two-stroke 6.5.2 → 7.0.0

package/CLAUDE.md

@@ -0,0 +1,50 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## What is this?
+
+Two-stroke is a lightweight TypeScript framework for building type-safe APIs on Cloudflare Workers. It provides structured routing, authentication (PBKDF, JWT/JWK), Zod-based request/response validation, auto-generated OpenAPI docs, queue/cron/email handlers, and Sentry error tracking.
+
+## Commands
+
+All commands are exposed as bin scripts (no `npm run` prefix needed when installed):
+
+- **`pnpm lint`** — ESLint + Prettier check (fails on violations)
+- **`pnpm format`** — ESLint fix + Prettier write
+- **`pnpm test`** — Builds with `wrangler deploy --dry-run`, then runs Vitest with Cloudflare Workers pool (Miniflare)
+- **`pnpm type-check`** — `wrangler deploy --dry-run` + `tsc --noEmit`
+- **`pnpm dev`** — Local dev server via `wrangler dev`
+- **`pnpm deploy <env> <version>`** — Deploy with Sentry release tracking
+- **`pnpm api-types <url>`** — Generate TypeScript types from an OpenAPI endpoint
+
+There is no way to run a single test file directly — use Vitest's built-in filtering (e.g., `vitest run src/foo.test.ts`).
+
+## Architecture
+
+### Core source files (`src/`)
+
+- **`index.ts`** — Main `twoStroke<T>()` factory. Returns `fetch`, `queue`, `scheduled`, `email` handlers plus route registration methods (`get`, `post`, `put`, `delete`) and auth builders (`noAuth`, `pbkdf`, `jwt`). Routes are regex-matched with path parameters like `{userId}`.
+- **`types.ts`** — Core type definitions: `Env` (CF bindings union), `Route<T, A>`, `Handler<T, I, O, A, P>`, `ExtractParameterNames<S>` (extracts `{param}` from path strings).
+- **`open-api.ts`** — Generates OpenAPI 3.1.0 spec from registered routes; served at `/doc`.
+- **`test.ts`** — Test utilities: `setupTests()` (fetch mocking, OpenAPI client), `fakeJWK()` (RS256 test tokens), request recording helpers, `waitForQueue()`.
+- **`cmd.mjs`** — Shared utility for spawning subprocesses in bin scripts.
+
+### Request flow
+
+1. Route matched by regex against URL pathname
+2. Auth handler runs (returns claims or throws)
+3. Request body parsed and validated against Zod input schema (POST/PUT)
+4. Handler executes with typed context: `{ req, env, body, params, searchParams, claims, sentry, waitUntil }`
+5. Response validated against Zod output schema
+6. CORS + security headers applied automatically
+
+### Key conventions
+
+- **Zod v4** — imported as `zod/v4` (not `zod`)
+- **ESM only** — `"type": "module"` with `verbatimModuleSyntax` in tsconfig
+- **Strict TypeScript** — `strict: true`, `noUncheckedIndexedAccess: true`, `isolatedModules: true`
+- **Node 24.9+** required, pnpm 10.30+ via Corepack
+- **Prettier** — 100 char print width
+- **ESLint config** — extends `eslint-config-two-stroke`
+- **Testing** — Vitest with `@cloudflare/vitest-pool-workers` pool; globals enabled (no imports needed for `describe`, `it`, `expect`)

package/README.md

@@ -2,22 +2,6 @@
 
 A minimalist framework for Cloudflare Workers with built-in routing, authentication, and validation.
 
-## Overview
-
-Two-Stroke is a lightweight framework for building APIs with Cloudflare Workers. It provides a structured approach to defining routes, handling authentication, validating requests and responses with Zod, and managing errors with Sentry.
-
-## Features
-
-- **Type-safe routing** with path parameter extraction
-- **Schema validation** for request and response bodies using Zod
-- **Built-in authentication** methods (JWT, PBKDF)
-- **Error handling** with Sentry integration
-- **CORS support** out of the box
-- **Queue handling** for background processing
-- **Cron job support** for scheduled tasks
-- **Email handling** capabilities
-- **OpenAPI documentation** generation
-
 ## Installation
 
 ```bash
@@ -28,121 +12,420 @@ npm install two-stroke
 
 ```typescript
 import { twoStroke } from "two-stroke";
-import { z } from "zod";
+import { z } from "zod/v4";
 
-// Define your environment type
 type MyEnv = {
-  MY_SECRET: string;
   MY_KV: KVNamespace;
 };
 
-// Create a Two-Stroke app
 const app = twoStroke<MyEnv>("My API", "1.0.0");
 
-// Define routes
-app.get(
-  app.noAuth,
-  "/hello",
-  z.object({ message: z.string() }),
-  async ({ env }) => {
-    return {
-      body: { message: "Hello, World!" },
-    };
-  },
-);
+app.get(app.noAuth, "/hello", z.object({ message: z.string() }), async () => ({
+  body: { message: "Hello, World!" },
+}));
+
+export default app;
+```
+
+The `twoStroke` function returns an object that directly satisfies the Cloudflare Workers `ExportedHandler` interface — export it as `default` and it handles `fetch`, `queue`, `scheduled`, and `email` events.
+
+## API Reference
+
+### `twoStroke<T>(title, release, origin?)`
+
+Creates a new application instance.
+
+| Parameter | Type                                 | Description                                                                                                                                                                           |
+| --------- | ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `title`   | `string`                             | API title, used in the generated OpenAPI spec.                                                                                                                                        |
+| `release` | `string`                             | Release version, used for Sentry and OpenAPI.                                                                                                                                         |
+| `origin`  | `(origin: string \| null) => string` | Optional. Returns the `Access-Control-Allow-Origin` value for a given request origin. If omitted, defaults to `"*"`. In staging environments, `localhost` origins are always allowed. |
+
+The environment type `T` must extend `Env`, which allows values of type `string`, `Queue`, `KVNamespace`, `R2Bucket`, `D1Database`, `Fetcher`, `Hyperdrive`, `DurableObjectNamespace`, `Vectorize`, or `ImagesBinding`.
+
+Every environment must also include `SENTRY_DSN` and `SENTRY_ENVIRONMENT` string bindings. These are used automatically to initialize Sentry on every request, queue batch, scheduled event, and email.
+
+Returns an object with the following methods:
 
-// Define a route with path parameters
+---
+
+### Route Registration
+
+All route methods register an HTTP endpoint with authentication, validation, and a handler.
+
+#### `app.get(auth, path, output, handler, params?)`
+
+Registers a `GET` route.
+
+| Parameter | Type                              | Description                                                                                                  |
+| --------- | --------------------------------- | ------------------------------------------------------------------------------------------------------------ |
+| `auth`    | `(c: { req, env }) => Promise<A>` | Authentication function.                                                                                     |
+| `path`    | `string`                          | URL path pattern (e.g. `"/users/{userId}"`).                                                                 |
+| `output`  | `ZodType`                         | Zod schema validating the response body.                                                                     |
+| `handler` | `Handler`                         | Async function handling the request.                                                                         |
+| `params`  | `ZodObject`                       | Optional. Zod object schema for query parameters. When provided, these appear in the generated OpenAPI spec. |
+
+#### `app.post(auth, path, input, output, handler, params?)`
+
+Registers a `POST` route.
+
+| Parameter | Type                              | Description                                                                                                                                                                                                                                      |
+| --------- | --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `auth`    | `(c: { req, env }) => Promise<A>` | Authentication function.                                                                                                                                                                                                                         |
+| `path`    | `string`                          | URL path pattern.                                                                                                                                                                                                                                |
+| `input`   | `ZodType \| undefined`            | Zod schema validating the request body. Pass `undefined` for routes that don't require a body, or if you want to handle the body yourself (e.g a stream). Accepts both `application/json` and `application/x-www-form-urlencoded` content types. |
+| `output`  | `ZodType`                         | Zod schema validating the response body.                                                                                                                                                                                                         |
+| `handler` | `Handler`                         | Async function handling the request.                                                                                                                                                                                                             |
+| `params`  | `ZodObject`                       | Optional. Zod object schema for query parameters.                                                                                                                                                                                                |
+
+#### `app.put(auth, path, input, output, handler)`
+
+Registers a `PUT` route. Same signature as `post` (without the optional `params`).
+
+#### `app.delete(auth, path, output, handler, params?)`
+
+Registers a `DELETE` route. Same signature as `get`.
+
+---
+
+### Path Parameters
+
+Path parameters use `{name}` syntax and are automatically extracted via regex:
+
+```typescript
 app.get(
   app.noAuth,
-  "/users/{userId}",
-  z.object({ user: z.object({ id: z.string(), name: z.string() }) }),
+  "/users/{userId}/posts/{postId}",
+  z.object({ title: z.string() }),
   async ({ params }) => {
-    return {
-      body: { user: { id: params.userId, name: "John Doe" } },
-    };
+    // params.userId and params.postId are typed as string
+    return { body: { title: "Hello" } };
   },
 );
+```
 
-// Define a POST route with request validation
-app.post(
-  app.noAuth,
-  "/messages",
-  z.object({ content: z.string().min(1) }),
-  z.object({ id: z.string() }),
-  async ({ body }) => {
-    return {
-      body: { id: "msg_123" },
-    };
-  },
-);
+The `ExtractParameterNames<P>` utility type extracts parameter names from the path string at compile time, so `params` is fully typed.
 
-// Export the worker handlers
-export default app;
+---
+
+### Handler Context
+
+Every route handler receives a single context object:
+
+```typescript
+async (c: {
+  req: Request;              // Original Cloudflare Request
+  env: T;                    // Environment bindings
+  body: z.infer<I>;          // Parsed & validated request body (undefined for GET/DELETE)
+  params: { ... };           // Extracted path parameters, typed from the path string
+  searchParams: URLSearchParams;  // URL query parameters
+  claims: A;                 // Authentication claims (type depends on auth method)
+  sentry: Toucan;            // Sentry instance for error tracking
+  waitUntil: (p: Promise<void>) => void;  // Extend request lifetime
+}) => Promise<Response>
+```
+
+Handlers must return an object with a `body` and optional `status` and `headers`:
+
+```typescript
+// Success (200 is the default)
+return { body: { id: "123" } };
+
+// Redirect
+return { body: { url: "/new-location" }, status: 302, headers: { Location: "/new-location" } };
+
+// Error
+return { body: { error: "Not found" }, status: 404 };
 ```
 
-## Authentication
+Valid status codes for typed success responses are `200` (default), `301`, and `302`. Any other numeric status is allowed when the body is `{ error: string }` or omitted.
+
+---
+
+### Authentication
+
+#### `app.noAuth`
 
-Two-Stroke provides several authentication methods out of the box:
+No authentication. The `claims` value is `null`.
 
 ```typescript
-// No authentication
-app.get(app.noAuth, "/public", z.object({ message: z.string() }), async () => ({
-  body: { message: "Public endpoint" },
-}));
+app.get(app.noAuth, "/public", outputSchema, handler);
+```
 
-// PBKDF authentication
-app.get(
-  app.pbkdf("API_KEY"),
-  "/protected",
-  z.object({ message: z.string() }),
-  async () => ({ body: { message: "Protected endpoint" } }),
-);
+#### `app.pbkdf(key, customHeaderName?)`
+
+PBKDF2 key verification. Validates a `Bearer` or `token` scheme credential against a hashed secret stored in the environment. The `claims` value is `void`.
+
+| Parameter          | Type      | Description                                                                       |
+| ------------------ | --------- | --------------------------------------------------------------------------------- |
+| `key`              | `keyof T` | Environment binding name containing the PBKDF2 hash.                              |
+| `customHeaderName` | `string`  | Optional. Header name to read the credential from. Defaults to `"Authorization"`. |
+
+```typescript
+app.get(app.pbkdf("API_KEY_HASH"), "/protected", outputSchema, handler);
+
+// With custom header
+app.get(app.pbkdf("API_KEY_HASH", "X-Api-Key"), "/protected", outputSchema, handler);
+```
+
+#### `app.jwt<J>(key, audience)`
+
+JWT verification using JWK (JSON Web Keys). Fetches the OIDC configuration and JWKS from the issuer URL, then verifies the token. The `claims` value is typed as `J`.
+
+| Parameter  | Type      | Description                                                |
+| ---------- | --------- | ---------------------------------------------------------- |
+| `key`      | `keyof T` | Environment binding name containing the issuer URL.        |
+| `audience` | `keyof T` | Environment binding name containing the expected audience. |
+
+```typescript
+type Claims = { sub: string; email: string };
 
-// JWT authentication
 app.get(
-  app.jwt<{ userId: string }>("JWT_SECRET", "JWT_AUDIENCE"),
-  "/user-data",
-  z.object({ userId: z.string() }),
-  async ({ claims }) => ({ body: { userId: claims.userId } }),
+  app.jwt<Claims>("AUTH_ISSUER", "AUTH_AUDIENCE"),
+  "/me",
+  z.object({ email: z.string() }),
+  async ({ claims }) => ({
+    // claims is typed as Claims
+    body: { email: claims.email },
+  }),
 );
 ```
 
-## Queue Handling
+Authentication failures return `401` with a `WWW-Authenticate: Bearer` header.
+
+---
+
+### Queue Handling
+
+#### `app.queueHandler(input, handler)`
+
+Registers a queue consumer. Only one queue handler can be registered per app.
+
+| Parameter | Type                                                        | Description                                          |
+| --------- | ----------------------------------------------------------- | ---------------------------------------------------- |
+| `input`   | `ZodType`                                                   | Zod schema for validating each message in the batch. |
+| `handler` | `(c: { env, batch, sentry, parsedBatch }) => Promise<void>` | Async function processing the batch.                 |
+
+The `parsedBatch` is an array of `ZodSafeParseResult` objects, one per message, allowing you to handle valid and invalid messages individually.
 
 ```typescript
-// Define a queue handler
 app.queueHandler(
-  z.object({ id: z.string() }),
+  z.object({ userId: z.string(), action: z.string() }),
   async ({ batch, parsedBatch, env }) => {
     for (let i = 0; i < batch.messages.length; i++) {
-      if (parsedBatch[i].success) {
-        const data = parsedBatch[i].data;
-        // Process queue message
-        console.log(`Processing message: ${data.id}`);
+      const result = parsedBatch[i];
+      if (result.success) {
+        console.log(result.data.userId, result.data.action);
+        batch.messages[i].ack();
+      } else {
+        batch.messages[i].retry();
       }
     }
   },
 );
+```
+
+### `addToQueue(queue, message, config?)`
+
+Standalone utility for sending messages to a queue with exponential backoff retry.
 
-// Add to queue with retry logic
+```typescript
 import { addToQueue } from "two-stroke";
 
-await addToQueue(
-  env.MY_QUEUE,
-  { id: "task_123" },
-  {
-    retries: 3,
-    backoffFactor: 2,
-  },
-);
+await addToQueue(env.MY_QUEUE, { userId: "123", action: "sync" });
+```
+
+| Config Option   | Type     | Default | Description                                                  |
+| --------------- | -------- | ------- | ------------------------------------------------------------ |
+| `retries`       | `number` | `5`     | Maximum number of send attempts.                             |
+| `backoffFactor` | `number` | `2`     | Base for exponential backoff (in seconds: `factor^attempt`). |
+
+All other properties on `config` are forwarded to the Cloudflare `Queue.send()` options (e.g. `contentType`, `delaySeconds`).
+
+---
+
+### Scheduled Tasks
+
+#### `app.schedule(cron, handler)`
+
+Registers a cron-triggered handler. Multiple schedules can be registered.
+
+| Parameter | Type                                    | Description                                                |
+| --------- | --------------------------------------- | ---------------------------------------------------------- |
+| `cron`    | `string`                                | Cron expression (must match a trigger in `wrangler.toml`). |
+| `handler` | `(c: { env, sentry }) => Promise<void>` | Async function to run on schedule.                         |
+
+```typescript
+app.schedule("0 * * * *", async ({ env, sentry }) => {
+  // Runs every hour
+});
+
+app.schedule("0 0 * * *", async ({ env }) => {
+  // Runs daily at midnight
+});
 ```
 
-## Scheduled Tasks
+---
+
+### Email Handling
+
+#### `app.emailHandler(handler)`
+
+Registers an email handler for Cloudflare Email Routing. Only one email handler can be registered per app.
+
+| Parameter | Type                                             | Description                          |
+| --------- | ------------------------------------------------ | ------------------------------------ |
+| `handler` | `(c: { env, message, sentry }) => Promise<void>` | Async function processing the email. |
+
+The `message` is a Cloudflare `ForwardableEmailMessage`.
 
 ```typescript
-// Define a scheduled task
-app.schedule("*/15 * * * *", async ({ env }) => {
-  // Run every 15 minutes
-  console.log("Running scheduled task");
+app.emailHandler(async ({ message, env }) => {
+  console.log(`Email from ${message.from} to ${message.to}`);
+  await message.forward("archive@example.com");
 });
 ```
+
+---
+
+### OpenAPI Documentation
+
+A `GET /doc` endpoint is automatically registered and serves an OpenAPI 3.1.0 specification generated from all registered routes. It includes:
+
+- Path and query parameters (from path patterns and `params` schemas)
+- Request body schemas (from `input`)
+- Response body schemas (from `output`)
+- Security requirements (routes using auth other than `noAuth` are marked with bearer auth)
+- Standard `400` and `500` error response schemas
+
+---
+
+### Request & Response Behavior
+
+**Request validation**: `POST` and `PUT` bodies are validated against the `input` schema. Invalid bodies return `400` with an `error` message and Zod `issues` array.
+
+**Response validation**: `200` responses are validated against the `output` schema. Validation failures are logged but the response is still sent (the schema acts as a development-time warning, not a gate).
+
+**CORS**: All responses include `Access-Control-Allow-Origin`. `OPTIONS` requests are handled automatically with a `204` and appropriate headers allowing `GET`, `HEAD`, `PUT`, `POST`, `DELETE` methods and `Authorization`, `Content-Type` headers.
+
+**Security headers**: All responses include `Strict-Transport-Security`, `X-Content-Type-Options: nosniff`, and `Content-Security-Policy: default-src 'self'`. Custom headers from the handler are preserved and take precedence.
+
+**Content types**: Responses default to `application/json`. Handlers can override this via the `headers` return value — when `Content-Type` is not `application/json`, the body is sent as-is without JSON serialization.
+
+**Errors**: Unhandled exceptions return `500` and are reported to Sentry. Authentication failures return `401`.
+
+**404**: Unmatched routes return an empty `404` response.
+
+---
+
+## Testing Utilities
+
+Two-stroke exports testing utilities from `two-stroke/test` designed for use with Vitest and `@cloudflare/vitest-pool-workers`.
+
+### `setupTests<Paths>()`
+
+Initializes the test environment. Call once per test file. Returns:
+
+| Property                            | Type                                              | Description                                                                                                                                              |
+| ----------------------------------- | ------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `url`                               | `URL`                                             | Base URL (`https://example.com/`).                                                                                                                       |
+| `fetchMock`                         | `MockAgent`                                       | Cloudflare's fetch mock (from `cloudflare:test`). Activated with `disableNetConnect()` in `beforeAll`.                                                   |
+| `client`                            | `Client<Paths>`                                   | An `openapi-fetch` client pointed at the worker, typed with the `Paths` generic (typically generated from the OpenAPI spec).                             |
+| `waitForQueue(trigger)`             | `(trigger: () => Promise<void>) => Promise<void>` | Triggers an action and waits until the queue batch finishes processing.                                                                                  |
+| `fakeJWK(issuer, audience, claims)` | `(issuer, audience, claims) => Promise<string>`   | Generates an RS256-signed JWT for testing. Automatically mocks the OIDC discovery and JWKS endpoints on the issuer URL. Returns the signed token string. |
+
+```typescript
+import { setupTests } from "two-stroke/test";
+import type { paths } from "./api";
+
+const { client, fetchMock, fakeJWK, waitForQueue } = await setupTests<paths>();
+
+describe("GET /hello", () => {
+  it("returns a greeting", async () => {
+    const { data, response } = await client.GET("/hello");
+    expect(response.status).toBe(200);
+    expect(data?.message).toBe("Hello, World!");
+  });
+});
+```
+
+### `recordRequest(cb, statusCode, data, responseOptions?)`
+
+Creates a fetch mock reply handler that captures the JSON request body and returns a fixed response. Useful for intercepting outgoing API calls.
+
+```typescript
+let captured: unknown;
+fetchMock
+  .get("https://api.example.com")
+  .intercept({ method: "POST", path: "/webhook" })
+  .reply(
+    recordRequest(
+      (data) => {
+        captured = data;
+      },
+      200,
+      { ok: true },
+    ),
+  );
+```
+
+### `recordFormRequest(cb, statusCode, data, responseOptions?)`
+
+Same as `recordRequest` but parses the body as `application/x-www-form-urlencoded`.
+
+### `recordFirehoseRequest(cb, statusCode, data, responseOptions?)`
+
+Same as `recordRequest` but also decodes and parses a base64-encoded `Record.Data` field from the JSON body (for AWS Firehose-style payloads). Calls `cb` twice: once with the raw body and once with the decoded inner payload.
+
+---
+
+## CLI Commands
+
+Two-stroke provides executable bin scripts. In consuming projects, these are available directly as commands (e.g. `npx dev`, `npx test`). For framework development, run them with `pnpm`:
+
+### `dev`
+
+Starts a local development server via `wrangler dev`.
+
+### `test`
+
+Builds the worker with `wrangler deploy --dry-run`, generates TypeScript types from the OpenAPI spec into `test/api.d.ts`, then runs `vitest`. Passes all arguments through to vitest (e.g. `test --watch`, `test src/users.test.ts`).
+
+### `lint`
+
+Runs `eslint --cache --max-warnings=0` followed by `prettier --cache --check .`. Fails on any violation.
+
+### `format`
+
+Runs `eslint --cache --fix` followed by `prettier --cache --write .`.
+
+### `type-check`
+
+Runs `wrangler deploy --dry-run --outdir=dist` followed by `tsc --noEmit`.
+
+### `deploy <env> <version>`
+
+Deploys the worker to a Cloudflare environment with Sentry release tracking:
+
+1. Writes the version to `src/release.ts`
+2. Uploads secrets via `wrangler secret bulk`
+3. Creates and finalizes a Sentry release
+4. Runs `wrangler deploy`
+5. Uploads sourcemaps to Sentry
+
+### `api-types <urls>`
+
+Generates TypeScript type definitions from live OpenAPI endpoints. Accepts a comma-separated list of service URLs. Fetches `/doc` from each, converts to TypeScript via `openapi-typescript`, and writes definition files to `src/__definitions__/`.
+
+### `bulk <entry|rest> <entryfile>`
+
+Uploads files from `dist/` to a Cloudflare KV namespace. Used for serving static assets.
+
+- `bulk entry index.html` — uploads only the entry file (with `nocache` cache control)
+- `bulk rest index.html` — uploads everything except the entry file (with immutable cache control)
+
+Requires `NAMESPACE` and `DOMAIN` environment variables.
+
+## License
+
+MIT

package/package.json

@@ -10,19 +10,21 @@
     "type-check": "./bin/type-check.mjs"
   },
   "dependencies": {
-    "@cloudflare/vitest-pool-workers": "^0.12.19",
-    "@sentry/cli": "^3.3.0",
-    "@types/node": "^25.3.3",
-    "@typescript-eslint/eslint-plugin": "^8.56.1",
-    "@typescript-eslint/parser": "^8.56.1",
-    "@vitest/coverage-istanbul": "^4.0.18",
+    "@cloudflare/vitest-pool-workers": "^0.13.2",
+    "@sentry/cli": "^3.3.3",
+    "@types/node": "^25.5.0",
+    "@typescript-eslint/eslint-plugin": "^8.57.1",
+    "@typescript-eslint/parser": "^8.57.1",
+    "@vitest/runner": "^4.1.0",
+    "@vitest/snapshot": "^4.1.0",
     "eslint-config-prettier": "^10.1.8",
-    "eslint-config-two-stroke": "^1.4.6",
+    "eslint-config-two-stroke": "^1.5.1",
     "eslint-config-typescript": "^3.0.0",
-    "jose": "^6.2.0",
+    "jose": "^6.2.1",
     "jwk-subtle": "^1.1.5",
     "mime": "^4.1.0",
-    "miniflare": "^4.20260312.1",
+    "miniflare": "^4.20260317.0",
+    "msw": "^2.12.13",
     "openapi-fetch": "^0.17.0",
     "openapi-typescript": "^7.13.0",
     "pbkdf-subtle": "^1.1.5",
@@ -31,10 +33,10 @@
   },
   "peerDependencies": {
     "@sentry/cli": ">=2",
-    "eslint": ">=9",
+    "eslint": ">=10",
     "prettier": ">=3",
     "typescript": ">=5",
-    "vitest": ">=3",
+    "vitest": ">=4",
     "wrangler": ">=3"
   },
   "description": "Simple Cloudflare Worker framework.",
@@ -57,12 +59,12 @@
     "url": "https://github.com/change-engine/two-stroke"
   },
   "type": "module",
-  "version": "6.5.2",
+  "version": "7.0.0",
   "devDependencies": {
     "@types/eslint": "^9.6.1",
     "eslint": "^10.0.3",
     "prettier": "^3.8.1",
     "typescript": "^5.9.3",
-    "vitest": "^4.0.18"
+    "vitest": "^4.1.0"
   }
 }

package/src/fake.ts

@@ -0,0 +1,3 @@
+import { twoStroke } from ".";
+
+export default twoStroke("fake", "0.1")