@stacksjs/router 0.75.233 → 0.75.236

package/README.md

@@ -76,6 +76,28 @@ For casual chit-chat with others using this package:
 
 [Join the Stacks Discord Server](https://stacksjs.com/discord)
 
+## Bounded JSON protocols
+
+Routes that own their wire body can opt into rejecting duplicate object keys:
+
+```ts
+import { readJsonBody } from '@stacksjs/router/body'
+
+const input = await readJsonBody(request, 8192, { rejectDuplicateKeys: true })
+```
+
+Keep automatic body parsing disabled for this route. The reader checks the media
+type, counts streamed bytes and validates UTF-8 before parsing. Duplicate keys at
+any depth, including equivalent escaped spellings, produce `RequestBodyError`
+with status400. The default retains normal `JSON.parse` behavior for existing
+callers. Identical names in different objects remain valid, and Unicode keys are
+compared after escape decoding without Unicode normalization.
+
+`parseJsonText(text, options)` is also exported from `@stacksjs/router` and
+`@stacksjs/router/json` for already-decoded JSON. It throws `SyntaxError` for
+invalid JSON or a duplicate key in strict mode. This helper does not read a
+request, limit bytes, authenticate a caller or validate an application schema.
+
 ## 📄 License
 
 The MIT License (MIT). Please see [LICENSE](https://github.com/stacksjs/stacks/tree/main/LICENSE.md) for more information.

package/dist/body.d.ts

@@ -1,4 +1,5 @@
-export declare function readJsonBody(request: Request, maxBytes?: unknown): Promise<unknown>;
+import type { JsonParseOptions } from './json';
+export declare function readJsonBody(request: Request, maxBytes?: unknown, options?: JsonParseOptions): Promise<unknown>;
 /** Bounded UTF-8 for form and text protocols, counted from actual streamed bytes. */
 export declare function readTextBody(request: Request, maxBytes?: unknown): Promise<string>;
 /** Bounded body reads for protocol handlers that need the original wire body. */

package/dist/body.js

@@ -1 +1 @@
-export class RequestBodyError extends Error{status;constructor(message,status){super(message);this.status=status;this.name="RequestBodyError"}}export async function readJsonBody(request,maxBytes=1048576){if(!Number.isSafeInteger(maxBytes)||maxBytes<1)throw RangeError("maxBytes must be a positive safe integer");if(request.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase()!=="application/json")throw new RequestBodyError("Content-Type must be application/json",415);const text=await readTextBody(request,maxBytes);try{return JSON.parse(text)}catch{throw new RequestBodyError("Send valid UTF-8 JSON",400)}}export async function readTextBody(request,maxBytes=1048576){if(!Number.isSafeInteger(maxBytes)||maxBytes<1)throw RangeError("maxBytes must be a positive safe integer");const declared=request.headers.get("content-length");if(declared&&(!/^\d+$/.test(declared)||Number(declared)>maxBytes))throw new RequestBodyError("Request body is too large",413);if(!request.body)throw new RequestBodyError("Send a request body",400);const reader=request.body.getReader();let bytes=new Uint8Array(Math.min(maxBytes,8192)),size=0;try{while(!0){const{done,value}=await reader.read();if(done)break;const offset=size;size+=value.byteLength;if(size>maxBytes){reader.cancel().catch(()=>{});throw new RequestBodyError("Request body is too large",413)}if(size>bytes.length){const grown=new Uint8Array(Math.min(maxBytes,Math.max(size,bytes.length*2)));grown.set(bytes);bytes=grown}bytes.set(value,offset)}}finally{reader.releaseLock()}try{return new TextDecoder("utf-8",{fatal:!0}).decode(bytes.subarray(0,size))}catch{throw new RequestBodyError("Send valid UTF-8",400)}}
+import{parseJsonText}from"./json";export class RequestBodyError extends Error{status;constructor(message,status){super(message);this.status=status;this.name="RequestBodyError"}}export async function readJsonBody(request,maxBytes=1048576,options={}){if(!Number.isSafeInteger(maxBytes)||maxBytes<1)throw RangeError("maxBytes must be a positive safe integer");if(request.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase()!=="application/json")throw new RequestBodyError("Content-Type must be application/json",415);const text=await readTextBody(request,maxBytes);try{return parseJsonText(text,options)}catch{throw new RequestBodyError("Send valid UTF-8 JSON",400)}}export async function readTextBody(request,maxBytes=1048576){if(!Number.isSafeInteger(maxBytes)||maxBytes<1)throw RangeError("maxBytes must be a positive safe integer");const declared=request.headers.get("content-length");if(declared&&(!/^\d+$/.test(declared)||Number(declared)>maxBytes))throw new RequestBodyError("Request body is too large",413);if(!request.body)throw new RequestBodyError("Send a request body",400);const reader=request.body.getReader();let bytes=new Uint8Array(Math.min(maxBytes,8192)),size=0;try{while(!0){const{done,value}=await reader.read();if(done)break;const offset=size;size+=value.byteLength;if(size>maxBytes){reader.cancel().catch(()=>{});throw new RequestBodyError("Request body is too large",413)}if(size>bytes.length){const grown=new Uint8Array(Math.min(maxBytes,Math.max(size,bytes.length*2)));grown.set(bytes);bytes=grown}bytes.set(value,offset)}}finally{reader.releaseLock()}try{return new TextDecoder("utf-8",{fatal:!0}).decode(bytes.subarray(0,size))}catch{throw new RequestBodyError("Send valid UTF-8",400)}}

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 import './request-augmentation';
+export type { JsonParseOptions } from './json';
 // Re-export the augmentation types so userland can refer to the marker
 // surface explicitly when needed.
 export type { StacksRequestExtensions, StacksRequestMacros, StacksRequestMarkers } from './request-augmentation';
@@ -27,6 +28,7 @@ export type {
   StacksSessionConfig,
 } from './session-factory';
 export { readJsonBody, readTextBody, RequestBodyError } from './body';
+export { parseJsonText } from './json';
 // Re-export everything from bun-router (includes response factory)
 export * from '@stacksjs/bun-router';
 // Export Stacks-specific action resolver and URL helper

package/dist/index.js

@@ -1 +1 @@
-import"./request-augmentation";export{readJsonBody,readTextBody,RequestBodyError}from"./body";export*from"@stacksjs/bun-router";export{assertRouteMiddlewareResolvable,configureViewDirectories,clearCsrfModuleCache,clearMiddlewareCache,createStacksRouter,disableViewRouting,enhanceRequest,findUnresolvableRouteMiddleware,installMiddlewareHotReload,loadMiddlewareHandlers,resetBootHooks,route,runBootHooks,serve,serverResponse,url,warnOnMultipleRouterInstances}from"./stacks-router";export{cacheRequestQuery,clearCurrentRequest,getCurrentRequest,getTraceId,request,runWithRequest,setCurrentRequest,withTraceId}from"./request-context";export{defineMiddleware,Middleware}from"./middleware";export{appRouteRegistry,bundleMounts,DEFAULT_ROUTE_BUNDLE_FEATURES,DEFAULT_ROUTE_REGISTRY,listRootMountedAppRoutes,loadRoutes,mountedDefaultRouteBundles}from"./route-loader";export{clearTrackedQueries,createErrorResponse,createMiddlewareErrorResponse,createNotFoundResponse,createValidationErrorResponse,getQueryShapeCounts,trackQuery}from"./error-handler";export{listNamedRoutes,listRegisteredRoutes,routeParams}from"./stacks-router";export{DASHBOARD_ROUTE_GROUPS,dashboardGroupMiddleware,describeUnknownDashboardGroups,resolveDashboardAccess}from"./dashboard-access";export{isRouterAction,wrapAction}from"./stacks-router";export{createTypedRouter}from"./typed-router";export{clearRouteModelBindings,defineRouteModelBinding,resolveRouteModel,routeModelBindings,setRouteModelFallback}from"./route-model-binding";export{isApiRequest,JSON_CONTENT_TYPE}from"./api-shape";export{rateLimit,rateLimitStatus,clearRateLimit,resetRateLimiters}from"./rate-limit";export{cacheRedisConnection,clientAddress,fallbackStorage,rateLimitScale,resetSharedRateLimitStorage,scaledLimit,sharedRateLimitStorage,trustedProxies,useRateLimitStorage}from"./security-settings";export{PathParamError,safePathParam,sanitizePathParam}from"./path-sanitize";export{checkApplicationHealth,runHealthProbes}from"./health";export{stream}from"./stacks-router";export{signedUrl,signUrl,verifySignedUrl,verifySignedUrlMiddleware}from"./signed-url";export{EncryptedSessionStore}from"./encrypted-session-store";export{createSessionStore,createStacksSessionStore,DatabaseSessionStore,FileSessionStore,MemorySessionStore,RedisSessionStore}from"./session-factory";
+import"./request-augmentation";export{readJsonBody,readTextBody,RequestBodyError}from"./body";export{parseJsonText}from"./json";export*from"@stacksjs/bun-router";export{assertRouteMiddlewareResolvable,configureViewDirectories,clearCsrfModuleCache,clearMiddlewareCache,createStacksRouter,disableViewRouting,enhanceRequest,findUnresolvableRouteMiddleware,installMiddlewareHotReload,loadMiddlewareHandlers,resetBootHooks,route,runBootHooks,serve,serverResponse,url,warnOnMultipleRouterInstances}from"./stacks-router";export{cacheRequestQuery,clearCurrentRequest,getCurrentRequest,getTraceId,request,runWithRequest,setCurrentRequest,withTraceId}from"./request-context";export{defineMiddleware,Middleware}from"./middleware";export{appRouteRegistry,bundleMounts,DEFAULT_ROUTE_BUNDLE_FEATURES,DEFAULT_ROUTE_REGISTRY,listRootMountedAppRoutes,loadRoutes,mountedDefaultRouteBundles}from"./route-loader";export{clearTrackedQueries,createErrorResponse,createMiddlewareErrorResponse,createNotFoundResponse,createValidationErrorResponse,getQueryShapeCounts,trackQuery}from"./error-handler";export{listNamedRoutes,listRegisteredRoutes,routeParams}from"./stacks-router";export{DASHBOARD_ROUTE_GROUPS,dashboardGroupMiddleware,describeUnknownDashboardGroups,resolveDashboardAccess}from"./dashboard-access";export{isRouterAction,wrapAction}from"./stacks-router";export{createTypedRouter}from"./typed-router";export{clearRouteModelBindings,defineRouteModelBinding,resolveRouteModel,routeModelBindings,setRouteModelFallback}from"./route-model-binding";export{isApiRequest,JSON_CONTENT_TYPE}from"./api-shape";export{rateLimit,rateLimitStatus,clearRateLimit,resetRateLimiters}from"./rate-limit";export{cacheRedisConnection,clientAddress,fallbackStorage,rateLimitScale,resetSharedRateLimitStorage,scaledLimit,sharedRateLimitStorage,trustedProxies,useRateLimitStorage}from"./security-settings";export{PathParamError,safePathParam,sanitizePathParam}from"./path-sanitize";export{checkApplicationHealth,runHealthProbes}from"./health";export{stream}from"./stacks-router";export{signedUrl,signUrl,verifySignedUrl,verifySignedUrlMiddleware}from"./signed-url";export{EncryptedSessionStore}from"./encrypted-session-store";export{createSessionStore,createStacksSessionStore,DatabaseSessionStore,FileSessionStore,MemorySessionStore,RedisSessionStore}from"./session-factory";

package/dist/json.d.ts

@@ -0,0 +1,5 @@
+/** Parse already-decoded JSON. Callers reading a wire body must enforce its byte/UTF-8 limits first. */
+export declare function parseJsonText(text: string, options?: JsonParseOptions): unknown;
+export declare interface JsonParseOptions {
+  rejectDuplicateKeys?: boolean
+}

package/dist/json.js

@@ -0,0 +1 @@
+export function parseJsonText(text,options={}){if(typeof text!=="string")throw TypeError("JSON text must be a string");const result=JSON.parse(text);if(!options.rejectDuplicateKeys)return result;const containers=[];for(let position=0;position<text.length;position++){const character=text[position];if(character==="{")containers.push(new Set);else if(character==="[")containers.push(null);else if(character==="}"||character==="]")containers.pop();else if(character==='"'){const start=position;while(++position<text.length)if(text[position]==="\\")position++;else if(text[position]==='"')break;let next=position+1;while(next<text.length&&/\s/.test(text[next]))next++;if(text[next]!==":")continue;const keys=containers.at(-1);if(!keys)throw SyntaxError("Invalid JSON object key");const key=JSON.parse(text.slice(start,position+1));if(keys.has(key))throw SyntaxError("Duplicate JSON object key");keys.add(key)}}return result}

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/router",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.233",
+  "version": "0.75.236",
   "description": "The Stacks framework router.",
   "author": "Chris Breuer",
   "contributors": [
@@ -67,27 +67,27 @@
   },
   "dependencies": {
     "@stacksjs/bun-router": "^0.1.24",
-    "@stacksjs/cache": "0.75.233",
-    "@stacksjs/collections": "0.75.233",
-    "@stacksjs/config": "0.75.233",
-    "@stacksjs/error-handling": "0.75.233",
-    "@stacksjs/logging": "0.75.233",
-    "@stacksjs/pagination": "0.75.233",
-    "@stacksjs/path": "0.75.233",
-    "@stacksjs/security": "0.75.233",
-    "@stacksjs/storage": "0.75.233",
+    "@stacksjs/cache": "0.75.236",
+    "@stacksjs/collections": "0.75.236",
+    "@stacksjs/config": "0.75.236",
+    "@stacksjs/error-handling": "0.75.236",
+    "@stacksjs/logging": "0.75.236",
+    "@stacksjs/pagination": "0.75.236",
+    "@stacksjs/path": "0.75.236",
+    "@stacksjs/security": "0.75.236",
+    "@stacksjs/storage": "0.75.236",
     "ts-rate-limiter": "^0.4.10"
   },
   "devDependencies": {
-    "@stacksjs/actions": "0.75.233",
-    "@stacksjs/types": "0.75.233",
+    "@stacksjs/actions": "0.75.236",
+    "@stacksjs/types": "0.75.236",
     "better-dx": "^0.2.24"
   },
   "peerDependencies": {
-    "@stacksjs/api": "0.75.233",
-    "@stacksjs/auth": "0.75.233",
-    "@stacksjs/database": "0.75.233",
-    "@stacksjs/validation": "0.75.233"
+    "@stacksjs/api": "0.75.236",
+    "@stacksjs/auth": "0.75.236",
+    "@stacksjs/database": "0.75.236",
+    "@stacksjs/validation": "0.75.236"
   },
   "peerDependenciesMeta": {
     "@stacksjs/api": {