@stacksjs/defaults 0.70.354 → 0.70.355

package/app/Actions/Dashboard/Rbac/PermissionDestroyAction.ts

@@ -1,3 +1,4 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { deletePermission } from '@stacksjs/auth'
 import { response } from '@stacksjs/router'
@@ -14,13 +15,12 @@ export default new Action({
   description: 'Hard-delete a permission + its pivot rows.',
   method: 'DELETE',
   apiResponse: true,
-  async handle(request) {
-    const name = String((request as any)?.params?.name ?? '').trim()
+  async handle(request: RequestInstance) {
+    const name = request.getParam('name').trim()
     if (!name) {
       return response.json({ error: '`name` route param is required.' }, 400)
     }
-    const url = new URL(request.url ?? 'http://localhost/')
-    const guardName = (url.searchParams.get('guard') || 'web').trim()
+    const guardName = String(request.get('guard', 'web')).trim()
     if (!guardName || guardName.length > 60) {
       return response.json({ error: 'Invalid guard name.' }, 400)
     }

package/app/Actions/Dashboard/Rbac/PermissionStoreAction.ts

@@ -1,3 +1,4 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { createPermission, findPermission } from '@stacksjs/auth'
 import { response } from '@stacksjs/router'
@@ -20,8 +21,8 @@ export default new Action({
   description: 'Create a new permission.',
   method: 'POST',
   apiResponse: true,
-  async handle(request) {
-    const body = (request as any).jsonBody as PermissionInput | undefined ?? {}
+  async handle(request: RequestInstance<PermissionInput>) {
+    const body = request.all()
 
     const name = typeof body.name === 'string' ? body.name.trim() : ''
     if (!name || name.length > 100) {

package/app/Actions/Dashboard/Rbac/RoleDestroyAction.ts

@@ -1,3 +1,4 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { deleteRole } from '@stacksjs/auth'
 import { response } from '@stacksjs/router'
@@ -16,13 +17,12 @@ export default new Action({
   description: 'Hard-delete a role + its pivot rows.',
   method: 'DELETE',
   apiResponse: true,
-  async handle(request) {
-    const name = String((request as any)?.params?.name ?? '').trim()
+  async handle(request: RequestInstance) {
+    const name = request.getParam('name').trim()
     if (!name) {
       return response.json({ error: '`name` route param is required.' }, 400)
     }
-    const url = new URL(request.url ?? 'http://localhost/')
-    const guardName = (url.searchParams.get('guard') || 'web').trim()
+    const guardName = String(request.get('guard', 'web')).trim()
     if (!guardName || guardName.length > 60) {
       return response.json({ error: 'Invalid guard name.' }, 400)
     }

package/app/Actions/Dashboard/Rbac/RolePermissionsShowAction.ts

@@ -1,3 +1,4 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { findRole, getRolePermissions } from '@stacksjs/auth'
 import { response } from '@stacksjs/router'
@@ -15,13 +16,12 @@ export default new Action({
   description: 'List permissions attached to one role.',
   method: 'GET',
   apiResponse: true,
-  async handle(request) {
-    const name = String((request as any)?.params?.name ?? '').trim()
+  async handle(request: RequestInstance) {
+    const name = request.getParam('name').trim()
     if (!name) {
       return response.json({ error: '`name` route param is required.' }, 400)
     }
-    const url = new URL(request.url ?? 'http://localhost/')
-    const guardName = (url.searchParams.get('guard') || 'web').trim()
+    const guardName = String(request.get('guard', 'web')).trim()
     if (!guardName || guardName.length > 60) {
       return response.json({ error: 'Invalid guard name.' }, 400)
     }

package/app/Actions/Dashboard/Rbac/RolePermissionsSyncAction.ts

@@ -1,3 +1,4 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { getRolePermissions, findRole, syncRolePermissions } from '@stacksjs/auth'
 import { response } from '@stacksjs/router'
@@ -19,13 +20,13 @@ export default new Action({
   description: 'Replace the permission set attached to one role.',
   method: 'POST',
   apiResponse: true,
-  async handle(request) {
-    const roleName = String((request as any)?.params?.name ?? '').trim()
+  async handle(request: RequestInstance<SyncInput>) {
+    const roleName = request.getParam('name').trim()
     if (!roleName) {
       return response.json({ error: '`name` route param is required.' }, 400)
     }
 
-    const body = (request as any).jsonBody as SyncInput | undefined ?? {}
+    const body = request.all()
     if (!Array.isArray(body.permissions)) {
       return response.json({ error: '`permissions` must be an array of permission names (possibly empty).' }, 400)
     }

package/app/Actions/Dashboard/Rbac/RoleStoreAction.ts

@@ -1,3 +1,4 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { createRole, findRole } from '@stacksjs/auth'
 import { response } from '@stacksjs/router'
@@ -25,8 +26,8 @@ export default new Action({
   description: 'Create a new role.',
   method: 'POST',
   apiResponse: true,
-  async handle(request) {
-    const body = (request as any).jsonBody as RoleInput | undefined ?? {}
+  async handle(request: RequestInstance<RoleInput>) {
+    const body = request.all()
 
     const name = typeof body.name === 'string' ? body.name.trim() : ''
     if (!name || name.length > 60) {

package/app/Actions/Dashboard/Rbac/UserRolesShowAction.ts

@@ -1,3 +1,4 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { getUserRoles } from '@stacksjs/auth'
 import { User } from '@stacksjs/orm'
@@ -16,14 +17,12 @@ export default new Action({
   description: 'List roles attached to one user.',
   method: 'GET',
   apiResponse: true,
-  async handle(request) {
-    const rawId = (request as any)?.params?.id
-    const userId = Number(rawId)
+  async handle(request: RequestInstance) {
+    const userId = Number(request.getParam('id'))
     if (!Number.isFinite(userId) || userId <= 0) {
       return response.json({ error: 'Invalid user id.' }, 400)
     }
-    const url = new URL(request.url ?? 'http://localhost/')
-    const guardName = (url.searchParams.get('guard') || 'web').trim()
+    const guardName = String(request.get('guard', 'web')).trim()
     if (!guardName || guardName.length > 60) {
       return response.json({ error: 'Invalid guard name.' }, 400)
     }

package/app/Actions/Dashboard/Rbac/UserRolesSyncAction.ts

@@ -1,3 +1,4 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { getUserRoles, syncRoles } from '@stacksjs/auth'
 import { User } from '@stacksjs/orm'
@@ -24,14 +25,13 @@ export default new Action({
   description: 'Replace the role set attached to one user.',
   method: 'POST',
   apiResponse: true,
-  async handle(request) {
-    const rawId = (request as any)?.params?.id
-    const userId = Number(rawId)
+  async handle(request: RequestInstance<SyncInput>) {
+    const userId = Number(request.getParam('id'))
     if (!Number.isFinite(userId) || userId <= 0) {
       return response.json({ error: 'Invalid user id.' }, 400)
     }
 
-    const body = (request as any).jsonBody as SyncInput | undefined ?? {}
+    const body = request.all()
     if (!Array.isArray(body.roles)) {
       return response.json({ error: '`roles` must be an array of role names (possibly empty).' }, 400)
     }

package/app/Actions/Dashboard/Search/GlobalSearchAction.ts

@@ -1,3 +1,4 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { env } from '@stacksjs/env'
 import { readdirSync } from 'node:fs'

package/app/Actions/Dashboard/Teams/TeamInviteAction.ts

@@ -25,12 +25,12 @@ export default new Action({
   method: 'POST',
   apiResponse: true,
 
-  async handle(request: RequestInstance) {
+  async handle(request: RequestInstance<InviteInput>) {
     const teamId = parsePositiveId(request.getParam('id'))
     if (!teamId)
       return response.json({ message: 'Invalid team id.' }, 400)
 
-    const input = (request as any).jsonBody as InviteInput | undefined ?? {}
+    const input = request.all()
     const email = normalizeInvitationEmail(input.email)
     const role = normalizeInvitationRole(input.role ?? 'member')
     if (!email)
@@ -83,7 +83,7 @@ export default new Action({
     const token = generateInvitationToken()
     const tokenHash = hashInvitationToken(token)
     const expiresAt = invitationExpiresAt()
-    const requester = (request as any).user ?? (request as any)._authenticatedUser ?? null
+    const requester = await request.user()
     const invitedByUserId = requester && Number.isInteger(Number(requester.id))
       ? Number(requester.id)
       : null

package/app/Actions/Dashboard/Teams/TeamMemberUpdateAction.ts

@@ -16,7 +16,7 @@ export default new Action({
   method: 'PATCH',
   apiResponse: true,
 
-  async handle(request: RequestInstance) {
+  async handle(request: RequestInstance<UpdateInput>) {
     const teamId = parsePositiveId(request.getParam('id'))
     const memberId = parsePositiveId(request.getParam('memberId'))
     if (!teamId || !memberId)
@@ -33,7 +33,7 @@ export default new Action({
     if (member.role === 'owner')
       return response.json({ message: 'Transfer team ownership before changing the owner.' }, 409)
 
-    const input = (request as any).jsonBody as UpdateInput | undefined ?? {}
+    const input = request.all()
     const role = input.role === undefined ? String(member.role) : normalizeInvitationRole(input.role)
     const status = input.status === undefined ? String(member.status) : String(input.status).trim().toLowerCase()
     if (!role)

package/app/Actions/Dashboard/dashboard-request.ts

@@ -0,0 +1,13 @@
+import type { RequestInstance } from '@stacksjs/types'
+
+/** Reads one scalar dashboard input value through the native request bag. */
+export function dashboardRequestValue(
+  request: RequestInstance,
+  key: string,
+  fallback = '',
+): string {
+  const value = request.get<unknown>(key, fallback)
+  if (Array.isArray(value))
+    return value.length > 0 ? String(value[0]).trim() : fallback
+  return value == null ? fallback : String(value).trim()
+}

package/app/Models/CardComment.ts

@@ -2,13 +2,12 @@ import { defineModel } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 /**
- * Card comment (stacksjs/stacks#1846 Phase 3).
+ * Card comment for the dashboard Kanban surface.
  *
  * Each comment belongs to a card and (optionally) to the user who
  * wrote it. Anonymous comments are allowed via nullable `user_id` —
  * makes the dev dashboard usable on localhost without an auth round-
- * trip, and supports system-generated activity entries
- * (eventually — Phase 4 could write status-change comments here).
+ * trip, and supports system-generated activity entries.
  *
  * Distinct from `Comment` (which is post-specific) so the schemas
  * don't fight: post comments carry `author_name`/`author_email` for
@@ -35,7 +34,7 @@ export default defineModel({
 
     useApi: {
       uri: 'card-comments',
-      routes: ['index', 'store', 'show', 'destroy'],
+      routes: ['index', 'store', 'show', 'update', 'destroy'],
       middleware: ['auth'],
     },
   },

package/functions/dashboard-api.ts

@@ -37,16 +37,9 @@ export class DashboardApiError extends Error {
   }
 }
 
-/**
- * Call a dashboard API endpoint and return its parsed JSON.
- *
- * Throws on a non-2xx response, using the server's `message` / `error`
- * field when there is one so callers can surface something better than a
- * bare status code.
- */
-export async function dashboardApi<T = unknown>(path: string, options: ApiRequestOptions = {}): Promise<T> {
+async function dashboardResponse(path: string, options: ApiRequestOptions, accept: string): Promise<Response> {
   const method = options.method ?? 'GET'
-  const headers: Record<string, string> = { accept: 'application/json' }
+  const headers: Record<string, string> = { accept }
   const authToken = useAuth().getToken()
 
   if (options.body !== undefined && options.formData)
@@ -62,7 +55,7 @@ export async function dashboardApi<T = unknown>(path: string, options: ApiReques
     ? headers
     : withCsrfHeader(headers)
 
-  const res = await fetch(path, {
+  return fetch(path, {
     method,
     headers: requestHeaders,
     credentials: 'same-origin',
@@ -70,6 +63,33 @@ export async function dashboardApi<T = unknown>(path: string, options: ApiReques
     ...(options.body !== undefined && { body: JSON.stringify(options.body) }),
     ...(options.formData && { body: options.formData }),
   })
+}
+
+async function dashboardResponseError(res: Response): Promise<DashboardApiError> {
+  const text = await res.text()
+  let payload: ApiErrorBody | null = null
+  try {
+    payload = text ? JSON.parse(text) as ApiErrorBody : null
+  }
+  catch {
+    payload = null
+  }
+
+  const failure = describeResponseError(res.status, payload)
+  if (failure.unexpected)
+    console.error('[dashboard-api] Unexpected request failure:', failure.cause)
+  return new DashboardApiError(failure.message, res.status, failure.fields)
+}
+
+/**
+ * Call a dashboard API endpoint and return its parsed JSON.
+ *
+ * Throws on a non-2xx response, using the server's `message` / `error`
+ * field when there is one so callers can surface something better than a
+ * bare status code.
+ */
+export async function dashboardApi<T = unknown>(path: string, options: ApiRequestOptions = {}): Promise<T> {
+  const res = await dashboardResponse(path, options, 'application/json')
 
   const text = await res.text()
   let payload: any = null
@@ -89,3 +109,24 @@ export async function dashboardApi<T = unknown>(path: string, options: ApiReques
 
   return payload as T
 }
+
+/**
+ * Download a guarded dashboard resource while preserving bearer and session
+ * authentication. The object URL only exists for the duration of the browser
+ * download and is then released.
+ */
+export async function dashboardDownload(path: string, filename: string): Promise<void> {
+  const res = await dashboardResponse(path, {}, 'application/octet-stream')
+  if (!res.ok)
+    throw await dashboardResponseError(res)
+
+  const objectUrl = URL.createObjectURL(await res.blob())
+  const anchor = document.createElement('a')
+  anchor.href = objectUrl
+  anchor.download = filename
+  anchor.hidden = true
+  document.body.append(anchor)
+  anchor.click()
+  anchor.remove()
+  setTimeout(() => URL.revokeObjectURL(objectUrl), 0)
+}

package/functions/inbox.test.ts

@@ -35,6 +35,8 @@ describe('dashboard inbox mapping', () => {
       date: '2026-07-29T12:00:00.000Z',
       read: false,
       hasAttachments: true,
+      attachments: [],
+      detailsLoaded: false,
     })
   })
 

package/functions/inbox.ts

@@ -6,7 +6,7 @@
 
 import { ref } from '@stacksjs/stx'
 import { get } from './api'
-import { dashboardApi } from './dashboard-api'
+import { dashboardApi, dashboardDownload } from './dashboard-api'
 import { pushToast } from './toasts'
 
 export type InboxActivityRange = 'day' | 'week' | 'month' | 'year'
@@ -71,6 +71,15 @@ export interface DashboardInboxEmail {
   date: string
   read: boolean
   hasAttachments: boolean
+  attachments: DashboardInboxAttachment[]
+  detailsLoaded: boolean
+}
+
+export interface DashboardInboxAttachment {
+  id: string
+  name: string
+  size: number
+  lastModified?: string
 }
 
 interface DashboardInboxEntry {
@@ -94,6 +103,7 @@ interface DashboardInboxResponse {
 interface DashboardInboxBodyResponse {
   html?: string
   text?: string
+  attachments?: DashboardInboxAttachment[]
   error?: string
 }
 
@@ -166,6 +176,8 @@ export function mapDashboardInboxEntry(item: DashboardInboxEntry): DashboardInbo
     date: item.date,
     read: item.read === true,
     hasAttachments: item.hasAttachments === true,
+    attachments: [],
+    detailsLoaded: false,
   }
 }
 
@@ -179,7 +191,7 @@ export async function fetchDashboardInbox(mailbox?: string): Promise<LoadedDashb
   }
 }
 
-export async function fetchDashboardInboxBody(messageId: string, mailbox?: string): Promise<Pick<DashboardInboxEmail, 'bodyHtml' | 'bodyText'>> {
+export async function fetchDashboardInboxBody(messageId: string, mailbox?: string): Promise<Pick<DashboardInboxEmail, 'attachments' | 'bodyHtml' | 'bodyText' | 'detailsLoaded' | 'hasAttachments'>> {
   const query = mailbox ? `?mailbox=${encodeURIComponent(mailbox)}` : ''
   const data = await dashboardApi<DashboardInboxBodyResponse>(`/api/dashboard/email/inbox/${encodeURIComponent(messageId)}${query}`)
   if (data.error)
@@ -187,9 +199,22 @@ export async function fetchDashboardInboxBody(messageId: string, mailbox?: strin
   return {
     bodyHtml: data.html || '',
     bodyText: data.text || '',
+    attachments: data.attachments || [],
+    detailsLoaded: true,
+    hasAttachments: (data.attachments || []).length > 0,
   }
 }
 
+export async function downloadDashboardInboxAttachment(
+  messageId: string,
+  attachment: DashboardInboxAttachment,
+  mailbox?: string,
+): Promise<void> {
+  const query = mailbox ? `?mailbox=${encodeURIComponent(mailbox)}` : ''
+  const path = `/api/dashboard/email/inbox/${encodeURIComponent(messageId)}/attachments/${encodeURIComponent(attachment.id)}${query}`
+  await dashboardDownload(path, attachment.name)
+}
+
 export async function fetchInboxActivity(range: InboxActivityRange): Promise<InboxActivity | null> {
   try {
     return await dashboardApi<InboxActivity>(`/api/dashboard/email/activity?range=${range}`)

package/functions/public-application-url.test.ts

@@ -0,0 +1,13 @@
+import { describe, expect, it } from 'bun:test'
+import { publicApplicationUrl } from './public-application-url'
+
+describe('publicApplicationUrl', () => {
+  it('uses HTTPS for application domains and removes duplicate separators', () => {
+    expect(publicApplicationUrl('/blog', 'stacks.localhost/')).toBe('https://stacks.localhost/blog')
+    expect(publicApplicationUrl('/blog/post', 'https://stacksjs.com/')).toBe('https://stacksjs.com/blog/post')
+  })
+
+  it('keeps explicit local development protocols', () => {
+    expect(publicApplicationUrl('/blog', 'http://localhost:3000')).toBe('http://localhost:3000/blog')
+  })
+})

package/functions/public-application-url.ts

@@ -0,0 +1,27 @@
+import process from 'node:process'
+
+function configuredApplicationUrl(): string {
+  const frontendUrl = process.env.FRONTEND_APP_URL?.trim()
+  if (frontendUrl && !frontendUrl.includes('${'))
+    return frontendUrl
+
+  return process.env.APP_URL?.trim() || 'http://localhost:3000'
+}
+
+function withProtocol(baseUrl: string): string {
+  if (/^https?:\/\//i.test(baseUrl))
+    return baseUrl
+
+  const host = baseUrl.split('/')[0].split(':')[0].toLowerCase()
+  const protocol = ['localhost', '127.0.0.1', '0.0.0.0', '[::1]'].includes(host)
+    ? 'http'
+    : 'https'
+  return `${protocol}://${baseUrl}`
+}
+
+/** Build an absolute URL for a page served by the public Stacks application. */
+export function publicApplicationUrl(pathname = '/', baseUrl = configuredApplicationUrl()): string {
+  const normalizedBase = withProtocol(baseUrl.trim()).replace(/\/+$/, '')
+  const normalizedPath = pathname.replace(/^\/+/, '')
+  return new URL(normalizedPath, `${normalizedBase}/`).toString()
+}

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.70.354",
+  "version": "0.70.355",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.70.354",
+  "version": "0.70.355",
   "description": "The complete managed Stacks application scaffold, including runtime defaults, AI guidance, editor metadata, and npm-backed project support files.",
   "author": "Chris Breuer",
   "license": "MIT",

package/resources/components/Dashboard/Auth/AccessTokens.stx

@@ -1,5 +1,6 @@
 <script client>
 import { DashboardApiError, dashboardApi } from '../../../../functions/dashboard-api'
+import { authStore } from '../../../../views/dashboard/stores/auth'
 
 interface AccessTokenRow {
   id: number
@@ -106,6 +107,20 @@ async function loadTokens(): Promise<void> {
   loading.set(true)
   loadError.set('')
   try {
+    await authStore.load()
+
+    if (authStore.error()) {
+      tokens.set([])
+      loadError.set(authStore.error() || 'The signed-in account could not be verified.')
+      return
+    }
+
+    if (authStore.unauthenticated()) {
+      tokens.set([])
+      authenticationRequired.set(true)
+      return
+    }
+
     const response = await dashboardApi<TokenListResponse>('/auth/tokens')
     tokens.set(response.tokens || [])
     authenticationRequired.set(false)

package/resources/components/Dashboard/Ci/CiDashboard.stx

@@ -5,7 +5,7 @@
   // (Action: Dashboard/Ci/StatusAction → @stacksjs/github). Active tab +
   // status filter live in the `ciStore` so they survive SPA navigation.
   //
-  // No <script server>, no window./document. reads — per #1838 the page
+  // No <script server>, no window./document. reads - per #1838 the page
   // is pure presentation against the store.
   import { useRole } from '~/storage/framework/defaults/views/dashboard/composables/useRole'
   import { ciStore } from '~/storage/framework/defaults/views/dashboard/stores/ci'
@@ -17,7 +17,7 @@
   // Role check is now backed by the real RBAC store + `/api/dashboard/auth/me`
   // (stacksjs/stacks#1843). `isDev()` returns true if the authenticated user
   // holds the `admin` or `dev` role, OR if the request is unauthenticated
-  // (i.e. local dev dashboard with no bearer token) — see `useRole.ts` for
+  // (i.e. local dev dashboard with no bearer token) - see `useRole.ts` for
   // the full resolution chain.
   const { isDev } = useRole()
   const canView = derived(() => isDev())
@@ -129,7 +129,7 @@
 
   // ─── Runner pressure sparkline (stacksjs/stacks#1850) ────────────
   //
-  // Inline SVG sparkline — no chart lib. The path is built off the
+  // Inline SVG sparkline - no chart lib. The path is built off the
   // active tab's sample history with a simple linear scale: x maps
   // to sample index (oldest left, newest right), y maps to queue
   // depth normalised against the larger of the org's cap or the
@@ -139,6 +139,8 @@
     const tab = activeTab()
     return (ci.runnerHistoryByOrg()[tab] || [])
   })
+  const runnerHistoryError = derived(() => ci.runnerHistoryErrors()[activeTab()] || '')
+  const loadingHistory = derived(() => ci.loadingRunnerHistory()[activeTab()] === true)
 
   effect(() => {
     const tab = activeTab()
@@ -173,7 +175,12 @@
     return samples && samples.length >= 2
   }
 
-  // Top-level fetch — runs on both hard reload (SSR hydration) and SPA
+  function retryRunnerHistory() {
+    const tab = activeTab()
+    if (tab) ci.loadRunnerHistory(tab, true)
+  }
+
+  // Top-level fetch - runs on both hard reload (SSR hydration) and SPA
   // mount, since `<script client>` re-executes on every entry. The store
   // tracks its own loading flag so back-to-back calls don't double-fire.
   ci.load()
@@ -195,7 +202,7 @@
     <p class="mt-1 text-sm text-zinc-500">GitHub Actions health across the configured orgs. Configure in <code class="text-xs">config/dashboard.ts</code>.</p>
   </header>
 
-  <!-- Disabled state — the surface is off in config/dashboard.ts -->
+  <!-- Disabled state - the surface is off in config/dashboard.ts -->
   <div :if="disabled" class="px-5 py-8 text-center bg-zinc-50 dark:bg-zinc-900 border border-zinc-200 rounded-lg dark:border-zinc-800">
     <p class="text-sm text-zinc-600 dark:text-zinc-400">CI tracking is disabled.</p>
     <p class="mt-1 text-xs text-zinc-500">Enable it in <code>config/dashboard.ts</code> by setting <code>ci.enabled = true</code> and listing one or more orgs.</p>
@@ -247,7 +254,7 @@
       <span class="text-zinc-300 dark:text-zinc-700">·</span>
       <span class="text-zinc-500 dark:text-zinc-400" :text="runnersText"></span>
     </div>
-    <!-- Sparkline showing recent queue depth for the active org —
+    <!-- Sparkline showing recent queue depth for the active org -
         appears only when alerts are on (history collection is gated
         on `ci.alerts.enabled`). Drawn inline as a single SVG path
         so we don't pull a chart library for 20 datapoints. -->
@@ -257,6 +264,17 @@
         <path :d="sparklinePath()" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linejoin="round" stroke-linecap="round" />
       </svg>
     </div>
+    <div :if="loadingHistory() && !hasHistory()" role="status" class="flex gap-2 items-center mb-5 text-zinc-500 text-xs dark:text-zinc-400">
+      <span aria-hidden="true" class="h-3.5 w-3.5 animate-spin i-hugeicons-loading-03"></span>
+      <span>Loading runner history</span>
+    </div>
+    <div :if="runnerHistoryError()" role="alert" class="flex flex-wrap gap-3 items-center justify-between mb-5 px-3 py-2 bg-amber-50 dark:bg-amber-950/30 border border-amber-200 rounded-lg dark:border-amber-900/50">
+      <div>
+        <p class="font-medium text-amber-800 text-xs dark:text-amber-200">Runner history unavailable</p>
+        <p class="mt-0.5 text-amber-700 text-xs dark:text-amber-300" :text="runnerHistoryError"></p>
+      </div>
+      <Button variant="secondary" size="xs" :loading="loadingHistory" @click="retryRunnerHistory()">Retry</Button>
+    </div>
 
     <!-- Repo cards -->
     <div class="grid gap-2" style="grid-template-columns: repeat(auto-fill, minmax(340px, 1fr))">

package/resources/components/Dashboard/Commerce/CommerceTaxDialog.stx

@@ -132,7 +132,7 @@ function errorMessages(): string[] {
             <input x-model="exemptible" type="checkbox" class="mt-0.5 h-4 w-4 text-blue-600 border-gray-300 rounded" />
             <span>
               <span class="block font-medium text-gray-700 text-sm dark:text-neutral-200">Can be exempted</span>
-              <span class="block mt-0.5 text-gray-500 text-xs dark:text-neutral-400">Customers who qualify for an exemption are not charged this component. Leave off for anything owed regardless — an excise or a city levy is usually still due.</span>
+              <span class="block mt-0.5 text-gray-500 text-xs dark:text-neutral-400">Customers who qualify for an exemption are not charged this component. Leave off for anything owed regardless - an excise or a city levy is usually still due.</span>
             </span>
           </label>
         </div>

package/resources/components/Dashboard/Commerce/ProductWaitlistDashboard.stx

@@ -23,6 +23,13 @@ const deleteRecord = state<ProductWaitlistRecord | null>(null)
 const isSaving = state(false)
 const isDeleting = state(false)
 const validationErrors = state<Record<string, string>>({})
+const metrics = derived(() => [
+  { label: 'Recorded', value: summary().total },
+  { label: 'Waiting', value: summary().waiting },
+  { label: 'Notified', value: summary().notified },
+  { label: 'Purchased', value: summary().purchased },
+  { label: 'Conversion', value: `${summary().conversionRate}%` },
+])
 
 function rows(): ProductWaitlistRecord[] {
   const query = search().trim().toLowerCase()
@@ -166,13 +173,7 @@ onMount(() => {
   </div>
 
   <section class="grid gap-3 grid-cols-2 lg:grid-cols-5">
-    <template :for="item in [
-      { label: 'Recorded', value: summary().total },
-      { label: 'Waiting', value: summary().waiting },
-      { label: 'Notified', value: summary().notified },
-      { label: 'Purchased', value: summary().purchased },
-      { label: 'Conversion', value: summary().conversionRate + '%' }
-    ]">
+    <template :for="item in metrics()">
       <div class="p-4 bg-white dark:bg-neutral-800 border border-gray-200 rounded-lg dark:border-neutral-700">
         <p class="text-gray-500 text-xs uppercase dark:text-neutral-400">{{ item.label }}</p>
         <p class="mt-2 font-semibold text-2xl text-gray-900 dark:text-white">{{ item.value }}</p>