@stacksjs/server 0.70.88 → 0.70.90

package/dist/config-production.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Production server config - minimal, no runtime file loading
+ * This config is inlined at build time for compiled binaries
+ * @defaultValue `{ server: { host: '0.0.0.0' } }`
+ */
+export declare const config: {
+  app: {
+  name: unknown;
+  env: unknown;
+  debug: boolean;
+  url: unknown
+};
+  server: {
+  port: unknown;
+  /** @defaultValue '0.0.0.0' */
+  host: string
+};
+  logging: {
+  level: unknown
+}
+};
+export default config;

package/dist/config-production.js

@@ -0,0 +1,16 @@
+export const config = {
+  app: {
+    name: process.env.APP_NAME || "Stacks",
+    env: process.env.APP_ENV || "production",
+    debug: process.env.APP_DEBUG === "true" || !1,
+    url: process.env.APP_URL || "https://stacksjs.com"
+  },
+  server: {
+    port: Number(process.env.PORT) || 3000,
+    host: "0.0.0.0"
+  },
+  logging: {
+    level: process.env.LOG_LEVEL || "info"
+  }
+};
+export default config;

package/dist/config.d.ts

@@ -0,0 +1,6 @@
+import type { ServerOptions } from '@stacksjs/types';
+export declare function config(options: ServerOptions): {
+  host: string
+  port: number
+  open: boolean
+};

package/dist/config.js

@@ -0,0 +1,60 @@
+import { ports } from "@stacksjs/config";
+export function config(options) {
+  const serversMap = {
+    frontend: {
+      host: "localhost",
+      port: ports.frontend
+    },
+    backend: {
+      host: "localhost",
+      port: ports.backend
+    },
+    api: {
+      host: "localhost",
+      port: ports.api
+    },
+    admin: {
+      host: "localhost",
+      port: ports.admin
+    },
+    library: {
+      host: "localhost",
+      port: ports.library
+    },
+    desktop: {
+      host: "localhost",
+      port: ports.desktop
+    },
+    docs: {
+      host: "localhost",
+      port: ports.docs
+    },
+    email: {
+      host: "localhost",
+      port: ports.email
+    },
+    inspect: {
+      host: "localhost",
+      port: ports.inspect
+    },
+    "system-tray": {
+      host: "localhost",
+      port: ports.systemTray
+    },
+    database: {
+      host: "localhost",
+      port: ports.database
+    }
+  };
+  if (options.type && options.type in serversMap)
+    return {
+      host: serversMap[options.type].host,
+      port: serversMap[options.type].port,
+      open: !1
+    };
+  return {
+    host: options.host || "stacks.localhost",
+    port: options.port || 3000,
+    open: !1
+  };
+}

package/dist/controllers/base.d.ts

@@ -0,0 +1,16 @@
+import type { ResponseData } from '@stacksjs/types';
+declare type Request = any;
+/**
+ * Base Controller class providing Laravel-like functionality
+ */
+export declare class Controller {
+  protected json(data: any, status?: number): any;
+  protected success(data: any): ResponseData;
+  protected created(data: any): ResponseData;
+  protected noContent(): any;
+  protected error(message: string, status?: number): ResponseData;
+  protected notFound(message?: string): ResponseData;
+  protected unauthorized(message?: string): ResponseData;
+  protected forbidden(message?: string): ResponseData;
+  protected validate(request: Request, rules: Record<string, any>): Promise<void>;
+}

package/dist/controllers/base.js

@@ -0,0 +1,38 @@
+import { log } from "@stacksjs/logging";
+import { response } from "@stacksjs/router";
+
+export class Controller {
+  json(data, status = 200) {
+    return response.json(data, status);
+  }
+  success(data) {
+    return this.json(data, 200);
+  }
+  created(data) {
+    return this.json(data, 201);
+  }
+  noContent() {
+    return response.noContent();
+  }
+  error(message, status = 500) {
+    return this.json({ error: message }, status);
+  }
+  notFound(message = "Resource not found") {
+    return this.error(message, 404);
+  }
+  unauthorized(message = "Unauthorized") {
+    return this.error(message, 401);
+  }
+  forbidden(message = "Forbidden") {
+    return this.error(message, 403);
+  }
+  validate(request, rules) {
+    try {
+      const result = request.validate(rules);
+      log.info("Validation result:", result);
+      return Promise.resolve();
+    } catch (error) {
+      return Promise.reject(error);
+    }
+  }
+}

package/dist/imports.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Generate runtime auto-import files for Bun runtime execution.
+ * This creates index files that can be imported to get all auto-imports,
+ * including defineModel()-based model definitions and resource functions.
+ */
+export declare function generateAutoImportFiles(): Promise<void>;
+/**
+ * Initialize auto-imports for both bundler and runtime.
+ *
+ * Scans defineModel() model files and resource functions, making them
+ * available globally without explicit imports.
+ */
+export declare function initiateImports(): void;
+/**
+ * Import and inject all auto-imports into globalThis for runtime access.
+ * Call this early in your application startup.
+ *
+ * This makes all models, plus framework primitives used by actions
+ * (Action, response, schema, Auth), available globally, matching the
+ * "no imports needed" ergonomics of framework default actions.
+ */
+export declare function injectGlobalAutoImports(): Promise<void>;
+/**
+ * Generate a runtime index file for defineModel() models.
+ * These use `export default defineModel(...)`, so we re-export each default as a named export.
+ *
+ * Each entry is either a plain string (recursive scan) or `{ dir, recursive: false }`
+ * for non-recursive scans. The defaults root passes the non-recursive form so
+ * that feature-module subdirs (commerce/, Content/, …) only ship when the
+ * project opted into them via config.
+ */
+declare type ScanEntry = string | { dir: string, recursive: boolean }

package/dist/imports.js

@@ -0,0 +1,224 @@
+import { existsSync } from "node:fs";
+import { dirname, relative } from "node:path";
+import { plugin } from "bun";
+import { log } from "@stacksjs/logging";
+import { path } from "@stacksjs/path";
+import { autoImports, generateRuntimeIndex, generateGlobalsScript } from "bun-plugin-auto-imports";
+import { globSync } from "@stacksjs/storage";
+const OPTIONAL_MODEL_MODULES = {
+  commerce: ["config/commerce.ts"],
+  Content: ["config/cms.ts", "config/blog.ts"],
+  realtime: ["config/realtime.ts"]
+};
+function configEnabled(configRelPaths) {
+  return configRelPaths.some((rel) => existsSync(path.projectPath(rel)));
+}
+function resolveDefaultModelDirs() {
+  const root = path.storagePath("framework/defaults/app/Models"), dirs = [root];
+  for (const [subdir, configPaths] of Object.entries(OPTIONAL_MODEL_MODULES))
+    if (configEnabled(configPaths))
+      dirs.push(`${root}/${subdir}`);
+  return dirs;
+}
+function scanDirTopLevel(dir) {
+  try {
+    return globSync(`${dir}/*.ts`, { ignore: ["**/*.d.ts", "**/index.ts", "**/README*"] });
+  } catch {
+    return [];
+  }
+}
+function scanDefineModelExports(dir, opts = {}) {
+  const { recursive = !0 } = opts;
+  let files = [];
+  try {
+    const pattern = recursive ? `${dir}/**/*.ts` : `${dir}/*.ts`;
+    files = globSync(pattern, { ignore: ["**/*.d.ts", "**/index.ts", "**/README*"] });
+  } catch {
+    return [];
+  }
+  const exports = [], seen = new Set;
+  for (const file of files) {
+    const basename = file.split("/").pop()?.replace(".ts", "") || "";
+    if (basename && !seen.has(basename)) {
+      seen.add(basename);
+      exports.push({ name: basename, file, isDefault: !0 });
+    }
+  }
+  return exports;
+}
+const GLOBAL_SHADOW_BLOCKLIST = new Set([
+  "Error",
+  "Request",
+  "Response",
+  "URL",
+  "Map",
+  "Set",
+  "Object",
+  "Array",
+  "Number",
+  "String",
+  "Date",
+  "Promise",
+  "Symbol"
+]);
+async function generateDefineModelIndex(entries, outputPath) {
+  const lines = ["// Generated by bun-plugin-auto-imports"], seen = new Set;
+  for (const entry of entries) {
+    const dir = typeof entry === "string" ? entry : entry.dir, recursive = typeof entry === "string" ? !0 : entry.recursive;
+    let files = [];
+    try {
+      const pattern = recursive ? `${dir}/**/*.ts` : `${dir}/*.ts`;
+      files = globSync(pattern, { ignore: ["**/*.d.ts", "**/index.ts", "**/README*"] });
+    } catch {
+      continue;
+    }
+    for (const file of files) {
+      const basename = file.split("/").pop()?.replace(".ts", "") || "";
+      if (!basename || seen.has(basename))
+        continue;
+      seen.add(basename);
+      const relativePath = relative(dirname(outputPath), file).replace(/\.ts$/, "");
+      if (GLOBAL_SHADOW_BLOCKLIST.has(basename)) {
+        lines.push(`// Skipped '${basename}' \u2014 would shadow a built-in global. Import directly if needed.`);
+        lines.push(`// export { default as ${basename} } from '${relativePath}'`);
+        continue;
+      }
+      lines.push(`export { default as ${basename} } from '${relativePath}'`);
+    }
+  }
+  await Bun.write(outputPath, lines.join(`
+`) + `
+`);
+}
+export async function generateAutoImportFiles() {
+  const userFunctionsPath = path.resourcesPath("functions"), defaultFunctionsPath = path.storagePath("framework/defaults/functions"), functionsPath = userFunctionsPath, outputDir = path.storagePath("framework/auto-imports"), userModelsPath = path.userModelsPath(), defaultModelDirs = resolveDefaultModelDirs(), [defaultsRoot = path.storagePath("framework/defaults/app/Models"), ...enabledSubdirs] = defaultModelDirs, userJobsPath = path.userJobsPath(), userControllersPath = path.userControllersPath(), defaultControllersPath = path.storagePath("framework/defaults/app/Controllers");
+  await Bun.write(`${outputDir}/.gitkeep`, "");
+  const functionsIndexPath = `${outputDir}/functions.ts`;
+  await generateRuntimeIndex([userFunctionsPath, defaultFunctionsPath], functionsIndexPath);
+  const modelsIndexPath = `${outputDir}/models.ts`, modelScan = [
+    userModelsPath,
+    { dir: defaultsRoot, recursive: !1 },
+    ...defaultModelDirs.slice(1).map((d) => ({ dir: d, recursive: !0 }))
+  ];
+  await generateDefineModelIndex(modelScan, modelsIndexPath);
+  const jobsIndexPath = `${outputDir}/jobs.ts`;
+  await generateDefineModelIndex([userJobsPath], jobsIndexPath);
+  const controllersIndexPath = `${outputDir}/controllers.ts`;
+  await generateDefineModelIndex([userControllersPath, defaultControllersPath], controllersIndexPath);
+  const combinedContent = `// Generated by bun-plugin-auto-imports
+export * from './functions'
+export * from './models'
+export * from './jobs'
+export * from './controllers'
+`;
+  await Bun.write(`${outputDir}/index.ts`, combinedContent);
+  const globalsPath = `${outputDir}/globals.ts`;
+  await generateGlobalsScript([functionsPath], globalsPath, `${outputDir}/index.ts`);
+  log.debug("Auto-import files generated successfully");
+}
+export function initiateImports() {
+  const functionsPath = path.resourcesPath("functions"), defaultFunctionsPath = path.storagePath("framework/defaults/functions"), userModelsPath = path.userModelsPath(), defaultModelDirs = resolveDefaultModelDirs(), [defaultsRoot = path.storagePath("framework/defaults/app/Models"), ...enabledSubdirs] = defaultModelDirs, userJobsPath = path.userJobsPath(), userControllersPath = path.userControllersPath(), defaultControllersPath = path.storagePath("framework/defaults/app/Controllers"), defineModelExports = [
+    ...scanDefineModelExports(userModelsPath),
+    ...scanDefineModelExports(defaultsRoot, { recursive: !1 }),
+    ...enabledSubdirs.flatMap((d) => scanDefineModelExports(d))
+  ], jobExports = scanDefineModelExports(userJobsPath), seen = new Set, uniqueDefineModelExports = defineModelExports.filter((exp) => {
+    if (seen.has(exp.name))
+      return !1;
+    seen.add(exp.name);
+    return !0;
+  }), dtsDir = dirname(path.storagePath("framework/types/server-auto-imports.d.ts")), defineModelImports = uniqueDefineModelExports.map((exp) => ({
+    from: `./${relative(dtsDir, exp.file).replace(/\\/g, "/").replace(/\.ts$/, "")}`,
+    name: "default",
+    as: exp.name
+  })), jobImports = jobExports.map((exp) => ({
+    from: `./${relative(dtsDir, exp.file).replace(/\\/g, "/").replace(/\.ts$/, "")}`,
+    name: "default",
+    as: exp.name
+  })), controllerExports = [
+    ...scanDefineModelExports(userControllersPath),
+    ...scanDefineModelExports(defaultControllersPath)
+  ], seenControllers = new Set, controllerImports = controllerExports.filter((exp) => {
+    if (seenControllers.has(exp.name))
+      return !1;
+    seenControllers.add(exp.name);
+    return !0;
+  }).map((exp) => ({
+    from: `./${relative(dtsDir, exp.file).replace(/\\/g, "/").replace(/\.ts$/, "")}`,
+    name: "default",
+    as: exp.name
+  })), options = {
+    dts: path.storagePath("framework/types/server-auto-imports.d.ts"),
+    imports: [...defineModelImports, ...jobImports, ...controllerImports],
+    dirs: [functionsPath, defaultFunctionsPath],
+    eslint: {
+      enabled: !0,
+      filepath: path.storagePath("framework/server-auto-imports.json")
+    }
+  };
+  plugin(autoImports(options));
+  generateAutoImportFiles().catch((err) => {
+    console.error("[Server] Failed to generate auto-import files:", err);
+  });
+}
+export async function injectGlobalAutoImports() {
+  if (globalThis.__stacksAutoImportsInjected)
+    return;
+  globalThis.__stacksAutoImportsInjected = !0;
+  const errors = [], primitiveModules = [
+    ["@stacksjs/types", ["Every", "ExitCode"]],
+    ["@stacksjs/path", ["path"]],
+    ["@stacksjs/error-handling", ["HttpError", "handleError"]],
+    ["@stacksjs/logging", ["log"]],
+    ["@stacksjs/config", ["config"]],
+    ["@stacksjs/validation", ["schema"]],
+    ["@stacksjs/router", ["response", "request", "route", "Middleware", "url"]],
+    ["@stacksjs/storage", ["storage", "fs"]],
+    ["@stacksjs/orm", ["defineModel", "toAttrs"]],
+    ["@stacksjs/database", ["db", "sql"]],
+    ["@stacksjs/email", ["mail", "template"]],
+    ["@stacksjs/queue", ["Job"]],
+    ["@stacksjs/scheduler", ["schedule"]],
+    ["@stacksjs/actions", ["Action"]],
+    ["@stacksjs/auth", ["Auth", "register", "sessionCheck"]],
+    ["@stacksjs/events", ["dispatch", "listen", "emitter"]],
+    ["@stacksjs/feature-flags", ["Feature"]],
+    ["@stacksjs/security", ["makeHash", "verifyHash"]],
+    ["@stacksjs/collections", ["collect"]],
+    ["@stacksjs/cli", ["quotes"]],
+    ["@stacksjs/notifications", ["notify", "useNotification", "useEmail", "useSMS", "useChat", "useDatabase"]],
+    ["@stacksjs/realtime", ["emit", "emitToUser", "emitToUsers", "createChannel", "dispatchBroadcast"]],
+    ["@stacksjs/i18n", ["I18n", "t", "tc", "te", "setLocale", "getLocale"]],
+    ["@stacksjs/stx", ["state", "derived", "effect"]],
+    ["@stacksjs/browser", ["useDark", "usePreferredDark", "useToggle", "useStorage"]]
+  ], importWithTimeout = async (pkg) => {
+    return Promise.race([
+      import(pkg),
+      new Promise((_, reject) => setTimeout(() => reject(Error(`auto-import timed out: ${pkg}`)), 4000))
+    ]);
+  };
+  await Promise.all(primitiveModules.map(async ([pkg, names]) => {
+    try {
+      const mod = await importWithTimeout(pkg);
+      for (const name of names)
+        if (mod[name] !== void 0)
+          globalThis[name] = mod[name];
+    } catch (err) {
+      errors.push(err);
+    }
+  }));
+  try {
+    const { ensureLocalesLoaded } = await import("@stacksjs/i18n");
+    await ensureLocalesLoaded();
+  } catch (err) {
+    errors.push(err);
+  }
+  try {
+    const autoImports = await import(path.storagePath("framework/auto-imports/index.ts"));
+    Object.assign(globalThis, autoImports);
+  } catch (err) {
+    errors.push(err);
+  }
+  if (errors.length)
+    for (const err of errors)
+      console.warn("[auto-imports]", err.message);
+}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { config as server } from './config';
+export * from './controllers/base';
+export * from './imports';
+export * from './maintenance';
+export * from './proxy';

package/dist/index.js

@@ -0,0 +1,5 @@
+export { config as server } from "./config";
+export * from "./controllers/base";
+export * from "./imports";
+export * from "./maintenance";
+export * from "./proxy";

package/dist/maintenance.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Get the path to the maintenance file
+ */
+export declare function maintenanceFilePath(): string;
+export declare function comingSoonFilePath(): string;
+export declare function siteModeFilePath(mode: SiteMode): string;
+/**
+ * Check if the application is in maintenance mode
+ */
+export declare function isDownForMaintenance(): Promise<boolean>;
+export declare function isComingSoon(): Promise<boolean>;
+/**
+ * Get the maintenance mode payload
+ */
+export declare function maintenancePayload(): Promise<MaintenancePayload | null>;
+export declare function comingSoonPayload(): Promise<MaintenancePayload | null>;
+export declare function siteModePayload(mode: SiteMode): Promise<MaintenancePayload | null>;
+export declare function activeSiteModePayload(): Promise<MaintenancePayload | null>;
+/**
+ * Put the application into maintenance mode
+ */
+export declare function down(options?: Partial<MaintenancePayload>): Promise<void>;
+export declare function comingSoon(options?: Partial<MaintenancePayload>): Promise<void>;
+/**
+ * Bring the application out of maintenance mode
+ */
+export declare function up(): Promise<void>;
+export declare function launch(): Promise<void>;
+/**
+ * Check if an IP address is allowed during maintenance
+ */
+export declare function isAllowedIp(ip: string, allowed?: string[]): boolean;
+/**
+ * Check if a request has a valid bypass cookie
+ */
+export declare function bypassCookieName(mode?: SiteMode): string;
+export declare function hasValidBypassCookie(cookies: Record<string, string>, secret: string, mode?: SiteMode): boolean;
+/**
+ * Check if a request path matches the bypass secret
+ */
+export declare function isSecretPath(path: string, secret: string): boolean;
+/**
+ * Generate maintenance mode HTML response
+ */
+export declare function maintenanceHtml(payload: MaintenancePayload): string;
+/**
+ * Create a maintenance mode response
+ */
+export declare function maintenanceResponse(payload: MaintenancePayload): Response;
+export declare function siteModeResponse(payload: MaintenancePayload): Response;
+/**
+ * Create bypass cookie
+ */
+export declare function bypassCookieValue(secret: string, mode?: SiteMode): string;
+/**
+ * Single source of truth for the maintenance / coming-soon gate.
+ *
+ * Returns a `Response` to short-circuit the request, or `null` to let
+ * normal request handling continue.
+ *
+ * Used by:
+ *   - the dev server's `onRequest` hook (so the gate runs before the
+ *     stx-serve view router or the API proxy ever sees the request);
+ *   - the global `Maintenance` middleware in production.
+ *
+ * Order of checks (mirrors Laravel):
+ *   1. No active site-mode (no down file, no coming-soon file, no env
+ *      override) → pass through.
+ *   2. Path is always-allowed (the holding page itself, email
+ *      subscribe, static assets) → pass through.
+ *   3. Path matches the secret token → set mode-aware bypass cookie,
+ *      redirect home.
+ *   4. Bypass cookie present OR client IP allowed → pass through.
+ *   5. Otherwise → return the active mode's response (redirect for
+ *      coming-soon when a redirect URL is configured; HTML page for
+ *      maintenance).
+ */
+export declare function maintenanceGate(req: Request): Promise<Response | null>;
+export declare interface MaintenancePayload {
+  mode?: SiteMode
+  time: number
+  message?: string
+  title?: string
+  retry?: number
+  secret?: string
+  allowed?: string[]
+  status?: number
+  template?: string
+  redirect?: string
+}
+export type SiteMode = 'maintenance' | 'coming-soon';

package/dist/maintenance.js

@@ -0,0 +1,365 @@
+import { log } from "@stacksjs/logging";
+import * as p from "@stacksjs/path";
+const DEFAULT_MAINTENANCE_PAYLOAD = {
+  mode: "maintenance",
+  status: 503,
+  message: "We are currently performing maintenance. Please check back soon."
+}, DEFAULT_COMING_SOON_PAYLOAD = {
+  mode: "coming-soon",
+  status: 200,
+  message: "Stacks is setting up camp. Check back soon for the public launch.",
+  redirect: "/coming-soon"
+};
+function defaultsForMode(mode) {
+  return mode === "coming-soon" ? DEFAULT_COMING_SOON_PAYLOAD : DEFAULT_MAINTENANCE_PAYLOAD;
+}
+export function maintenanceFilePath() {
+  return p.storagePath("framework/down");
+}
+export function comingSoonFilePath() {
+  return p.storagePath("framework/coming-soon");
+}
+export function siteModeFilePath(mode) {
+  return mode === "coming-soon" ? comingSoonFilePath() : maintenanceFilePath();
+}
+export async function isDownForMaintenance() {
+  try {
+    return await Bun.file(maintenanceFilePath()).exists();
+  } catch {
+    return !1;
+  }
+}
+export async function isComingSoon() {
+  try {
+    return await Bun.file(comingSoonFilePath()).exists();
+  } catch {
+    return !1;
+  }
+}
+export async function maintenancePayload() {
+  return siteModePayload("maintenance");
+}
+export async function comingSoonPayload() {
+  return siteModePayload("coming-soon");
+}
+export async function siteModePayload(mode) {
+  try {
+    const file = Bun.file(siteModeFilePath(mode));
+    if (!await file.exists())
+      return null;
+    const content = await file.text();
+    return {
+      ...defaultsForMode(mode),
+      ...JSON.parse(content),
+      mode
+    };
+  } catch {
+    return null;
+  }
+}
+export async function activeSiteModePayload() {
+  return await maintenancePayload() ?? await comingSoonPayload() ?? envSiteModePayload();
+}
+function envSiteModePayload() {
+  if (isTruthy(process.env.APP_MAINTENANCE))
+    return {
+      ...DEFAULT_MAINTENANCE_PAYLOAD,
+      mode: "maintenance",
+      time: Date.now(),
+      secret: process.env.APP_MAINTENANCE_SECRET || void 0
+    };
+  if (isTruthy(process.env.APP_COMING_SOON))
+    return {
+      ...DEFAULT_COMING_SOON_PAYLOAD,
+      mode: "coming-soon",
+      time: Date.now(),
+      secret: process.env.APP_COMING_SOON_SECRET || void 0
+    };
+  return null;
+}
+function isTruthy(value) {
+  return ["1", "true", "yes", "on"].includes(String(value || "").toLowerCase());
+}
+export async function down(options = {}) {
+  const payload = {
+    ...DEFAULT_MAINTENANCE_PAYLOAD,
+    ...options,
+    mode: "maintenance",
+    time: Date.now()
+  }, frameworkDir = p.storagePath("framework"), { mkdirSync, existsSync } = await import("@stacksjs/storage");
+  if (!existsSync(frameworkDir))
+    mkdirSync(frameworkDir, { recursive: !0 });
+  await Bun.write(maintenanceFilePath(), JSON.stringify(payload, null, 2));
+  log.info("Application is now in maintenance mode.");
+  if (payload.secret)
+    log.info("Maintenance bypass secret has been configured");
+}
+export async function comingSoon(options = {}) {
+  const payload = {
+    ...DEFAULT_COMING_SOON_PAYLOAD,
+    ...options,
+    mode: "coming-soon",
+    time: Date.now()
+  }, frameworkDir = p.storagePath("framework"), { mkdirSync, existsSync } = await import("@stacksjs/storage");
+  if (!existsSync(frameworkDir))
+    mkdirSync(frameworkDir, { recursive: !0 });
+  await Bun.write(comingSoonFilePath(), JSON.stringify(payload, null, 2));
+  log.info("Application is now in coming soon mode.");
+  if (payload.secret)
+    log.info("Coming soon bypass secret has been configured");
+}
+export async function up() {
+  const { unlinkSync, existsSync } = await import("node:fs"), filePath = maintenanceFilePath();
+  if (existsSync(filePath)) {
+    unlinkSync(filePath);
+    log.info("Application is now live.");
+  } else
+    log.info("Application is already live.");
+}
+export async function launch() {
+  const { unlinkSync, existsSync } = await import("node:fs"), filePath = comingSoonFilePath();
+  if (existsSync(filePath)) {
+    unlinkSync(filePath);
+    log.info("Application is out of coming soon mode.");
+  } else
+    log.info("Application is not in coming soon mode.");
+}
+export function isAllowedIp(ip, allowed = []) {
+  if (allowed.length === 0)
+    return !1;
+  if (["127.0.0.1", "::1", "localhost"].includes(ip))
+    return !0;
+  return allowed.includes(ip);
+}
+export function bypassCookieName(mode = "maintenance") {
+  return mode === "coming-soon" ? "stacks_coming_soon_bypass" : "stacks_maintenance_bypass";
+}
+export function hasValidBypassCookie(cookies, secret, mode = "maintenance") {
+  return cookies[bypassCookieName(mode)] === secret;
+}
+export function isSecretPath(path, secret) {
+  return path === `/${secret}` || path.startsWith(`/${secret}/`);
+}
+export function maintenanceHtml(payload) {
+  const mode = payload.mode ?? "maintenance", defaults = defaultsForMode(mode), message = escapeHtml(payload.message || defaults.message || ""), title = escapeHtml(payload.title || (mode === "coming-soon" ? "Opening Soon" : "Trail Maintenance"));
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>${title}</title>
+  <style>
+    @font-face {
+      font-display: swap;
+      font-family: "Campmate Script";
+      src: url("/assets/fonts/nps/CampmateScript-Regular.woff2") format("woff2");
+    }
+    @font-face {
+      font-display: swap;
+      font-family: "Switchback";
+      src: url("/assets/fonts/nps/Switchback-Regular.woff2") format("woff2");
+    }
+    @font-face {
+      font-display: swap;
+      font-family: "NPS 2026";
+      font-weight: 100 900;
+      src: url("/assets/fonts/nps/NPS_2026-variable.woff2") format("woff2");
+    }
+    * {
+      margin: 0;
+      padding: 0;
+      box-sizing: border-box;
+    }
+    body {
+      font-family: "Switchback", ui-sans-serif, system-ui, sans-serif;
+      min-height: 100vh;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      background:
+        linear-gradient(180deg, rgba(10, 28, 18, 0.78), rgba(10, 28, 18, 0.94)),
+        url("/assets/images/topography.svg") center / 760px auto,
+        #0d1e16;
+      color: #fff7e1;
+      padding: 20px;
+    }
+    .container {
+      position: relative;
+      width: min(760px, 100%);
+      overflow: hidden;
+      border: 1px solid rgba(255, 240, 200, 0.28);
+      border-top: 6px solid #df9a2f;
+      border-radius: 8px;
+      padding: clamp(2rem, 7vw, 4.5rem);
+      background:
+        linear-gradient(180deg, rgba(27, 65, 40, 0.86), rgba(12, 31, 21, 0.96)),
+        #163824;
+      box-shadow: 0 30px 80px rgba(0, 0, 0, 0.38);
+    }
+    .container::after {
+      position: absolute;
+      inset: auto 0 0;
+      height: 44%;
+      content: "";
+      background: url("/assets/images/park-ridge.svg") center bottom / cover no-repeat;
+      opacity: 0.34;
+      pointer-events: none;
+    }
+    .eyebrow {
+      position: relative;
+      z-index: 1;
+      display: flex;
+      gap: .75rem;
+      align-items: center;
+      color: #aac47d;
+      font-family: "Switchback", ui-sans-serif, system-ui, sans-serif;
+      font-size: .9rem;
+      font-weight: 800;
+      text-transform: uppercase;
+    }
+    .eyebrow::before {
+      width: 44px;
+      height: 2px;
+      content: "";
+      background: #df9a2f;
+    }
+    h1 {
+      position: relative;
+      z-index: 1;
+      margin-top: 1rem;
+      font-family: "Campmate Script", ui-serif, Georgia, serif;
+      font-size: clamp(4.5rem, 16vw, 8rem);
+      font-weight: 400;
+      line-height: .82;
+    }
+    .lead,
+    .message,
+    .retry {
+      position: relative;
+      z-index: 1;
+      max-width: 560px;
+      color: rgba(255, 247, 225, .84);
+      font-size: 1.08rem;
+      line-height: 1.65;
+    }
+    .lead {
+      margin-top: 1.25rem;
+      color: #b8d9cf;
+      font-family: "NPS 2026", "Switchback", ui-sans-serif, system-ui, sans-serif;
+      font-size: 1.22rem;
+      font-weight: 850;
+      line-height: 1.3;
+      text-transform: uppercase;
+    }
+    .message {
+      margin-top: .75rem;
+    }
+    .retry {
+      margin-top: 1.4rem;
+      color: #aac47d;
+      font-family: "Switchback", ui-sans-serif, system-ui, sans-serif;
+      font-size: .95rem;
+      font-weight: 800;
+      text-transform: uppercase;
+    }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <div class="eyebrow">${mode === "coming-soon" ? "Stacks basecamp" : "Service notice"}</div>
+    <h1>${title}</h1>
+    <p class="lead">${mode === "coming-soon" ? "The public trailhead is almost ready." : "The route is temporarily closed while the crew improves the path."}</p>
+    <p class="message">${message}</p>
+    ${payload.retry ? `<p class="retry">Estimated reopening: ${Math.ceil(payload.retry / 60)} minutes.</p>` : ""}
+  </div>
+</body>
+</html>`;
+}
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#039;");
+}
+export function maintenanceResponse(payload) {
+  return siteModeResponse(payload);
+}
+export function siteModeResponse(payload) {
+  const headers = {
+    "Content-Type": "text/html; charset=utf-8"
+  };
+  if (payload.retry)
+    headers["Retry-After"] = String(payload.retry);
+  if (payload.redirect)
+    return new Response(null, {
+      status: 302,
+      headers: { Location: payload.redirect }
+    });
+  return new Response(maintenanceHtml(payload), {
+    status: payload.status || (payload.mode === "coming-soon" ? 200 : 503),
+    headers
+  });
+}
+export function bypassCookieValue(secret, mode = "maintenance") {
+  return `${bypassCookieName(mode)}=${secret}; Path=/; HttpOnly; SameSite=Lax`;
+}
+const ALWAYS_ALLOWED_PATHS = new Set([
+  "/coming-soon",
+  "/api/email/subscribe",
+  "/favicon.ico"
+]), ALWAYS_ALLOWED_PREFIXES = [
+  "/css/",
+  "/js/",
+  "/images/",
+  "/fonts/",
+  "/assets/",
+  "/_modules/",
+  "/@vite/",
+  "/@fs/",
+  "/__deps/"
+];
+function isAlwaysAllowed(path) {
+  if (ALWAYS_ALLOWED_PATHS.has(path))
+    return !0;
+  return ALWAYS_ALLOWED_PREFIXES.some((p) => path.startsWith(p));
+}
+function parseCookieHeader(header) {
+  const out = {};
+  if (!header)
+    return out;
+  for (const part of header.split(";")) {
+    const trimmed = part.trim(), eq = trimmed.indexOf("=");
+    if (eq === -1)
+      continue;
+    const k = trimmed.slice(0, eq).trim(), v = trimmed.slice(eq + 1).trim();
+    if (k)
+      out[k] = v;
+  }
+  return out;
+}
+function clientIp(req) {
+  const fwd = req.headers.get("x-forwarded-for");
+  if (fwd)
+    return fwd.split(",")[0]?.trim() ?? "127.0.0.1";
+  const real = req.headers.get("x-real-ip");
+  if (real)
+    return real;
+  return "127.0.0.1";
+}
+export async function maintenanceGate(req) {
+  const payload = await activeSiteModePayload();
+  if (!payload)
+    return null;
+  const mode = payload.mode ?? "maintenance", path = new URL(req.url).pathname;
+  if (isAlwaysAllowed(path))
+    return null;
+  if (payload.secret && isSecretPath(path, payload.secret))
+    return new Response(null, {
+      status: 302,
+      headers: {
+        Location: "/",
+        "Set-Cookie": bypassCookieValue(payload.secret, mode)
+      }
+    });
+  const cookies = parseCookieHeader(req.headers.get("cookie")), hasCookie = !!payload.secret && hasValidBypassCookie(cookies, payload.secret, mode), ipAllowed = isAllowedIp(clientIp(req), payload.allowed);
+  if (hasCookie || ipAllowed)
+    return null;
+  return siteModeResponse(payload);
+}

package/dist/proxy.d.ts

@@ -0,0 +1,7 @@
+/**` prefix, or uses a verb that never matches a
+ * static stx page render. Without the verb rule,
+ * `route.post('/subscribe', ...)` declared at the root hits stx-serve
+ * and 404s.
+ */
+export declare function isApiBoundRequest(req: Request, pathname: string): boolean;
+export declare function proxyToBackend(req: Request, backendBase: string, stripPrefix?: string): Promise<Response>;

package/dist/proxy.js

@@ -0,0 +1,28 @@
+const API_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+export function isApiBoundRequest(req, pathname) {
+  return pathname.startsWith("/api/") || API_METHODS.has(req.method);
+}
+export async function proxyToBackend(req, backendBase, stripPrefix) {
+  const incoming = new URL(req.url);
+  let pathname = incoming.pathname;
+  if (stripPrefix && (pathname === stripPrefix || pathname.startsWith(`${stripPrefix}/`)))
+    pathname = pathname.slice(stripPrefix.length) || "/";
+  const target = `${backendBase}${pathname}${incoming.search}`, fwd = new Headers(req.headers);
+  fwd.delete("host");
+  fwd.delete("content-length");
+  fwd.set("x-forwarded-host", incoming.host);
+  fwd.set("x-forwarded-proto", incoming.protocol.replace(":", ""));
+  const body = req.method === "GET" || req.method === "HEAD" ? void 0 : await req.arrayBuffer(), upstream = await fetch(target, {
+    method: req.method,
+    headers: fwd,
+    body,
+    redirect: "manual"
+  }), out = new Headers(upstream.headers);
+  out.delete("content-length");
+  out.delete("content-encoding");
+  return new Response(upstream.body, {
+    status: upstream.status,
+    statusText: upstream.statusText,
+    headers: out
+  });
+}

package/dist/start.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/start.js

@@ -0,0 +1,54 @@
+globalThis.__STACKS_BINARY_MODE__ = !0;
+import { assertRouteMiddlewareResolvable, loadRoutes, serve } from "@stacksjs/router";
+import { log, report } from "@stacksjs/logging";
+import config from "./config-production";
+import routeRegistry from "../../../../../app/Routes";
+process.on("unhandledRejection", (reason) => {
+  report(reason, { label: "[server] unhandledRejection" });
+});
+process.on("uncaughtException", (error) => {
+  report(error, { label: "[server] uncaughtException" });
+  log.flush().finally(() => process.exit(1));
+});
+console.log("[START] Application starting...");
+console.log("[START] Node version:", process.version);
+console.log("[START] Working directory:", process.cwd());
+console.log("[START] Environment:", process.env.APP_ENV || "not set");
+process.env.SKIP_CONFIG_LOADING = "true";
+console.log("[START] Config loaded:", {
+  port: config.server.port,
+  host: config.server.host,
+  appName: config.app.name,
+  appUrl: config.app.url
+});
+console.log("[START] Loading routes from registry...");
+loadRoutes(routeRegistry).then(async () => {
+  console.log("[START] Routes loaded successfully");
+  try {
+    await import("../../orm/routes");
+    console.log("[START] ORM routes loaded successfully");
+  } catch (ormError) {
+    console.warn("[START] ORM routes skipped:", ormError instanceof Error ? ormError.message : String(ormError));
+  }
+  try {
+    await assertRouteMiddlewareResolvable();
+    console.log("[START] Route middleware validated");
+  } catch (middlewareError) {
+    console.error("[START] FATAL: unresolvable route middleware \u2014 refusing to serve unprotected routes:", middlewareError instanceof Error ? middlewareError.message : String(middlewareError));
+    process.exit(1);
+  }
+  console.log("[START] Calling serve()...");
+  try {
+    serve({
+      port: config.server.port,
+      host: config.server.host
+    });
+    console.log("[START] serve() called successfully");
+  } catch (error) {
+    console.error("[START] ERROR calling serve():", error);
+    process.exit(1);
+  }
+}).catch((error) => {
+  console.error("[START] ERROR loading routes:", error);
+  process.exit(1);
+});

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/server",
   "type": "module",
   "sideEffects": false,
-  "version": "0.70.88",
+  "version": "0.70.90",
   "description": "Local development and production-ready.",
   "author": "Chris Breuer",
   "contributors": [
@@ -53,11 +53,11 @@
     "prepublishOnly": "bun run build"
   },
   "devDependencies": {
-    "@stacksjs/config": "0.70.88",
+    "@stacksjs/config": "0.70.90",
     "better-dx": "^0.2.16",
-    "@stacksjs/path": "0.70.88",
-    "@stacksjs/router": "0.70.88",
-    "@stacksjs/validation": "0.70.88",
+    "@stacksjs/path": "0.70.90",
+    "@stacksjs/router": "0.70.90",
+    "@stacksjs/validation": "0.70.90",
     "bun-plugin-auto-imports": "^0.4.0"
   }
 }