@stacksjs/defaults 0.70.354 → 0.70.356

package/app/Actions/Dashboard/Teams/team-invitation-delivery.ts

@@ -1,7 +1,8 @@
 import { config } from '@stacksjs/config'
 import { db } from '@stacksjs/database'
 import { sendTeamInvitation } from '../../../Mail/TeamInvitation'
-import { invitationUrl, sqlTimestamp } from './team-records'
+import { teamOperationalIssue } from '../../Teams/team-response'
+import { changedRows, invitationUrl, sqlTimestamp } from './team-records'
 
 interface DeliveryInput {
   id: number
@@ -9,12 +10,22 @@ interface DeliveryInput {
   teamName: string
   role: string
   token: string
+  tokenHash: string
+}
+
+async function recordDeliveryFailure(input: DeliveryInput, message: string): Promise<void> {
+  try {
+    await markTeamInvitationDeliveryFailed(input.id, input.tokenHash, message)
+  }
+  catch (error) {
+    teamOperationalIssue(error, 'Invitation delivery failure could not be recorded.', 'deliverTeamInvitation.failureStatus')
+  }
 }
 
 export async function deliverTeamInvitation(input: DeliveryInput): Promise<void> {
   const baseUrl = String(process.env.APP_URL || config.app.url || '').trim()
   if (!baseUrl) {
-    await markTeamInvitationDeliveryFailed(input.id, 'APP_URL is not configured.')
+    await recordDeliveryFailure(input, 'APP_URL is not configured.')
     throw new Error('APP_URL must be configured before invitations can be delivered.')
   }
 
@@ -26,7 +37,15 @@ export async function deliverTeamInvitation(input: DeliveryInput): Promise<void>
       invitationUrl: invitationUrl(baseUrl, input.token),
       expiresInDays: 7,
     })
-    await (db as any)
+  }
+  catch (error) {
+    const message = teamOperationalIssue(error, 'Email delivery failed.', 'deliverTeamInvitation.provider')
+    await recordDeliveryFailure(input, message)
+    throw error
+  }
+
+  try {
+    const result = await (db as any)
       .updateTable('team_invitations')
       .set({
         delivery_status: 'sent',
@@ -35,16 +54,18 @@ export async function deliverTeamInvitation(input: DeliveryInput): Promise<void>
         updated_at: sqlTimestamp(),
       })
       .where('id', '=', input.id)
-      .execute()
+      .where('token_hash', '=', input.tokenHash)
+      .executeTakeFirst()
+    if (changedRows(result) !== 1)
+      throw new Error('Invitation delivery status changed before it could be recorded.')
   }
   catch (error) {
-    const message = error instanceof Error ? error.message : 'Email delivery failed.'
-    await markTeamInvitationDeliveryFailed(input.id, message)
+    teamOperationalIssue(error, 'Invitation delivery success could not be recorded.', 'deliverTeamInvitation.successStatus')
     throw error
   }
 }
 
-export async function markTeamInvitationDeliveryFailed(id: number, error: string): Promise<void> {
+export async function markTeamInvitationDeliveryFailed(id: number, tokenHash: string, error: string): Promise<void> {
   await (db as any)
     .updateTable('team_invitations')
     .set({
@@ -53,5 +74,6 @@ export async function markTeamInvitationDeliveryFailed(id: number, error: string
       updated_at: sqlTimestamp(),
     })
     .where('id', '=', id)
+    .where('token_hash', '=', tokenHash)
     .execute()
 }

package/app/Actions/Dashboard/Teams/team-member-count.ts

@@ -1,4 +1,4 @@
-import { db } from '@stacksjs/database'
+import { db, sql } from '@stacksjs/database'
 import { sqlTimestamp } from './team-records'
 
 export async function syncTeamMemberCount(teamId: number, connection: typeof db = db): Promise<number> {
@@ -6,9 +6,11 @@ export async function syncTeamMemberCount(teamId: number, connection: typeof db
     .selectFrom('team_members')
     .where('team_id', '=', teamId)
     .where('status', '=', 'active')
-    .select(connection.fn.count('id').as('count'))
+    .select(sql`count(*) as count`)
     .executeTakeFirst()
   const count = Number(row?.count || 0)
+  if (!Number.isSafeInteger(count) || count < 0)
+    throw new TypeError('Team member count must be a non-negative integer.')
 
   await connection
     .updateTable('teams')

package/app/Actions/Dashboard/Teams/team-records.test.ts

@@ -25,6 +25,8 @@ describe('team records', () => {
     expect(changedRows({ changes: 1 })).toBe(1)
     expect(changedRows({ affectedRows: 2 })).toBe(2)
     expect(changedRows([{ numUpdatedRows: 3n }])).toBe(3)
+    expect(changedRows({ numDeletedRows: 4n })).toBe(4)
+    expect(changedRows({ numInsertedRows: 5n })).toBe(5)
     expect(changedRows(null)).toBe(0)
   })
 

package/app/Actions/Dashboard/Teams/team-records.ts

@@ -24,6 +24,8 @@ export function changedRows(result: unknown): number {
     ?? record.affectedRows
     ?? record.numAffectedRows
     ?? record.numUpdatedRows
+    ?? record.numDeletedRows
+    ?? record.numInsertedRows
     ?? 0,
   )
 }

package/app/Actions/Dashboard/dashboard-request.ts

@@ -0,0 +1,13 @@
+import type { RequestInstance } from '@stacksjs/types'
+
+/** Reads one scalar dashboard input value through the native request bag. */
+export function dashboardRequestValue(
+  request: RequestInstance,
+  key: string,
+  fallback = '',
+): string {
+  const value = request.get<unknown>(key, fallback)
+  if (Array.isArray(value))
+    return value.length > 0 ? String(value[0]).trim() : fallback
+  return value == null ? fallback : String(value).trim()
+}

package/app/Actions/Dashboard/dashboard-response.ts

@@ -0,0 +1,16 @@
+import { response } from '@stacksjs/router'
+
+export function dashboardOperationalError(
+  error: unknown,
+  message: string,
+  action: string,
+  status = 503,
+): Response {
+  console.error(`[dashboard/api] ${action} failed:`, error)
+  return response.json({ message }, status)
+}
+
+export function dashboardOperationalIssue(error: unknown, message: string, action: string): string {
+  console.error(`[dashboard/api] ${action} failed:`, error)
+  return message
+}

package/app/Actions/SendWelcomeEmail.ts

@@ -15,7 +15,7 @@ export default new Action({
     const appName = config.app.name || 'our app'
     const url = config.app.url || 'https://localhost:5173'
 
-    await mail.send({
+    await mail.sendOrFail({
       to,
       subject: `Welcome to ${appName}!`,
       text: `

package/app/Actions/Teams/AcceptInvitationAction.ts

@@ -13,6 +13,7 @@ import {
   sqlTimestamp,
 } from '../Dashboard/Teams/team-records'
 import { syncTeamMemberCount } from '../Dashboard/Teams/team-member-count'
+import { teamOperationalError } from './team-response'
 
 export default new Action({
   name: 'Accept Team Invitation',
@@ -25,23 +26,38 @@ export default new Action({
     if (!token || token.length > 200)
       return response.json({ message: 'Invitation not found.' }, 404)
 
-    const authenticated = await resolveAuthenticatedUser(request as any)
+    let authenticated
+    try {
+      authenticated = await resolveAuthenticatedUser(request as any)
+    }
+    catch (error) {
+      return teamOperationalError(error, 'Authentication could not be verified.', 'AcceptInvitationAction.auth')
+    }
     if (!authenticated?.id)
       return response.json({ message: 'Sign in to accept this invitation.' }, 401)
 
-    const user = await db
-      .selectFrom('users')
-      .where('id', '=', authenticated.id)
-      .select(['id', 'email'])
-      .executeTakeFirst()
+    const tokenHash = hashInvitationToken(token)
+    let user
+    let invitation
+    try {
+      [user, invitation] = await Promise.all([
+        db
+          .selectFrom('users')
+          .where('id', '=', authenticated.id)
+          .select(['id', 'email'])
+          .executeTakeFirst(),
+        (db as any)
+          .selectFrom('team_invitations')
+          .where('token_hash', '=', tokenHash)
+          .select(['id', 'team_id', 'email', 'role', 'status', 'expires_at'])
+          .executeTakeFirst(),
+      ])
+    }
+    catch (error) {
+      return teamOperationalError(error, 'Invitation acceptance could not be prepared.', 'AcceptInvitationAction.lookup')
+    }
     if (!user)
       return response.json({ message: 'Authenticated user not found.' }, 401)
-
-    const invitation = await (db as any)
-      .selectFrom('team_invitations')
-      .where('token_hash', '=', hashInvitationToken(token))
-      .select(['id', 'team_id', 'email', 'role', 'status', 'expires_at'])
-      .executeTakeFirst()
     if (!invitation)
       return response.json({ message: 'Invitation not found.' }, 404)
 
@@ -58,49 +74,56 @@ export default new Action({
     const userId = Number(user.id)
     const now = sqlTimestamp()
 
-    const accepted = await db.transaction(async (rawTrx) => {
-      const trx = rawTrx as unknown as typeof db
-      const claim = await (trx as any)
-        .updateTable('team_invitations')
-        .set({
-          status: 'accepted',
-          token_hash: hashInvitationToken(generateInvitationToken()),
-          accepted_by_user_id: userId,
-          accepted_at: now,
-          updated_at: now,
-        })
-        .where('id', '=', Number(invitation.id))
-        .where('token_hash', '=', hashInvitationToken(token))
-        .where('status', '=', 'pending')
-        .executeTakeFirst()
+    let accepted
+    try {
+      accepted = await db.transaction(async (rawTrx) => {
+        const trx = rawTrx as unknown as typeof db
+        const claim = await (trx as any)
+          .updateTable('team_invitations')
+          .set({
+            status: 'accepted',
+            token_hash: hashInvitationToken(generateInvitationToken()),
+            pending_key: null,
+            accepted_by_user_id: userId,
+            accepted_at: now,
+            updated_at: now,
+          })
+          .where('id', '=', Number(invitation.id))
+          .where('token_hash', '=', tokenHash)
+          .where('status', '=', 'pending')
+          .executeTakeFirst()
 
-      if (changedRows(claim) !== 1)
-        return null
+        if (changedRows(claim) !== 1)
+          return null
 
-      const existing = await (trx as any)
-        .selectFrom('team_members')
-        .where('team_id', '=', teamId)
-        .where('user_id', '=', userId)
-        .select(['id'])
-        .executeTakeFirst()
+        const existing = await (trx as any)
+          .selectFrom('team_members')
+          .where('team_id', '=', teamId)
+          .where('user_id', '=', userId)
+          .select(['id'])
+          .executeTakeFirst()
 
-      if (!existing) {
-        await (trx as any)
-          .insertInto('team_members')
-          .values({
-            team_id: teamId,
-            user_id: userId,
-            role: String(invitation.role),
-            status: 'active',
-            created_at: now,
-            uuid: randomUUID(),
-          })
-          .execute()
-      }
+        if (!existing) {
+          await (trx as any)
+            .insertInto('team_members')
+            .values({
+              team_id: teamId,
+              user_id: userId,
+              role: String(invitation.role),
+              status: 'active',
+              created_at: now,
+              uuid: randomUUID(),
+            })
+            .execute()
+        }
 
-      await syncTeamMemberCount(teamId, trx)
-      return { alreadyMember: Boolean(existing) }
-    })
+        await syncTeamMemberCount(teamId, trx)
+        return { alreadyMember: Boolean(existing) }
+      })
+    }
+    catch (error) {
+      return teamOperationalError(error, 'The invitation could not be accepted.', 'AcceptInvitationAction.accept', 500)
+    }
 
     if (!accepted)
       return response.json({ message: 'This invitation is no longer available.' }, 409)

package/app/Actions/Teams/ShowInvitationAction.ts

@@ -3,6 +3,7 @@ import { Action } from '@stacksjs/actions'
 import { db } from '@stacksjs/database'
 import { response } from '@stacksjs/router'
 import { hashInvitationToken, invitationStatus } from '../Dashboard/Teams/team-records'
+import { teamOperationalError } from './team-response'
 
 export default new Action({
   name: 'Show Team Invitation',
@@ -15,20 +16,26 @@ export default new Action({
     if (!token || token.length > 200)
       return response.json({ message: 'Invitation not found.' }, 404)
 
-    const invitation = await (db as any)
-      .selectFrom('team_invitations')
-      .innerJoin('teams', 'teams.id', '=', 'team_invitations.team_id')
-      .where('team_invitations.token_hash', '=', hashInvitationToken(token))
-      .select([
-        'team_invitations.id as id',
-        'team_invitations.team_id as team_id',
-        'team_invitations.email as email',
-        'team_invitations.role as role',
-        'team_invitations.status as status',
-        'team_invitations.expires_at as expires_at',
-        'teams.name as team_name',
-      ])
-      .executeTakeFirst()
+    let invitation
+    try {
+      invitation = await (db as any)
+        .selectFrom('team_invitations')
+        .innerJoin('teams', 'teams.id', '=', 'team_invitations.team_id')
+        .where('team_invitations.token_hash', '=', hashInvitationToken(token))
+        .select([
+          'team_invitations.id as id',
+          'team_invitations.team_id as team_id',
+          'team_invitations.email as email',
+          'team_invitations.role as role',
+          'team_invitations.status as status',
+          'team_invitations.expires_at as expires_at',
+          'teams.name as team_name',
+        ])
+        .executeTakeFirst()
+    }
+    catch (error) {
+      return teamOperationalError(error, 'Invitation details could not be loaded.', 'ShowInvitationAction')
+    }
     if (!invitation)
       return response.json({ message: 'Invitation not found.' }, 404)
 

package/app/Actions/Teams/team-response.ts

@@ -0,0 +1,23 @@
+import { response } from '@stacksjs/router'
+
+export class TeamStateConflictError extends Error {
+  constructor(message: string) {
+    super(message)
+    this.name = 'TeamStateConflictError'
+  }
+}
+
+export function teamOperationalError(
+  error: unknown,
+  message: string,
+  action: string,
+  status = 503,
+): Response {
+  console.error(`[teams/api] ${action} failed:`, error)
+  return response.json({ message }, status)
+}
+
+export function teamOperationalIssue(error: unknown, message: string, action: string): string {
+  console.error(`[teams/api] ${action} failed:`, error)
+  return message
+}

package/app/Mail/OrderConfirmation.ts

@@ -48,7 +48,7 @@ export async function sendOrderConfirmation(options: OrderConfirmationOptions):
     subject: `Your ${appName} order #${options.orderId} is confirmed`,
   })
 
-  await mail.send({
+  await mail.sendOrFail({
     to: [options.to],
     from: { name: appName, address: fromAddress },
     subject: `Your ${appName} order #${options.orderId} is confirmed`,

package/app/Mail/SubscriptionConfirmation.ts

@@ -26,7 +26,7 @@ export async function sendSubscriptionConfirmation(options: SubscriptionConfirma
     subject: `Welcome to ${appName}!`,
   })
 
-  await mail.send({
+  await mail.sendOrFail({
     to: [to],
     from: {
       name: config.email.from?.name || appName,

package/app/Mail/TeamInvitation.ts

@@ -23,7 +23,7 @@ export async function sendTeamInvitation(options: TeamInvitationMailOptions): Pr
     subject,
   })
 
-  await mail.send({
+  await mail.sendOrFail({
     to: [options.to],
     from: {
       name: config.email.from?.name || appName,

package/app/Models/CardComment.ts

@@ -2,13 +2,12 @@ import { defineModel } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 /**
- * Card comment (stacksjs/stacks#1846 Phase 3).
+ * Card comment for the dashboard Kanban surface.
  *
  * Each comment belongs to a card and (optionally) to the user who
  * wrote it. Anonymous comments are allowed via nullable `user_id` —
  * makes the dev dashboard usable on localhost without an auth round-
- * trip, and supports system-generated activity entries
- * (eventually — Phase 4 could write status-change comments here).
+ * trip, and supports system-generated activity entries.
  *
  * Distinct from `Comment` (which is post-specific) so the schemas
  * don't fight: post comments carry `author_name`/`author_email` for
@@ -35,7 +34,7 @@ export default defineModel({
 
     useApi: {
       uri: 'card-comments',
-      routes: ['index', 'store', 'show', 'destroy'],
+      routes: ['index', 'store', 'show', 'update', 'destroy'],
       middleware: ['auth'],
     },
   },

package/app/Models/EmailIdempotency.ts

@@ -0,0 +1,64 @@
+import { defineModel } from '@stacksjs/orm'
+import { schema } from '@stacksjs/validation'
+
+export default defineModel({
+  name: 'EmailIdempotency',
+  table: 'email_idempotency',
+  primaryKey: 'id',
+  autoIncrement: true,
+
+  traits: {
+    useTimestamps: true,
+    useApi: {
+      uri: 'email-idempotency',
+      routes: ['index', 'show', 'destroy'],
+      middleware: ['auth'],
+    },
+  },
+
+  attributes: {
+    idempotencyKey: {
+      required: true,
+      hidden: true,
+      unique: true,
+      validation: {
+        rule: schema.string().required().max(255),
+      },
+    },
+    messageId: {
+      required: false,
+      validation: {
+        rule: schema.string().max(512),
+      },
+    },
+    recipient: {
+      required: false,
+      hidden: true,
+      validation: {
+        rule: schema.string().max(2000),
+      },
+    },
+    subject: {
+      required: false,
+      hidden: true,
+      validation: {
+        rule: schema.string().max(998),
+      },
+    },
+    provider: {
+      required: false,
+      validation: {
+        rule: schema.string().max(100),
+      },
+    },
+    success: {
+      required: true,
+      default: true,
+      validation: {
+        rule: schema.boolean(),
+      },
+    },
+  },
+
+  dashboard: { enabled: false },
+} as const)

package/app/Models/EmailSuppression.ts

@@ -0,0 +1,52 @@
+import { defineModel } from '@stacksjs/orm'
+import { schema } from '@stacksjs/validation'
+
+export default defineModel({
+  name: 'EmailSuppression',
+  table: 'email_suppressions',
+  primaryKey: 'id',
+  autoIncrement: true,
+
+  indexes: [
+    {
+      name: 'email_suppressions_email_type_unique',
+      columns: ['email', 'type'],
+      unique: true,
+    },
+  ],
+
+  traits: {
+    useTimestamps: true,
+    useApi: {
+      uri: 'email-suppressions',
+      routes: ['index', 'show', 'destroy'],
+      middleware: ['auth'],
+    },
+  },
+
+  attributes: {
+    email: {
+      required: true,
+      fillable: true,
+      validation: {
+        rule: schema.string().email().required().max(320),
+      },
+    },
+    type: {
+      required: true,
+      fillable: true,
+      validation: {
+        rule: schema.enum(['bounce', 'complaint', 'unsubscribe', 'manual']),
+      },
+    },
+    reason: {
+      required: false,
+      fillable: true,
+      validation: {
+        rule: schema.string().max(2000),
+      },
+    },
+  },
+
+  dashboard: { enabled: false },
+} as const)

package/app/Models/EmailWebhookEvent.ts

@@ -0,0 +1,51 @@
+import { defineModel } from '@stacksjs/orm'
+import { schema } from '@stacksjs/validation'
+
+export default defineModel({
+  name: 'EmailWebhookEvent',
+  table: 'email_webhook_events',
+  primaryKey: 'id',
+  autoIncrement: true,
+
+  indexes: [
+    {
+      name: 'email_webhook_events_provider_event_unique',
+      columns: ['provider', 'event_id'],
+      unique: true,
+    },
+  ],
+
+  traits: {
+    useTimestamps: true,
+    useApi: {
+      uri: 'email-webhook-events',
+      routes: ['index', 'show', 'destroy'],
+      middleware: ['auth'],
+    },
+  },
+
+  attributes: {
+    provider: {
+      required: true,
+      fillable: true,
+      validation: {
+        rule: schema.enum(['mailgun', 'postmark', 'ses', 'sendgrid']),
+      },
+    },
+    eventId: {
+      required: true,
+      hidden: true,
+      validation: {
+        rule: schema.string().required().max(512),
+      },
+    },
+    processedAt: {
+      required: true,
+      validation: {
+        rule: schema.timestamp().required(),
+      },
+    },
+  },
+
+  dashboard: { enabled: false },
+} as const)

package/app/Models/TeamInvitation.ts

@@ -20,6 +20,11 @@ export default defineModel({
       columns: ['token_hash'],
       unique: true,
     },
+    {
+      name: 'team_invitations_pending_key_unique',
+      columns: ['pending_key'],
+      unique: true,
+    },
     {
       name: 'team_invitations_team_email_status_index',
       columns: ['team_id', 'email', 'status'],
@@ -79,6 +84,14 @@ export default defineModel({
       },
     },
 
+    pendingKey: {
+      required: false,
+      hidden: true,
+      validation: {
+        rule: schema.string().max(384),
+      },
+    },
+
     invitedByUserId: {
       required: false,
       validation: {