@stacksjs/defaults 0.70.354 → 0.70.356

package/app/Actions/Dashboard/Models/ModelShowAction.ts

@@ -1,7 +1,8 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
-import { env } from '@stacksjs/env'
-import { request, response as routerResponse } from '@stacksjs/router'
+import { response as routerResponse } from '@stacksjs/router'
 import { loadModelIfExists, safeGet } from '../../../../resources/functions/dashboard/data'
+import { dashboardOperationalError } from '../dashboard-response'
 import { isValidModelSlug, type ModelCreateField, type ModelWriteCapabilities, modelCreateFields, modelSchemaColumns, modelWriteCapabilities, slugToPascal } from './model-write'
 
 /**
@@ -22,8 +23,8 @@ import { isValidModelSlug, type ModelCreateField, type ModelWriteCapabilities, m
  *      queries, so scopes, casts and accessors all apply.
  *   2. `loadModelIfExists(Name)` — path-map lookup, covers models the ORM has not
  *      registered as a global.
- *   3. Raw SQLite — last resort for a table with no model file at all
- *      (lookup/pivot tables, or a schema added outside the ORM).
+ * A missing model is a 404. The generic browser never bypasses model scopes,
+ * casts, observers, connection drivers, or the app override contract.
  */
 
 interface ColumnMeta {
@@ -49,8 +50,6 @@ interface ResponseShape {
   dir: 'asc' | 'desc'
   q: string
   filters: Record<string, string>
-  source: 'orm' | 'sqlite-fallback'
-  /** False for tables reached through the SQLite fallback: no model, no writes. */
   writable: boolean
   writeCapabilities: ModelWriteCapabilities
   createFields: ModelCreateField[]
@@ -84,6 +83,15 @@ function humanize(column: string): string {
 // filter by it.
 const HIDDEN_COLUMNS = new Set(['password', 'remember_token', 'api_token', 'access_token', 'refresh_token', 'secret', 'two_factor_secret'])
 
+function hiddenModelColumns(Model: any): Set<string> {
+  const hidden = new Set(HIDDEN_COLUMNS)
+  for (const [name, definition] of Object.entries(Model?.attributes ?? {})) {
+    if ((definition as { hidden?: boolean })?.hidden)
+      hidden.add(pascalToSnake(name))
+  }
+  return hidden
+}
+
 /**
  * Column identifiers reach the query builder as raw, unquoted SQL, so only
  * valid identifiers from the table's own column list may ever be used.
@@ -108,14 +116,11 @@ function typeForColumn(column: string, values: unknown[]): ColumnMeta['type'] {
   return inferType(values)
 }
 
-function queryParams(): URLSearchParams {
-  const query = ((request as any).query || {}) as Record<string, string | string[] | undefined>
-  const params = new URLSearchParams()
-  for (const [key, value] of Object.entries(query)) {
-    if (value === undefined) continue
-    params.set(key, Array.isArray(value) ? String(value[0]) : String(value))
-  }
-  return params
+function queryValue(request: RequestInstance, key: string, fallback = ''): string {
+  const value = request.get<unknown>(key, fallback)
+  if (Array.isArray(value))
+    return value.length > 0 ? String(value[0]) : fallback
+  return value == null ? fallback : String(value)
 }
 
 /** `filters` arrives as a JSON object so column names stay unambiguous. */
@@ -153,15 +158,6 @@ export function parseFilters(raw: string | null): Record<string, string> {
   return out
 }
 
-/**
- * Signals that a free-text search spans several columns, which the query
- * builder cannot express (`whereLike` is single-column and `orWhere` only
- * takes equality pairs). The SQLite path builds that OR with bound
- * parameters instead. Distinct from a real failure so it never surfaces
- * to the page as an error.
- */
-class SearchUnsupported extends Error {}
-
 function resolveOrmModel(modelName: string): any {
   const injected = (globalThis as Record<string, any>)[modelName]
   // The ORM injects Proxies that answer `undefined` for every property
@@ -176,23 +172,22 @@ export default new Action({
   description: 'Queries a single model by URL slug with paging, sorting, search and column filters.',
   method: 'GET',
   apiResponse: true,
-  async handle(req: { getParam?: (name: string) => unknown, route?: { params?: { slug?: string } } }) {
-    const slug = String(req?.getParam?.('slug') ?? req?.route?.params?.slug ?? '')
+  async handle(request: RequestInstance) {
+    const slug = request.getParam('slug')
     if (!isValidModelSlug(slug))
       return routerResponse.json({ message: 'Model slug must be lowercase kebab-case.' }, 400)
 
     const modelName = slugToPascal(slug)
     const tableName = pluralize(pascalToSnake(modelName))
 
-    const params = queryParams()
-    const page = Math.max(1, Number.parseInt(params.get('page') || '1', 10) || 1)
-    const perPage = Math.min(MAX_PER_PAGE, Math.max(1, Number.parseInt(params.get('per_page') || String(DEFAULT_PER_PAGE), 10) || DEFAULT_PER_PAGE))
-    const requestedSort = (params.get('sort') || '').trim()
-    const dir: 'asc' | 'desc' = params.get('dir') === 'asc' ? 'asc' : 'desc'
-    const q = (params.get('q') || '').trim()
+    const page = Math.max(1, Number.parseInt(queryValue(request, 'page', '1'), 10) || 1)
+    const perPage = Math.min(MAX_PER_PAGE, Math.max(1, Number.parseInt(queryValue(request, 'per_page', String(DEFAULT_PER_PAGE)), 10) || DEFAULT_PER_PAGE))
+    const requestedSort = queryValue(request, 'sort').trim()
+    const dir: 'asc' | 'desc' = queryValue(request, 'dir') === 'asc' ? 'asc' : 'desc'
+    const q = queryValue(request, 'q').trim()
     let filters: Record<string, string>
     try {
-      filters = parseFilters(params.get('filters'))
+      filters = parseFilters(queryValue(request, 'filters') || null)
     }
     catch (error) {
       return routerResponse.json({
@@ -216,182 +211,92 @@ export default new Action({
       dir,
       q,
       filters,
-      source: 'orm',
       writable: false,
       writeCapabilities: { create: false, update: false, destroy: false },
       createFields: [],
       error: null,
     }
 
-    const Model = resolveOrmModel(modelName) ?? await loadModelIfExists(modelName)
-    const hasOrm = Boolean(Model) && typeof Model.where === 'function'
-
-    if (hasOrm) {
-      try {
-        response.tableName = String(Model.table || tableName)
-        // The column list has to come from a real row: the ORM does not
-        // expose a database schema reflection API. Empty tables fall back
-        // to the model definition, which is also the migration source.
-        const probe = await Model.orderByDesc('id').take(1).get() as Array<Record<string, unknown>>
-        const first = Array.isArray(probe) ? probe[0] : undefined
-        const shape = first && typeof first === 'object'
-          ? ((first as { attributes?: Record<string, unknown> }).attributes ?? first)
-          : {}
-        response.columns = Object.keys(shape).filter(k => typeof k === 'string' && !k.startsWith('_'))
-        if (response.columns.length === 0)
-          response.columns = modelSchemaColumns(Model)
-
-        const allowed = new Set(response.columns.filter(c => !HIDDEN_COLUMNS.has(c)))
-        const unknownFilter = Object.keys(filters).find(column => !isSafeColumn(column, allowed))
-        if (unknownFilter)
-          return routerResponse.json({ message: `Unknown model filter column "${unknownFilter}".` }, 422)
-        if (requestedSort && !isSafeColumn(requestedSort, allowed))
-          return routerResponse.json({ message: `Unknown model sort column "${requestedSort}".` }, 422)
-
-        const sort = isSafeColumn(requestedSort, allowed)
-          ? requestedSort
-          : (allowed.has('id') ? 'id' : (response.columns[0] ?? ''))
-        response.sort = sort
-
-        // Text columns are decided from the probe row, before any query is
-        // built, so the search clause does not depend on response metadata
-        // that is only assembled after the rows come back.
-        const searchColumns = [...allowed].filter(c => typeof safeGet(first, c, null) === 'string')
-
-        const build = () => {
-          let chain = Model as any
-          for (const [column, value] of Object.entries(filters)) {
-            if (!isSafeColumn(column, allowed)) continue
-            chain = chain.where(column, value)
-          }
-          // Global search is a LIKE across every text column. The builder's
-          // `whereLike` covers one column and `orWhere` only takes equality
-          // pairs, so a multi-column OR-LIKE has no ORM expression; that
-          // case is served by the SQLite path below instead, which builds
-          // the OR with bound parameters. Writes stay enabled either way,
-          // because the model still exists.
-          if (q && searchColumns.length === 1)
-            chain = chain.whereLike(searchColumns[0], `%${q}%`)
-          return chain
-        }
-
-        // A multi-column search has no ORM expression, so hand that one
-        // query to the SQLite path — without recording an error, because it
-        // is a gap in the builder's vocabulary, not a failure.
-        if (q && searchColumns.length > 1)
-          throw new SearchUnsupported()
-
-        response.totalCount = q && searchColumns.length === 0
-          ? 0
-          : await build().count()
-        const rows = response.totalCount === 0
-          ? []
-          : await build()
-              .orderBy(sort, dir)
-              .skip((page - 1) * perPage)
-              .take(perPage)
-              .get() as Array<Record<string, unknown>>
-
-        // Flatten to plain JSON-safe objects — proxy models and
-        // accessor-rich rows do not serialise cleanly across the wire.
-        response.rows = (Array.isArray(rows) ? rows : []).map((row) => {
-          const flat: Record<string, unknown> = {}
-          for (const col of response.columns)
-            flat[col] = safeGet(row, col, null)
-          return flat
-        })
-      }
-      catch (e) {
-        if (e instanceof SearchUnsupported) {
-          response.source = 'sqlite-fallback'
-        }
-        else {
-          return routerResponse.json({
-            message: `Could not query model ${modelName}: ${e instanceof Error ? e.message : String(e)}`,
-          }, 503)
-        }
-      }
+    let Model: any
+    try {
+      Model = resolveOrmModel(modelName) ?? await loadModelIfExists(modelName)
     }
-    else {
-      response.source = 'sqlite-fallback'
+    catch (error) {
+      return dashboardOperationalError(error, `${modelName} could not be loaded.`, 'ModelShowAction.resolve')
     }
+    if (!Model || typeof Model.where !== 'function')
+      return routerResponse.json({ message: `No ORM model named ${modelName}.` }, 404)
 
-    if (response.source === 'sqlite-fallback') {
-      try {
-        const { Database } = await import('bun:sqlite')
-        const db = new Database(env.DB_DATABASE_PATH || 'database/stacks.sqlite', { readonly: true })
-        try {
-          if (!/^[A-Za-z_]\w*$/.test(response.tableName))
-            return routerResponse.json({ message: `Model table "${response.tableName}" is not a safe SQL identifier.` }, 500)
-
-          const tableInfo = db.query(`PRAGMA table_info(${response.tableName})`).all() as Array<{ name: string, type: string }>
-          if (tableInfo.length === 0)
-            return routerResponse.json({ message: `Model table "${response.tableName}" does not exist.` }, 404)
-
-          response.columns = tableInfo.map(c => c.name)
-
-          if (response.columns.length > 0) {
-            const allowed = new Set(response.columns.filter(c => !HIDDEN_COLUMNS.has(c)))
-            const unknownFilter = Object.keys(filters).find(column => !isSafeColumn(column, allowed))
-            if (unknownFilter)
-              return routerResponse.json({ message: `Unknown model filter column "${unknownFilter}".` }, 422)
-            if (requestedSort && !isSafeColumn(requestedSort, allowed))
-              return routerResponse.json({ message: `Unknown model sort column "${requestedSort}".` }, 422)
-
-            const sort = isSafeColumn(requestedSort, allowed)
-              ? requestedSort
-              : (allowed.has('id') ? 'id' : response.columns[0])
-            response.sort = sort
-
-            // Every value is bound; only identifiers are interpolated, and
-            // those come from the allowlist built out of PRAGMA above.
-            const wheres: string[] = []
-            const values: unknown[] = []
-            for (const [column, value] of Object.entries(filters)) {
-              if (!isSafeColumn(column, allowed)) continue
-              wheres.push(`${column} = ?`)
-              values.push(value)
-            }
-            if (q) {
-              const textColumns = tableInfo
-                .filter(c => allowed.has(c.name) && /char|text|clob/i.test(c.type || ''))
-                .map(c => c.name)
-              if (textColumns.length > 0) {
-                wheres.push(`(${textColumns.map(c => `${c} LIKE ?`).join(' OR ')})`)
-                for (const _ of textColumns) values.push(`%${q}%`)
-              }
-            }
-            const whereSql = wheres.length > 0 ? ` WHERE ${wheres.join(' AND ')}` : ''
-
-            const countRow = db.query(`SELECT COUNT(*) as count FROM ${response.tableName}${whereSql}`).get(...values as any[]) as { count?: number } | null
-            response.totalCount = countRow?.count ?? 0
-            response.rows = db
-              .query(`SELECT * FROM ${response.tableName}${whereSql} ORDER BY ${sort} ${dir.toUpperCase()} LIMIT ? OFFSET ?`)
-              .all(...values as any[], perPage, (page - 1) * perPage) as Array<Record<string, unknown>>
-            response.error = null
-          }
+    try {
+      response.tableName = String(Model.table || tableName)
+      const probe = await Model.orderByDesc('id').take(1).get() as Array<Record<string, unknown>>
+      const first = Array.isArray(probe) ? probe[0] : undefined
+      const shape = first && typeof first === 'object'
+        ? ((first as { attributes?: Record<string, unknown> }).attributes ?? first)
+        : {}
+      const hiddenColumns = hiddenModelColumns(Model)
+      response.columns = Object.keys(shape).filter(k => typeof k === 'string' && !k.startsWith('_') && !hiddenColumns.has(k))
+      if (response.columns.length === 0)
+        response.columns = modelSchemaColumns(Model).filter(column => !hiddenColumns.has(column))
+
+      const allowed = new Set(response.columns)
+      const unknownFilter = Object.keys(filters).find(column => !isSafeColumn(column, allowed))
+      if (unknownFilter)
+        return routerResponse.json({ message: `Unknown model filter column "${unknownFilter}".` }, 422)
+      if (requestedSort && !isSafeColumn(requestedSort, allowed))
+        return routerResponse.json({ message: `Unknown model sort column "${requestedSort}".` }, 422)
+
+      const sort = isSafeColumn(requestedSort, allowed)
+        ? requestedSort
+        : (allowed.has('id') ? 'id' : (response.columns[0] ?? ''))
+      response.sort = sort
+      const searchColumns = [...allowed].filter(c => typeof safeGet(first, c, null) === 'string')
+
+      const build = () => {
+        let chain = Model.query() as any
+        for (const [column, value] of Object.entries(filters)) {
+          if (!isSafeColumn(column, allowed)) continue
+          chain = chain.where(column, value)
         }
-        finally {
-          db.close()
+        if (q && searchColumns.length > 0) {
+          chain = chain.whereGroup((group: any) => {
+            for (const [index, column] of searchColumns.entries()) {
+              group = index === 0
+                ? group.whereLike(column, `%${q}%`)
+                : group.orWhereLike(column, `%${q}%`)
+            }
+            return group
+          })
         }
+        return chain
       }
-      catch (e) {
-        return routerResponse.json({
-          message: `Could not query table ${response.tableName}: ${e instanceof Error ? e.message : String(e)}`,
-        }, 503)
-      }
+
+      response.totalCount = q && searchColumns.length === 0
+        ? 0
+        : await build().count()
+      const rows = response.totalCount === 0
+        ? []
+        : await build()
+            .orderBy(sort, dir)
+            .skip((page - 1) * perPage)
+            .take(perPage)
+            .get() as Array<Record<string, unknown>>
+
+      response.rows = (Array.isArray(rows) ? rows : []).map((row) => {
+        const flat: Record<string, unknown> = {}
+        for (const col of response.columns)
+          flat[col] = safeGet(row, col, null)
+        return flat
+      })
+    }
+    catch (error) {
+      return dashboardOperationalError(error, `${modelName} records could not be loaded.`, 'ModelShowAction.query')
     }
 
-    // Writability follows the model's declared useApi routes, not which
-    // engine answered this particular query. A multi-column search can be
-    // served by SQLite for a model that still creates and updates through
-    // the ORM.
-    response.writeCapabilities = hasOrm
-      ? modelWriteCapabilities(Model)
-      : { create: false, update: false, destroy: false }
+    response.writeCapabilities = modelWriteCapabilities(Model)
     response.writable = Object.values(response.writeCapabilities).some(Boolean)
     response.createFields = response.writeCapabilities.create ? modelCreateFields(Model) : []
-    response.displayColumns = response.columns.filter(col => !HIDDEN_COLUMNS.has(col) && !col.startsWith('_'))
+    response.displayColumns = response.columns.filter(col => !col.startsWith('_'))
     response.columnMeta = response.displayColumns.map(name => ({
       name,
       label: humanize(name),

package/app/Actions/Dashboard/Models/ModelStoreAction.ts

@@ -1,31 +1,33 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { toSnakeCaseKeys } from '@stacksjs/orm'
-import { request } from '@stacksjs/router'
+import { response } from '@stacksjs/router'
+import { dashboardOperationalError } from '../dashboard-response'
 import { prepareModelFields, resolveWritableModel } from './model-write'
 
+interface ModelWriteInput {
+  fields?: unknown
+}
+
 export default new Action({
   name: 'Dashboard Model Store',
   description: 'Creates one row through a model declared useApi store contract.',
   method: 'POST',
   apiResponse: true,
-  async handle(req: {
-    getParam?: (name: string) => unknown
-    all?: () => Record<string, unknown>
-    route?: { params?: { slug?: string } }
-  }) {
-    const resolved = await resolveWritableModel(String(req?.getParam?.('slug') ?? req?.route?.params?.slug ?? ''), 'store')
+  async handle(request: RequestInstance<ModelWriteInput>) {
+    const resolved = await resolveWritableModel(request.getParam('slug'), 'store')
     if ('error' in resolved)
-      return { ok: false, error: resolved.error }
+      return response.json({ message: resolved.error }, resolved.status)
 
-    const input = (req.all?.() ?? (request as any).all?.() ?? {}) as Record<string, unknown>
+    const input = request.all()
     const raw = input.fields
     const body = (raw && typeof raw === 'object' && !Array.isArray(raw)) ? raw as Record<string, unknown> : {}
     const { data, errors } = prepareModelFields(resolved.Model, body)
 
     if (Object.keys(errors).length > 0)
-      return { ok: false, error: 'Validation failed.', errors }
+      return response.json({ message: 'Validation failed.', errors }, 422)
     if (Object.keys(data).length === 0)
-      return { ok: false, error: 'No fillable fields in the request body.' }
+      return response.json({ message: 'No fillable fields in the request body.' }, 422)
 
     try {
       const row = await resolved.Model.create(toSnakeCaseKeys(data))
@@ -33,7 +35,7 @@ export default new Action({
       return { ok: true, id }
     }
     catch (error) {
-      return { ok: false, error: error instanceof Error ? error.message : String(error) }
+      return dashboardOperationalError(error, 'The model record could not be created.', 'ModelStoreAction', 500)
     }
   },
 })

package/app/Actions/Dashboard/Models/ModelUpdateAction.ts

@@ -1,8 +1,14 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { toSnakeCaseKeys } from '@stacksjs/orm'
-import { request } from '@stacksjs/router'
+import { response } from '@stacksjs/router'
+import { dashboardOperationalError } from '../dashboard-response'
 import { parseRowId, prepareModelFields, resolveWritableModel } from './model-write'
 
+interface ModelWriteInput {
+  fields?: unknown
+}
+
 /**
  * `PATCH /api/dashboard/models/{slug}/{id}`.
  *
@@ -16,18 +22,14 @@ export default new Action({
   description: 'Updates one row of a model from the dashboard model browser.',
   method: 'PATCH',
   apiResponse: true,
-  async handle(req: {
-    getParam?: (name: string) => unknown
-    all?: () => Record<string, unknown>
-    route?: { params?: { slug?: string, id?: string } }
-  }) {
-    const resolved = await resolveWritableModel(String(req?.getParam?.('slug') ?? req?.route?.params?.slug ?? ''), 'update')
+  async handle(request: RequestInstance<ModelWriteInput>) {
+    const resolved = await resolveWritableModel(request.getParam('slug'), 'update')
     if ('error' in resolved)
-      return { ok: false, error: resolved.error }
+      return response.json({ message: resolved.error }, resolved.status)
 
-    const id = parseRowId(req?.getParam?.('id') ?? req?.route?.params?.id)
+    const id = parseRowId(request.getParam('id'))
     if (id === null)
-      return { ok: false, error: 'A numeric row id is required.' }
+      return response.json({ message: 'A numeric row id is required.' }, 400)
 
     // Edits arrive nested under `fields`. The router's input bag merges the
     // body with route params and query, so a flat payload would silently
@@ -35,25 +37,25 @@ export default new Action({
     // columns — and `slug` is a real column on plenty of models, so it
     // cannot simply be blocklisted. One level of nesting keeps the two
     // namespaces apart.
-    const input = (req.all?.() ?? (request as any).all?.() ?? {}) as Record<string, unknown>
+    const input = request.all()
     const raw = input.fields
     const body = (raw && typeof raw === 'object' && !Array.isArray(raw)) ? raw as Record<string, unknown> : {}
     const prepared = prepareModelFields(resolved.Model, body, true)
     if (Object.keys(prepared.errors).length > 0)
-      return { ok: false, error: 'Validation failed.', errors: prepared.errors }
+      return response.json({ message: 'Validation failed.', errors: prepared.errors }, 422)
     const changes = toSnakeCaseKeys(prepared.data)
     if (Object.keys(changes).length === 0)
-      return { ok: false, error: 'No writable fields in the request body.' }
+      return response.json({ message: 'No writable fields in the request body.' }, 422)
 
     try {
       const row = await resolved.Model.find(id)
       if (!row)
-        return { ok: false, error: `${resolved.modelName} ${id} not found.` }
+        return response.json({ message: `${resolved.modelName} ${id} not found.` }, 404)
       await resolved.Model.update(id, changes)
       return { ok: true, id, changed: Object.keys(changes) }
     }
-    catch (e) {
-      return { ok: false, error: e instanceof Error ? e.message : String(e) }
+    catch (error) {
+      return dashboardOperationalError(error, 'The model record could not be updated.', 'ModelUpdateAction', 500)
     }
   },
 })

package/app/Actions/Dashboard/Models/ModelsIndexAction.ts

@@ -3,6 +3,8 @@ import { existsSync, readdirSync } from 'node:fs'
 import { join } from 'node:path'
 import process from 'node:process'
 import { countRows } from '../../../../resources/functions/dashboard/data'
+import { dashboardOperationalError, dashboardOperationalIssue } from '../dashboard-response'
+import { modelApiConfiguration } from './model-api'
 
 /**
  * `GET /api/dashboard/models` (stacksjs/stacks#1838).
@@ -40,6 +42,12 @@ interface ModelGroup {
   countLabel: string
 }
 
+interface DiscoveredModel {
+  name: string
+  file: string
+  source: 'userland' | 'framework'
+}
+
 function pascalToSnake(s: string): string {
   return s.replace(/([a-z])([A-Z])/g, '$1_$2').toLowerCase()
 }
@@ -91,6 +99,21 @@ function categoryLabel(k: string): string {
   return k === 'userland' ? 'Your Models' : k.charAt(0).toUpperCase() + k.slice(1)
 }
 
+function unavailableModelRow(model: DiscoveredModel, error: string): ModelRow {
+  return {
+    name: model.name,
+    table: pluralize(pascalToSnake(model.name)),
+    href: `/models/${pascalToKebab(model.name)}`,
+    count: null,
+    attributeCount: 0,
+    category: categorize(model),
+    source: model.source,
+    apiUri: '',
+    apiRoutes: [],
+    error,
+  }
+}
+
 export default new Action({
   name: 'Dashboard Models Index',
   description: 'List every model + live record count for the dashboard models overview.',
@@ -101,11 +124,18 @@ export default new Action({
     const userlandDir = join(cwd, 'app', 'Models')
     const defaultsDir = join(cwd, 'storage/framework/defaults/app/Models')
 
-    const userland = walkModels(userlandDir, false)
-    const defaults = walkModels(defaultsDir, true)
+    let userland: Array<Omit<DiscoveredModel, 'source'>>
+    let defaults: Array<Omit<DiscoveredModel, 'source'>>
+    try {
+      userland = walkModels(userlandDir, false)
+      defaults = walkModels(defaultsDir, true)
+    }
+    catch (error) {
+      return dashboardOperationalError(error, 'Model catalog could not be loaded.', 'ModelsIndexAction.catalog')
+    }
 
     const seen = new Set<string>()
-    const merged: Array<{ name: string, file: string, source: 'userland' | 'framework' }> = []
+    const merged: DiscoveredModel[] = []
     for (const list of [userland, defaults]) {
       for (const m of list) {
         if (seen.has(m.name)) continue
@@ -121,28 +151,29 @@ export default new Action({
         Model = module.default ?? module
       }
       catch (error) {
-        return {
-          name: m.name,
-          table: pluralize(pascalToSnake(m.name)),
-          href: `/models/${pascalToKebab(m.name)}`,
-          count: null,
-          attributeCount: 0,
-          category: categorize(m),
-          source: m.source,
-          apiUri: '',
-          apiRoutes: [],
-          error: error instanceof Error ? error.message : String(error),
-        }
+        return unavailableModelRow(
+          m,
+          dashboardOperationalIssue(error, 'Model definition could not be loaded.', `ModelsIndexAction.import.${m.name}`),
+        )
       }
 
-      const api = Model.traits?.useApi
+      let api: ReturnType<typeof modelApiConfiguration>
+      try {
+        api = modelApiConfiguration(Model)
+      }
+      catch (error) {
+        return unavailableModelRow(
+          m,
+          dashboardOperationalIssue(error, 'Model metadata could not be loaded.', `ModelsIndexAction.metadata.${m.name}`),
+        )
+      }
       let count: number | null = null
       let error: string | null = null
       try {
         count = await countRows(Model)
       }
       catch (cause) {
-        error = cause instanceof Error ? cause.message : String(cause)
+        error = dashboardOperationalIssue(cause, 'Model count could not be loaded.', `ModelsIndexAction.count.${m.name}`)
       }
 
       return {
@@ -153,8 +184,8 @@ export default new Action({
         attributeCount: Object.keys(Model.attributes || {}).length,
         category: categorize(m),
         source: m.source,
-        apiUri: typeof api === 'object' && typeof api.uri === 'string' ? `/api/${api.uri}` : '',
-        apiRoutes: typeof api === 'object' && Array.isArray(api.routes) ? api.routes.map(String) : [],
+        apiUri: api.uri ? `/api/${api.uri}` : '',
+        apiRoutes: api.routes,
         error,
       }
     }))

package/app/Actions/Dashboard/Models/model-api.ts

@@ -0,0 +1,27 @@
+export const DEFAULT_MODEL_API_ROUTES = ['index', 'show', 'store', 'update', 'destroy'] as const
+
+export interface ModelApiConfiguration {
+  uri: string
+  routes: string[]
+}
+
+/**
+ * Normalize a model's useApi trait exactly as the ORM route generator does.
+ * An enabled trait without explicit routes receives the complete REST set,
+ * while an explicit empty routes array remains intentionally empty.
+ */
+export function modelApiConfiguration(Model: any): ModelApiConfiguration {
+  const useApi = Model?.traits?.useApi
+  if (!useApi)
+    return { uri: '', routes: [] }
+
+  const config = typeof useApi === 'object' ? useApi : {}
+  const fallbackUri = String(Model?.table || `${String(Model?.name || '').toLowerCase()}s`)
+
+  return {
+    uri: String(config.uri || fallbackUri),
+    routes: Array.isArray(config.routes)
+      ? config.routes.map(String)
+      : [...DEFAULT_MODEL_API_ROUTES],
+  }
+}