useApi endpoints are unavailable.");log.debug("[router] Loading discovered package routes...");try{await stacksRouter.loadDiscoveredRoutes()}catch(error){log.debug("Package route discovery skipped:",error)}await assertRouteMiddlewareResolvable()},async loadDiscoveredRoutes(){try{const manifestPath=p.storagePath("framework/discovered-packages.json"),file=Bun.file(manifestPath);if(!await file.exists())return;const packages=(await file.json())?.packages;if(!packages)return;for(const[pkgName,meta]of Object.entries(packages)){const routes=meta?.routes;if(!routes)continue;const routeList=Array.isArray(routes)?routes:[routes],pkgDir=meta?.root?p.projectPath(meta.root):`${p.projectPath("pantry")}/${pkgName}`;for(const routeFile of routeList){log.debug(`[router] Discovered route: ${pkgName} \u2192 ${routeFile}`);const fullPath=routeFile.startsWith("/")?routeFile:`${pkgDir}/${routeFile}`,prefix=meta?.routePrefix,middleware=meta?.routeMiddleware;try{await stacksRouter.register(fullPath,{prefix,middleware})}catch(err){log.warn(`Failed to load routes from package '${pkgName}': ${err}`)}}}}catch{}}};return stacksRouter}function wrapHandleRequestForCsrf(bunRouter){const router=bunRouter;if(router._csrfSeedingWrapped)return;const original=router.handleRequest.bind(router),handleUnseededSafeRequest=async(request,rendersCsrf,cookieHeader)=>{if(rendersCsrf&&requestMayRenderHtml(request)){const seeding=seedCsrfTokenForRender(request,cookieHeader);if(seeding)await seeding}request[CSRF_SEEDED_BY_HANDLE_REQUEST]=!0;const response=await original(request);if(!response)return response;try{const mod=loadCsrfModule(),csrf=mod instanceof Promise?await mod:mod;if(!csrf)return response;return csrf.seedCsrfCookieIfMissing(request,response,request._csrfToken)}catch(err){log.warn("[router] CSRF cookie seeding failed on the view path",{error:err});return response}},handleSafeRequest=(request,rendersCsrf)=>{const cookieHeader=request.headers.get("cookie")??"";if(cookieHeader.includes("X-CSRF-Token=")||cookieHeader.includes("csrf-token=")){request[CSRF_SEEDED_BY_HANDLE_REQUEST]=!0;return original(request)}return handleUnseededSafeRequest(request,rendersCsrf,cookieHeader)};router.handleRequest=(request)=>{const method=request.method;if(method==="GET"||method==="HEAD")return handleSafeRequest(request,!0);if(method==="OPTIONS")return handleSafeRequest(request,!1);return original(request)};router._csrfSeedingWrapped=!0}export function configureViewDirectories(bunRouter){const router=bunRouter;if(typeof router.views!=="function")return;const existing=router._fileRoutingConfig;if(existing&&Object.keys(existing).length>0)return;if(!existsSync(p.projectPath("resources/views")))return;const layouts=[p.projectPath("resources/views/layouts"),p.projectPath("resources/layouts")].find(existsSync),partials=[p.projectPath("resources/views/partials"),p.projectPath("resources/partials")].find(existsSync),components=[p.projectPath("resources/components"),p.projectPath("resources/views/components")].find(existsSync);router.views({...components?{componentsDir:components}:{},...layouts?{layoutsDir:layouts}:{},...partials?{partialsDir:partials}:{}})}export function disableViewRouting(bunRouter){const router=bunRouter;if(typeof router.disableFileRouting!=="function")return!1;const existing=router._fileRoutingConfig;if(existing&&Object.keys(existing).length>0)return!1;router.disableFileRouting();return!0}const ROUTE_SINGLETON_KEY=Symbol.for("@stacksjs/router:route-singleton");export const route=globalThis[ROUTE_SINGLETON_KEY]??=createStacksRouter();let routesLoadPromise=null,routingContextDispatcher=null;const databaseContextWrappedRouters=new WeakSet;function applyDirectNativeCookies(router,response,request){const cookieChanges=request;return cookieChanges._cookiesToSet?.length||cookieChanges._cookiesToDelete?.length?router.applyModifiedCookies(response,request):response}function nativeRouteErrorResponse(error){return new Response(JSON.stringify({success:!1,message:"Internal Server Error",error:error instanceof Error?error.message:String(error)}),{status:500,headers:{"Content-Type":"application/json","Access-Control-Allow-Origin":"*","Access-Control-Allow-Methods":"GET, POST, PUT, DELETE, PATCH, OPTIONS","Access-Control-Allow-Headers":"Content-Type, Authorization, X-Requested-With, Accept, Origin"}})}function handleDirectNativeRouteError(router,error){console.error("Error handling request:",error);return router.errorHandler?router.errorHandler(error instanceof Error?error:Error(String(error))):nativeRouteErrorResponse(error)}function directNativePath(path){const segments=path.split("/");for(let index=0;index<segments.length;index++){const segment=segments[index];if(!segment)continue;const parameter=segment.match(/^\{([A-Z_$][\w$]*)\}$/i);if(parameter){segments[index]=`:${parameter[1]}`;continue}if(segment.includes("{")||segment.includes(":")||segment.includes("*"))return}return segments.join("/")}function buildDirectNativeHandlers(router,finalizeResponse){const nativeRouter=router,handlers=new Map;if(nativeRouter.globalMiddleware.length!==0)return handlers;for(const route of nativeRouter.routes){if(!NATIVE_ROUTE_METHODS.has(route.method)||route.nativeDispatch===!1||route.constraints&&Object.keys(route.constraints).length>0||(route.middleware?.length??0)!==0||typeof route.handler!=="function"||!stacksRouteHandlers.has(route.handler))continue;const handler=route.handler,nativePath=directNativePath(route.path);if(!nativePath)continue;const key=`${route.method}:${nativePath}`;if(handlers.has(key))continue;handlers.set(key,(request)=>{const nativeParams=request.params??{},enhancedRequest=nativeRouter.enhanceRequest(request,nativeParams);enhancedRequest.route=route;return runWithBunRouterRequest(enhancedRequest,()=>{try{const response=handler(enhancedRequest);return response instanceof Response?finalizeResponse(applyDirectNativeCookies(nativeRouter,response,enhancedRequest),request):response.then((result)=>finalizeResponse(applyDirectNativeCookies(nativeRouter,result,enhancedRequest),request),(error)=>{const result=handleDirectNativeRouteError(nativeRouter,error);return result instanceof Response?finalizeResponse(result,request):result.then((response)=>finalizeResponse(response,request))})}catch(error){const result=handleDirectNativeRouteError(nativeRouter,error);return result instanceof Response?finalizeResponse(result,request):result.then((response)=>finalizeResponse(response,request))}})})}return handlers}function wrapNativeRoutesForDatabaseContext(router,dispatchInRoutingContext){const nativeRouter=router;if(nativeRouter._nativeDatabaseContextWrapped||typeof nativeRouter._buildNativeRoutes!=="function")return;const buildNativeRoutes=nativeRouter._buildNativeRoutes.bind(nativeRouter);nativeRouter._buildNativeRoutes=()=>{const routes=buildNativeRoutes();if(!routes)return routes;const compression=nativeRouter.config.compression,compressionDisabled=compression?.enabled===!1,compressionThreshold=compression?.threshold??1024,finalizeResponse=(response,request)=>{const bodyLength=response[FRAMEWORK_RESPONSE_BODY_LENGTH];if(compressionDisabled||typeof bodyLength==="number"&&bodyLength<compressionThreshold)return response;if(bodyLength===void 0){const declaredLength=response.headers.get("content-length");if(declaredLength!==null){const length=Number(declaredLength);if(Number.isSafeInteger(length)&&length>=0&&length<compressionThreshold)return response}}return applyResponseCompression(response,request,compression)},directHandlers=buildDirectNativeHandlers(router,finalizeResponse),secureTransport=secureNativeRouteRouters.has(router),csrfEnabled=csrfEnabledNativeRouteRouters.has(router);for(const[path,methods]of Object.entries(routes))for(const[method,handler]of Object.entries(methods)){const safeMethod=method==="GET"||method==="HEAD"||method==="OPTIONS",directDispatch=directHandlers.get(`${method}:${path}`)??(method==="HEAD"?directHandlers.get(`GET:${path}`):void 0),dispatch=directDispatch??handler;methods[method]=(request)=>{if(safeMethod&&csrfEnabled){const cookie=request.headers.get("cookie")??"",markedRequest=request;if(cookie.includes("X-CSRF-Token=")||cookie.includes("csrf-token="))markedRequest[CSRF_SEEDED_BY_HANDLE_REQUEST]=!0;else markedRequest[CSRF_SECURE_TRANSPORT]=secureTransport}const response=dispatchInRoutingContext(dispatch,request);if(directDispatch)return response;return response instanceof Response?finalizeResponse(response,request):response.then((resolved)=>finalizeResponse(resolved,request))}}return routes};nativeRouter._nativeDatabaseContextWrapped=!0}async function wrapHandleRequestForDatabaseContext(router){if(databaseContextWrappedRouters.has(router))return;const dispatchInRoutingContext=await getRoutingContextDispatcher();if(databaseContextWrappedRouters.has(router))return;wrapNativeRoutesForDatabaseContext(router,dispatchInRoutingContext);const original=router.handleRequest.bind(router);router.handleRequest=(request)=>dispatchInRoutingContext(original,request);databaseContextWrappedRouters.add(router)}async function getRoutingContextDispatcher(){if(!routingContextDispatcher)try{const database=await import("@stacksjs/database"),dispatcher=database.runInDatabaseRoutingContext,runner=database.withDatabaseRoutingContext??database.withRoutingContext;routingContextDispatcher=typeof dispatcher==="function"?dispatcher:typeof runner==="function"?(fn,arg)=>runner(()=>fn(arg)):(fn,arg)=>fn(arg)}catch{routingContextDispatcher=(fn,arg)=>fn(arg)}return routingContextDispatcher}export async function serverResponse(request,_body){return(await getRoutingContextDispatcher())(handleServerRequest,request)}async function handleServerRequest(request){if(!routesLoadPromise){log.debug("[router] Loading routes for first time...");routesLoadPromise=route.importRoutes().catch((err)=>{routesLoadPromise=null;throw err})}await routesLoadPromise;const response=await route.handleRequest(request);if(response.status===404&&response.headers.get("content-type")?.includes("json"))try{const body=await response.clone().json();if(body?.message==="Not Found"||body?.error==="Not Found"){const url=new URL(request.url),enriched={...body,path:url.pathname,method:request.method};return new Response(JSON.stringify(enriched),{status:404,headers:response.headers})}}catch{}return response}export async function serve(options={}){return route.serve(options)}

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/router",
   "type": "module",
   "sideEffects": false,
-  "version": "0.74.26",
+  "version": "0.74.28",
   "description": "The Stacks framework router.",
   "author": "Chris Breuer",
   "contributors": [
@@ -61,27 +61,27 @@
   },
   "dependencies": {
     "@stacksjs/bun-router": "^0.1.11",
-    "@stacksjs/cache": "0.74.26",
-    "@stacksjs/collections": "0.74.26",
-    "@stacksjs/config": "0.74.26",
-    "@stacksjs/error-handling": "0.74.26",
-    "@stacksjs/logging": "0.74.26",
-    "@stacksjs/pagination": "0.74.26",
-    "@stacksjs/path": "0.74.26",
-    "@stacksjs/security": "0.74.26",
-    "@stacksjs/storage": "0.74.26",
+    "@stacksjs/cache": "0.74.28",
+    "@stacksjs/collections": "0.74.28",
+    "@stacksjs/config": "0.74.28",
+    "@stacksjs/error-handling": "0.74.28",
+    "@stacksjs/logging": "0.74.28",
+    "@stacksjs/pagination": "0.74.28",
+    "@stacksjs/path": "0.74.28",
+    "@stacksjs/security": "0.74.28",
+    "@stacksjs/storage": "0.74.28",
     "ts-rate-limiter": "^0.4.2"
   },
   "devDependencies": {
-    "@stacksjs/actions": "0.74.26",
-    "@stacksjs/types": "0.74.26",
+    "@stacksjs/actions": "0.74.28",
+    "@stacksjs/types": "0.74.28",
     "better-dx": "^0.2.24"
   },
   "peerDependencies": {
-    "@stacksjs/api": "0.74.26",
-    "@stacksjs/auth": "0.74.26",
-    "@stacksjs/database": "0.74.26",
-    "@stacksjs/validation": "0.74.26"
+    "@stacksjs/api": "0.74.28",
+    "@stacksjs/auth": "0.74.28",
+    "@stacksjs/database": "0.74.28",
+    "@stacksjs/validation": "0.74.28"
   },
   "peerDependenciesMeta": {
     "@stacksjs/api": {