@stacksjs/defaults 0.70.353 → 0.70.355

package/app/Actions/Dashboard/Notifications/NotificationDeliveryIndexAction.ts

@@ -1,7 +1,8 @@
 import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { NotificationDelivery } from '@stacksjs/orm'
-import { request as routerRequest, response } from '@stacksjs/router'
+import { response } from '@stacksjs/router'
+import { dashboardRequestValue } from '../dashboard-request'
 import { parseDeliveryMetadata } from './notification-delivery'
 
 type DashboardDeliveryChannel = 'email' | 'sms'
@@ -29,9 +30,10 @@ export default new Action({
   method: 'GET',
   apiResponse: true,
   async handle(request: RequestInstance) {
-    const query = ((routerRequest as any).query || {}) as Record<string, string | string[] | undefined>
-    const queryChannel = Array.isArray(query.channel) ? query.channel[0] : query.channel
-    const channel = resolveDashboardDeliveryChannel(request.url, queryChannel, request.get('channel'))
+    const channel = resolveDashboardDeliveryChannel(
+      request.url,
+      dashboardRequestValue(request, 'channel'),
+    )
     if (!channel)
       return response.json({ message: 'Channel must be email or sms.' }, 422)
 

package/app/Actions/Dashboard/Queries/QueryShowAction.ts

@@ -1,3 +1,4 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { db } from '@stacksjs/database'
 import { response } from '@stacksjs/router'

package/app/Actions/Dashboard/Rbac/PermissionDestroyAction.ts

@@ -1,3 +1,4 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { deletePermission } from '@stacksjs/auth'
 import { response } from '@stacksjs/router'
@@ -14,13 +15,12 @@ export default new Action({
   description: 'Hard-delete a permission + its pivot rows.',
   method: 'DELETE',
   apiResponse: true,
-  async handle(request) {
-    const name = String((request as any)?.params?.name ?? '').trim()
+  async handle(request: RequestInstance) {
+    const name = request.getParam('name').trim()
     if (!name) {
       return response.json({ error: '`name` route param is required.' }, 400)
     }
-    const url = new URL(request.url ?? 'http://localhost/')
-    const guardName = (url.searchParams.get('guard') || 'web').trim()
+    const guardName = String(request.get('guard', 'web')).trim()
     if (!guardName || guardName.length > 60) {
       return response.json({ error: 'Invalid guard name.' }, 400)
     }

package/app/Actions/Dashboard/Rbac/PermissionStoreAction.ts

@@ -1,3 +1,4 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { createPermission, findPermission } from '@stacksjs/auth'
 import { response } from '@stacksjs/router'
@@ -20,8 +21,8 @@ export default new Action({
   description: 'Create a new permission.',
   method: 'POST',
   apiResponse: true,
-  async handle(request) {
-    const body = (request as any).jsonBody as PermissionInput | undefined ?? {}
+  async handle(request: RequestInstance<PermissionInput>) {
+    const body = request.all()
 
     const name = typeof body.name === 'string' ? body.name.trim() : ''
     if (!name || name.length > 100) {

package/app/Actions/Dashboard/Rbac/RoleDestroyAction.ts

@@ -1,3 +1,4 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { deleteRole } from '@stacksjs/auth'
 import { response } from '@stacksjs/router'
@@ -16,13 +17,12 @@ export default new Action({
   description: 'Hard-delete a role + its pivot rows.',
   method: 'DELETE',
   apiResponse: true,
-  async handle(request) {
-    const name = String((request as any)?.params?.name ?? '').trim()
+  async handle(request: RequestInstance) {
+    const name = request.getParam('name').trim()
     if (!name) {
       return response.json({ error: '`name` route param is required.' }, 400)
     }
-    const url = new URL(request.url ?? 'http://localhost/')
-    const guardName = (url.searchParams.get('guard') || 'web').trim()
+    const guardName = String(request.get('guard', 'web')).trim()
     if (!guardName || guardName.length > 60) {
       return response.json({ error: 'Invalid guard name.' }, 400)
     }

package/app/Actions/Dashboard/Rbac/RolePermissionsShowAction.ts

@@ -1,3 +1,4 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { findRole, getRolePermissions } from '@stacksjs/auth'
 import { response } from '@stacksjs/router'
@@ -15,13 +16,12 @@ export default new Action({
   description: 'List permissions attached to one role.',
   method: 'GET',
   apiResponse: true,
-  async handle(request) {
-    const name = String((request as any)?.params?.name ?? '').trim()
+  async handle(request: RequestInstance) {
+    const name = request.getParam('name').trim()
     if (!name) {
       return response.json({ error: '`name` route param is required.' }, 400)
     }
-    const url = new URL(request.url ?? 'http://localhost/')
-    const guardName = (url.searchParams.get('guard') || 'web').trim()
+    const guardName = String(request.get('guard', 'web')).trim()
     if (!guardName || guardName.length > 60) {
       return response.json({ error: 'Invalid guard name.' }, 400)
     }

package/app/Actions/Dashboard/Rbac/RolePermissionsSyncAction.ts

@@ -1,3 +1,4 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { getRolePermissions, findRole, syncRolePermissions } from '@stacksjs/auth'
 import { response } from '@stacksjs/router'
@@ -19,13 +20,13 @@ export default new Action({
   description: 'Replace the permission set attached to one role.',
   method: 'POST',
   apiResponse: true,
-  async handle(request) {
-    const roleName = String((request as any)?.params?.name ?? '').trim()
+  async handle(request: RequestInstance<SyncInput>) {
+    const roleName = request.getParam('name').trim()
     if (!roleName) {
       return response.json({ error: '`name` route param is required.' }, 400)
     }
 
-    const body = (request as any).jsonBody as SyncInput | undefined ?? {}
+    const body = request.all()
     if (!Array.isArray(body.permissions)) {
       return response.json({ error: '`permissions` must be an array of permission names (possibly empty).' }, 400)
     }

package/app/Actions/Dashboard/Rbac/RoleStoreAction.ts

@@ -1,3 +1,4 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { createRole, findRole } from '@stacksjs/auth'
 import { response } from '@stacksjs/router'
@@ -25,8 +26,8 @@ export default new Action({
   description: 'Create a new role.',
   method: 'POST',
   apiResponse: true,
-  async handle(request) {
-    const body = (request as any).jsonBody as RoleInput | undefined ?? {}
+  async handle(request: RequestInstance<RoleInput>) {
+    const body = request.all()
 
     const name = typeof body.name === 'string' ? body.name.trim() : ''
     if (!name || name.length > 60) {

package/app/Actions/Dashboard/Rbac/UserRolesShowAction.ts

@@ -1,3 +1,4 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { getUserRoles } from '@stacksjs/auth'
 import { User } from '@stacksjs/orm'
@@ -16,14 +17,12 @@ export default new Action({
   description: 'List roles attached to one user.',
   method: 'GET',
   apiResponse: true,
-  async handle(request) {
-    const rawId = (request as any)?.params?.id
-    const userId = Number(rawId)
+  async handle(request: RequestInstance) {
+    const userId = Number(request.getParam('id'))
     if (!Number.isFinite(userId) || userId <= 0) {
       return response.json({ error: 'Invalid user id.' }, 400)
     }
-    const url = new URL(request.url ?? 'http://localhost/')
-    const guardName = (url.searchParams.get('guard') || 'web').trim()
+    const guardName = String(request.get('guard', 'web')).trim()
     if (!guardName || guardName.length > 60) {
       return response.json({ error: 'Invalid guard name.' }, 400)
     }

package/app/Actions/Dashboard/Rbac/UserRolesSyncAction.ts

@@ -1,3 +1,4 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { getUserRoles, syncRoles } from '@stacksjs/auth'
 import { User } from '@stacksjs/orm'
@@ -24,14 +25,13 @@ export default new Action({
   description: 'Replace the role set attached to one user.',
   method: 'POST',
   apiResponse: true,
-  async handle(request) {
-    const rawId = (request as any)?.params?.id
-    const userId = Number(rawId)
+  async handle(request: RequestInstance<SyncInput>) {
+    const userId = Number(request.getParam('id'))
     if (!Number.isFinite(userId) || userId <= 0) {
       return response.json({ error: 'Invalid user id.' }, 400)
     }
 
-    const body = (request as any).jsonBody as SyncInput | undefined ?? {}
+    const body = request.all()
     if (!Array.isArray(body.roles)) {
       return response.json({ error: '`roles` must be an array of role names (possibly empty).' }, 400)
     }

package/app/Actions/Dashboard/Search/GlobalSearchAction.ts

@@ -1,3 +1,4 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { env } from '@stacksjs/env'
 import { readdirSync } from 'node:fs'

package/app/Actions/Dashboard/Teams/TeamInviteAction.ts

@@ -25,12 +25,12 @@ export default new Action({
   method: 'POST',
   apiResponse: true,
 
-  async handle(request: RequestInstance) {
+  async handle(request: RequestInstance<InviteInput>) {
     const teamId = parsePositiveId(request.getParam('id'))
     if (!teamId)
       return response.json({ message: 'Invalid team id.' }, 400)
 
-    const input = (request as any).jsonBody as InviteInput | undefined ?? {}
+    const input = request.all()
     const email = normalizeInvitationEmail(input.email)
     const role = normalizeInvitationRole(input.role ?? 'member')
     if (!email)
@@ -83,7 +83,7 @@ export default new Action({
     const token = generateInvitationToken()
     const tokenHash = hashInvitationToken(token)
     const expiresAt = invitationExpiresAt()
-    const requester = (request as any).user ?? (request as any)._authenticatedUser ?? null
+    const requester = await request.user()
     const invitedByUserId = requester && Number.isInteger(Number(requester.id))
       ? Number(requester.id)
       : null

package/app/Actions/Dashboard/Teams/TeamMemberUpdateAction.ts

@@ -16,7 +16,7 @@ export default new Action({
   method: 'PATCH',
   apiResponse: true,
 
-  async handle(request: RequestInstance) {
+  async handle(request: RequestInstance<UpdateInput>) {
     const teamId = parsePositiveId(request.getParam('id'))
     const memberId = parsePositiveId(request.getParam('memberId'))
     if (!teamId || !memberId)
@@ -33,7 +33,7 @@ export default new Action({
     if (member.role === 'owner')
       return response.json({ message: 'Transfer team ownership before changing the owner.' }, 409)
 
-    const input = (request as any).jsonBody as UpdateInput | undefined ?? {}
+    const input = request.all()
     const role = input.role === undefined ? String(member.role) : normalizeInvitationRole(input.role)
     const status = input.status === undefined ? String(member.status) : String(input.status).trim().toLowerCase()
     if (!role)

package/app/Actions/Dashboard/dashboard-request.ts

@@ -0,0 +1,13 @@
+import type { RequestInstance } from '@stacksjs/types'
+
+/** Reads one scalar dashboard input value through the native request bag. */
+export function dashboardRequestValue(
+  request: RequestInstance,
+  key: string,
+  fallback = '',
+): string {
+  const value = request.get<unknown>(key, fallback)
+  if (Array.isArray(value))
+    return value.length > 0 ? String(value[0]).trim() : fallback
+  return value == null ? fallback : String(value).trim()
+}

package/app/Models/CardComment.ts

@@ -2,13 +2,12 @@ import { defineModel } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 /**
- * Card comment (stacksjs/stacks#1846 Phase 3).
+ * Card comment for the dashboard Kanban surface.
  *
  * Each comment belongs to a card and (optionally) to the user who
  * wrote it. Anonymous comments are allowed via nullable `user_id` —
  * makes the dev dashboard usable on localhost without an auth round-
- * trip, and supports system-generated activity entries
- * (eventually — Phase 4 could write status-change comments here).
+ * trip, and supports system-generated activity entries.
  *
  * Distinct from `Comment` (which is post-specific) so the schemas
  * don't fight: post comments carry `author_name`/`author_email` for
@@ -35,7 +34,7 @@ export default defineModel({
 
     useApi: {
       uri: 'card-comments',
-      routes: ['index', 'store', 'show', 'destroy'],
+      routes: ['index', 'store', 'show', 'update', 'destroy'],
       middleware: ['auth'],
     },
   },

package/app/Models/commerce/TaxRate.ts

@@ -111,6 +111,54 @@ export default defineModel({
       },
       factory: () => false,
     },
+
+    /**
+     * A stable name for this component, for code to reference.
+     *
+     * `name` is what an operator reads and edits in the dashboard, so it is
+     * the wrong thing for an application to branch on — renaming "State sales
+     * tax" to "Sales tax (CA)" should not change what gets charged. A code is
+     * the identifier that survives the rename.
+     *
+     * Free-form on purpose. What counts as a component differs by
+     * jurisdiction: `vat`, `gst`, `excise`, `city`, `eco-fee`.
+     */
+    code: {
+      order: 8,
+      fillable: true,
+      default: '',
+      validation: {
+        rule: schema.string().max(64),
+        message: {
+          max: 'Code must have a maximum of 64 characters',
+        },
+      },
+      factory: faker => faker.helpers.arrayElement(['vat', 'gst', 'sales', 'excise', 'city']),
+    },
+
+    /**
+     * Whether a qualifying exemption removes this component.
+     *
+     * Most places tax in parts, and an exemption usually lifts some of them
+     * and not others: groceries escape VAT but not a deposit levy, and a
+     * Californian medical cannabis patient is exempt from sales tax while
+     * still paying excise and the city's business tax. Modelling tax as one
+     * blended number cannot say that, so an app either over-charges the
+     * exempt customer or under-collects tax it owes.
+     *
+     * What *qualifies* is the application's business — a card, a resale
+     * certificate, a charity registration. This only records that the
+     * component is the kind that can be lifted.
+     */
+    exemptible: {
+      order: 9,
+      fillable: true,
+      default: false,
+      validation: {
+        rule: schema.boolean(),
+      },
+      factory: () => false,
+    },
   },
 
   dashboard: {

package/functions/dashboard-api.ts

@@ -37,16 +37,9 @@ export class DashboardApiError extends Error {
   }
 }
 
-/**
- * Call a dashboard API endpoint and return its parsed JSON.
- *
- * Throws on a non-2xx response, using the server's `message` / `error`
- * field when there is one so callers can surface something better than a
- * bare status code.
- */
-export async function dashboardApi<T = unknown>(path: string, options: ApiRequestOptions = {}): Promise<T> {
+async function dashboardResponse(path: string, options: ApiRequestOptions, accept: string): Promise<Response> {
   const method = options.method ?? 'GET'
-  const headers: Record<string, string> = { accept: 'application/json' }
+  const headers: Record<string, string> = { accept }
   const authToken = useAuth().getToken()
 
   if (options.body !== undefined && options.formData)
@@ -62,7 +55,7 @@ export async function dashboardApi<T = unknown>(path: string, options: ApiReques
     ? headers
     : withCsrfHeader(headers)
 
-  const res = await fetch(path, {
+  return fetch(path, {
     method,
     headers: requestHeaders,
     credentials: 'same-origin',
@@ -70,6 +63,33 @@ export async function dashboardApi<T = unknown>(path: string, options: ApiReques
     ...(options.body !== undefined && { body: JSON.stringify(options.body) }),
     ...(options.formData && { body: options.formData }),
   })
+}
+
+async function dashboardResponseError(res: Response): Promise<DashboardApiError> {
+  const text = await res.text()
+  let payload: ApiErrorBody | null = null
+  try {
+    payload = text ? JSON.parse(text) as ApiErrorBody : null
+  }
+  catch {
+    payload = null
+  }
+
+  const failure = describeResponseError(res.status, payload)
+  if (failure.unexpected)
+    console.error('[dashboard-api] Unexpected request failure:', failure.cause)
+  return new DashboardApiError(failure.message, res.status, failure.fields)
+}
+
+/**
+ * Call a dashboard API endpoint and return its parsed JSON.
+ *
+ * Throws on a non-2xx response, using the server's `message` / `error`
+ * field when there is one so callers can surface something better than a
+ * bare status code.
+ */
+export async function dashboardApi<T = unknown>(path: string, options: ApiRequestOptions = {}): Promise<T> {
+  const res = await dashboardResponse(path, options, 'application/json')
 
   const text = await res.text()
   let payload: any = null
@@ -89,3 +109,24 @@ export async function dashboardApi<T = unknown>(path: string, options: ApiReques
 
   return payload as T
 }
+
+/**
+ * Download a guarded dashboard resource while preserving bearer and session
+ * authentication. The object URL only exists for the duration of the browser
+ * download and is then released.
+ */
+export async function dashboardDownload(path: string, filename: string): Promise<void> {
+  const res = await dashboardResponse(path, {}, 'application/octet-stream')
+  if (!res.ok)
+    throw await dashboardResponseError(res)
+
+  const objectUrl = URL.createObjectURL(await res.blob())
+  const anchor = document.createElement('a')
+  anchor.href = objectUrl
+  anchor.download = filename
+  anchor.hidden = true
+  document.body.append(anchor)
+  anchor.click()
+  anchor.remove()
+  setTimeout(() => URL.revokeObjectURL(objectUrl), 0)
+}

package/functions/inbox.test.ts

@@ -35,6 +35,8 @@ describe('dashboard inbox mapping', () => {
       date: '2026-07-29T12:00:00.000Z',
       read: false,
       hasAttachments: true,
+      attachments: [],
+      detailsLoaded: false,
     })
   })
 

package/functions/inbox.ts

@@ -6,7 +6,7 @@
 
 import { ref } from '@stacksjs/stx'
 import { get } from './api'
-import { dashboardApi } from './dashboard-api'
+import { dashboardApi, dashboardDownload } from './dashboard-api'
 import { pushToast } from './toasts'
 
 export type InboxActivityRange = 'day' | 'week' | 'month' | 'year'
@@ -71,6 +71,15 @@ export interface DashboardInboxEmail {
   date: string
   read: boolean
   hasAttachments: boolean
+  attachments: DashboardInboxAttachment[]
+  detailsLoaded: boolean
+}
+
+export interface DashboardInboxAttachment {
+  id: string
+  name: string
+  size: number
+  lastModified?: string
 }
 
 interface DashboardInboxEntry {
@@ -94,6 +103,7 @@ interface DashboardInboxResponse {
 interface DashboardInboxBodyResponse {
   html?: string
   text?: string
+  attachments?: DashboardInboxAttachment[]
   error?: string
 }
 
@@ -166,6 +176,8 @@ export function mapDashboardInboxEntry(item: DashboardInboxEntry): DashboardInbo
     date: item.date,
     read: item.read === true,
     hasAttachments: item.hasAttachments === true,
+    attachments: [],
+    detailsLoaded: false,
   }
 }
 
@@ -179,7 +191,7 @@ export async function fetchDashboardInbox(mailbox?: string): Promise<LoadedDashb
   }
 }
 
-export async function fetchDashboardInboxBody(messageId: string, mailbox?: string): Promise<Pick<DashboardInboxEmail, 'bodyHtml' | 'bodyText'>> {
+export async function fetchDashboardInboxBody(messageId: string, mailbox?: string): Promise<Pick<DashboardInboxEmail, 'attachments' | 'bodyHtml' | 'bodyText' | 'detailsLoaded' | 'hasAttachments'>> {
   const query = mailbox ? `?mailbox=${encodeURIComponent(mailbox)}` : ''
   const data = await dashboardApi<DashboardInboxBodyResponse>(`/api/dashboard/email/inbox/${encodeURIComponent(messageId)}${query}`)
   if (data.error)
@@ -187,9 +199,22 @@ export async function fetchDashboardInboxBody(messageId: string, mailbox?: strin
   return {
     bodyHtml: data.html || '',
     bodyText: data.text || '',
+    attachments: data.attachments || [],
+    detailsLoaded: true,
+    hasAttachments: (data.attachments || []).length > 0,
   }
 }
 
+export async function downloadDashboardInboxAttachment(
+  messageId: string,
+  attachment: DashboardInboxAttachment,
+  mailbox?: string,
+): Promise<void> {
+  const query = mailbox ? `?mailbox=${encodeURIComponent(mailbox)}` : ''
+  const path = `/api/dashboard/email/inbox/${encodeURIComponent(messageId)}/attachments/${encodeURIComponent(attachment.id)}${query}`
+  await dashboardDownload(path, attachment.name)
+}
+
 export async function fetchInboxActivity(range: InboxActivityRange): Promise<InboxActivity | null> {
   try {
     return await dashboardApi<InboxActivity>(`/api/dashboard/email/activity?range=${range}`)

package/functions/public-application-url.test.ts

@@ -0,0 +1,13 @@
+import { describe, expect, it } from 'bun:test'
+import { publicApplicationUrl } from './public-application-url'
+
+describe('publicApplicationUrl', () => {
+  it('uses HTTPS for application domains and removes duplicate separators', () => {
+    expect(publicApplicationUrl('/blog', 'stacks.localhost/')).toBe('https://stacks.localhost/blog')
+    expect(publicApplicationUrl('/blog/post', 'https://stacksjs.com/')).toBe('https://stacksjs.com/blog/post')
+  })
+
+  it('keeps explicit local development protocols', () => {
+    expect(publicApplicationUrl('/blog', 'http://localhost:3000')).toBe('http://localhost:3000/blog')
+  })
+})

package/functions/public-application-url.ts

@@ -0,0 +1,27 @@
+import process from 'node:process'
+
+function configuredApplicationUrl(): string {
+  const frontendUrl = process.env.FRONTEND_APP_URL?.trim()
+  if (frontendUrl && !frontendUrl.includes('${'))
+    return frontendUrl
+
+  return process.env.APP_URL?.trim() || 'http://localhost:3000'
+}
+
+function withProtocol(baseUrl: string): string {
+  if (/^https?:\/\//i.test(baseUrl))
+    return baseUrl
+
+  const host = baseUrl.split('/')[0].split(':')[0].toLowerCase()
+  const protocol = ['localhost', '127.0.0.1', '0.0.0.0', '[::1]'].includes(host)
+    ? 'http'
+    : 'https'
+  return `${protocol}://${baseUrl}`
+}
+
+/** Build an absolute URL for a page served by the public Stacks application. */
+export function publicApplicationUrl(pathname = '/', baseUrl = configuredApplicationUrl()): string {
+  const normalizedBase = withProtocol(baseUrl.trim()).replace(/\/+$/, '')
+  const normalizedPath = pathname.replace(/^\/+/, '')
+  return new URL(normalizedPath, `${normalizedBase}/`).toString()
+}

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.70.353",
+  "version": "0.70.355",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.70.353",
+  "version": "0.70.355",
   "description": "The complete managed Stacks application scaffold, including runtime defaults, AI guidance, editor metadata, and npm-backed project support files.",
   "author": "Chris Breuer",
   "license": "MIT",

package/resources/components/Dashboard/Auth/AccessTokens.stx

@@ -1,5 +1,6 @@
 <script client>
 import { DashboardApiError, dashboardApi } from '../../../../functions/dashboard-api'
+import { authStore } from '../../../../views/dashboard/stores/auth'
 
 interface AccessTokenRow {
   id: number
@@ -106,6 +107,20 @@ async function loadTokens(): Promise<void> {
   loading.set(true)
   loadError.set('')
   try {
+    await authStore.load()
+
+    if (authStore.error()) {
+      tokens.set([])
+      loadError.set(authStore.error() || 'The signed-in account could not be verified.')
+      return
+    }
+
+    if (authStore.unauthenticated()) {
+      tokens.set([])
+      authenticationRequired.set(true)
+      return
+    }
+
     const response = await dashboardApi<TokenListResponse>('/auth/tokens')
     tokens.set(response.tokens || [])
     authenticationRequired.set(false)