@stacksjs/defaults 0.70.229 → 0.70.231

package/app/Actions/Dashboard/Data/UserIndexAction.ts

@@ -1,47 +1,45 @@
 import { Action } from '@stacksjs/actions'
 import { User } from '@stacksjs/orm'
+import { safeGet } from '../../../../resources/functions/dashboard/data'
+import { dateValue, daysAgoIso, numberValue, textValue } from './data-records'
 
 export default new Action({
   name: 'UserIndexAction',
-  description: 'Returns user data for the dashboard.',
+  description: 'Returns a safe projection of users and native registration statistics.',
   method: 'GET',
+  apiResponse: true,
   async handle() {
-    const roles = ['All Roles', 'Admin', 'Editor', 'Author', 'Subscriber', 'User']
-
     try {
-      const allUsers = await User.orderBy('created_at', 'desc').get()
-      const totalUsers = await User.count()
-
-      const users = allUsers.map((u) => {
-        const name = String(u.get('name') || 'Unknown')
-        const initials = name.split(' ').map(n => n[0]).join('').slice(0, 2).toUpperCase()
-        return {
-          name,
-          email: String(u.get('email') || 'N/A'),
-          role: 'User',
-          status: 'active',
-          lastLogin: 'Recently',
-          avatar: initials,
-        }
-      })
+      const rows = await User.orderByDesc('created_at').limit(100).get()
+      const users = rows.map(row => ({
+        id: numberValue(safeGet(row, 'id', 0)),
+        name: textValue(safeGet(row, 'name'), 'Unnamed user'),
+        email: textValue(safeGet(row, 'email')),
+        emailVerifiedAt: dateValue(safeGet(row, 'email_verified_at', safeGet(row, 'emailVerifiedAt'))),
+        createdAt: dateValue(safeGet(row, 'created_at', safeGet(row, 'createdAt'))),
+        updatedAt: dateValue(safeGet(row, 'updated_at', safeGet(row, 'updatedAt'))),
+      }))
 
-      const stats = [
-        { label: 'Total Users', value: String(totalUsers) },
-        { label: 'Active Today', value: String(totalUsers) },
-        { label: 'New This Week', value: String(Math.min(totalUsers, 5)) },
-      ]
+      const [total, newThisWeek, verified] = await Promise.all([
+        User.count(),
+        User.where('created_at', '>=', daysAgoIso(7)).count(),
+        User.whereNotNull('email_verified_at' as never).count(),
+      ])
 
-      return { users, stats, roles }
+      return {
+        users,
+        stats: {
+          total,
+          newThisWeek,
+          verified,
+        },
+      }
     }
-    catch {
+    catch (error) {
       return {
         users: [],
-        stats: [
-          { label: 'Total Users', value: '0' },
-          { label: 'Active Today', value: '0' },
-          { label: 'New This Week', value: '0' },
-        ],
-        roles,
+        stats: { total: 0, newThisWeek: 0, verified: 0 },
+        error: error instanceof Error ? error.message : 'Users could not be loaded.',
       }
     }
   },

package/app/Actions/Dashboard/Data/data-records.test.ts

@@ -0,0 +1,19 @@
+import { describe, expect, it } from 'bun:test'
+import { createdWithinDays, dateValue, daysAgoIso, numberValue, textValue } from './data-records'
+
+describe('dashboard data record shaping', () => {
+  it('normalizes response values without leaking arbitrary objects', () => {
+    expect(textValue(null, 'fallback')).toBe('fallback')
+    expect(textValue('  active  ')).toBe('active')
+    expect(numberValue('12')).toBe(12)
+    expect(numberValue('invalid')).toBe(0)
+    expect(dateValue('invalid')).toBe('')
+  })
+
+  it('computes recent records from their real timestamps', () => {
+    const now = Date.parse('2026-07-29T12:00:00.000Z')
+    expect(createdWithinDays('2026-07-28T12:00:00.000Z', 7, now)).toBe(true)
+    expect(createdWithinDays('2026-07-01T12:00:00.000Z', 7, now)).toBe(false)
+    expect(daysAgoIso(7, now)).toBe('2026-07-22T12:00:00.000Z')
+  })
+})

package/app/Actions/Dashboard/Data/data-records.ts

@@ -0,0 +1,28 @@
+export function textValue(value: unknown, fallback = ''): string {
+  if (value === null || value === undefined)
+    return fallback
+  const result = String(value).trim()
+  return result || fallback
+}
+
+export function numberValue(value: unknown): number {
+  const result = Number(value)
+  return Number.isFinite(result) ? result : 0
+}
+
+export function dateValue(value: unknown): string {
+  const text = textValue(value)
+  if (!text)
+    return ''
+  const date = new Date(text)
+  return Number.isNaN(date.getTime()) ? '' : date.toISOString()
+}
+
+export function createdWithinDays(value: string, days: number, now = Date.now()): boolean {
+  const timestamp = new Date(value).getTime()
+  return Number.isFinite(timestamp) && timestamp >= now - days * 24 * 60 * 60 * 1000
+}
+
+export function daysAgoIso(days: number, now = Date.now()): string {
+  return new Date(now - days * 24 * 60 * 60 * 1000).toISOString()
+}

package/app/Actions/Dashboard/Deployments/CreateDeployment.ts

@@ -1,11 +1,114 @@
 import { Action } from '@stacksjs/actions'
+import { join } from 'node:path'
+import process from 'node:process'
+import { Deployment } from '@stacksjs/orm'
+import { request, response } from '@stacksjs/router'
+import { booleanValue, deploymentCommandArgs } from './deployment-input'
+
+function gitValue(args: string[]): string {
+  const result = Bun.spawnSync(['git', ...args], {
+    cwd: process.cwd(),
+    stdout: 'pipe',
+    stderr: 'ignore',
+  })
+  if (result.exitCode !== 0)
+    throw new Error('Git metadata could not be resolved for this deployment.')
+  return new TextDecoder().decode(result.stdout).trim()
+}
 
 export default new Action({
   name: 'CreateDeployment',
-  description: 'Triggers/creates a new deployment.',
+  description: 'Starts a confirmed non-interactive buddy deployment.',
+  method: 'POST',
   apiResponse: true,
 
   async handle() {
-    //
+    const dryRun = booleanValue(request.get('dryRun') || request.get('dry_run'))
+    const confirmed = booleanValue(request.get('confirmed'))
+    if (!dryRun && !confirmed) {
+      return response.json({
+        success: false,
+        confirmationRequired: true,
+        message: 'Deployment confirmation is required.',
+      }, { status: 409 })
+    }
+
+    let args: string[]
+    try {
+      args = deploymentCommandArgs({
+        environment: request.get('environment') || request.get('env'),
+        domain: request.get('domain'),
+        dryRun,
+      })
+    }
+    catch (error) {
+      return response.json({
+        success: false,
+        message: error instanceof Error ? error.message : 'Deployment input is invalid.',
+      }, { status: 422 })
+    }
+
+    let deployment: Awaited<ReturnType<typeof Deployment.create>> | null = null
+    const startedAt = Date.now()
+    if (!dryRun) {
+      try {
+        deployment = await Deployment.create({
+          commitHash: gitValue(['rev-parse', '--short=12', 'HEAD']),
+          commitMessage: gitValue(['log', '-1', '--pretty=%s']),
+          branch: gitValue(['branch', '--show-current']),
+          status: 'running',
+          environment: args[2],
+          author: gitValue(['log', '-1', '--pretty=%an <%ae>']),
+        })
+      }
+      catch (error) {
+        return response.json({
+          success: false,
+          message: error instanceof Error ? error.message : 'Deployment record could not be created.',
+        }, { status: 500 })
+      }
+    }
+
+    let child: ReturnType<typeof Bun.spawn>
+    try {
+      child = Bun.spawn([join(process.cwd(), 'buddy'), ...args], {
+        cwd: process.cwd(),
+        stdout: 'inherit',
+        stderr: 'inherit',
+      })
+      child.unref()
+    }
+    catch (error) {
+      if (deployment) {
+        await deployment.update({
+          status: 'failed',
+          duration: 0,
+          errorLog: error instanceof Error ? error.message : String(error),
+        })
+      }
+      return response.json({
+        success: false,
+        message: error instanceof Error ? error.message : 'Deployment process could not be started.',
+      }, { status: 500 })
+    }
+
+    if (deployment) {
+      const record = deployment
+      void child.exited.then(async (exitCode) => {
+        await record.update({
+          status: exitCode === 0 ? 'success' : 'failed',
+          duration: Math.max(0, Math.round((Date.now() - startedAt) / 1000)),
+          errorLog: exitCode === 0 ? '' : `buddy deploy exited with code ${exitCode}`,
+        })
+      })
+    }
+
+    return {
+      success: true,
+      pid: child.pid,
+      command: ['./buddy', ...args],
+      deployment: deployment?.toJSON() || null,
+      message: dryRun ? 'Deployment preview started.' : 'Deployment started.',
+    }
   },
 })

package/app/Actions/Dashboard/Deployments/GetAverageDeploymentTime.ts

@@ -1,15 +1,15 @@
 import { Action } from '@stacksjs/actions'
-import { response } from '@stacksjs/router'
+import { Deployment } from '@stacksjs/orm'
+import { averageRecordedDuration } from './deployment-input'
 
-// The original implementation called `Deployment.averageDuration()`,
-// which doesn't exist on the model yet. Returning a placeholder so
-// the route registers cleanly until the aggregation is wired.
 export default new Action({
   name: 'GetAverageDeploymentTime',
   description: 'Gets the average deployment time of your application.',
+  method: 'GET',
   apiResponse: true,
 
   async handle() {
-    return response.json({ average_seconds: null, note: 'Not yet implemented' })
+    const deployments = await Deployment.all()
+    return { average_seconds: averageRecordedDuration(deployments) }
   },
 })

package/app/Actions/Dashboard/Deployments/GetDeployScript.ts

@@ -1,12 +1,36 @@
 import { Action } from '@stacksjs/actions'
-// import { Deployment } from '@stacksjs/orm'
+import { readFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import process from 'node:process'
+import { response } from '@stacksjs/router'
 
 export default new Action({
   name: 'GetDeployScript',
   description: 'Gets the deploy script used by the application.',
+  method: 'GET',
   apiResponse: true,
 
   async handle() {
-    // return Deployment.script()
+    const filePath = join(process.cwd(), 'cloud', 'deploy-script.ts')
+    try {
+      return {
+        path: 'cloud/deploy-script.ts',
+        content: await readFile(filePath, 'utf8'),
+        exists: true,
+      }
+    }
+    catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') {
+        return response.json({
+          message: error instanceof Error ? error.message : 'Deploy script could not be read.',
+        }, 500)
+      }
+
+      return {
+        path: 'cloud/deploy-script.ts',
+        content: '',
+        exists: false,
+      }
+    }
   },
 })

package/app/Actions/Dashboard/Deployments/GetDeployment.ts

@@ -0,0 +1,31 @@
+import { Action } from '@stacksjs/actions'
+import { Deployment } from '@stacksjs/orm'
+import { response } from '@stacksjs/router'
+
+export default new Action({
+  name: 'GetDeployment',
+  description: 'Returns one Deployment model record for the dashboard.',
+  method: 'GET',
+  apiResponse: true,
+
+  async handle(request: RequestInstance) {
+    const id = Number(request.getParam('id'))
+    if (!Number.isFinite(id) || id <= 0)
+      return response.json({ message: 'Deployment id must be a positive number.' }, 422)
+
+    try {
+      const deployment = await Deployment.find(id)
+      if (!deployment)
+        return response.json({ message: 'Deployment not found.' }, 404)
+
+      return {
+        deployment: deployment.toJSON(),
+      }
+    }
+    catch (error) {
+      return response.json({
+        message: error instanceof Error ? error.message : 'Deployment could not be loaded.',
+      }, 503)
+    }
+  },
+})

package/app/Actions/Dashboard/Deployments/GetDeploymentCount.ts

@@ -1,12 +1,13 @@
 import { Action } from '@stacksjs/actions'
-// import { Deployment } from '@stacksjs/orm'
+import { Deployment } from '@stacksjs/orm'
 
 export default new Action({
   name: 'GetDeploymentCount',
   description: 'Gets the total number of deployments.',
+  method: 'GET',
   apiResponse: true,
 
   async handle() {
-    // return Deployment.count()
+    return await Deployment.count()
   },
 })

package/app/Actions/Dashboard/Deployments/GetDeploymentLiveTerminalOutput.ts

@@ -1,12 +1,39 @@
 import { Action } from '@stacksjs/actions'
-// import { Deployment } from '@stacksjs/orm'
+import { readFile } from 'node:fs/promises'
+import { resolve } from 'node:path'
+import process from 'node:process'
+import { logging } from '@stacksjs/config'
+import { response } from '@stacksjs/router'
+import { tailLines } from './deployment-input'
 
 export default new Action({
   name: 'GetDeploymentLiveTerminalOutput',
   description: 'Gets the live terminal output of the deployment.',
+  method: 'GET',
   apiResponse: true,
 
   async handle() {
-    // return Deployment.liveTerminalOutput()
+    const configuredPath = logging.deploymentsPath || 'storage/logs/deployments.log'
+    const filePath = resolve(process.cwd(), configuredPath)
+    try {
+      return {
+        path: configuredPath,
+        output: tailLines(await readFile(filePath, 'utf8')),
+        exists: true,
+      }
+    }
+    catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') {
+        return response.json({
+          message: error instanceof Error ? error.message : 'Deployment output could not be read.',
+        }, 500)
+      }
+
+      return {
+        path: configuredPath,
+        output: '',
+        exists: false,
+      }
+    }
   },
 })

package/app/Actions/Dashboard/Deployments/GetDeployments.ts

@@ -1,20 +1,25 @@
 import { Action } from '@stacksjs/actions'
 import { Deployment } from '@stacksjs/orm'
+import { response } from '@stacksjs/router'
 
 export default new Action({
   name: 'GetDeployments',
-  description: 'Gets your application deployments.',
+  description: 'Returns recent Deployment model records for the dashboard.',
   method: 'GET',
+  apiResponse: true,
+
   async handle() {
     try {
-      const deployments = await Deployment.orderBy('created_at', 'desc').limit(50).get()
+      const deployments = await Deployment.orderBy('created_at', 'desc').limit(100).get()
 
       return {
         deployments: deployments.map(d => d.toJSON()),
       }
     }
-    catch {
-      return { deployments: [] }
+    catch (error) {
+      return response.json({
+        message: error instanceof Error ? error.message : 'Deployment records could not be loaded.',
+      }, 503)
     }
   },
 })

package/app/Actions/Dashboard/Deployments/GetRecentDeployments.ts

@@ -1,12 +1,14 @@
 import { Action } from '@stacksjs/actions'
-// import { Deployment } from '@stacksjs/orm'
+import { Deployment } from '@stacksjs/orm'
 
 export default new Action({
   name: 'GetRecentDeployments',
   description: 'Gets recent deployments.',
+  method: 'GET',
   apiResponse: true,
 
   async handle() {
-    // return Deployment.recent(3)
+    const deployments = await Deployment.orderByDesc('created_at').limit(3).get()
+    return deployments.map(deployment => deployment.toJSON())
   },
 })

package/app/Actions/Dashboard/Deployments/UpdateDeployScript.ts

@@ -1,11 +1,41 @@
 import { Action } from '@stacksjs/actions'
+import { mkdir, rename, writeFile } from 'node:fs/promises'
+import { dirname, join } from 'node:path'
+import process from 'node:process'
+import { request, response } from '@stacksjs/router'
 
 export default new Action({
   name: 'UpdateDeployScript',
   description: 'Updates the deploy script.',
+  method: 'PUT',
   apiResponse: true,
 
   async handle() {
-    //
+    const content = String(request.get('content') || '')
+    if (!content.trim())
+      return response.json({ success: false, message: 'Deploy script content is required.' }, { status: 422 })
+    if (Buffer.byteLength(content, 'utf8') > 256 * 1024)
+      return response.json({ success: false, message: 'Deploy script must be smaller than 256 KB.' }, { status: 422 })
+
+    try {
+      new Bun.Transpiler({ loader: 'ts' }).transformSync(content)
+    }
+    catch (error) {
+      return response.json({
+        success: false,
+        message: error instanceof Error ? error.message : 'Deploy script syntax is invalid.',
+      }, { status: 422 })
+    }
+
+    const filePath = join(process.cwd(), 'cloud', 'deploy-script.ts')
+    const temporaryPath = `${filePath}.${process.pid}.tmp`
+    await mkdir(dirname(filePath), { recursive: true })
+    await writeFile(temporaryPath, content, { encoding: 'utf8', mode: 0o644 })
+    await rename(temporaryPath, filePath)
+
+    return {
+      success: true,
+      path: 'cloud/deploy-script.ts',
+    }
   },
 })

package/app/Actions/Dashboard/Deployments/deployment-input.test.ts

@@ -0,0 +1,50 @@
+import { describe, expect, it } from 'bun:test'
+import {
+  averageRecordedDuration,
+  booleanValue,
+  deploymentCommandArgs,
+  tailLines,
+} from './deployment-input'
+
+function record(duration: unknown) {
+  return {
+    get(key: string) {
+      return key === 'duration' ? duration : undefined
+    },
+  }
+}
+
+describe('dashboard deployment inputs', () => {
+  it('builds a non-interactive buddy command from validated arguments', () => {
+    expect(deploymentCommandArgs({
+      environment: 'staging',
+      domain: 'app.example.com',
+      dryRun: true,
+    })).toEqual([
+      'deploy',
+      '--env',
+      'staging',
+      '--no-interaction',
+      '--yes',
+      '--domain',
+      'app.example.com',
+      '--dry-run',
+    ])
+  })
+
+  it('rejects invalid command fields', () => {
+    expect(() => deploymentCommandArgs({ environment: '../production' })).toThrow()
+    expect(() => deploymentCommandArgs({ domain: 'not a domain' })).toThrow()
+  })
+
+  it('aggregates only recorded durations', () => {
+    expect(averageRecordedDuration([record(30), record('90'), record(null), record('bad')])).toBe(60)
+    expect(averageRecordedDuration([record('bad')])).toBeNull()
+  })
+
+  it('normalizes booleans and tails persisted output', () => {
+    expect(booleanValue('on')).toBe(true)
+    expect(booleanValue('false')).toBe(false)
+    expect(tailLines('one\ntwo\nthree', 2)).toBe('two\nthree')
+  })
+})

package/app/Actions/Dashboard/Deployments/deployment-input.ts

@@ -0,0 +1,48 @@
+export interface DeploymentCommandInput {
+  environment?: unknown
+  domain?: unknown
+  dryRun?: unknown
+}
+
+export interface DeploymentRecordLike {
+  get: (key: string) => unknown
+}
+
+export function booleanValue(value: unknown): boolean {
+  return value === true || value === 1 || value === '1' || value === 'true' || value === 'on'
+}
+
+export function deploymentCommandArgs(input: DeploymentCommandInput): string[] {
+  const environment = String(input.environment || 'production').trim().toLowerCase()
+  if (!/^[a-z0-9][a-z0-9_-]{0,63}$/.test(environment))
+    throw new Error('Environment must contain only letters, numbers, underscores, and hyphens.')
+
+  const args = ['deploy', '--env', environment, '--no-interaction', '--yes']
+  const domain = String(input.domain || '').trim().toLowerCase()
+  if (domain) {
+    if (!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(domain))
+      throw new Error('Domain must be a valid DNS name.')
+    args.push('--domain', domain)
+  }
+  if (booleanValue(input.dryRun))
+    args.push('--dry-run')
+  return args
+}
+
+export function averageRecordedDuration(records: DeploymentRecordLike[]): number | null {
+  const durations = records
+    .map(record => record.get('duration'))
+    .filter(duration => duration !== null && duration !== undefined && duration !== '')
+    .map(duration => Number(duration))
+    .filter(duration => Number.isFinite(duration) && duration >= 0)
+
+  return durations.length > 0
+    ? durations.reduce((sum, duration) => sum + duration, 0) / durations.length
+    : null
+}
+
+export function tailLines(content: string, limit = 250): string {
+  if (limit <= 0)
+    return ''
+  return content.split(/\r?\n/).slice(-limit).join('\n')
+}

package/app/Actions/Dashboard/Email/CapturedMailIndexAction.ts

@@ -0,0 +1,27 @@
+import { Action } from '@stacksjs/actions'
+import { response } from '@stacksjs/router'
+import { listCapturedMail } from './captured-mail'
+
+export default new Action({
+  name: 'CapturedMailIndexAction',
+  description: 'Returns outbound emails captured by the local log mail driver.',
+  method: 'GET',
+  apiResponse: true,
+
+  async handle() {
+    try {
+      const messages = await listCapturedMail()
+      return {
+        captureDriver: 'log',
+        activeDriver: process.env.MAIL_MAILER || 'log',
+        total: messages.length,
+        messages,
+      }
+    }
+    catch (error) {
+      return response.json({
+        message: error instanceof Error ? error.message : 'Captured emails could not be loaded.',
+      }, 503)
+    }
+  },
+})

package/app/Actions/Dashboard/Email/CapturedMailShowAction.ts

@@ -0,0 +1,31 @@
+import type { RequestInstance } from '@stacksjs/types'
+import { Action } from '@stacksjs/actions'
+import { response } from '@stacksjs/router'
+import { showCapturedMail } from './captured-mail'
+
+export default new Action({
+  name: 'CapturedMailShowAction',
+  description: 'Returns one outbound email captured by the local log mail driver.',
+  method: 'GET',
+  apiResponse: true,
+
+  async handle(request: RequestInstance) {
+    const id = request.params?.id
+    if (typeof id !== 'string' || !id)
+      return response.json({ message: 'Captured email id is required.' }, 422)
+    if (!/^disk:[^/\\]+\.html$/.test(id) && !/^mem:\d+:\d+$/.test(id))
+      return response.json({ message: 'Captured email id must use the disk or memory format.' }, 422)
+
+    try {
+      const message = await showCapturedMail(id)
+      if (!message)
+        return response.json({ message: 'Captured email not found.' }, 404)
+      return { message }
+    }
+    catch (error) {
+      return response.json({
+        message: error instanceof Error ? error.message : 'Captured email could not be loaded.',
+      }, 503)
+    }
+  },
+})