@stacksjs/defaults 0.70.229 → 0.70.231

package/resources/components/index.ts

@@ -6,8 +6,7 @@
 
 // Layout components
 export { default as DashboardLayout } from './Dashboard/DashboardLayout.stx'
-export { default as NavbarModern } from './Dashboard/NavbarModern.stx'
-export { default as SidebarModern } from './Dashboard/SidebarModern.stx'
+export { default as DashboardNavbar } from './Dashboard/Navbar.stx'
 
 // Dashboard and UI components
 export * from './Dashboard'

package/resources/emails/team-invitation.stx

@@ -0,0 +1,43 @@
+<script server>
+const appName = props.appName || 'Stacks'
+const teamName = props.teamName || 'a team'
+const role = props.role || 'member'
+const invitationUrl = props.invitationUrl || '#'
+const expiresInDays = props.expiresInDays || 7
+const primaryColor = props.primaryColor || '#2563eb'
+const subject = props.subject || `You are invited to join ${teamName}`
+const year = props.year || new Date().getFullYear()
+</script>
+
+<EmailLayout title="{{ subject }}">
+  <template #header>
+    <tr>
+      <td style="background-color:{{ primaryColor }};padding:30px 40px;text-align:center;">
+        <h1 style="margin:0;color:#ffffff;font-size:24px;font-weight:600;">{{ appName }}</h1>
+      </td>
+    </tr>
+  </template>
+
+  <EmailText size="heading">Join {{ teamName }}</EmailText>
+  <EmailText>You have been invited to join <strong>{{ teamName }}</strong> as a <strong>{{ role }}</strong>.</EmailText>
+
+  <EmailButton href="{{ invitationUrl }}" bg="{{ primaryColor }}">Accept Invitation</EmailButton>
+
+  <EmailText size="sm" color="#6b7280">This invitation expires in <strong>{{ expiresInDays }} days</strong> and can only be used by this email address.</EmailText>
+  <EmailText size="sm" color="#6b7280">If you were not expecting this invitation, you can safely ignore this email.</EmailText>
+
+  <EmailDivider />
+  <EmailText size="sm" color="#9ca3af" spacing="8px">If the button above does not work, copy and paste this URL into your browser:</EmailText>
+  <p style="margin:0;word-break:break-all;">
+    <EmailLink href="{{ invitationUrl }}" color="{{ primaryColor }}">{{ invitationUrl }}</EmailLink>
+  </p>
+
+  <template #footer>
+    <tr>
+      <td style="padding:20px 40px;background-color:#f9fafb;border-top:1px solid #e5e7eb;">
+        <p style="margin:0;color:#6b7280;font-size:12px;text-align:center;">This is an automated message from {{ appName }}. Please do not reply to this email.</p>
+        <p style="margin:10px 0 0 0;color:#9ca3af;font-size:11px;text-align:center;">&copy; {{ year }} {{ appName }}. All rights reserved.</p>
+      </td>
+    </tr>
+  </template>
+</EmailLayout>

package/resources/functions/counter.ts

@@ -1,13 +1,8 @@
-// reactive state
-const count = ref(0)
-const now = useDateFormat(useNow(), 'YYYY-MM-DD HH:mm:ss')
+export const count = state(0)
 
-// functions that mutate state and trigger updates
-function increment() {
+export function increment(): void {
   // eslint-disable-next-line no-console
-  console.log('increment() was last run:', now)
+  console.log('increment() was run')
 
-  count.value++
+  count.update(value => value + 1)
 }
-
-export { count, increment }

package/resources/functions/dashboard/analytics.ts

@@ -3,12 +3,11 @@
  * pulls from the seeded `Activity` / `Request` / `Order` / `Subscriber`
  * tables and reduces to the chart-ready shape the page expects.
  *
- * No model is required to exist — the helpers fall back to empty data
- * when the table or column is missing, so analytics pages still render
- * without errors on an unseeded database.
+ * Models and tables must exist. Query failures propagate to the API layer
+ * so pages can distinguish a real empty dataset from unavailable data.
  */
 
-import { countBy, groupByDay, loadModel, safeAll, safeGet, sumByDay, topN } from './data'
+import { allRows, countBy, groupByDay, loadModel, safeGet, sumByDay, topN } from './data'
 
 export interface WebMetrics {
   totalRequests: number
@@ -25,7 +24,7 @@ export interface WebMetrics {
  */
 export async function getWebMetrics(days = 30): Promise<WebMetrics> {
   const Request = await loadModel('Request')
-  const rows = await safeAll(Request)
+  const rows = await allRows(Request)
   const ips = new Set<string>()
   let totalDuration = 0
   let durationSamples = 0
@@ -53,14 +52,14 @@ export async function getWebMetrics(days = 30): Promise<WebMetrics> {
 /** Top referrer hosts. */
 export async function getTopReferrers(n = 10): Promise<Array<{ value: string, count: number }>> {
   const Request = await loadModel('Request')
-  const rows = await safeAll(Request)
+  const rows = await allRows(Request)
   return topN(rows, 'referrer', n)
 }
 
 /** Visitor breakdown by user-agent family (best-effort). */
 export async function getBrowserBreakdown(): Promise<Array<{ value: string, count: number }>> {
   const Request = await loadModel('Request')
-  const rows = await safeAll(Request)
+  const rows = await allRows(Request)
   const counts: Record<string, number> = {}
   for (const r of rows) {
     const ua = String(safeGet(r, 'user_agent', '') || safeGet(r, 'browser', ''))
@@ -75,7 +74,7 @@ export async function getBrowserBreakdown(): Promise<Array<{ value: string, coun
 /** Visitor breakdown by device type (mobile/tablet/desktop). */
 export async function getDeviceBreakdown(): Promise<Array<{ value: string, count: number }>> {
   const Request = await loadModel('Request')
-  const rows = await safeAll(Request)
+  const rows = await allRows(Request)
   const counts: Record<string, number> = { desktop: 0, mobile: 0, tablet: 0, other: 0 }
   for (const r of rows) {
     const ua = String(safeGet(r, 'user_agent', '') || safeGet(r, 'device', '')).toLowerCase()
@@ -93,14 +92,14 @@ export async function getDeviceBreakdown(): Promise<Array<{ value: string, count
 /** Visitor breakdown by country, using an explicit `country` column. */
 export async function getCountryBreakdown(n = 10): Promise<Array<{ value: string, count: number }>> {
   const Request = await loadModel('Request')
-  const rows = await safeAll(Request)
+  const rows = await allRows(Request)
   return topN(rows, 'country', n)
 }
 
 /** Top page paths by request count. */
 export async function getTopPages(n = 10): Promise<Array<{ value: string, count: number }>> {
   const Request = await loadModel('Request')
-  const rows = await safeAll(Request)
+  const rows = await allRows(Request)
   return topN(rows, 'path', n)
 }
 
@@ -113,11 +112,11 @@ export interface SalesTimeSeries {
 
 /**
  * Revenue-per-day plus rollups, derived from the `Order` model.
- * Falls back to zero values if the model isn't loaded.
+ * Empty rows produce zero-valued rollups; unavailable data throws.
  */
 export async function getSalesTimeSeries(days = 30): Promise<SalesTimeSeries> {
   const Order = await loadModel('Order')
-  const rows = await safeAll(Order)
+  const rows = await allRows(Order)
   let totalRevenue = 0
   for (const r of rows) {
     totalRevenue += Number(safeGet(r, 'total_amount', 0)) || Number(safeGet(r, 'amount', 0)) || 0
@@ -133,14 +132,14 @@ export async function getSalesTimeSeries(days = 30): Promise<SalesTimeSeries> {
 /** Top-selling products by occurrence in OrderItems. */
 export async function getTopProducts(n = 5): Promise<Array<{ value: string, count: number }>> {
   const OrderItem = await loadModel('OrderItem')
-  const rows = await safeAll(OrderItem)
+  const rows = await allRows(OrderItem)
   return topN(rows, 'product_name', n)
 }
 
 /** Top customers by order count. */
 export async function getTopCustomers(n = 5): Promise<Array<{ value: string, count: number }>> {
   const Order = await loadModel('Order')
-  const rows = await safeAll(Order)
+  const rows = await allRows(Order)
   return topN(rows, 'customer_name', n)
 }
 
@@ -163,11 +162,11 @@ export async function getMarketingMetrics(days = 30): Promise<MarketingMetrics>
     loadModel('Review'),
   ])
   const [campaigns, lists, subscribers, posts, reviews] = await Promise.all([
-    safeAll(Campaign),
-    safeAll(EmailList),
-    safeAll(Subscriber),
-    safeAll(SocialPost),
-    safeAll(Review),
+    allRows(Campaign),
+    allRows(EmailList),
+    allRows(Subscriber),
+    allRows(SocialPost),
+    allRows(Review),
   ])
   return {
     campaignCount: campaigns.length,
@@ -187,7 +186,7 @@ export async function getEventStats(): Promise<{
   perDay: Array<{ date: string, count: number }>
 }> {
   const Activity = await loadModel('Activity')
-  const rows = await safeAll(Activity)
+  const rows = await allRows(Activity)
   return {
     total: rows.length,
     byEvent: countBy(rows, 'event'),
@@ -205,7 +204,7 @@ export async function getBlogMetrics(): Promise<{
   postsPerDay: Array<{ date: string, count: number }>
 }> {
   const [Post, Comment] = await Promise.all([loadModel('Post'), loadModel('Comment')])
-  const [posts, comments] = await Promise.all([safeAll(Post), safeAll(Comment)])
+  const [posts, comments] = await Promise.all([allRows(Post), allRows(Comment)])
   let totalViews = 0
   let publishedCount = 0
   let draftCount = 0

package/resources/functions/dashboard/config-io.ts

@@ -27,8 +27,10 @@
  *     (`env.X ?? 'y'`) — those need to be edited via env, not config
  */
 
-import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs'
-import { join, resolve } from 'node:path'
+import { chmodSync, existsSync, readdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from 'node:fs'
+import { randomUUID } from 'node:crypto'
+import { basename, dirname, join, resolve } from 'node:path'
+import { pathToFileURL } from 'node:url'
 import process from 'node:process'
 
 let projectRootCache: string | null = null
@@ -57,28 +59,39 @@ export interface ConfigFileSummary {
   name: string
   /** Display title, e.g. 'Email'. */
   title: string
-  /** Absolute path to the source file. */
-  path: string
-  /** Bytes — UI uses this to show "small / large config" hints. */
+  /** Bytes - UI uses this to show "small / large config" hints. */
   size: number
 }
 
 /** Enumerate every `.ts` config file. Hidden / non-ts files are skipped. */
-export function listConfigFiles(): ConfigFileSummary[] {
-  const dir = configDir()
-  if (!existsSync(dir)) return []
-  let entries: string[]
-  try { entries = readdirSync(dir) }
-  catch { return [] }
+export function listConfigFiles(dir = configDir()): ConfigFileSummary[] {
+  if (!existsSync(dir))
+    throw new Error(`Could not list dashboard configuration: ${dir} does not exist`)
+
+  let entries: ReturnType<typeof readdirSync>
+  try {
+    entries = readdirSync(dir, { withFileTypes: true })
+  }
+  catch (error) {
+    throw new Error(`Could not list dashboard configuration: ${error instanceof Error ? error.message : String(error)}`)
+  }
+
   const out: ConfigFileSummary[] = []
-  for (const e of entries) {
-    if (!e.endsWith('.ts') || e.startsWith('.')) continue
-    const path = join(dir, e)
-    let size = 0
-    try { size = Bun.file(path).size }
-    catch { /* unreadable — leave at 0 */ }
-    const name = e.replace(/\.ts$/, '')
-    out.push({ name, title: titleCase(name), path, size })
+  for (const entry of entries) {
+    if (!entry.isFile() || !entry.name.endsWith('.ts') || entry.name.startsWith('.'))
+      continue
+
+    const path = join(dir, entry.name)
+    let size: number
+    try {
+      size = statSync(path).size
+    }
+    catch (error) {
+      throw new Error(`Could not read dashboard configuration ${entry.name}: ${error instanceof Error ? error.message : String(error)}`)
+    }
+
+    const name = entry.name.replace(/\.ts$/, '')
+    out.push({ name, title: titleCase(name), size })
   }
   return out.sort((a, b) => a.name.localeCompare(b.name))
 }
@@ -113,29 +126,31 @@ export interface ConfigField {
 
 /** Read one config file by name (e.g. 'email'). */
 export async function readConfig(name: string): Promise<ReadResult | null> {
+  assertConfigName(name)
   const path = join(configDir(), `${name}.ts`)
   if (!existsSync(path)) return null
 
-  const stat = await Bun.file(path).stat?.().catch(() => null)
-  const mtimeMs = stat?.mtimeMs ?? Date.now()
+  let mtimeMs: number
+  try {
+    mtimeMs = (await Bun.file(path).stat()).mtimeMs
+  }
+  catch (error) {
+    throw new Error(`Failed to stat config/${name}.ts: ${error instanceof Error ? error.message : String(error)}`)
+  }
 
   // Read the source as the source-of-truth for the field listing.
-  // We deliberately do NOT re-`import()` the file after every edit — Bun
-  // caches modules by URL, query-string cache-busting (`?t=…`) caused
-  // intermittent 0-status responses for some configs (likely when the
-  // resolved value held a function or unsupported sentinel). The source
-  // text + a one-off initial import gives us everything the editor
-  // needs without re-executing the config graph on every keystroke.
   const source = readFileSync(path, 'utf8')
 
   let modVal: any
   const cached = moduleCache.get(path)
-  if (cached) {
+  if (cached?.mtimeMs === mtimeMs) {
     modVal = cached.value
   }
   else {
     try {
-      const mod = await import(path)
+      const moduleUrl = pathToFileURL(path)
+      moduleUrl.searchParams.set('dashboard-config-mtime', String(mtimeMs))
+      const mod = await import(moduleUrl.href)
       modVal = mod?.default ?? mod
       moduleCache.set(path, { mtimeMs, value: modVal })
     }
@@ -144,10 +159,8 @@ export async function readConfig(name: string): Promise<ReadResult | null> {
     }
   }
 
-  // For previously-cached modules, refresh scalar fields from the source
-  // text instead of re-importing — that way edits made via this API are
-  // reflected immediately in subsequent reads without paying the import
-  // re-evaluation cost (and without tripping Bun's URL cache).
+  // Literal overlays also cover filesystems whose timestamp precision is too
+  // coarse to distinguish two edits made in the same tick.
   modVal = applySourceOverrides(modVal, source)
   const fields = describeFields(modVal, source)
   return { values: modVal, source, fields }
@@ -164,26 +177,45 @@ export interface UpdateResult {
   source: string
 }
 
+export interface ConfigUpdate {
+  key: string
+  value: string | number | boolean
+}
+
+export interface BatchUpdateResult {
+  ok: true
+  updates: ConfigUpdate[]
+  source: string
+}
+
 export async function updateConfigKey(
   name: string,
   key: string,
   newValue: string | number | boolean,
 ): Promise<UpdateResult> {
+  const result = await updateConfigKeys(name, [{ key, value: newValue }])
+  return { ok: true, newValue, source: result.source }
+}
+
+/**
+ * Validate and apply a group of config edits as one filesystem operation.
+ * Every rewrite is prepared in memory first, so one invalid field prevents
+ * all fields from being persisted. The completed source is then swapped into
+ * place with a same-directory rename.
+ */
+export async function updateConfigKeys(
+  name: string,
+  updates: ConfigUpdate[],
+): Promise<BatchUpdateResult> {
+  assertConfigName(name)
   const path = join(configDir(), `${name}.ts`)
   if (!existsSync(path))
     throw new Error(`config/${name}.ts not found`)
 
   const source = readFileSync(path, 'utf8')
-  const rewritten = rewriteKey(source, key, newValue)
-  if (!rewritten)
-    throw new Error(`Cannot edit "${key}" in config/${name}.ts — key is not a top-level scalar literal (likely env-backed or nested).`)
-
-  writeFileSync(path, rewritten, 'utf8')
-  // We don't bust moduleCache here on purpose — re-importing with a
-  // changed-on-disk file via Bun reuses the original module from the
-  // first import; subsequent reads pick up the edit through the source-
-  // text overlay (`applySourceOverrides`) instead.
-  return { ok: true, newValue, source: rewritten }
+  const rewritten = rewriteConfigKeys(source, updates, `config/${name}.ts`)
+  atomicWrite(path, rewritten)
+  return { ok: true, updates, source: rewritten }
 }
 
 /**
@@ -223,12 +255,27 @@ function parseLiteral(literal: string): any {
 /* -------------------------------------------------------------------------- */
 
 function titleCase(name: string): string {
+  const acronyms: Record<string, string> = {
+    ai: 'AI',
+    cli: 'CLI',
+    cms: 'CMS',
+    dns: 'DNS',
+    saas: 'SaaS',
+    sms: 'SMS',
+    ui: 'UI',
+  }
+
   return name
     .split(/[-_]/)
-    .map(s => s.charAt(0).toUpperCase() + s.slice(1))
+    .map(segment => acronyms[segment.toLowerCase()] || segment.charAt(0).toUpperCase() + segment.slice(1))
     .join(' ')
 }
 
+function assertConfigName(name: string): void {
+  if (!/^[\w-]+$/.test(name))
+    throw new Error('Invalid config name')
+}
+
 function describeFields(values: any, source: string): ConfigField[] {
   if (!values || typeof values !== 'object' || Array.isArray(values)) return []
   const out: ConfigField[] = []
@@ -250,7 +297,7 @@ function describeFields(values: any, source: string): ConfigField[] {
         value,
         type,
         editable: false,
-        reason: 'Defined via env var or expression — set the env variable to change',
+        reason: 'Defined via env var or expression. Set the environment variable to change it.',
       })
       continue
     }
@@ -296,6 +343,29 @@ function scalarLiteralRegex(key: string): RegExp {
   )
 }
 
+export function rewriteConfigKeys(
+  source: string,
+  updates: ConfigUpdate[],
+  label = 'config source',
+): string {
+  if (updates.length === 0)
+    throw new Error('No configuration updates supplied')
+
+  const seen = new Set<string>()
+  let rewritten = source
+  for (const { key, value } of updates) {
+    if (!key || seen.has(key))
+      throw new Error(`Duplicate or empty configuration key "${key}"`)
+    seen.add(key)
+
+    const next = rewriteKey(rewritten, key, value)
+    if (!next)
+      throw new Error(`Cannot edit "${key}" in ${label}. The key is not a top-level scalar literal (likely env-backed or nested).`)
+    rewritten = next
+  }
+  return rewritten
+}
+
 function rewriteKey(source: string, key: string, newValue: string | number | boolean): string | null {
   const re = scalarLiteralRegex(key)
   if (!re.test(source)) return null
@@ -305,6 +375,21 @@ function rewriteKey(source: string, key: string, newValue: string | number | boo
   })
 }
 
+function atomicWrite(path: string, source: string): void {
+  const tempPath = join(dirname(path), `.${basename(path)}.${randomUUID()}.tmp`)
+  try {
+    const mode = statSync(path).mode
+    writeFileSync(tempPath, source, { encoding: 'utf8', flag: 'wx', mode })
+    chmodSync(tempPath, mode)
+    renameSync(tempPath, path)
+  }
+  catch (error) {
+    if (existsSync(tempPath))
+      unlinkSync(tempPath)
+    throw error
+  }
+}
+
 function serializeScalar(v: string | number | boolean): string {
   if (typeof v === 'string') {
     // Prefer single quotes; fall back to double if the value contains a

package/resources/functions/dashboard/data.test.ts

@@ -0,0 +1,45 @@
+import { describe, expect, test } from 'bun:test'
+import {
+  allRows,
+  countRows,
+  DashboardModelLoadError,
+  loadModel,
+  loadModelIfExists,
+  safeGet,
+} from './data'
+
+describe('dashboard model data helpers', () => {
+  test('returns real rows and counts without inventing fallback data', async () => {
+    const rows = [{ id: 1 }, { id: 2 }]
+
+    expect(await allRows({ all: async () => rows })).toEqual(rows)
+    expect(await countRows({ count: async () => 0 })).toBe(0)
+    expect(await countRows({ all: async () => rows })).toBe(2)
+  })
+
+  test('surfaces query failures and invalid query results', async () => {
+    const failure = new Error('database unavailable')
+
+    await expect(allRows({ all: async () => { throw failure } })).rejects.toBe(failure)
+    await expect(allRows({ all: async () => ({}) })).rejects.toThrow('did not return an array')
+    await expect(countRows({ count: async () => Number.NaN })).rejects.toThrow('finite number')
+  })
+
+  test('distinguishes optional missing models from strict model loads', async () => {
+    const name = 'DefinitelyMissingDashboardModelForContract'
+
+    expect(await loadModelIfExists(name)).toBeNull()
+    await expect(loadModel(name)).rejects.toBeInstanceOf(DashboardModelLoadError)
+  })
+
+  test('does not hide model accessor failures', () => {
+    const failure = new Error('accessor failed')
+    const row = {
+      get() {
+        throw failure
+      },
+    }
+
+    expect(() => safeGet(row, 'name')).toThrow(failure)
+  })
+})