bun-plugin-stx 0.2.169 → 0.2.171

package/dist/serve.js

@@ -8721,6 +8721,7 @@ var defaultGeneratedDir4 = /* @__PURE__ */ resolve12(process20.cwd(), "src/gener
 import { BUILD_ID_HEADER, extractPageResponseStatus, findContainerRegion, getBuildId, mergeCrosswindConfig, stateDir, stateDirName } from "@stacksjs/stx";
 import { buildCodeFrame, locateFailureLine } from "@stacksjs/stx/build-message";
 import { clearBundleFailures, getBundleFailures } from "@stacksjs/stx/client-script-bundler";
+import { compressResponse, runPageAction as sharedRunPageAction } from "@stacksjs/stx";
 var defaultStxModule = import("@stacksjs/stx");
 var REACTIVE_TEMPLATE_DIRECTIVE_RE = /@for|:for|@if|:if|@else|:else|x-for|x-if|x-else/;
 function extractServerScriptsFromTemplate(content) {
@@ -9379,6 +9380,7 @@ function __stxOverlay(errs){
     const full = reqCtx ?? {
       url: "",
       path: "",
+      method: "GET",
       search,
       host,
       cookieHeader: activeServeCookieHeader,
@@ -9520,7 +9522,7 @@ function __stxOverlay(errs){
     pageMiddlewarePatterns.length = 0;
     await Promise.all(files.map((f) => detectPageMiddleware(f)));
     try {
-      const { Router } = await import("./chunk-z66h8w4a.js");
+      const { Router } = await import("./chunk-ebg5468e.js");
       const pagesDirs = patterns.map((p) => p.replace(/\/$/, "")).filter(Boolean);
       const router = new Router(process19.cwd(), { pagesDirs, stateDir: stateDirName() });
       if (!options.quiet)
@@ -9700,57 +9702,17 @@ function __stxOverlay(errs){
       return "";
     }
   }
-  async function parseFormBody(request) {
-    const type = request.headers.get("content-type") || "";
-    const form = {};
-    const put = (key, value) => {
-      const existing = form[key];
-      if (existing === undefined)
-        form[key] = value;
-      else if (Array.isArray(existing))
-        existing.push(value);
-      else
-        form[key] = [existing, value];
-    };
-    if (type.includes("multipart/form-data")) {
-      const data = await request.formData();
-      for (const [key, value] of data.entries()) {
-        if (typeof value === "string")
-          put(key, value);
-      }
-      return form;
-    }
-    if (type.includes("application/x-www-form-urlencoded")) {
-      for (const [key, value] of new URLSearchParams(await request.text()).entries())
-        put(key, value);
-      return form;
-    }
-    return form;
-  }
   async function runPageAction(context, reqCtx) {
-    if (!reqCtx || reqCtx.method === "GET" || reqCtx.method === "HEAD")
-      return;
-    if (typeof context.action !== "function" || !reqCtx.request)
+    if (!reqCtx)
       return;
-    let form = {};
-    try {
-      form = await parseFormBody(reqCtx.request);
-    } catch {}
-    const result = await context.action({
+    const result = await sharedRunPageAction(context, {
       request: reqCtx.request,
-      form,
+      method: reqCtx.method,
       params: reqCtx.params ?? {},
-      query: context.query ?? {},
       cookies: reqCtx.cookies ?? {}
     });
-    if (result && typeof result === "object") {
-      const to = result.redirect;
-      if (typeof to === "string" && to) {
-        reqCtx.actionRedirect = to;
-        return;
-      }
-      Object.assign(context, result);
-    }
+    if (result.redirect)
+      reqCtx.actionRedirect = result.redirect;
   }
   async function processTemplate(filePath, reqCtx) {
     const content = await Bun.file(filePath).text();
@@ -10136,426 +10098,427 @@ ${html}`;
         reusePort: options.reusePort ?? false,
         idleTimeout: 0,
         async fetch(req, server) {
-          const url = new URL(req.url);
-          let path = url.pathname;
-          const proxyRules = stxConfig.server?.proxy;
-          if (proxyRules) {
-            for (const [prefix, rule] of Object.entries(proxyRules)) {
-              if (path !== prefix && !path.startsWith(prefix))
-                continue;
-              const ruleCfg = typeof rule === "string" ? { target: rule } : rule;
-              const outPath = ruleCfg.rewrite ? ruleCfg.rewrite(path) : path;
-              const target = new URL(ruleCfg.target);
-              const outUrl = new URL(outPath + url.search, target);
-              const headers = new Headers(req.headers);
-              if (ruleCfg.changeOrigin !== false)
-                headers.set("host", target.host);
-              try {
-                return await fetch(outUrl, {
-                  method: req.method,
-                  headers,
-                  body: req.body,
-                  redirect: "manual",
-                  ...req.body ? { duplex: "half" } : {}
-                });
-              } catch (err) {
-                return new Response(`[stx dev proxy] ${prefix} \u2192 ${ruleCfg.target} failed: ${err instanceof Error ? err.message : String(err)}`, { status: 502 });
+          return compressResponse(req, await (async () => {
+            const url = new URL(req.url);
+            let path = url.pathname;
+            const proxyRules = stxConfig.server?.proxy;
+            if (proxyRules) {
+              for (const [prefix, rule] of Object.entries(proxyRules)) {
+                if (path !== prefix && !path.startsWith(prefix))
+                  continue;
+                const ruleCfg = typeof rule === "string" ? { target: rule } : rule;
+                const outPath = ruleCfg.rewrite ? ruleCfg.rewrite(path) : path;
+                const target = new URL(ruleCfg.target);
+                const outUrl = new URL(outPath + url.search, target);
+                const headers = new Headers(req.headers);
+                if (ruleCfg.changeOrigin !== false)
+                  headers.set("host", target.host);
+                try {
+                  return await fetch(outUrl, {
+                    method: req.method,
+                    headers,
+                    body: req.body,
+                    redirect: "manual",
+                    ...req.body ? { duplex: "half" } : {}
+                  });
+                } catch (err) {
+                  return new Response(`[stx dev proxy] ${prefix} \u2192 ${ruleCfg.target} failed: ${err instanceof Error ? err.message : String(err)}`, { status: 502 });
+                }
               }
             }
-          }
-          let i18nLocale = null;
-          if (i18nConfig && !url.pathname.startsWith("/api/")) {
-            const stripped = localeFromPath(url.pathname);
-            i18nLocale = stripped.locale;
-            if (stripped.path !== url.pathname) {
-              const rewritten = new URL(req.url);
-              rewritten.pathname = stripped.path;
-              const headers = new Headers(req.headers);
-              headers.set("x-stx-locale", stripped.locale);
-              req = new Request(rewritten, { headers, method: req.method, body: req.body, redirect: req.redirect, duplex: "half" });
-              path = stripped.path;
-            } else if (i18nLocale) {
-              const headers = new Headers(req.headers);
-              headers.set("x-stx-locale", i18nLocale);
-              req = new Request(req, { headers });
-            }
-          }
-          let mintedCsrfToken = null;
-          const _i18nResp = await (async () => {
-            activeServeLocale = i18nLocale;
-            activeServeSearch = url.search;
-            activeServeHost = req.headers.get("host") || "";
-            activeServeCookieHeader = req.headers.get("cookie") || "";
-            activeServeCookies = parseCookies(req);
-            activeServeIp = server.requestIP(req)?.address || (req.headers.get("x-forwarded-for") || "").split(",")[0].trim();
-            mintedCsrfToken = csrfTokenToMint(req, activeServeCookies);
-            if (mintedCsrfToken)
-              activeServeCookies[CSRF_COOKIE] = mintedCsrfToken;
-            const reqCtx = {
-              url: req.url,
-              path,
-              search: activeServeSearch,
-              host: activeServeHost,
-              cookieHeader: activeServeCookieHeader,
-              cookies: activeServeCookies,
-              ip: activeServeIp,
-              locale: activeServeLocale,
-              params: {},
-              method: (req.method || "GET").toUpperCase(),
-              request: req
-            };
-            try {
-              if (req.method === "OPTIONS") {
-                return new Response(null, { headers: corsHeaders });
+            let i18nLocale = null;
+            if (i18nConfig && !url.pathname.startsWith("/api/")) {
+              const stripped = localeFromPath(url.pathname);
+              i18nLocale = stripped.locale;
+              if (stripped.path !== url.pathname) {
+                const rewritten = new URL(req.url);
+                rewritten.pathname = stripped.path;
+                const headers = new Headers(req.headers);
+                headers.set("x-stx-locale", stripped.locale);
+                req = new Request(rewritten, { headers, method: req.method, body: req.body, redirect: req.redirect, duplex: "half" });
+                path = stripped.path;
+              } else if (i18nLocale) {
+                const headers = new Headers(req.headers);
+                headers.set("x-stx-locale", i18nLocale);
+                req = new Request(req, { headers });
               }
-              if (path === "/_stx/hmr") {
-                let controller;
-                let keepalive;
-                const stream = new ReadableStream({
-                  start(c) {
-                    controller = c;
-                    hmrClients.add(c);
-                    c.enqueue(hmrEncoder.encode(`data: {"type":"connected"}
+            }
+            let mintedCsrfToken = null;
+            const _i18nResp = await (async () => {
+              activeServeLocale = i18nLocale;
+              activeServeSearch = url.search;
+              activeServeHost = req.headers.get("host") || "";
+              activeServeCookieHeader = req.headers.get("cookie") || "";
+              activeServeCookies = parseCookies(req);
+              activeServeIp = server.requestIP(req)?.address || (req.headers.get("x-forwarded-for") || "").split(",")[0].trim();
+              mintedCsrfToken = csrfTokenToMint(req, activeServeCookies);
+              if (mintedCsrfToken)
+                activeServeCookies[CSRF_COOKIE] = mintedCsrfToken;
+              const reqCtx = {
+                url: req.url,
+                path,
+                search: activeServeSearch,
+                host: activeServeHost,
+                cookieHeader: activeServeCookieHeader,
+                cookies: activeServeCookies,
+                ip: activeServeIp,
+                locale: activeServeLocale,
+                params: {},
+                method: (req.method || "GET").toUpperCase(),
+                request: req
+              };
+              try {
+                if (req.method === "OPTIONS") {
+                  return new Response(null, { headers: corsHeaders });
+                }
+                if (path === "/_stx/hmr") {
+                  let controller;
+                  let keepalive;
+                  const stream = new ReadableStream({
+                    start(c) {
+                      controller = c;
+                      hmrClients.add(c);
+                      c.enqueue(hmrEncoder.encode(`data: {"type":"connected"}
 
 `));
-                    if (currentBuildErrors.length > 0) {
-                      c.enqueue(hmrEncoder.encode(`data: ${JSON.stringify({ type: "build-error", errors: currentBuildErrors })}
+                      if (currentBuildErrors.length > 0) {
+                        c.enqueue(hmrEncoder.encode(`data: ${JSON.stringify({ type: "build-error", errors: currentBuildErrors })}
 
 `));
-                    }
-                    keepalive = setInterval(() => {
-                      try {
-                        c.enqueue(hmrEncoder.encode(`: keepalive
+                      }
+                      keepalive = setInterval(() => {
+                        try {
+                          c.enqueue(hmrEncoder.encode(`: keepalive
 
 `));
-                      } catch {}
-                    }, 5000);
-                  },
-                  cancel() {
-                    if (keepalive)
-                      clearInterval(keepalive);
-                    if (controller)
-                      hmrClients.delete(controller);
-                  }
-                });
-                return new Response(stream, {
-                  headers: {
-                    "Content-Type": "text/event-stream",
-                    "Cache-Control": "no-cache, no-transform",
-                    Connection: "keep-alive",
-                    "X-Accel-Buffering": "no"
-                  }
-                });
-              }
-              if (path === "/_stx/runtime.js" || path === "/_stx/router.js") {
-                const stx = await stxModule;
-                const content2 = path === "/_stx/runtime.js" ? await stx.getCachedSignalsRuntime(stxConfig.debug === true) : await stx.getCachedRouterScript();
-                const etag = `"${Bun.hash(content2).toString(16)}"`;
-                const headers = {
-                  "Content-Type": "application/javascript; charset=utf-8",
-                  "Cache-Control": "public, max-age=0, must-revalidate",
-                  ETag: etag,
-                  ...corsHeaders
-                };
-                if (req.headers.get("if-none-match") === etag)
-                  return new Response(null, { status: 304, headers });
-                if (req.method === "HEAD")
-                  return new Response(null, { headers });
-                return new Response(content2, { headers });
-              }
-              if (path === "/_stx/stores.js") {
-                const stx = await stxModule;
-                const code = typeof stx.getStoreScript === "function" ? await stx.getStoreScript() : null;
-                return new Response(code ?? "", {
-                  status: code === null ? 404 : 200,
-                  headers: {
+                        } catch {}
+                      }, 5000);
+                    },
+                    cancel() {
+                      if (keepalive)
+                        clearInterval(keepalive);
+                      if (controller)
+                        hmrClients.delete(controller);
+                    }
+                  });
+                  return new Response(stream, {
+                    headers: {
+                      "Content-Type": "text/event-stream",
+                      "Cache-Control": "no-cache, no-transform",
+                      Connection: "keep-alive",
+                      "X-Accel-Buffering": "no"
+                    }
+                  });
+                }
+                if (path === "/_stx/runtime.js" || path === "/_stx/router.js") {
+                  const stx = await stxModule;
+                  const content2 = path === "/_stx/runtime.js" ? await stx.getCachedSignalsRuntime(stxConfig.debug === true) : await stx.getCachedRouterScript();
+                  const etag = `"${Bun.hash(content2).toString(16)}"`;
+                  const headers = {
                     "Content-Type": "application/javascript; charset=utf-8",
-                    "Cache-Control": "no-store",
+                    "Cache-Control": "public, max-age=0, must-revalidate",
+                    ETag: etag,
                     ...corsHeaders
-                  }
-                });
-              }
-              const crosswindAsset = path.match(/^\/_stx\/crosswind\.([a-f0-9]{16})\.css$/);
-              if (crosswindAsset) {
-                const stx = await stxModule;
-                const content2 = stx.getCrosswindServeAsset(crosswindAsset[1]);
-                if (content2 === undefined)
-                  return new Response("Crosswind asset not found", { status: 404 });
-                const headers = {
-                  "Content-Type": "text/css; charset=utf-8",
-                  "Cache-Control": "public, max-age=31536000, immutable",
-                  ...corsHeaders
-                };
-                if (req.method === "HEAD")
-                  return new Response(null, { headers });
-                return new Response(content2, { headers });
-              }
-              if (options.onRequest) {
-                const hookResult = await options.onRequest(req);
-                if (hookResult instanceof Response)
-                  return hookResult;
-                if (hookResult && typeof hookResult === "object")
-                  Object.assign(reqCtx, hookResult);
-              }
-              const route = resolveRouteMiddleware(path);
-              const extraNames = extraProtectedPrefixes.some((p) => path === p || path.startsWith(p.endsWith("/") ? p : `${p}/`)) ? ["auth"] : [];
-              const requested = [...globalMiddlewareNames, ...route.names, ...extraNames];
-              if (requested.length > 0) {
-                const expanded = expandMiddlewareNames(requested);
-                const cookies = parseCookies(req);
-                const ctx = {
-                  path,
-                  url,
-                  params: route.params,
-                  cookies,
-                  redirect: (to, status = 302) => {
-                    const sep = to.includes("?") ? "&" : "?";
-                    const next = encodeURIComponent(path + (url.search || ""));
-                    return new Response(null, {
-                      status,
-                      headers: { Location: `${to}${sep}next=${next}` }
-                    });
-                  }
-                };
-                for (const entry of expanded) {
-                  const colon = entry.indexOf(":");
-                  const name = colon === -1 ? entry : entry.slice(0, colon);
-                  const args = colon === -1 ? [] : entry.slice(colon + 1).split(",");
-                  const handler = middlewareRegistry[name];
-                  if (!handler) {
-                    console.warn(`[stx serve] unknown middleware "${name}" on ${path}`);
-                    continue;
-                  }
-                  const result = await handler(req, ctx, ...args);
-                  if (result instanceof Response)
-                    return result;
+                  };
+                  if (req.headers.get("if-none-match") === etag)
+                    return new Response(null, { status: 304, headers });
+                  if (req.method === "HEAD")
+                    return new Response(null, { headers });
+                  return new Response(content2, { headers });
                 }
-              }
-              if (options.routes) {
-                const routeHandler = options.routes[path];
-                if (routeHandler) {
-                  return routeHandler(req);
+                if (path === "/_stx/stores.js") {
+                  const stx = await stxModule;
+                  const code = typeof stx.getStoreScript === "function" ? await stx.getStoreScript() : null;
+                  return new Response(code ?? "", {
+                    status: code === null ? 404 : 200,
+                    headers: {
+                      "Content-Type": "application/javascript; charset=utf-8",
+                      "Cache-Control": "no-store",
+                      ...corsHeaders
+                    }
+                  });
                 }
-              }
-              if (path.startsWith("/_stx/component/")) {
-                const componentName = decodeURIComponent(path.slice("/_stx/component/".length));
-                if (componentName) {
-                  try {
-                    const { processDirectives, defaultConfig: defaultConfig4 } = await stxModule;
-                    const componentTemplate = `<${componentName} />`;
-                    const componentOpts = {
-                      ...defaultConfig4,
-                      ...componentsDir && { componentsDir },
-                      ...layoutsDir && { layoutsDir },
-                      ...partialsDir && { partialsDir },
-                      autoShell: false
-                    };
-                    const html = await processDirectives(componentTemplate, {}, `${componentsDir}/${componentName}.stx`, componentOpts, new Set);
-                    return new Response(html, {
-                      headers: { "Content-Type": "text/html; charset=utf-8", ...corsHeaders }
-                    });
-                  } catch (e) {
-                    return new Response(`<div class="stx-async-error">${e.message}</div>`, {
-                      status: 500,
-                      headers: { "Content-Type": "text/html; charset=utf-8", ...corsHeaders }
-                    });
+                const crosswindAsset = path.match(/^\/_stx\/crosswind\.([a-f0-9]{16})\.css$/);
+                if (crosswindAsset) {
+                  const stx = await stxModule;
+                  const content2 = stx.getCrosswindServeAsset(crosswindAsset[1]);
+                  if (content2 === undefined)
+                    return new Response("Crosswind asset not found", { status: 404 });
+                  const headers = {
+                    "Content-Type": "text/css; charset=utf-8",
+                    "Cache-Control": "public, max-age=31536000, immutable",
+                    ...corsHeaders
+                  };
+                  if (req.method === "HEAD")
+                    return new Response(null, { headers });
+                  return new Response(content2, { headers });
+                }
+                if (options.onRequest) {
+                  const hookResult = await options.onRequest(req);
+                  if (hookResult instanceof Response)
+                    return hookResult;
+                  if (hookResult && typeof hookResult === "object")
+                    Object.assign(reqCtx, hookResult);
+                }
+                const route = resolveRouteMiddleware(path);
+                const extraNames = extraProtectedPrefixes.some((p) => path === p || path.startsWith(p.endsWith("/") ? p : `${p}/`)) ? ["auth"] : [];
+                const requested = [...globalMiddlewareNames, ...route.names, ...extraNames];
+                if (requested.length > 0) {
+                  const expanded = expandMiddlewareNames(requested);
+                  const cookies = parseCookies(req);
+                  const ctx = {
+                    path,
+                    url,
+                    params: route.params,
+                    cookies,
+                    redirect: (to, status = 302) => {
+                      const sep = to.includes("?") ? "&" : "?";
+                      const next = encodeURIComponent(path + (url.search || ""));
+                      return new Response(null, {
+                        status,
+                        headers: { Location: `${to}${sep}next=${next}` }
+                      });
+                    }
+                  };
+                  for (const entry of expanded) {
+                    const colon = entry.indexOf(":");
+                    const name = colon === -1 ? entry : entry.slice(0, colon);
+                    const args = colon === -1 ? [] : entry.slice(colon + 1).split(",");
+                    const handler = middlewareRegistry[name];
+                    if (!handler) {
+                      console.warn(`[stx serve] unknown middleware "${name}" on ${path}`);
+                      continue;
+                    }
+                    const result = await handler(req, ctx, ...args);
+                    if (result instanceof Response)
+                      return result;
                   }
                 }
-              }
-              if (path.startsWith("/api/data/") && req.method === "POST") {
-                try {
-                  const tableName = path.replace("/api/data/", "").split("/")[0];
-                  if (!tableName) {
-                    return new Response(JSON.stringify({ error: "Table name required" }), {
-                      status: 400,
-                      headers: { "Content-Type": "application/json", ...corsHeaders }
-                    });
+                if (options.routes) {
+                  const routeHandler = options.routes[path];
+                  if (routeHandler) {
+                    return routeHandler(req);
                   }
-                  if (!/^[a-zA-Z_]\w*$/.test(tableName)) {
-                    return new Response(JSON.stringify({ error: "Invalid table name" }), {
-                      status: 400,
-                      headers: { "Content-Type": "application/json", ...corsHeaders }
-                    });
+                }
+                if (path.startsWith("/_stx/component/")) {
+                  const componentName = decodeURIComponent(path.slice("/_stx/component/".length));
+                  if (componentName) {
+                    try {
+                      const { processDirectives, defaultConfig: defaultConfig4 } = await stxModule;
+                      const componentTemplate = `<${componentName} />`;
+                      const componentOpts = {
+                        ...defaultConfig4,
+                        ...componentsDir && { componentsDir },
+                        ...layoutsDir && { layoutsDir },
+                        ...partialsDir && { partialsDir },
+                        autoShell: false
+                      };
+                      const html = await processDirectives(componentTemplate, {}, `${componentsDir}/${componentName}.stx`, componentOpts, new Set);
+                      return new Response(html, {
+                        headers: { "Content-Type": "text/html; charset=utf-8", ...corsHeaders }
+                      });
+                    } catch (e) {
+                      return new Response(`<div class="stx-async-error">${e.message}</div>`, {
+                        status: 500,
+                        headers: { "Content-Type": "text/html; charset=utf-8", ...corsHeaders }
+                      });
+                    }
                   }
-                  const body = await req.json();
-                  const { Database } = await import("bun:sqlite");
-                  const dbPath = nodePath.resolve(process19.cwd(), "database/stacks.sqlite");
-                  const db = new Database(dbPath);
+                }
+                if (path.startsWith("/api/data/") && req.method === "POST") {
                   try {
-                    const tableInfo = db.query(`PRAGMA table_info("${tableName}")`).all();
-                    const validColumns = tableInfo.map((c) => c.name).filter((n) => n !== "id" && n !== "created_at" && n !== "updated_at");
-                    const columns = [];
-                    const placeholders = [];
-                    const values = [];
-                    for (const col of validColumns) {
-                      if (body[col] !== undefined && body[col] !== "") {
-                        columns.push(col);
-                        placeholders.push("?");
-                        values.push(body[col]);
-                      }
-                    }
-                    const now = new Date().toISOString();
-                    if (tableInfo.some((c) => c.name === "created_at")) {
-                      columns.push("created_at");
-                      placeholders.push("?");
-                      values.push(now);
-                    }
-                    if (tableInfo.some((c) => c.name === "updated_at")) {
-                      columns.push("updated_at");
-                      placeholders.push("?");
-                      values.push(now);
+                    const tableName = path.replace("/api/data/", "").split("/")[0];
+                    if (!tableName) {
+                      return new Response(JSON.stringify({ error: "Table name required" }), {
+                        status: 400,
+                        headers: { "Content-Type": "application/json", ...corsHeaders }
+                      });
                     }
-                    if (columns.length === 0) {
-                      return new Response(JSON.stringify({ error: "No valid fields provided" }), {
+                    if (!/^[a-zA-Z_]\w*$/.test(tableName)) {
+                      return new Response(JSON.stringify({ error: "Invalid table name" }), {
                         status: 400,
                         headers: { "Content-Type": "application/json", ...corsHeaders }
                       });
                     }
-                    const query = `INSERT INTO "${tableName}" (${columns.join(", ")}) VALUES (${placeholders.join(", ")})`;
-                    const stmt = db.prepare(query);
-                    const result = stmt.run(...values);
-                    return new Response(JSON.stringify({
-                      success: true,
-                      id: result.lastInsertRowid,
-                      message: "Record created successfully"
-                    }), {
-                      status: 201,
-                      headers: { "Content-Type": "application/json", ...corsHeaders }
-                    });
-                  } catch (error) {
-                    console.error("API Error:", error);
-                    return new Response(JSON.stringify({
-                      error: error.message || "Failed to create record"
-                    }), {
-                      status: 500,
-                      headers: { "Content-Type": "application/json", ...corsHeaders }
-                    });
-                  } finally {
-                    db.close();
-                  }
-                } catch {}
-              }
-              if (path === "/index")
-                path = "/";
-              if (path === "/") {
-                const indexContent = await getRoute("/", reqCtx);
-                if (!indexContent) {
-                  const homeContent = await getRoute("/home", reqCtx);
-                  if (homeContent) {
-                    return new Response(null, {
-                      status: 302,
-                      headers: {
-                        Location: "/home",
-                        ...corsHeaders
+                    const body = await req.json();
+                    const { Database } = await import("bun:sqlite");
+                    const dbPath = nodePath.resolve(process19.cwd(), "database/stacks.sqlite");
+                    const db = new Database(dbPath);
+                    try {
+                      const tableInfo = db.query(`PRAGMA table_info("${tableName}")`).all();
+                      const validColumns = tableInfo.map((c) => c.name).filter((n) => n !== "id" && n !== "created_at" && n !== "updated_at");
+                      const columns = [];
+                      const placeholders = [];
+                      const values = [];
+                      for (const col of validColumns) {
+                        if (body[col] !== undefined && body[col] !== "") {
+                          columns.push(col);
+                          placeholders.push("?");
+                          values.push(body[col]);
+                        }
                       }
-                    });
+                      const now = new Date().toISOString();
+                      if (tableInfo.some((c) => c.name === "created_at")) {
+                        columns.push("created_at");
+                        placeholders.push("?");
+                        values.push(now);
+                      }
+                      if (tableInfo.some((c) => c.name === "updated_at")) {
+                        columns.push("updated_at");
+                        placeholders.push("?");
+                        values.push(now);
+                      }
+                      if (columns.length === 0) {
+                        return new Response(JSON.stringify({ error: "No valid fields provided" }), {
+                          status: 400,
+                          headers: { "Content-Type": "application/json", ...corsHeaders }
+                        });
+                      }
+                      const query = `INSERT INTO "${tableName}" (${columns.join(", ")}) VALUES (${placeholders.join(", ")})`;
+                      const stmt = db.prepare(query);
+                      const result = stmt.run(...values);
+                      return new Response(JSON.stringify({
+                        success: true,
+                        id: result.lastInsertRowid,
+                        message: "Record created successfully"
+                      }), {
+                        status: 201,
+                        headers: { "Content-Type": "application/json", ...corsHeaders }
+                      });
+                    } catch (error) {
+                      console.error("API Error:", error);
+                      return new Response(JSON.stringify({
+                        error: error.message || "Failed to create record"
+                      }), {
+                        status: 500,
+                        headers: { "Content-Type": "application/json", ...corsHeaders }
+                      });
+                    } finally {
+                      db.close();
+                    }
+                  } catch {}
+                }
+                if (path === "/index")
+                  path = "/";
+                if (path === "/") {
+                  const indexContent = await getRoute("/", reqCtx);
+                  if (!indexContent) {
+                    const homeContent = await getRoute("/home", reqCtx);
+                    if (homeContent) {
+                      return new Response(null, {
+                        status: 302,
+                        headers: {
+                          Location: "/home",
+                          ...corsHeaders
+                        }
+                      });
+                    }
                   }
                 }
-              }
-              const content = await getRoute(path, reqCtx);
-              if (reqCtx.actionRedirect) {
-                return new Response(null, {
-                  status: 303,
-                  headers: { ...corsHeaders, Location: reqCtx.actionRedirect }
-                });
-              }
-              if (content) {
-                const responseStatus = reqCtx.responseStatus ?? 200;
-                const isSpaNav = req.headers.get("X-STX-Router") === "true";
-                if (isSpaNav) {
-                  const layoutMatch = content.match(/<!-- stx-layout: ([^ ]+) -->/);
-                  const pageLayout = layoutMatch ? layoutMatch[1] : "default";
-                  const groupMetaMatch = content.match(/<meta\b[^>]*name=["']stx-layout-group["'][^>]*content=["']([^"']+)["'][^>]*>/i);
-                  const pageLayoutGroup = i18nConfig && i18nLocale ? `i18n:${i18nLocale}` : groupMetaMatch?.[1] || deriveLayoutGroup(pageLayout);
-                  let fragment = content;
-                  let containerAttrs = "";
-                  let mainContentStart = -1;
-                  let mainContentEnd = -1;
-                  const headStyles = [];
-                  const headMatch = content.match(/<head\b[^>]*>([\s\S]*?)<\/head>/i);
-                  if (headMatch) {
-                    const headContent = headMatch[1];
-                    let styleMatch;
-                    const styleRe = /<style\b[^>]*>[\s\S]*?<\/style>/gi;
-                    while ((styleMatch = styleRe.exec(headContent)) !== null) {
-                      if (styleMatch[0].includes("data-crosswind")) {
-                        const cssContent = styleMatch[0].replace(/<style[^>]*>/, "").replace(/<\/style>/, "");
-                        const hiddenRule = cssContent.indexOf("[hidden]");
-                        if (hiddenRule !== -1) {
-                          const afterPreflight = cssContent.indexOf("}", hiddenRule) + 1;
-                          const utilities = cssContent.slice(afterPreflight).trim();
-                          if (utilities) {
-                            headStyles.push(`<style data-crosswind="fragment">${utilities}</style>`);
+                const content = await getRoute(path, reqCtx);
+                if (reqCtx.actionRedirect) {
+                  return new Response(null, {
+                    status: 303,
+                    headers: { ...corsHeaders, Location: reqCtx.actionRedirect }
+                  });
+                }
+                if (content) {
+                  const responseStatus = reqCtx.responseStatus ?? 200;
+                  const isSpaNav = req.headers.get("X-STX-Router") === "true";
+                  if (isSpaNav) {
+                    const layoutMatch = content.match(/<!-- stx-layout: ([^ ]+) -->/);
+                    const pageLayout = layoutMatch ? layoutMatch[1] : "default";
+                    const groupMetaMatch = content.match(/<meta\b[^>]*name=["']stx-layout-group["'][^>]*content=["']([^"']+)["'][^>]*>/i);
+                    const pageLayoutGroup = i18nConfig && i18nLocale ? `i18n:${i18nLocale}` : groupMetaMatch?.[1] || deriveLayoutGroup(pageLayout);
+                    let fragment = content;
+                    let containerAttrs = "";
+                    let mainContentStart = -1;
+                    let mainContentEnd = -1;
+                    const headStyles = [];
+                    const headMatch = content.match(/<head\b[^>]*>([\s\S]*?)<\/head>/i);
+                    if (headMatch) {
+                      const headContent = headMatch[1];
+                      let styleMatch;
+                      const styleRe = /<style\b[^>]*>[\s\S]*?<\/style>/gi;
+                      while ((styleMatch = styleRe.exec(headContent)) !== null) {
+                        if (styleMatch[0].includes("data-crosswind")) {
+                          const cssContent = styleMatch[0].replace(/<style[^>]*>/, "").replace(/<\/style>/, "");
+                          const hiddenRule = cssContent.indexOf("[hidden]");
+                          if (hiddenRule !== -1) {
+                            const afterPreflight = cssContent.indexOf("}", hiddenRule) + 1;
+                            const utilities = cssContent.slice(afterPreflight).trim();
+                            if (utilities) {
+                              headStyles.push(`<style data-crosswind="fragment">${utilities}</style>`);
+                            }
                           }
+                          continue;
                         }
-                        continue;
+                        headStyles.push(styleMatch[0]);
+                      }
+                      const crosswindLinkRe = /<link\b[^>]*\bdata-crosswind=(?:"generated"|'generated')[^>]*>/gi;
+                      let crosswindLinkMatch;
+                      while ((crosswindLinkMatch = crosswindLinkRe.exec(headContent)) !== null) {
+                        headStyles.push(crosswindLinkMatch[0]);
                       }
-                      headStyles.push(styleMatch[0]);
                     }
-                    const crosswindLinkRe = /<link\b[^>]*\bdata-crosswind=(?:"generated"|'generated')[^>]*>/gi;
-                    let crosswindLinkMatch;
-                    while ((crosswindLinkMatch = crosswindLinkRe.exec(headContent)) !== null) {
-                      headStyles.push(crosswindLinkMatch[0]);
+                    const containerSelector = stxConfig?.router?.container || "main";
+                    const containerRegion = findContainerRegion(fragment, containerSelector);
+                    if (!containerRegion) {
+                      console.warn(`[stx] No SPA swap container matching "${containerSelector}" in ${new URL(req.url).pathname}. SPA navigation is disabled for links on this page; the full document will load instead. Add a matching element, or point router.container at one this page has.`);
                     }
-                  }
-                  const containerSelector = stxConfig?.router?.container || "main";
-                  const containerRegion = findContainerRegion(fragment, containerSelector);
-                  if (!containerRegion) {
-                    console.warn(`[stx] No SPA swap container matching "${containerSelector}" in ${new URL(req.url).pathname}. SPA navigation is disabled for links on this page; the full document will load instead. Add a matching element, or point router.container at one this page has.`);
-                  }
-                  const mainOpenMatch = containerRegion ? { 0: containerRegion.openTag, index: containerRegion.openIndex } : null;
-                  const mainCloseIdx = containerRegion ? containerRegion.end : -1;
-                  if (mainOpenMatch && mainCloseIdx !== -1) {
-                    const bodyMatch = content.match(/<body\b[^>]*>/i);
-                    if (bodyMatch) {
-                      const bodyStart = bodyMatch.index + bodyMatch[0].length;
-                      const mainIdx = mainOpenMatch.index;
-                      const beforeMain = content.slice(bodyStart, mainIdx);
-                      let bodyStyleMatch;
-                      const bodyStyleRe = /<style\b[^>]*>[\s\S]*?<\/style>/gi;
-                      while ((bodyStyleMatch = bodyStyleRe.exec(beforeMain)) !== null) {
-                        headStyles.push(bodyStyleMatch[0]);
+                    const mainOpenMatch = containerRegion ? { 0: containerRegion.openTag, index: containerRegion.openIndex } : null;
+                    const mainCloseIdx = containerRegion ? containerRegion.end : -1;
+                    if (mainOpenMatch && mainCloseIdx !== -1) {
+                      const bodyMatch = content.match(/<body\b[^>]*>/i);
+                      if (bodyMatch) {
+                        const bodyStart = bodyMatch.index + bodyMatch[0].length;
+                        const mainIdx = mainOpenMatch.index;
+                        const beforeMain = content.slice(bodyStart, mainIdx);
+                        let bodyStyleMatch;
+                        const bodyStyleRe = /<style\b[^>]*>[\s\S]*?<\/style>/gi;
+                        while ((bodyStyleMatch = bodyStyleRe.exec(beforeMain)) !== null) {
+                          headStyles.push(bodyStyleMatch[0]);
+                        }
                       }
+                      containerAttrs = mainOpenMatch[0].replace(new RegExp(`^<${containerRegion.tagName}\\b`, "i"), "").replace(/\/?>$/, "").trim();
+                      const mainStart = mainOpenMatch.index + mainOpenMatch[0].length;
+                      mainContentStart = mainStart;
+                      mainContentEnd = mainCloseIdx;
+                      fragment = fragment.slice(mainStart, mainCloseIdx).trim();
                     }
-                    containerAttrs = mainOpenMatch[0].replace(new RegExp(`^<${containerRegion.tagName}\\b`, "i"), "").replace(/\/?>$/, "").trim();
-                    const mainStart = mainOpenMatch.index + mainOpenMatch[0].length;
-                    mainContentStart = mainStart;
-                    mainContentEnd = mainCloseIdx;
-                    fragment = fragment.slice(mainStart, mainCloseIdx).trim();
-                  }
-                  const pageSetupScripts = [];
-                  const pageSetupScriptOffsets = new Set;
-                  const appendOutsideMainScript = (match) => {
-                    const offset = match.index;
-                    const insideMain = mainContentStart !== -1 && offset >= mainContentStart && offset < mainContentEnd;
-                    if (insideMain || pageSetupScriptOffsets.has(offset))
-                      return;
-                    pageSetupScriptOffsets.add(offset);
-                    pageSetupScripts.push(match[0]);
-                  };
-                  const routeParamsRe = /<script\b[^>]*data-stx-route-params[^>]*>[\s\S]*?<\/script>/gi;
-                  let setupMatch;
-                  while ((setupMatch = routeParamsRe.exec(content)) !== null) {
-                    appendOutsideMainScript(setupMatch);
-                  }
-                  const allScriptRe = /<script\b[^>]*data-stx-scoped[^>]*>[\s\S]*?<\/script>/gi;
-                  while ((setupMatch = allScriptRe.exec(content)) !== null) {
-                    const scriptContent = setupMatch[0];
-                    if (scriptContent.includes("__stx_early_mounts"))
-                      continue;
-                    if (scriptContent.includes("data-stx-reactive") && scriptContent.includes("window.__stx_reactive"))
-                      continue;
-                    appendOutsideMainScript(setupMatch);
-                  }
-                  const bridgeInitRe = /<script\b[^>]*data-stx-reactive[^>]*>(?![\s\S]*window\.__stx_reactive)[\s\S]*?<\/script>/gi;
-                  while ((setupMatch = bridgeInitRe.exec(content)) !== null) {
-                    appendOutsideMainScript(setupMatch);
-                  }
-                  fragment = fragment.replace(/<script data-stx-scoped>\s*;?\(function\(\)\s*\{[\s\S]*?<\/script>/g, "");
-                  const clearStale = "<script data-stx-page>if(window.stx)window.stx._latestSetup=null;</script>";
-                  const componentFactoryScripts = pageSetupScripts.filter((script) => script.includes("data-stx-component-factories"));
-                  const trailingPageScripts = pageSetupScripts.filter((script) => !script.includes("data-stx-component-factories"));
-                  fragment = `${headStyles.join(`
+                    const pageSetupScripts = [];
+                    const pageSetupScriptOffsets = new Set;
+                    const appendOutsideMainScript = (match) => {
+                      const offset = match.index;
+                      const insideMain = mainContentStart !== -1 && offset >= mainContentStart && offset < mainContentEnd;
+                      if (insideMain || pageSetupScriptOffsets.has(offset))
+                        return;
+                      pageSetupScriptOffsets.add(offset);
+                      pageSetupScripts.push(match[0]);
+                    };
+                    const routeParamsRe = /<script\b[^>]*data-stx-route-params[^>]*>[\s\S]*?<\/script>/gi;
+                    let setupMatch;
+                    while ((setupMatch = routeParamsRe.exec(content)) !== null) {
+                      appendOutsideMainScript(setupMatch);
+                    }
+                    const allScriptRe = /<script\b[^>]*data-stx-scoped[^>]*>[\s\S]*?<\/script>/gi;
+                    while ((setupMatch = allScriptRe.exec(content)) !== null) {
+                      const scriptContent = setupMatch[0];
+                      if (scriptContent.includes("__stx_early_mounts"))
+                        continue;
+                      if (scriptContent.includes("data-stx-reactive") && scriptContent.includes("window.__stx_reactive"))
+                        continue;
+                      appendOutsideMainScript(setupMatch);
+                    }
+                    const bridgeInitRe = /<script\b[^>]*data-stx-reactive[^>]*>(?![\s\S]*window\.__stx_reactive)[\s\S]*?<\/script>/gi;
+                    while ((setupMatch = bridgeInitRe.exec(content)) !== null) {
+                      appendOutsideMainScript(setupMatch);
+                    }
+                    fragment = fragment.replace(/<script data-stx-scoped>\s*;?\(function\(\)\s*\{[\s\S]*?<\/script>/g, "");
+                    const clearStale = "<script data-stx-page>if(window.stx)window.stx._latestSetup=null;</script>";
+                    const componentFactoryScripts = pageSetupScripts.filter((script) => script.includes("data-stx-component-factories"));
+                    const trailingPageScripts = pageSetupScripts.filter((script) => !script.includes("data-stx-component-factories"));
+                    fragment = `${headStyles.join(`
 `)}
 ${componentFactoryScripts.join(`
 `)}
@@ -10563,215 +10526,216 @@ ${fragment}
 ${clearStale}
 ${trailingPageScripts.join(`
 `)}`;
-                  const titleMatch = content.match(/<title[^>]*>([\s\S]*?)<\/title>/i);
-                  const pageTitle = titleMatch ? titleMatch[1].trim() : "";
-                  const shipsRuntime = content.includes("data-stx-runtime");
-                  return new Response(fragment, {
-                    status: isRenderFailure(content) ? 500 : responseStatus,
+                    const titleMatch = content.match(/<title[^>]*>([\s\S]*?)<\/title>/i);
+                    const pageTitle = titleMatch ? titleMatch[1].trim() : "";
+                    const shipsRuntime = content.includes("data-stx-runtime");
+                    return new Response(fragment, {
+                      status: isRenderFailure(content) ? 500 : responseStatus,
+                      headers: {
+                        "Content-Type": "text/html; charset=utf-8",
+                        "X-STX-Fragment": "true",
+                        "X-STX-Layout": pageLayout,
+                        "X-STX-Layout-Group": pageLayoutGroup,
+                        "X-STX-Runtime": shipsRuntime ? "true" : "false",
+                        ...pageTitle && { "X-STX-Title": encodeURIComponent(pageTitle) },
+                        [BUILD_ID_HEADER]: getBuildId(),
+                        ...containerAttrs && { "X-STX-Container-Attrs": encodeURIComponent(containerAttrs) },
+                        "Cache-Control": "no-store",
+                        ...corsHeaders
+                      }
+                    });
+                  }
+                  let cleaned = content;
+                  let runtimeCount = 0;
+                  cleaned = content.replace(/<script data-stx-scoped>\(function\(\)\{'use strict';var cloakStyle[\s\S]*?<\/script>/g, (match) => {
+                    runtimeCount++;
+                    return runtimeCount === 1 ? match : "";
+                  });
+                  const pageRenderFailed = isRenderFailure(cleaned);
+                  if (pageRenderFailed) {
+                    console.error(`[stx] render failed for ${new URL(req.url).pathname} \u2014 serving 500`);
+                    for (const custom500 of ["/500", "/errors/500"]) {
+                      try {
+                        const errorPage = usableErrorPage(await getRoute(custom500, reqCtx));
+                        if (errorPage) {
+                          const isProd2 = isProductionServe();
+                          return new Response(isProd2 ? errorPage : injectHmrClient(errorPage), {
+                            status: 500,
+                            headers: {
+                              "Content-Type": "text/html; charset=utf-8",
+                              "Cache-Control": "no-store",
+                              ...corsHeaders
+                            }
+                          });
+                        }
+                      } catch {}
+                    }
+                  }
+                  return new Response(injectHmrClient(cleaned), {
+                    status: pageRenderFailed ? 500 : responseStatus,
                     headers: {
                       "Content-Type": "text/html; charset=utf-8",
-                      "X-STX-Fragment": "true",
-                      "X-STX-Layout": pageLayout,
-                      "X-STX-Layout-Group": pageLayoutGroup,
-                      "X-STX-Runtime": shipsRuntime ? "true" : "false",
-                      ...pageTitle && { "X-STX-Title": encodeURIComponent(pageTitle) },
-                      [BUILD_ID_HEADER]: getBuildId(),
-                      ...containerAttrs && { "X-STX-Container-Attrs": encodeURIComponent(containerAttrs) },
                       "Cache-Control": "no-store",
                       ...corsHeaders
                     }
                   });
                 }
-                let cleaned = content;
-                let runtimeCount = 0;
-                cleaned = content.replace(/<script data-stx-scoped>\(function\(\)\{'use strict';var cloakStyle[\s\S]*?<\/script>/g, (match) => {
-                  runtimeCount++;
-                  return runtimeCount === 1 ? match : "";
-                });
-                const pageRenderFailed = isRenderFailure(cleaned);
-                if (pageRenderFailed) {
-                  console.error(`[stx] render failed for ${new URL(req.url).pathname} \u2014 serving 500`);
-                  for (const custom500 of ["/500", "/errors/500"]) {
-                    try {
-                      const errorPage = usableErrorPage(await getRoute(custom500, reqCtx));
-                      if (errorPage) {
-                        const isProd2 = isProductionServe();
-                        return new Response(isProd2 ? errorPage : injectHmrClient(errorPage), {
-                          status: 500,
-                          headers: {
-                            "Content-Type": "text/html; charset=utf-8",
-                            "Cache-Control": "no-store",
-                            ...corsHeaders
-                          }
-                        });
-                      }
-                    } catch {}
-                  }
-                }
-                return new Response(injectHmrClient(cleaned), {
-                  status: pageRenderFailed ? 500 : responseStatus,
-                  headers: {
-                    "Content-Type": "text/html; charset=utf-8",
-                    "Cache-Control": "no-store",
-                    ...corsHeaders
-                  }
-                });
-              }
-              const contentWithExt = await getRoute(`${path}.html`, reqCtx);
-              if (contentWithExt) {
-                return new Response(injectHmrClient(contentWithExt), {
-                  status: reqCtx.responseStatus ?? 200,
-                  headers: {
-                    "Content-Type": "text/html; charset=utf-8",
-                    "Cache-Control": "no-store",
-                    ...corsHeaders
-                  }
-                });
-              }
-              if (path.startsWith("/chunk-") || path.endsWith(".js") || path.endsWith(".css")) {
-                try {
-                  const buildFile = Bun.file(stateDir(process19.cwd(), path));
-                  if (await buildFile.exists()) {
-                    const ext = path.split(".").pop()?.toLowerCase();
-                    const contentType = ext === "css" ? "text/css" : ext === "js" ? "application/javascript" : "text/plain";
-                    return new Response(buildFile, {
-                      headers: {
-                        "Content-Type": contentType,
-                        "Cache-Control": "no-store"
-                      }
-                    });
-                  }
-                } catch {}
-              }
-              if (path.startsWith("/assets/") || path.startsWith("/resources/assets/")) {
-                await ensureAssets();
-                let assetPathname;
-                try {
-                  assetPathname = decodeURIComponent(path);
-                } catch {
-                  return new Response("Invalid asset path", { status: 400 });
+                const contentWithExt = await getRoute(`${path}.html`, reqCtx);
+                if (contentWithExt) {
+                  return new Response(injectHmrClient(contentWithExt), {
+                    status: reqCtx.responseStatus ?? 200,
+                    headers: {
+                      "Content-Type": "text/html; charset=utf-8",
+                      "Cache-Control": "no-store",
+                      ...corsHeaders
+                    }
+                  });
                 }
-                if (!isSafeAssetPath(assetPathname))
-                  return new Response("Invalid asset path", { status: 400 });
-                for (const assetPath of assetRequestPaths(assetPathname)) {
+                if (path.startsWith("/chunk-") || path.endsWith(".js") || path.endsWith(".css")) {
                   try {
-                    const filePath = nodePath.resolve(process19.cwd(), `.${assetPath}`);
-                    const file = Bun.file(filePath);
-                    if (await file.exists()) {
-                      const ext = getAssetExtension(assetPath);
-                      if (isBundledAssetExtension(ext))
-                        return bundleBrowserAsset(filePath);
-                      return new Response(file, {
+                    const buildFile = Bun.file(stateDir(process19.cwd(), path));
+                    if (await buildFile.exists()) {
+                      const ext = path.split(".").pop()?.toLowerCase();
+                      const contentType = ext === "css" ? "text/css" : ext === "js" ? "application/javascript" : "text/plain";
+                      return new Response(buildFile, {
                         headers: {
-                          "Content-Type": staticContentTypes[ext || ""] || "application/octet-stream",
+                          "Content-Type": contentType,
                           "Cache-Control": "no-store"
                         }
                       });
                     }
+                  } catch {}
+                }
+                if (path.startsWith("/assets/") || path.startsWith("/resources/assets/")) {
+                  await ensureAssets();
+                  let assetPathname;
+                  try {
+                    assetPathname = decodeURIComponent(path);
                   } catch {
-                    continue;
+                    return new Response("Invalid asset path", { status: 400 });
                   }
-                }
-              }
-              if ((req.method === "GET" || req.method === "HEAD") && path !== "/") {
-                const publicRoot = nodePath.resolve(process19.cwd(), publicDir);
-                let safePathname;
-                try {
-                  safePathname = decodeURIComponent(path);
-                } catch {
-                  safePathname = path;
-                }
-                if (!safePathname.includes("\x00")) {
-                  const resolvedPath = nodePath.resolve(publicRoot, `.${safePathname}`);
-                  const isInsidePublicRoot = resolvedPath === publicRoot || resolvedPath.startsWith(`${publicRoot}${nodePath.sep}`);
-                  if (isInsidePublicRoot) {
+                  if (!isSafeAssetPath(assetPathname))
+                    return new Response("Invalid asset path", { status: 400 });
+                  for (const assetPath of assetRequestPaths(assetPathname)) {
                     try {
-                      const file = Bun.file(resolvedPath);
+                      const filePath = nodePath.resolve(process19.cwd(), `.${assetPath}`);
+                      const file = Bun.file(filePath);
                       if (await file.exists()) {
-                        const stat4 = await file.stat().catch(() => null);
-                        if (stat4 && !stat4.isDirectory()) {
-                          const ext = resolvedPath.split(".").pop()?.toLowerCase();
-                          return new Response(file, {
-                            headers: {
-                              "Content-Type": staticContentTypes[ext || ""] || "application/octet-stream",
-                              "Cache-Control": staticCacheControl(resolvedPath)
-                            }
-                          });
-                        }
+                        const ext = getAssetExtension(assetPath);
+                        if (isBundledAssetExtension(ext))
+                          return bundleBrowserAsset(filePath);
+                        return new Response(file, {
+                          headers: {
+                            "Content-Type": staticContentTypes[ext || ""] || "application/octet-stream",
+                            "Cache-Control": "no-store"
+                          }
+                        });
                       }
-                    } catch {}
+                    } catch {
+                      continue;
+                    }
                   }
                 }
-              }
-              if (path === "/favicon.ico") {
-                return new Response(null, { status: 204 });
-              }
-              const isProd = isProductionServe();
-              for (const custom404 of ["/404", "/errors/404"]) {
-                try {
-                  const customContent = await getRoute(custom404, reqCtx);
-                  if (customContent) {
-                    return new Response(isProd ? customContent : injectHmrClient(customContent), {
-                      status: 404,
-                      headers: { "Content-Type": "text/html; charset=utf-8" }
-                    });
+                if ((req.method === "GET" || req.method === "HEAD") && path !== "/") {
+                  const publicRoot = nodePath.resolve(process19.cwd(), publicDir);
+                  let safePathname;
+                  try {
+                    safePathname = decodeURIComponent(path);
+                  } catch {
+                    safePathname = path;
                   }
-                } catch {}
-              }
-              let availableRoutes;
-              if (!isProd) {
-                const files = await discoverFiles();
-                availableRoutes = [];
-                for (const filePath of files) {
-                  let normalizedPath = filePath.replace(/^\.\//, "").replace(/\\/g, "/");
-                  for (const pattern of patterns) {
-                    const normalizedPattern = pattern.replace(/\\/g, "/").replace(/\/$/, "");
-                    if (normalizedPath.startsWith(`${normalizedPattern}/`)) {
-                      normalizedPath = normalizedPath.slice(normalizedPattern.length + 1);
-                      break;
+                  if (!safePathname.includes("\x00")) {
+                    const resolvedPath = nodePath.resolve(publicRoot, `.${safePathname}`);
+                    const isInsidePublicRoot = resolvedPath === publicRoot || resolvedPath.startsWith(`${publicRoot}${nodePath.sep}`);
+                    if (isInsidePublicRoot) {
+                      try {
+                        const file = Bun.file(resolvedPath);
+                        if (await file.exists()) {
+                          const stat4 = await file.stat().catch(() => null);
+                          if (stat4 && !stat4.isDirectory()) {
+                            const ext = resolvedPath.split(".").pop()?.toLowerCase();
+                            return new Response(file, {
+                              headers: {
+                                "Content-Type": staticContentTypes[ext || ""] || "application/octet-stream",
+                                "Cache-Control": staticCacheControl(resolvedPath)
+                              }
+                            });
+                          }
+                        }
+                      } catch {}
                     }
                   }
-                  let route2 = normalizedPath.replace(/\.(stx|md|html)$/, "");
-                  if (route2.startsWith("pages/")) {
-                    route2 = route2.slice(6);
+                }
+                if (path === "/favicon.ico") {
+                  return new Response(null, { status: 204 });
+                }
+                const isProd = isProductionServe();
+                for (const custom404 of ["/404", "/errors/404"]) {
+                  try {
+                    const customContent = await getRoute(custom404, reqCtx);
+                    if (customContent) {
+                      return new Response(isProd ? customContent : injectHmrClient(customContent), {
+                        status: 404,
+                        headers: { "Content-Type": "text/html; charset=utf-8" }
+                      });
+                    }
+                  } catch {}
+                }
+                let availableRoutes;
+                if (!isProd) {
+                  const files = await discoverFiles();
+                  availableRoutes = [];
+                  for (const filePath of files) {
+                    let normalizedPath = filePath.replace(/^\.\//, "").replace(/\\/g, "/");
+                    for (const pattern of patterns) {
+                      const normalizedPattern = pattern.replace(/\\/g, "/").replace(/\/$/, "");
+                      if (normalizedPath.startsWith(`${normalizedPattern}/`)) {
+                        normalizedPath = normalizedPath.slice(normalizedPattern.length + 1);
+                        break;
+                      }
+                    }
+                    let route2 = normalizedPath.replace(/\.(stx|md|html)$/, "");
+                    if (route2.startsWith("pages/")) {
+                      route2 = route2.slice(6);
+                    }
+                    availableRoutes.push(route2);
                   }
-                  availableRoutes.push(route2);
                 }
+                const notFoundHtml = render404Page({ path, routes: availableRoutes, isProduction: isProd });
+                return new Response(isProd ? notFoundHtml : injectHmrClient(notFoundHtml), {
+                  status: 404,
+                  headers: { "Content-Type": "text/html; charset=utf-8" }
+                });
+              } finally {
+                activeServeLocale = null;
+                activeServeSearch = "";
+                activeServeHost = "";
+                activeServeCookieHeader = "";
+                activeServeCookies = {};
+                activeServeIp = "";
+              }
+            })();
+            let _finalResp = await applyI18nToResponse(_i18nResp, i18nLocale ?? (i18nConfig?.defaultLocale ?? "en"), path);
+            if (mintedCsrfToken) {
+              try {
+                _finalResp.headers.append("Set-Cookie", csrfCookieHeader(mintedCsrfToken, req.url.startsWith("https://")));
+              } catch {
+                const headers = new Headers(_finalResp.headers);
+                headers.append("Set-Cookie", csrfCookieHeader(mintedCsrfToken, req.url.startsWith("https://")));
+                _finalResp = new Response(_finalResp.body, {
+                  status: _finalResp.status,
+                  statusText: _finalResp.statusText,
+                  headers
+                });
               }
-              const notFoundHtml = render404Page({ path, routes: availableRoutes, isProduction: isProd });
-              return new Response(isProd ? notFoundHtml : injectHmrClient(notFoundHtml), {
-                status: 404,
-                headers: { "Content-Type": "text/html; charset=utf-8" }
-              });
-            } finally {
-              activeServeLocale = null;
-              activeServeSearch = "";
-              activeServeHost = "";
-              activeServeCookieHeader = "";
-              activeServeCookies = {};
-              activeServeIp = "";
             }
-          })();
-          let _finalResp = await applyI18nToResponse(_i18nResp, i18nLocale ?? (i18nConfig?.defaultLocale ?? "en"), path);
-          if (mintedCsrfToken) {
-            try {
-              _finalResp.headers.append("Set-Cookie", csrfCookieHeader(mintedCsrfToken, req.url.startsWith("https://")));
-            } catch {
-              const headers = new Headers(_finalResp.headers);
-              headers.append("Set-Cookie", csrfCookieHeader(mintedCsrfToken, req.url.startsWith("https://")));
-              _finalResp = new Response(_finalResp.body, {
-                status: _finalResp.status,
-                statusText: _finalResp.statusText,
-                headers
-              });
+            if (options.onResponse) {
+              const hooked = await options.onResponse(req, _finalResp);
+              if (hooked instanceof Response)
+                return hooked;
             }
-          }
-          if (options.onResponse) {
-            const hooked = await options.onResponse(req, _finalResp);
-            if (hooked instanceof Response)
-              return hooked;
-          }
-          return _finalResp;
+            return _finalResp;
+          })());
         }
       });
       break;