Drop the exports entry for the deleted http-security module

[aamoghS]

Loose end from the adversarial review of #325.

That PR deleted packages/api/src/middleware/http-security.ts and left "./middleware/http-security" in the package exports map — so the specifier the manifest advertises resolves to a file that is not there. Nothing imports it, nothing is broken today; this removes the trap for whoever writes that import next.

Three entries were already dangling before this work — ./middleware → src/middleware.ts, ./client → src/client.ts, ./trpc-server → src/trpc-server.ts. All three point at files that do not exist. I have left them alone: they predate this stack and removing them is a separate call, not mine to make in a cleanup PR. Worth a look though.

typecheck · 426 tests · lint --max-warnings 0 · build.

---

Note

Low Risk
Manifest-only cleanup with no runtime or import changes; risk is negligible.

Overview
Removes the "./middleware/http-security" entry from @query/api’s package.json exports map after http-security.ts was deleted in a prior change.

Without this, the manifest still advertises a subpath that resolves to a missing file—nothing in the repo imports it today, but the export is a trap for the next @query/api/middleware/http-security import.

Other dangling export keys noted in the PR description (./middleware, ./client, ./trpc-server) are unchanged here.

^{Reviewed by Cursor Bugbot for commit 4bd743e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_fd99a6d7-66e9-4969-9598-932a2254cf22)

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[github-actions]

Visit the preview URL for this PR (updated for commit 4bd743e):

https://hacklytics2027--pr-328-5xypfvpp.web.app

_{(expires Sun, 16 Aug 2026 03:05:09 GMT)}

_{🔥 via Firebase Hosting GitHub Action 🌎}

_{Sign: c48ba34db61581e25fe2978355160b5eefe0e83f}

[greptile-apps]

Greptile Summary

This PR removes a stale package export for the previously deleted HTTP security middleware.

• Removes ./middleware/http-security from the @query/api exports map.
• Leaves unrelated, pre-existing dangling exports unchanged.

Confidence Score: 5/5

The PR appears safe to merge because it removes an unusable export without affecting any current repository consumer.

The removed subpath pointed to an already deleted module, while repository source, tests, fixtures, configuration, and documentation contain no imports of that subpath.

Important Files Changed

Filename	Overview
packages/api/package.json	Removes an export whose target file no longer exists; no current repository consumer references the removed subpath.

_{Reviews (1): Last reviewed commit: "chore(api): drop the exports entry for t..." | Re-trigger Greptile}