@stacksjs/defaults 0.70.353 → 0.70.355

package/app/Actions/Dashboard/Jobs/JobIndexAction.ts

@@ -1,26 +1,19 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { FailedJob, Job } from '@stacksjs/orm'
-import { request, response } from '@stacksjs/router'
+import { response } from '@stacksjs/router'
 import { matchesJobSearch, normalizeActiveJob, normalizeFailedJob } from './job-records'
 
 export default new Action({
   name: 'JobIndexAction',
   description: 'Returns a paginated list of jobs across the active queue and the failed_jobs table.',
   method: 'GET',
-  async handle() {
-    // bun-router populates `request.query` as a Record<string, string|string[]>.
-    // Outside a request context (e.g. ad-hoc tests) it's undefined — fall back
-    // to defaults so the action stays callable.
-    const query = ((request as any).query || {}) as Record<string, string | string[] | undefined>
-    const pick = (key: string) => {
-      const v = query[key]
-      return Array.isArray(v) ? v[0] : v
-    }
-    const page = Math.max(1, Number(pick('page')) || 1)
-    const perPage = Math.min(200, Math.max(1, Number(pick('per_page')) || 25))
-    const queueFilter = String(pick('queue') || '').trim()
-    const statusFilter = String(pick('status') || '').trim().toLowerCase()
-    const search = String(pick('search') || '').trim().toLowerCase()
+  async handle(request: RequestInstance) {
+    const page = Math.max(1, Number(request.get('page', 1)) || 1)
+    const perPage = Math.min(200, Math.max(1, Number(request.get('per_page', 25)) || 25))
+    const queueFilter = String(request.get('queue', '')).trim()
+    const statusFilter = String(request.get('status', '')).trim().toLowerCase()
+    const search = String(request.get('search', '')).trim().toLowerCase()
 
     try {
       const [activeJobs, failedJobs] = await Promise.all([

package/app/Actions/Dashboard/Jobs/JobRetryAction.ts

@@ -1,5 +1,6 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
-import { request, response } from '@stacksjs/router'
+import { response } from '@stacksjs/router'
 import { retryFailedJob } from '@stacksjs/queue'
 import { parseJobReference } from './job-records'
 
@@ -7,8 +8,8 @@ export default new Action({
   name: 'JobRetryAction',
   description: 'Retries a single failed job by its failed_jobs id.',
   method: 'POST',
-  async handle() {
-    const reference = String((request as any).params?.id || '')
+  async handle(request: RequestInstance) {
+    const reference = request.getParam('id')
     const parsed = parseJobReference(reference)
     const id = Number(parsed.id)
     if (parsed.source === 'job') {

package/app/Actions/Dashboard/Jobs/JobShowAction.ts

@@ -1,14 +1,14 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { FailedJob, Job } from '@stacksjs/orm'
-import { request } from '@stacksjs/router'
 import { normalizeActiveJob, normalizeFailedJob, parseJobReference } from './job-records'
 
 export default new Action({
   name: 'JobShowAction',
   description: 'Returns one native Job or FailedJob record for dashboard inspection.',
   method: 'GET',
-  async handle() {
-    const reference = String((request as any).params?.id || '')
+  async handle(request: RequestInstance) {
+    const reference = request.getParam('id')
     const parsed = parseJobReference(reference)
     const id = Number(parsed.id)
 

package/app/Actions/Dashboard/Kanban/BoardDestroyAction.ts

@@ -1,9 +1,10 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { db } from '@stacksjs/database'
 import { kanbanError } from './kanban-response'
 
 /**
- * `DELETE /api/dashboard/kanban/boards/:id` (stacksjs/stacks#1846 Phase 2).
+ * `DELETE /api/dashboard/kanban/boards/:id`.
  *
  * Hard delete with cascade: removes the board, its columns, its cards,
  * its labels, and the relevant pivot rows in `card_labels` and
@@ -23,9 +24,8 @@ export default new Action({
   description: 'Hard-deletes a board and all of its columns, cards, labels, and pivot rows.',
   method: 'DELETE',
   apiResponse: true,
-  async handle(request) {
-    const rawId = (request as any)?.params?.id ?? (request as any)?.param?.('id') ?? null
-    const id = Number(rawId)
+  async handle(request: RequestInstance) {
+    const id = Number(request.getParam('id'))
     if (!Number.isFinite(id) || id <= 0) {
       return kanbanError('Invalid board id', 400)
     }
@@ -42,7 +42,7 @@ export default new Action({
           'DELETE FROM card_assignees WHERE card_id IN (SELECT id FROM cards WHERE board_id = ?)',
           [id],
         ).execute()
-        // Card comments (Phase 3, migration 0000000112). Same
+        // Card comments use the same
         // card-scoped pattern as the pivots.
         await qb.unsafe(
           'DELETE FROM card_comments WHERE card_id IN (SELECT id FROM cards WHERE board_id = ?)',

package/app/Actions/Dashboard/Kanban/BoardShowAction.ts

@@ -1,3 +1,4 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { db } from '@stacksjs/database'
 import { modelBoolean } from './kanban-model'
@@ -56,8 +57,8 @@ interface LabelRow {
  *
  * Returns a single board with its columns + cards + label palette
  * nested in render order. Powers the kanban board page
- * (`/kanban/[id]`) — Phase 2 hits this on mount, the drag handler
- * then mutates positions via the (Phase 2) reorder endpoint and
+ * (`/kanban/[id]`). The page loads this on mount, then its drag handler
+ * mutates positions through the reorder endpoint and
  * relies on optimistic updates for snappy UX.
  *
  * Query layout (3 queries, all indexed):
@@ -67,24 +68,16 @@ interface LabelRow {
  *      `column_id, position`).
  *   4. All labels for the board.
  *
- * Card-label pivot reads land in Phase 3 alongside the card detail
- * modal — the board view shows label chips inline, hydrated from a
- * single pivot query batched with the card fetch.
+ * Card-label pivots hydrate label chips inline through a single query
+ * batched with the card fetch.
  */
 export default new Action({
   name: 'Kanban Board Show',
   description: 'Returns a single kanban board with its columns + cards + label palette.',
   method: 'GET',
   apiResponse: true,
-  async handle(request) {
-    // Route param resolution: bun-router exposes `:id` via
-    // `request.param('id')` / `request.params.id`. Both shapes appear
-    // in this codebase depending on how the route was registered;
-    // covering both keeps the action portable.
-    const rawId = (request as any)?.params?.id
-      ?? (request as any)?.param?.('id')
-      ?? null
-    const id = Number(rawId)
+  async handle(request: RequestInstance) {
+    const id = Number(request.getParam('id'))
     if (!Number.isFinite(id) || id <= 0) {
       return kanbanError('Invalid board id', 400)
     }
@@ -114,8 +107,8 @@ export default new Action({
         ).execute() as Promise<LabelRow[]>,
       ])
 
-      // Pivot lookups for label + assignee chips on card previews
-      // (stacksjs/stacks#1846 Phase 3). Two batched JOINs keyed off the
+      // Pivot lookups for label + assignee chips on card previews.
+      // Two batched JOINs keyed off the
       // board's card list — single round-trip per pivot, then group
       // client-side into `cardId → list` maps.
       const [cardLabelRows, cardAssigneeRows] = await Promise.all([

package/app/Actions/Dashboard/Kanban/BoardStoreAction.ts

@@ -1,3 +1,4 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { db } from '@stacksjs/database'
 import { Board } from '@stacksjs/orm'
@@ -11,7 +12,7 @@ interface BoardInput {
 }
 
 /**
- * `POST /api/dashboard/kanban/boards` (stacksjs/stacks#1846 Phase 2).
+ * `POST /api/dashboard/kanban/boards`.
  *
  * Creates a new board with sensible defaults and appends it to the
  * end of the boards list (`position = max(position) + 1` so the new
@@ -28,8 +29,8 @@ export default new Action({
   description: 'Creates a new kanban board.',
   method: 'POST',
   apiResponse: true,
-  async handle(request) {
-    const body = (request as any).jsonBody as BoardInput | undefined ?? {}
+  async handle(request: RequestInstance<BoardInput>) {
+    const body = request.all()
 
     const name = typeof body.name === 'string' ? body.name.trim() : ''
     if (!name || name.length > 120) {

package/app/Actions/Dashboard/Kanban/BoardUpdateAction.ts

@@ -1,3 +1,4 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { Board } from '@stacksjs/orm'
 import { modelBoolean, modelNullableString, modelNumber, modelString, refreshModel } from './kanban-model'
@@ -12,7 +13,7 @@ interface BoardInput {
 }
 
 /**
- * `PATCH /api/dashboard/kanban/boards/:id` (stacksjs/stacks#1846 Phase 2).
+ * `PATCH /api/dashboard/kanban/boards/:id`.
  *
  * Partial update — only the fields present in the body are written.
  * Omitting `archived` does NOT change the archive flag; passing
@@ -30,14 +31,13 @@ export default new Action({
   description: 'Partial update of a kanban board.',
   method: 'PATCH',
   apiResponse: true,
-  async handle(request) {
-    const rawId = (request as any)?.params?.id ?? (request as any)?.param?.('id') ?? null
-    const id = Number(rawId)
+  async handle(request: RequestInstance<BoardInput>) {
+    const id = Number(request.getParam('id'))
     if (!Number.isFinite(id) || id <= 0) {
       return kanbanError('Invalid board id', 400)
     }
 
-    const body = (request as any).jsonBody as BoardInput | undefined ?? {}
+    const body = request.all()
     const set: Record<string, unknown> = {}
 
     if (typeof body.name === 'string') {

package/app/Actions/Dashboard/Kanban/BoardsIndexAction.ts

@@ -30,8 +30,7 @@ interface BoardRow {
  * group (boards are a dev-mode surface per #1843). The action body
  * doesn't re-check the role; the middleware did.
  *
- * Phase 1 — read-only. Phase 2 lands store / update / destroy + the
- * reorder endpoint that moves a board's position.
+ * Mutations use the sibling store, update, destroy, and reorder actions.
  */
 export default new Action({
   name: 'Kanban Boards Index',

package/app/Actions/Dashboard/Kanban/BoardsReorderAction.ts

@@ -1,3 +1,4 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { db } from '@stacksjs/database'
 import { kanbanError } from './kanban-response'
@@ -14,7 +15,7 @@ interface ReorderInput {
 }
 
 /**
- * `POST /api/dashboard/kanban/boards/reorder` (stacksjs/stacks#1846 Phase 2).
+ * `POST /api/dashboard/kanban/boards/reorder`.
  *
  * Rewrites the `position` column on every board in the submitted list
  * to match its index. Wrapped in a transaction so a partial failure
@@ -33,8 +34,8 @@ export default new Action({
   description: 'Bulk-rewrite `position` on a list of boards to match the submitted order.',
   method: 'POST',
   apiResponse: true,
-  async handle(request) {
-    const body = (request as any).jsonBody as ReorderInput | undefined ?? {}
+  async handle(request: RequestInstance<ReorderInput>) {
+    const body = request.all()
     if (!Array.isArray(body.order) || body.order.length === 0) {
       return kanbanError('`order` must be a non-empty array of board ids.', 400)
     }

package/app/Actions/Dashboard/Kanban/CardAssigneesSyncAction.ts

@@ -1,3 +1,4 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { db } from '@stacksjs/database'
 import { kanbanError } from './kanban-response'
@@ -7,7 +8,7 @@ interface SyncInput {
 }
 
 /**
- * `POST /api/dashboard/kanban/cards/:id/assignees` (stacksjs/stacks#1846 Phase 3).
+ * `POST /api/dashboard/kanban/cards/:id/assignees`.
  *
  * Replaces the set of users assigned to a card. Sync semantics —
  * pass the new full list of user ids, the action diffs against
@@ -20,21 +21,20 @@ interface SyncInput {
  *
  * Cross-validation: each user id must exist. Doesn't validate
  * board-scoped membership — kanban users aren't (currently) team-
- * scoped; any platform user can be assigned to any card. Phase 4
- * could tighten this if board-membership becomes a concept.
+ * scoped; any platform user can be assigned to any card. A future
+ * board-membership feature can tighten this contract.
  */
 export default new Action({
   name: 'Kanban Card Assignees Sync',
   description: 'Replaces the set of users assigned to a card.',
   method: 'POST',
   apiResponse: true,
-  async handle(request) {
-    const rawId = (request as any)?.params?.id ?? (request as any)?.param?.('id') ?? null
-    const cardId = Number(rawId)
+  async handle(request: RequestInstance<SyncInput>) {
+    const cardId = Number(request.getParam('id'))
     if (!Number.isFinite(cardId) || cardId <= 0)
       return kanbanError('Invalid card id', 400)
 
-    const body = (request as any).jsonBody as SyncInput | undefined ?? {}
+    const body = request.all()
     if (!Array.isArray(body.userIds))
       return kanbanError('`userIds` must be an array of user ids (possibly empty).', 400)
 
@@ -63,8 +63,10 @@ export default new Action({
           return kanbanError('One or more user ids do not exist.', 400)
       }
 
-      const requester = (request as any).user ?? (request as any)._authenticatedUser ?? null
-      const assignedByUserId = requester && typeof requester.id === 'number' ? requester.id : null
+      const requester = await request.user()
+      const assignedByUserId = requester && Number.isInteger(Number(requester.id))
+        ? Number(requester.id)
+        : null
 
       await db.transaction(async (rawTrx) => {
         const qb = rawTrx as unknown as typeof db

package/app/Actions/Dashboard/Kanban/CardCommentDestroyAction.ts

@@ -1,29 +1,27 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
-import { db } from '@stacksjs/database'
+import { CardComment } from '@stacksjs/orm'
 import { kanbanError } from './kanban-response'
 
 /**
- * `DELETE /api/dashboard/kanban/comments/:id` (stacksjs/stacks#1846 Phase 3).
- *
- * Hard-deletes a card comment. No authorship check yet — Phase 4
- * could add "only the author or an admin can delete" semantics by
- * looking at `request.user.id` vs the comment's `user_id`. For now
- * the dashboard's role-gated visibility (only admin+dev see the
- * surface) is the gate.
+ * `DELETE /api/dashboard/kanban/comments/:id`.
+ * The dashboard route applies its local-development or admin guard.
  */
 export default new Action({
   name: 'Kanban Card Comment Destroy',
   description: 'Hard-deletes a single card comment.',
   method: 'DELETE',
   apiResponse: true,
-  async handle(request) {
-    const rawId = (request as any)?.params?.id ?? (request as any)?.param?.('id') ?? null
-    const id = Number(rawId)
+  async handle(request: RequestInstance) {
+    const id = Number(request.getParam('id'))
     if (!Number.isFinite(id) || id <= 0)
       return kanbanError('Invalid comment id', 400)
 
     try {
-      await db.deleteFrom('card_comments').where('id', '=', id).execute()
+      const comment = await CardComment.find(id)
+      if (!comment)
+        return kanbanError('Comment not found.', 404)
+      await comment.delete()
       return { deleted: true, id }
     }
     catch (err) {

package/app/Actions/Dashboard/Kanban/CardCommentStoreAction.ts

@@ -1,5 +1,8 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
-import { db } from '@stacksjs/database'
+import { Card, CardComment } from '@stacksjs/orm'
+import { cardCommentResponse } from './kanban-comment'
+import { refreshModel } from './kanban-model'
 import { kanbanError } from './kanban-response'
 
 interface CommentInput {
@@ -7,72 +10,45 @@ interface CommentInput {
 }
 
 /**
- * `POST /api/dashboard/kanban/cards/:id/comments` (stacksjs/stacks#1846 Phase 3).
+ * `POST /api/dashboard/kanban/cards/:id/comments`.
  *
  * Appends a comment to a card. Stamps `user_id` from the request's
  * authenticated user when available; leaves it null on the no-auth
  * dev dashboard so the surface stays usable locally.
  *
- * Returns the inserted row with denormalised author name/email for
- * the optimistic UI to render without a round-trip back through
- * `/cards/:id`.
+ * Writes through the model so generated API validation, timestamps, and
+ * observers stay aligned with the rest of the application.
  */
 export default new Action({
   name: 'Kanban Card Comment Store',
   description: 'Adds a comment to a card.',
   method: 'POST',
   apiResponse: true,
-  async handle(request) {
-    const rawId = (request as any)?.params?.id ?? (request as any)?.param?.('id') ?? null
-    const cardId = Number(rawId)
+  async handle(request: RequestInstance<CommentInput>) {
+    const cardId = Number(request.getParam('id'))
     if (!Number.isFinite(cardId) || cardId <= 0)
       return kanbanError('Invalid card id', 400)
 
-    const body = (request as any).jsonBody as CommentInput | undefined ?? {}
+    const body = request.all()
     const text = typeof body.body === 'string' ? body.body.trim() : ''
     if (!text || text.length > 10000)
       return kanbanError('`body` is required and must be 1-10000 characters.', 400)
 
     try {
-      const cardRows = await db.unsafe('SELECT id FROM cards WHERE id = ? LIMIT 1', [cardId]).execute() as Array<{ id: number }>
-      if (!cardRows?.length)
+      const card = await Card.find(cardId)
+      if (!card)
         return kanbanError('Card not found.', 404)
 
-      const user = (request as any).user ?? (request as any)._authenticatedUser ?? null
-      const userId = user && typeof user.id === 'number' ? user.id : null
-
-      await db.insertInto('card_comments').values({
-        card_id: cardId,
-        user_id: userId,
+      const user = await request.user()
+      const userId = user && Number.isInteger(Number(user.id)) ? Number(user.id) : null
+      const comment = await refreshModel(await CardComment.create({
+        cardId,
+        userId,
         body: text,
-      }).execute()
-
-      // Pull the inserted row + author denormalisation. Ordered by id
-      // DESC so the freshest matching row wins.
-      const rows = await db.unsafe(
-        `SELECT cc.id, cc.uuid, cc.user_id, cc.body, cc.created_at, cc.updated_at, u.name, u.email
-        FROM card_comments cc
-        LEFT JOIN users u ON u.id = cc.user_id
-        WHERE cc.card_id = ? AND cc.body = ?
-        ORDER BY cc.id DESC
-        LIMIT 1`,
-        [cardId, text],
-      ).execute() as Array<{ id: number, uuid: string | null, user_id: number | null, body: string, created_at: string | null, updated_at: string | null, name: string | null, email: string | null }>
-      const r = rows?.[0]
-      if (!r)
-        return kanbanError('Comment insert succeeded but follow-up read returned nothing.', 500)
+      }))
 
       return {
-        comment: {
-          id: r.id,
-          uuid: r.uuid,
-          userId: r.user_id,
-          body: r.body,
-          authorName: r.name,
-          authorEmail: r.email,
-          createdAt: r.created_at,
-          updatedAt: r.updated_at,
-        },
+        comment: cardCommentResponse(comment, user),
       }
     }
     catch (err) {

package/app/Actions/Dashboard/Kanban/CardCommentUpdateAction.ts

@@ -0,0 +1,44 @@
+import type { RequestInstance } from '@stacksjs/types'
+import { Action } from '@stacksjs/actions'
+import { CardComment, User } from '@stacksjs/orm'
+import { cardCommentResponse } from './kanban-comment'
+import { modelNullableNumber, refreshModel } from './kanban-model'
+import { kanbanError } from './kanban-response'
+
+interface CommentInput {
+  body?: unknown
+}
+
+/** `PATCH /api/dashboard/kanban/comments/:id`. */
+export default new Action({
+  name: 'Kanban Card Comment Update',
+  description: 'Edits the body of a card comment.',
+  method: 'PATCH',
+  apiResponse: true,
+  async handle(request: RequestInstance<CommentInput>) {
+    const id = Number(request.getParam('id'))
+    if (!Number.isFinite(id) || id <= 0)
+      return kanbanError('Invalid comment id', 400)
+
+    const input = request.all()
+    const body = typeof input.body === 'string' ? input.body.trim() : ''
+    if (!body || body.length > 10000)
+      return kanbanError('`body` is required and must be 1-10000 characters.', 400)
+
+    try {
+      const comment = await CardComment.find(id)
+      if (!comment)
+        return kanbanError('Comment not found.', 404)
+
+      const updated = await refreshModel(await comment.update({ body }))
+      const userId = modelNullableNumber(updated, 'userId', 'user_id')
+      const author = userId === null ? null : await User.find(userId)
+
+      return { comment: cardCommentResponse(updated, author) }
+    }
+    catch (error) {
+      console.error('[dashboard/kanban] CardCommentUpdateAction failed:', error)
+      return kanbanError(error instanceof Error ? error.message : 'unknown error', 500)
+    }
+  },
+})

package/app/Actions/Dashboard/Kanban/CardDestroyAction.ts

@@ -1,9 +1,10 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { db } from '@stacksjs/database'
 import { kanbanError } from './kanban-response'
 
 /**
- * `DELETE /api/dashboard/kanban/cards/:id` (stacksjs/stacks#1846 Phase 2).
+ * `DELETE /api/dashboard/kanban/cards/:id`.
  *
  * Hard-deletes a card and clears its pivot rows in `card_labels` /
  * `card_assignees`. The columns and board are untouched — only the
@@ -18,9 +19,8 @@ export default new Action({
   description: 'Hard-deletes a card and its pivot rows.',
   method: 'DELETE',
   apiResponse: true,
-  async handle(request) {
-    const rawId = (request as any)?.params?.id ?? (request as any)?.param?.('id') ?? null
-    const id = Number(rawId)
+  async handle(request: RequestInstance) {
+    const id = Number(request.getParam('id'))
     if (!Number.isFinite(id) || id <= 0) {
       return kanbanError('Invalid card id', 400)
     }
@@ -30,7 +30,7 @@ export default new Action({
         const qb = rawTrx as unknown as typeof db
         await qb.deleteFrom('card_labels').where('card_id', '=', id).execute()
         await qb.deleteFrom('card_assignees').where('card_id', '=', id).execute()
-        // Card comments (Phase 3, stacksjs/stacks#1846).
+        // Card comments are card-scoped children.
         await qb.deleteFrom('card_comments').where('card_id', '=', id).execute()
         await qb.deleteFrom('cards').where('id', '=', id).execute()
       })

package/app/Actions/Dashboard/Kanban/CardLabelsSyncAction.ts

@@ -1,3 +1,4 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { db } from '@stacksjs/database'
 import { kanbanError } from './kanban-response'
@@ -7,7 +8,7 @@ interface SyncInput {
 }
 
 /**
- * `POST /api/dashboard/kanban/cards/:id/labels` (stacksjs/stacks#1846 Phase 3).
+ * `POST /api/dashboard/kanban/cards/:id/labels`.
  *
  * Replaces the set of labels attached to a card. Sync semantics —
  * pass the new full list of label ids, the action diffs against
@@ -26,13 +27,12 @@ export default new Action({
   description: 'Replaces the set of labels attached to a card.',
   method: 'POST',
   apiResponse: true,
-  async handle(request) {
-    const rawId = (request as any)?.params?.id ?? (request as any)?.param?.('id') ?? null
-    const cardId = Number(rawId)
+  async handle(request: RequestInstance<SyncInput>) {
+    const cardId = Number(request.getParam('id'))
     if (!Number.isFinite(cardId) || cardId <= 0)
       return kanbanError('Invalid card id', 400)
 
-    const body = (request as any).jsonBody as SyncInput | undefined ?? {}
+    const body = request.all()
     if (!Array.isArray(body.labelIds))
       return kanbanError('`labelIds` must be an array of label ids (possibly empty).', 400)
 
@@ -56,7 +56,7 @@ export default new Action({
         return kanbanError('Card not found.', 404)
 
       // Every label must belong to the same board (labels are
-      // board-scoped per Phase 1's `labels.board_id` design).
+      // board-scoped through `labels.board_id`).
       if (uniqueLabelIds.length > 0) {
         const placeholders = uniqueLabelIds.map(() => '?').join(',')
         const labelRows = await db.unsafe(

package/app/Actions/Dashboard/Kanban/CardShowAction.ts

@@ -1,3 +1,4 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { db } from '@stacksjs/database'
 import { modelBoolean } from './kanban-model'
@@ -20,7 +21,7 @@ interface CardRow {
 }
 
 /**
- * `GET /api/dashboard/kanban/cards/:id` (stacksjs/stacks#1846 Phase 3).
+ * `GET /api/dashboard/kanban/cards/:id`.
  *
  * Fetches a single card with everything the detail modal needs in one
  * round-trip: labels, assignees, comments. The board view's cards
@@ -39,9 +40,8 @@ export default new Action({
   description: 'Returns a single card with its labels, assignees, and comments thread.',
   method: 'GET',
   apiResponse: true,
-  async handle(request) {
-    const rawId = (request as any)?.params?.id ?? (request as any)?.param?.('id') ?? null
-    const id = Number(rawId)
+  async handle(request: RequestInstance) {
+    const id = Number(request.getParam('id'))
     if (!Number.isFinite(id) || id <= 0) {
       return kanbanError('Invalid card id', 400)
     }

package/app/Actions/Dashboard/Kanban/CardStoreAction.ts

@@ -1,3 +1,4 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { db } from '@stacksjs/database'
 import { BoardColumn, Card } from '@stacksjs/orm'
@@ -11,7 +12,7 @@ interface CardInput {
 }
 
 /**
- * `POST /api/dashboard/kanban/cards` (stacksjs/stacks#1846 Phase 2).
+ * `POST /api/dashboard/kanban/cards`.
  *
  * Creates a card at the end of the target column. `boardId` is
  * resolved server-side from `column.board_id` (denormalised onto the
@@ -19,7 +20,7 @@ interface CardInput {
  * would invite drift if the column was moved between boards (which
  * isn't a feature, but still).
  *
- * Stamps `created_by_user_id` from `request.user` when the request is
+ * Stamps `created_by_user_id` from `request.user()` when the request is
  * authenticated; leaves it null for the no-auth dev dashboard so the
  * surface still works on localhost.
  */
@@ -28,8 +29,8 @@ export default new Action({
   description: 'Creates a new card in a column.',
   method: 'POST',
   apiResponse: true,
-  async handle(request) {
-    const body = (request as any).jsonBody as CardInput | undefined ?? {}
+  async handle(request: RequestInstance<CardInput>) {
+    const body = request.all()
 
     const columnId = Number(body.columnId)
     if (!Number.isFinite(columnId) || columnId <= 0) {
@@ -57,8 +58,8 @@ export default new Action({
       ).execute() as Array<{ m: number }>
       const nextPosition = (Number(maxRow?.[0]?.m ?? -1) + 1) || 0
 
-      const user = (request as any).user ?? (request as any)._authenticatedUser ?? null
-      const createdByUserId = user && typeof user.id === 'number' ? user.id : null
+      const user = await request.user()
+      const createdByUserId = user && Number.isInteger(Number(user.id)) ? Number(user.id) : null
 
       const card = await Card.create({
         columnId,