@stacksjs/defaults 0.70.354 → 0.70.356

package/resources/components/Dashboard/Email/InboxDashboard.stx

@@ -121,7 +121,7 @@ async function openEmail(value: DashboardInboxEmail | CustomEvent<DashboardInbox
   deletePending.set(false)
   replyText.set('')
 
-  if (!email.bodyHtml && !email.bodyText) {
+  if (!email.detailsLoaded) {
     try {
       const body = await fetchDashboardInboxBody(email.id, mailbox())
       emails.set(emails().map(item => item.id === email.id ? { ...item, ...body } : item))
@@ -228,7 +228,7 @@ onMount(() => {
 </script>
 
 <div class="overflow-hidden bg-white dark:bg-neutral-800 border border-gray-200 rounded-lg dark:border-neutral-700">
-  <div class="flex min-h-[calc(100vh-8rem)]">
+  <div class="flex flex-col md:flex-row min-h-[calc(100vh-8rem)]">
     <EmailSidebar
       activeFolder="inbox"
       :folders="folders"
@@ -237,10 +237,10 @@ onMount(() => {
       @compose="compose"
     />
 
-    <div class="flex overflow-hidden flex-1 flex-col">
+    <div class="flex overflow-hidden flex-1 flex-col min-w-0">
       <header class="px-4 py-3 bg-white dark:bg-neutral-700 border-b border-gray-200 dark:border-neutral-600">
         <div class="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
-          <div class="flex gap-4 items-center">
+          <div class="flex flex-col gap-2 sm:flex-row sm:gap-4 sm:items-center min-w-0">
             <h1 class="font-bold text-gray-900 text-xl dark:text-white">Inbox</h1>
             <EmailNavigation active="inbox" />
           </div>
@@ -277,6 +277,7 @@ onMount(() => {
           :replying="isReplying"
           :replyText="replyText"
           :canSendReply="canSendReply"
+          :mailbox="mailbox"
           @close="closeEmail"
           @toggle-read="toggleSelectedRead"
           @request-delete="requestDelete"

package/resources/components/Dashboard/Email/InboxMessageDetail.stx

@@ -7,6 +7,7 @@ const deleting = useReactiveProp('deleting', false)
 const replying = useReactiveProp('replying', false)
 const replyText = useReactiveProp('replyText', '')
 const canSendReply = useReactiveProp('canSendReply', false)
+const mailbox = useReactiveProp('mailbox', '')
 const emit = defineEmits()
 
 function message(): DashboardInboxEmail | null {
@@ -69,10 +70,11 @@ function formatDate(value: string): string {
       :text="message()?.bodyText || ''"
       :title="message()?.subject || 'Inbound email preview'"
     />
-    <div :if="message()?.hasAttachments" class="flex gap-3 items-start mb-4 mx-4 p-3 text-gray-700 text-sm dark:text-neutral-300 bg-gray-50 dark:bg-neutral-800 border border-gray-200 rounded-md dark:border-neutral-600">
-      <span class="flex-shrink-0 mt-0.5 h-5 w-5 i-hugeicons-attachment-01"></span>
-      <p>This message includes attachments. Attachment downloads are not exposed by the inbox API yet.</p>
-    </div>
+    <InboxAttachmentList
+      :attachments="message()?.attachments || []"
+      :mailbox="mailbox"
+      :messageId="message()?.id || ''"
+    />
   </div>
 
   <div class="p-4 bg-white dark:bg-neutral-700 border-gray-200 border-t dark:border-neutral-600">

package/resources/components/Dashboard/Jobs/JobDetail.stx

@@ -1,5 +1,6 @@
 <script client>
 import type { DashboardJob } from '../../../../functions/jobs'
+import { DashboardApiError } from '../../../../functions/dashboard-api'
 import { fetchJob, retryJob } from '../../../../functions/jobs'
 import { pushToast } from '../../../../functions/toasts'
 
@@ -53,11 +54,11 @@ async function loadJob(): Promise<void> {
   try {
     const response = await fetchJob(jobId())
     job.set(response.job)
-    loadError.set(response.error || '')
   }
   catch (error) {
     job.set(null)
-    loadError.set(error instanceof Error ? error.message : 'Job could not be loaded.')
+    if (!(error instanceof DashboardApiError && error.status === 404))
+      loadError.set(error instanceof Error ? error.message : 'Job could not be loaded.')
   }
   finally {
     isLoading.set(false)

package/resources/components/Dashboard/Kanban/KanbanBoardDashboard.stx

@@ -1,5 +1,5 @@
 <script client>
-  // Kanban board view (stacksjs/stacks#1846 Phase 2).
+  // Kanban board view.
   //
   // Optimistic-update pattern:
   //   1. The DnD handler mutates the store immediately (so the card
@@ -29,7 +29,7 @@
   const columns = derived(() => kanban.currentColumns())
   const allLabels = derived(() => kanban.currentLabels())
 
-  // Card detail modal state — read straight from the store. The
+  // Card detail modal state - read straight from the store. The
   // modal itself lives at the bottom of this file.
   const openCard = derived(() => kanban.openCard())
   const loadingCard = derived(() => kanban.loadingCard())
@@ -48,6 +48,9 @@
   const titleDraft = state('')
   const descDraft = state('')
   const commentDraft = state('')
+  const editingCommentId = state(null)
+  const commentEditDraft = state('')
+  const savingCommentId = state(null)
   const showLabelPicker = state(false)
   const showAssigneePicker = state(false)
   const showNewLabelComposer = state(false)
@@ -83,6 +86,9 @@
     descDraft.set(c ? (c.description || '') : '')
     dueDateDraft.set(c?.dueDate ? c.dueDate.slice(0, 10) : '')
     commentDraft.set('')
+    editingCommentId.set(null)
+    commentEditDraft.set('')
+    savingCommentId.set(null)
   }
   // Sync drafts when the open card changes (open / close / refetch).
   effect(() => { openCard(); Promise.resolve().then(syncDraftsFromCard) })
@@ -134,6 +140,40 @@
     if (ok) commentDraft.set('')
   }
 
+  function startCommentEdit(id, body) {
+    editingCommentId.set(id)
+    commentEditDraft.set(body)
+  }
+
+  function cancelCommentEdit() {
+    editingCommentId.set(null)
+    commentEditDraft.set('')
+  }
+
+  async function saveCommentEdit(id) {
+    const body = commentEditDraft().trim()
+    if (!body || savingCommentId()) return
+    savingCommentId.set(id)
+    try {
+      if (await kanban.updateComment(id, body))
+        cancelCommentEdit()
+    }
+    finally {
+      savingCommentId.set(null)
+    }
+  }
+
+  function handleCommentEditKeydown(event, id) {
+    if (event.key === 'Escape') {
+      event.preventDefault()
+      cancelCommentEdit()
+    }
+    if (event.key === 'Enter' && (event.metaKey || event.ctrlKey)) {
+      event.preventDefault()
+      void saveCommentEdit(id)
+    }
+  }
+
   function requestDelete(kind: DeleteKind, id: number, hasCards = false): void {
     pendingDelete.set({ kind, id, hasCards })
   }
@@ -219,7 +259,7 @@
   }
 
   // Pull the id from the URL through the navigation composable.
-  // (stacksjs/stacks#1838 — no vanilla DOM in dashboard pages).
+  // (stacksjs/stacks#1838 - no vanilla DOM in dashboard pages).
   const id = useNavigation().urlIdParam()
   if (id !== null)
     kanban.loadBoard(id)
@@ -647,7 +687,7 @@
     </div>
   </div>
 
-  <!-- ───────────── Card detail modal (Phase 3) ───────────── -->
+  <!-- Card detail modal -->
   <!-- Opens on card click. Fixed positioned with a backdrop; closes
       on backdrop click + Escape. Sections (top → bottom):
         · Title (inline-editable, blurs to commit)
@@ -739,9 +779,26 @@
                   <div class="flex gap-2 items-baseline">
                     <span class="font-medium text-xs text-zinc-700 dark:text-zinc-200" :text="cm.authorName || cm.authorEmail || 'Unknown'"></span>
                     <span class="text-[10px] text-zinc-400" :text="formatTimestamp(cm.createdAt)"></span>
-                    <Button variant="ghost" size="xs" @click="requestDelete('comment', cm.id)"><span class="text-red-500">Delete</span></Button>
+                    <template :if="editingCommentId() !== cm.id">
+                      <Button variant="ghost" size="xs" @click="startCommentEdit(cm.id, cm.body)">Edit</Button>
+                      <Button variant="ghost" size="xs" @click="requestDelete('comment', cm.id)"><span class="text-red-500">Delete</span></Button>
+                    </template>
+                  </div>
+                  <p :if="editingCommentId() !== cm.id" class="mt-0.5 text-xs text-zinc-700 whitespace-pre-wrap dark:text-zinc-300" :text="cm.body"></p>
+                  <div :if="editingCommentId() === cm.id" class="mt-2">
+                    <textarea
+                      x-model="commentEditDraft"
+                      @keydown="handleCommentEditKeydown($event, cm.id)"
+                      rows="3"
+                      maxlength="10000"
+                      :aria-label="'Edit comment by ' + (cm.authorName || cm.authorEmail || 'Unknown')"
+                      class="px-3 py-2 w-full text-sm text-zinc-800 dark:text-zinc-200 bg-white dark:bg-zinc-950 border border-zinc-200 rounded dark:border-zinc-800 focus:border-violet-400 focus:outline-none dark:focus:border-violet-600 resize-y"
+                    ></textarea>
+                    <div class="flex gap-2 justify-end mt-2">
+                      <Button variant="secondary" size="xs" :disabled="savingCommentId() === cm.id" @click="cancelCommentEdit()">Cancel</Button>
+                      <Button size="xs" :loading="savingCommentId() === cm.id" :disabled="!commentEditDraft().trim()" @click="saveCommentEdit(cm.id)">Save comment</Button>
+                    </div>
                   </div>
-                  <p class="mt-0.5 text-xs text-zinc-700 whitespace-pre-wrap dark:text-zinc-300" :text="cm.body"></p>
                 </div>
               </li>
             </ul>

package/resources/components/Dashboard/Kanban/KanbanBoardsDashboard.stx

@@ -1,12 +1,9 @@
 <script client>
-  // Kanban — Boards index (stacksjs/stacks#1846, Phase 1).
-  //
   // Lists every non-archived board with a card-count badge. Clicking a
-  // board navigates to `/kanban/[id]` — Phase 2 ships the actual
-  // drag-and-drop board view at that URL.
+  // board navigates to its complete drag-and-drop view.
   //
   // Follows #1838 conventions: no <script server>, no vanilla DOM
-  // reads, all state via the store. Role gate via useRole() — the
+  // reads, all state via the store. Role gate via useRole() - the
   // surface is dev-mode-only (admins + devs see it, clients don't).
   import { useRole } from '~/storage/framework/defaults/views/dashboard/composables/useRole'
   import { kanbanStore } from '~/storage/framework/defaults/views/dashboard/stores/kanban'
@@ -175,7 +172,7 @@
       <p class="mt-2 text-xs text-zinc-500">Most common: migrations haven't run yet. Try <code>./buddy migrate</code>.</p>
     </div>
 
-    <!-- Empty state — DB reachable but no boards yet -->
+    <!-- Empty state - DB reachable but no boards yet -->
     <div :if="!loading && !error && !hasBoards" class="px-6 py-12 text-center border border-dashed border-zinc-300 rounded-lg dark:border-zinc-700">
       <span class="block mb-3 mx-auto h-10 w-10 text-zinc-400 i-hugeicons-layout-3-column"></span>
       <p class="font-medium text-sm text-zinc-700 dark:text-zinc-300">No boards yet</p>

package/resources/components/Dashboard/Management/PermissionsDashboard.stx

@@ -5,7 +5,7 @@
   // and the role/permission matrix against the live `user_roles` /
   // `role_permissions` / `user_permissions` pivots. All persistence
   // flows through the dashboard RBAC endpoints, which delegate
-  // to `@stacksjs/auth`'s `Rbac` facade — no direct DB writes from the
+  // to `@stacksjs/auth`'s `Rbac` facade - no direct DB writes from the
   // page.
   //
   // Follows #1838 conventions:
@@ -13,13 +13,13 @@
   //   - All state in the rbacStore; the page is pure presentation.
   //   - Mutations are optimistic with rollback on failure (store handles
   //     the snapshot/rollback dance).
-  import { useStore } from '@stacksjs/stx'
   import { useRole } from '~/storage/framework/defaults/views/dashboard/composables/useRole'
+  import { rbacStore } from '~/storage/framework/defaults/views/dashboard/stores/rbac'
 
-  const rbac = useStore('rbac')
+  const rbac = rbacStore
   // Admin-only surface. Per `useRole.ts`, `isAdmin()` returns true for
   // any user with the `admin` role *or* an unauthenticated viewer on
-  // the localhost dev dashboard — same permissive-dev defaults the rest
+  // the localhost dev dashboard - same permissive-dev defaults the rest
   // of the management surface uses.
   const { isAdmin } = useRole()
   const canManage = derived(() => isAdmin())

package/resources/components/Dashboard/Models/ModelRecordsDashboard.stx

@@ -7,7 +7,7 @@
 // works the same on a table with 10 rows and one with a million. Rows and
 // writes go through the model, so scopes, casts and observers apply.
 import { useNavigation } from '~/storage/framework/defaults/views/dashboard/composables/useNavigation'
-import { dashboardApi } from '~/storage/framework/defaults/functions/dashboard-api'
+import { DashboardApiError, dashboardApi } from '~/storage/framework/defaults/functions/dashboard-api'
 import { pushToast } from '~/storage/framework/defaults/functions/toasts'
 
 interface ColumnMeta {
@@ -46,7 +46,6 @@ interface ResponseShape {
   writable: boolean
   writeCapabilities: WriteCapabilities
   createFields: CreateField[]
-  source: 'orm' | 'sqlite-fallback'
   error: string | null
 }
 
@@ -67,7 +66,6 @@ const search = state(navigation.urlQuery('q') || '')
 const filters = state<Record<string, string>>({})
 const writeCapabilities = state<WriteCapabilities>({ create: false, update: false, destroy: false })
 const createFields = state<CreateField[]>([])
-const source = state<'orm' | 'sqlite-fallback'>('orm')
 const error = state<string | null>(null)
 const loading = state(true)
 const showFilters = state(false)
@@ -86,14 +84,6 @@ const createErrors = state<Record<string, string[]>>({})
 
 const slug = derived(() => navigation.urlSegment(-1) || '')
 
-const sourceLabel = derived(() => {
-  if (source() === 'orm')
-    return 'via Stacks ORM'
-  return Object.values(writeCapabilities()).some(Boolean)
-    ? 'SQLite query, ORM writes'
-    : 'raw SQLite, read-only'
-})
-
 const recordLabel = derived(() => {
   const n = totalCount()
   return `${n.toLocaleString()} ${n === 1 ? 'record' : 'records'}`
@@ -223,7 +213,6 @@ async function load() {
     sort.set(data.sort ?? '')
     writeCapabilities.set(data.writeCapabilities ?? { create: false, update: false, destroy: false })
     createFields.set(data.createFields ?? [])
-    source.set(data.source ?? 'orm')
     error.set(data.error ?? null)
   }
   catch (e) {
@@ -319,6 +308,11 @@ async function createRecord(fields: Record<string, unknown>): Promise<void> {
   }
   catch (reason) {
     createError.set(reason instanceof Error ? reason.message : String(reason))
+    if (reason instanceof DashboardApiError && reason.fields) {
+      createErrors.set(Object.fromEntries(
+        Object.entries(reason.fields).map(([field, message]) => [field, [message]]),
+      ))
+    }
   }
   finally {
     creating.set(false)
@@ -402,7 +396,7 @@ void load()
   <div class="flex flex-wrap gap-4 items-start justify-between">
     <div class="min-w-0">
       <h1 class="font-semibold text-2xl text-neutral-900 truncate dark:text-white" :text="modelName()"></h1>
-      <p class="mt-1 text-[13px] text-neutral-500 dark:text-neutral-400" :text="recordLabel() + ' · ' + tableName() + ' · ' + sourceLabel()"></p>
+      <p class="mt-1 text-[13px] text-neutral-500 dark:text-neutral-400" :text="recordLabel() + ' · ' + tableName() + ' · via Stacks ORM'"></p>
     </div>
     <div class="flex gap-2 items-center">
       <Button

package/resources/components/Dashboard/Models/ModelsOverview.stx

@@ -129,7 +129,7 @@ onMount(() => {
 
   <div :if="!loadError() && unavailableModels() > 0" role="status" class="flex gap-3 items-start px-4 py-3 text-amber-800 text-sm dark:text-amber-200 bg-amber-50 dark:bg-amber-950/40 border border-amber-200 rounded-lg dark:border-amber-900">
     <span class="flex-none mt-0.5 h-4 w-4 i-hugeicons-alert-02"></span>
-    <span>{{ unavailableModels() }} model {{ unavailableModels() === 1 ? 'count is' : 'counts are' }} unavailable. Affected cards show the query error instead of reporting zero records.</span>
+    <span>{{ unavailableModels() }} model {{ unavailableModels() === 1 ? 'count is' : 'counts are' }} unavailable. Affected cards remain unavailable instead of reporting zero records.</span>
   </div>
 
   <Card padding="none">

package/resources/components/Dashboard/NotFoundDashboard.stx

@@ -11,19 +11,16 @@
           Sorry, we couldn't find the page you're looking for. The page might have been moved or deleted.
         </p>
         <div class="flex gap-x-6 items-center justify-center mt-10">
-          <Button tag="a" href="/dashboard">
+          <Button tag="a" href="/">
             Return to dashboard
           </Button>
-          <Button tag="a" href="/" variant="ghost">
-            Go to home <span aria-hidden="true">&rarr;</span>
-          </Button>
         </div>
       </div>
 
       <div>
         <h2 class="font-semibold leading-6 text-base text-center text-gray-900 dark:text-white">You might be looking for</h2>
         <div class="grid gap-5 grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 mt-6">
-          <StxLink to="/dashboard" class="overflow-hidden bg-white dark:bg-neutral-800 rounded-lg shadow hover:shadow-md duration-200 transition-shadow">
+          <StxLink to="/" class="overflow-hidden bg-white dark:bg-neutral-800 rounded-lg shadow hover:shadow-md duration-200 transition-shadow">
             <div class="p-5">
               <div class="flex items-center">
                 <div class="flex-shrink-0 p-3 bg-blue-500 rounded-md">

package/resources/components/Dashboard/Queries/QueryDashboard.stx

@@ -97,6 +97,10 @@ function formatDate(value: string): string {
   return Number.isNaN(date.getTime()) ? value : date.toLocaleString()
 }
 
+function queryDetailsPath(id: DashboardQueryLog['id']): string {
+  return `/queries/${encodeURIComponent(String(id))}`
+}
+
 function typeClass(value: DashboardQueryLog['type']): string {
   const classes: Record<DashboardQueryLog['type'], string> = {
     SELECT: 'text-blue-700 dark:text-blue-300 bg-blue-50 dark:bg-blue-950/40',
@@ -248,9 +252,9 @@ onMount(() => {
               </td>
               <td class="px-4 py-3.5 text-neutral-500 text-right text-xs whitespace-nowrap dark:text-neutral-400">{{ formatDate(query.executedAt) }}</td>
               <td class="pr-5 py-3.5 text-right">
-                <StxLink :to="'/queries/' + query.id" :aria-label="'View query ' + query.id" class="inline-flex p-1.5 text-neutral-500 dark:text-neutral-400 hover:text-blue-600 dark:hover:text-blue-400 rounded-md">
+                <a :href="queryDetailsPath(query.id)" :aria-label="'View query ' + query.id" class="inline-flex p-1.5 text-neutral-500 dark:text-neutral-400 hover:text-blue-600 dark:hover:text-blue-400 rounded-md">
                   <span class="h-4 w-4 i-hugeicons-arrow-right-01"></span>
-                </StxLink>
+                </a>
               </td>
             </tr>
           </template>

package/resources/components/Dashboard/Settings/AppearanceSettingsDashboard.stx

@@ -1,6 +1,6 @@
 <script server>
 // The navigation the toggles below control. Read from the same builder the
-// layout uses, so the list can never drift from what the sidebar renders —
+// layout uses, so the list can never drift from what the sidebar renders -
 // including sections a project has switched off in config/dashboard.ts, which
 // simply are not here to toggle.
 import { buildWebSidebarSections } from '~/storage/framework/defaults/resources/functions/dashboard/sidebar'
@@ -29,7 +29,7 @@ const appearance = useAppearance()
 // see until you navigate away is the thing this is avoiding.
 const styleOptions = SIDEBAR_STYLE_OPTIONS
 const colorModes = COLOR_MODE_OPTIONS
-const sections = navSections
+const sections = {{ navSections }}
 
 const sidebarStyle = appearance.sidebarStyle
 const colorMode = appearance.colorMode
@@ -58,9 +58,9 @@ function resetAll() {
 }
 
 // Selected state travels as a data attribute rather than as a swapped class
-// string. It began as a workaround — Crosswind could not see class names that
+// string. It began as a workaround - Crosswind could not see class names that
 // existed only inside a client-script expression, so those utilities were never
-// emitted and the control rendered unstyled — and that gap is now closed
+// emitted and the control rendered unstyled - and that gap is now closed
 // upstream. It stays because it is the better shape regardless: one selector
 // per state in the block below, rather than two class strings kept in sync by
 // hand inside a ternary.

package/resources/components/Dashboard/UI/EmptyState.stx

@@ -19,9 +19,9 @@ const actionHref = useReactiveProp('actionHref', '')
   <p :if="description()" class="mb-6 max-w-sm text-neutral-500 text-sm dark:text-neutral-400" :text="description()"></p>
 
   <Button
-    :if="actionLabel()"
+    :if="actionLabel() && actionHref()"
     tag="a"
-    :href="actionHref() || '#'"
+    :href="actionHref()"
   >
     <span :if="actionIcon()" :class="actionIcon() + ' h-4 w-4'"></span>
     <span :text="actionLabel()"></span>

package/resources/components/Dashboard/UI/PageLayout.stx

@@ -3,11 +3,11 @@ interface PageLayoutProps {
   /**
    * Visual variant.
    *
-   * - `default` — standard centered column with `mx-auto` + max-width
+   * - `default` - standard centered column with `mx-auto` + max-width
    *   gutter. Use for almost every page.
-   * - `centered` — vertically centered hero block on a min-height
+   * - `centered` - vertically centered hero block on a min-height
    *   container. Use for splash / 404 / empty-route pages.
-   * - `bare` — no container at all. Use when the page wants to own
+   * - `bare` - no container at all. Use when the page wants to own
    *   its own gutter (e.g. a settings page with side-by-side panels
    *   that already pad themselves).
    */

package/resources/functions/dashboard/sidebar.ts

@@ -428,11 +428,11 @@ export function buildNavSections(
       // The layout's role map hides the row from client-role viewers.
       { to: '/kanban', icon: 'table', text: 'Kanban', roles: ['admin', 'dev'] },
     ]
-    // CI tracking (stacksjs/stacks#1844) — opt-in via `ci.enabled` in
-    // config/dashboard.ts. The page additionally checks `useRole().isDev()`
-    // (stub for #1843) before rendering.
+    // CI tracking (stacksjs/stacks#1844) - opt-in via `ci.enabled` in
+    // config/dashboard.ts. Keep the row gate aligned with the page's
+    // `useRole().isDev()` check so client-only viewers never get a dead link.
     if (toggles.ci)
-      managementItems.push({ to: '/ci', icon: 'check-circle', text: 'CI' })
+      managementItems.push({ to: '/ci', icon: 'check-circle', text: 'CI', roles: ['dev'] })
     sections.push(['management', 'management', managementItems])
   }
 

package/routes/dashboard-api.ts

@@ -264,28 +264,15 @@ route.group({ prefix: '/api/dashboard', apiResponse: true }, () => {
   // requests — see the action for the soft-fallback shape.
   route.get('/auth/me', 'Actions/Dashboard/Auth/MeAction')
 
-  // Kanban surface (stacksjs/stacks#1846). Phase 1: read-only.
-  //
-  // Phase 2 lands write endpoints under the same prefix:
-  //   POST   /kanban/boards           — store
-  //   PATCH  /kanban/boards/{id}      — update
-  //   DELETE /kanban/boards/{id}      — destroy
-  //   POST   /kanban/boards/reorder   — bulk position update
-  //   POST   /kanban/columns          — store
-  //   PATCH  /kanban/columns/{id}     — update
-  //   POST   /kanban/columns/reorder  — bulk position update
-  //   POST   /kanban/cards            — store
-  //   PATCH  /kanban/cards/{id}       — update (incl. column move)
-  //   POST   /kanban/cards/reorder    — bulk position update
-  //
+  // Kanban reads and mutations share the guarded dashboard surface.
   // Kanban data is local-only without authentication. Outside local
   // environments every read and write uses the same auth + admin guard as
   // the other operational dashboard surfaces.
-  // Reads (Phase 1)
+  // Reads
   guard(route.get('/kanban/boards', 'Actions/Dashboard/Kanban/BoardsIndexAction'))
   guard(route.get('/kanban/boards/{id}', 'Actions/Dashboard/Kanban/BoardShowAction'))
 
-  // Writes (Phase 2). The reorder endpoints are POST not PATCH because
+  // Writes. The reorder endpoints are POST not PATCH because
   // their semantics — "here's the full new state of this slice of the
   // board" — match the resource-replacement intent better than PATCH's
   // "apply this delta" verb. They also accept a body shape that PATCH
@@ -305,7 +292,7 @@ route.group({ prefix: '/api/dashboard', apiResponse: true }, () => {
   guard(route.delete('/kanban/cards/{id}', 'Actions/Dashboard/Kanban/CardDestroyAction'))
   guard(route.post('/kanban/cards/reorder', 'Actions/Dashboard/Kanban/CardsReorderAction'))
 
-  // Phase 3 — card detail + labels + assignees + comments.
+  // Card detail, labels, assignees, and comments.
   //
   // The card-show endpoint is the only "single card with everything"
   // read; the boards/{id} response already embeds labels + assignees
@@ -325,10 +312,10 @@ route.group({ prefix: '/api/dashboard', apiResponse: true }, () => {
   guard(route.post('/kanban/cards/{id}/labels', 'Actions/Dashboard/Kanban/CardLabelsSyncAction'))
   guard(route.post('/kanban/cards/{id}/assignees', 'Actions/Dashboard/Kanban/CardAssigneesSyncAction'))
 
-  // Comments. Append-only thread: store + destroy, no edit yet — the
-  // history-preservation argument outweighs the "fix a typo" argument
-  // until someone explicitly asks for editing.
+  // Card-scoped comment thread. Writes stay under the dashboard guard while
+  // the CardComment model also exposes its conventional generated API.
   guard(route.post('/kanban/cards/{id}/comments', 'Actions/Dashboard/Kanban/CardCommentStoreAction'))
+  guard(route.patch('/kanban/comments/{id}', 'Actions/Dashboard/Kanban/CardCommentUpdateAction'))
   guard(route.delete('/kanban/comments/{id}', 'Actions/Dashboard/Kanban/CardCommentDestroyAction'))
 
   // Lightweight user list for the assignee picker. Distinct from the
@@ -466,6 +453,7 @@ route.group({ prefix: '/api/dashboard', apiResponse: true }, () => {
   // the per-mailbox inbox.json index. Both are guarded outside local/dev
   // because they touch real mailbox state and PII.
   guard(route.get('/email/inbox', 'Actions/Dashboard/Email/InboxIndexAction'))
+  guard(route.get('/email/inbox/{id}/attachments/{attachmentId}', 'Actions/Dashboard/Email/InboxAttachmentDownloadAction'))
   guard(route.get('/email/inbox/{id}', 'Actions/Dashboard/Email/InboxShowAction'))
   guard(route.get('/email/stats', 'Actions/Dashboard/Email/InboxStatsAction'))
   guard(route.get('/email/activity', 'Actions/Dashboard/Email/InboxActivityAction'))

package/views/dashboard/.discovered-models.json

@@ -138,6 +138,16 @@
         "highlight": true
       }
     },
+    {
+      "id": "delivery-stop",
+      "name": "DeliveryStop",
+      "icon": "tablecells.fill",
+      "hasDedicatedPage": false,
+      "category": "commerce",
+      "dashboard": {
+        "highlight": true
+      }
+    },
     {
       "id": "deployment",
       "name": "Deployment",
@@ -168,6 +178,23 @@
         "highlight": true
       }
     },
+    {
+      "id": "driver-ping",
+      "name": "DriverPing",
+      "icon": "tablecells.fill",
+      "hasDedicatedPage": false,
+      "category": "commerce"
+    },
+    {
+      "id": "email-idempotency",
+      "name": "EmailIdempotency",
+      "icon": "tablecells.fill",
+      "hasDedicatedPage": false,
+      "category": "data",
+      "dashboard": {
+        "enabled": false
+      }
+    },
     {
       "id": "email-list",
       "name": "EmailList",
@@ -182,6 +209,26 @@
       "hasDedicatedPage": false,
       "category": "data"
     },
+    {
+      "id": "email-suppression",
+      "name": "EmailSuppression",
+      "icon": "tablecells.fill",
+      "hasDedicatedPage": false,
+      "category": "data",
+      "dashboard": {
+        "enabled": false
+      }
+    },
+    {
+      "id": "email-webhook-event",
+      "name": "EmailWebhookEvent",
+      "icon": "tablecells.fill",
+      "hasDedicatedPage": false,
+      "category": "data",
+      "dashboard": {
+        "enabled": false
+      }
+    },
     {
       "id": "gift-card",
       "name": "GiftCard",
@@ -456,6 +503,13 @@
         "highlight": true
       }
     },
+    {
+      "id": "social-account",
+      "name": "SocialAccount",
+      "icon": "tablecells.fill",
+      "hasDedicatedPage": false,
+      "category": "data"
+    },
     {
       "id": "social-post",
       "name": "SocialPost",