@stacksjs/defaults 0.70.355 → 0.70.357

package/app/Actions/Dashboard/Library/GetFunctions.ts

@@ -1,18 +1,25 @@
 import { Action } from '@stacksjs/actions'
+import { dashboardOperationalError } from '../dashboard-response'
 import { functionSourceRows } from './library-source'
 
 export default new Action({
   name: 'GetFunctions',
   description: 'Gets your utility functions.',
   method: 'GET',
+  apiResponse: true,
 
   async handle() {
-    const functions = functionSourceRows()
+    try {
+      const functions = functionSourceRows()
 
-    return {
-      functions,
-      totalBytes: functions.reduce((sum, fn) => sum + fn.bytes, 0),
-      sourceRoot: 'resources/functions',
+      return {
+        functions,
+        totalBytes: functions.reduce((sum, fn) => sum + fn.bytes, 0),
+        sourceRoot: 'resources/functions',
+      }
+    }
+    catch (error) {
+      return dashboardOperationalError(error, 'Function library could not be loaded.', 'GetFunctions')
     }
   },
 })

package/app/Actions/Dashboard/Library/GetReleaseCount.ts

@@ -1,5 +1,6 @@
 import { Action } from '@stacksjs/actions'
 import { db } from '@stacksjs/database'
+import { dashboardOperationalError } from '../dashboard-response'
 
 export default new Action({
   name: 'GetReleaseCount',
@@ -7,11 +8,19 @@ export default new Action({
   apiResponse: true,
 
   async handle() {
-    const row = await db
-      .selectFrom('releases')
-      .select(db.fn.count('id').as('count'))
-      .executeTakeFirst() as { count?: number | string } | undefined
+    try {
+      const row = await db
+        .selectFrom('releases')
+        .select(db.fn.count('id').as('count'))
+        .executeTakeFirst() as { count?: number | string } | undefined
+      const count = Number(row?.count || 0)
+      if (!Number.isSafeInteger(count) || count < 0)
+        throw new TypeError('Release count must be a non-negative integer.')
 
-    return { count: Number(row?.count || 0) }
+      return { count }
+    }
+    catch (error) {
+      return dashboardOperationalError(error, 'Release count could not be loaded.', 'GetReleaseCount')
+    }
   },
 })

package/app/Actions/Dashboard/Library/GetReleases.ts

@@ -1,23 +1,30 @@
 import { Action } from '@stacksjs/actions'
 import { Release } from '@stacksjs/orm'
+import { dashboardOperationalError } from '../dashboard-response'
 
 export default new Action({
   name: 'GetReleases',
   description: 'Gets your releases.',
   method: 'GET',
+  apiResponse: true,
 
   async handle() {
-    const allReleases = await Release.orderByDesc('id').get()
+    try {
+      const allReleases = await Release.orderByDesc('id').limit(500).get()
 
-    const releases = allReleases.map(r => ({
-      version: String(r.get('version') || ''),
-      date: String(r.get('created_at') || r.get('released_at') || ''),
-      type: String(r.get('type') || 'patch'),
-      status: String(r.get('status') || 'previous'),
-      changes: Number(r.get('changes') || r.get('change_count') || 0),
-      breaking: Boolean(r.get('breaking') || false),
-    }))
+      const releases = allReleases.map(r => ({
+        version: String(r.get('version') || ''),
+        date: String(r.get('created_at') || r.get('released_at') || ''),
+        type: String(r.get('type') || 'patch'),
+        status: String(r.get('status') || 'previous'),
+        changes: Number(r.get('changes') || r.get('change_count') || 0),
+        breaking: Boolean(r.get('breaking') || false),
+      }))
 
-    return { releases }
+      return { releases }
+    }
+    catch (error) {
+      return dashboardOperationalError(error, 'Releases could not be loaded.', 'GetReleases')
+    }
   },
 })

package/app/Actions/Dashboard/Library/PackageIndexAction.ts

@@ -1,19 +1,26 @@
 import { Action } from '@stacksjs/actions'
+import { dashboardOperationalError } from '../dashboard-response'
 import { workspacePackageRows } from './library-source'
 
 export default new Action({
   name: 'PackageIndexAction',
   description: 'Returns package data for the dashboard.',
   method: 'GET',
+  apiResponse: true,
   async handle() {
-    const packages = workspacePackageRows()
+    try {
+      const packages = workspacePackageRows()
 
-    return {
-      packages,
-      publicCount: packages.filter(pkg => !pkg.private).length,
-      privateCount: packages.filter(pkg => pkg.private).length,
-      dependencyCount: packages.reduce((sum, pkg) => sum + pkg.dependencyCount, 0),
-      source: 'bun.lock',
+      return {
+        packages,
+        publicCount: packages.filter(pkg => !pkg.private).length,
+        privateCount: packages.filter(pkg => pkg.private).length,
+        dependencyCount: packages.reduce((sum, pkg) => sum + pkg.dependencyCount, 0),
+        source: 'bun.lock',
+      }
+    }
+    catch (error) {
+      return dashboardOperationalError(error, 'Workspace packages could not be loaded.', 'PackageIndexAction')
     }
   },
 })

package/app/Actions/Dashboard/Models/ModelDestroyAction.ts

@@ -1,5 +1,7 @@
 import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
+import { response } from '@stacksjs/router'
+import { dashboardOperationalError } from '../dashboard-response'
 import { parseRowId, resolveWritableModel } from './model-write'
 
 /**
@@ -17,21 +19,21 @@ export default new Action({
   async handle(request: RequestInstance) {
     const resolved = await resolveWritableModel(request.getParam('slug'), 'destroy')
     if ('error' in resolved)
-      return { ok: false, error: resolved.error }
+      return response.json({ message: resolved.error }, resolved.status)
 
     const id = parseRowId(request.getParam('id'))
     if (id === null)
-      return { ok: false, error: 'A numeric row id is required.' }
+      return response.json({ message: 'A numeric row id is required.' }, 400)
 
     try {
       const row = await resolved.Model.find(id)
       if (!row)
-        return { ok: false, error: `${resolved.modelName} ${id} not found.` }
+        return response.json({ message: `${resolved.modelName} ${id} not found.` }, 404)
       await row.delete()
       return { ok: true, id }
     }
-    catch (e) {
-      return { ok: false, error: e instanceof Error ? e.message : String(e) }
+    catch (error) {
+      return dashboardOperationalError(error, 'The model record could not be deleted.', 'ModelDestroyAction', 500)
     }
   },
 })

package/app/Actions/Dashboard/Models/ModelShowAction.ts

@@ -1,8 +1,8 @@
 import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
-import { env } from '@stacksjs/env'
 import { response as routerResponse } from '@stacksjs/router'
 import { loadModelIfExists, safeGet } from '../../../../resources/functions/dashboard/data'
+import { dashboardOperationalError } from '../dashboard-response'
 import { isValidModelSlug, type ModelCreateField, type ModelWriteCapabilities, modelCreateFields, modelSchemaColumns, modelWriteCapabilities, slugToPascal } from './model-write'
 
 /**
@@ -23,8 +23,8 @@ import { isValidModelSlug, type ModelCreateField, type ModelWriteCapabilities, m
  *      queries, so scopes, casts and accessors all apply.
  *   2. `loadModelIfExists(Name)` — path-map lookup, covers models the ORM has not
  *      registered as a global.
- *   3. Raw SQLite — last resort for a table with no model file at all
- *      (lookup/pivot tables, or a schema added outside the ORM).
+ * A missing model is a 404. The generic browser never bypasses model scopes,
+ * casts, observers, connection drivers, or the app override contract.
  */
 
 interface ColumnMeta {
@@ -50,8 +50,6 @@ interface ResponseShape {
   dir: 'asc' | 'desc'
   q: string
   filters: Record<string, string>
-  source: 'orm' | 'sqlite-fallback'
-  /** False for tables reached through the SQLite fallback: no model, no writes. */
   writable: boolean
   writeCapabilities: ModelWriteCapabilities
   createFields: ModelCreateField[]
@@ -85,6 +83,15 @@ function humanize(column: string): string {
 // filter by it.
 const HIDDEN_COLUMNS = new Set(['password', 'remember_token', 'api_token', 'access_token', 'refresh_token', 'secret', 'two_factor_secret'])
 
+function hiddenModelColumns(Model: any): Set<string> {
+  const hidden = new Set(HIDDEN_COLUMNS)
+  for (const [name, definition] of Object.entries(Model?.attributes ?? {})) {
+    if ((definition as { hidden?: boolean })?.hidden)
+      hidden.add(pascalToSnake(name))
+  }
+  return hidden
+}
+
 /**
  * Column identifiers reach the query builder as raw, unquoted SQL, so only
  * valid identifiers from the table's own column list may ever be used.
@@ -151,15 +158,6 @@ export function parseFilters(raw: string | null): Record<string, string> {
   return out
 }
 
-/**
- * Signals that a free-text search spans several columns, which the query
- * builder cannot express (`whereLike` is single-column and `orWhere` only
- * takes equality pairs). The SQLite path builds that OR with bound
- * parameters instead. Distinct from a real failure so it never surfaces
- * to the page as an error.
- */
-class SearchUnsupported extends Error {}
-
 function resolveOrmModel(modelName: string): any {
   const injected = (globalThis as Record<string, any>)[modelName]
   // The ORM injects Proxies that answer `undefined` for every property
@@ -213,182 +211,92 @@ export default new Action({
       dir,
       q,
       filters,
-      source: 'orm',
       writable: false,
       writeCapabilities: { create: false, update: false, destroy: false },
       createFields: [],
       error: null,
     }
 
-    const Model = resolveOrmModel(modelName) ?? await loadModelIfExists(modelName)
-    const hasOrm = Boolean(Model) && typeof Model.where === 'function'
-
-    if (hasOrm) {
-      try {
-        response.tableName = String(Model.table || tableName)
-        // The column list has to come from a real row: the ORM does not
-        // expose a database schema reflection API. Empty tables fall back
-        // to the model definition, which is also the migration source.
-        const probe = await Model.orderByDesc('id').take(1).get() as Array<Record<string, unknown>>
-        const first = Array.isArray(probe) ? probe[0] : undefined
-        const shape = first && typeof first === 'object'
-          ? ((first as { attributes?: Record<string, unknown> }).attributes ?? first)
-          : {}
-        response.columns = Object.keys(shape).filter(k => typeof k === 'string' && !k.startsWith('_'))
-        if (response.columns.length === 0)
-          response.columns = modelSchemaColumns(Model)
-
-        const allowed = new Set(response.columns.filter(c => !HIDDEN_COLUMNS.has(c)))
-        const unknownFilter = Object.keys(filters).find(column => !isSafeColumn(column, allowed))
-        if (unknownFilter)
-          return routerResponse.json({ message: `Unknown model filter column "${unknownFilter}".` }, 422)
-        if (requestedSort && !isSafeColumn(requestedSort, allowed))
-          return routerResponse.json({ message: `Unknown model sort column "${requestedSort}".` }, 422)
-
-        const sort = isSafeColumn(requestedSort, allowed)
-          ? requestedSort
-          : (allowed.has('id') ? 'id' : (response.columns[0] ?? ''))
-        response.sort = sort
-
-        // Text columns are decided from the probe row, before any query is
-        // built, so the search clause does not depend on response metadata
-        // that is only assembled after the rows come back.
-        const searchColumns = [...allowed].filter(c => typeof safeGet(first, c, null) === 'string')
-
-        const build = () => {
-          let chain = Model as any
-          for (const [column, value] of Object.entries(filters)) {
-            if (!isSafeColumn(column, allowed)) continue
-            chain = chain.where(column, value)
-          }
-          // Global search is a LIKE across every text column. The builder's
-          // `whereLike` covers one column and `orWhere` only takes equality
-          // pairs, so a multi-column OR-LIKE has no ORM expression; that
-          // case is served by the SQLite path below instead, which builds
-          // the OR with bound parameters. Writes stay enabled either way,
-          // because the model still exists.
-          if (q && searchColumns.length === 1)
-            chain = chain.whereLike(searchColumns[0], `%${q}%`)
-          return chain
-        }
-
-        // A multi-column search has no ORM expression, so hand that one
-        // query to the SQLite path — without recording an error, because it
-        // is a gap in the builder's vocabulary, not a failure.
-        if (q && searchColumns.length > 1)
-          throw new SearchUnsupported()
-
-        response.totalCount = q && searchColumns.length === 0
-          ? 0
-          : await build().count()
-        const rows = response.totalCount === 0
-          ? []
-          : await build()
-              .orderBy(sort, dir)
-              .skip((page - 1) * perPage)
-              .take(perPage)
-              .get() as Array<Record<string, unknown>>
-
-        // Flatten to plain JSON-safe objects — proxy models and
-        // accessor-rich rows do not serialise cleanly across the wire.
-        response.rows = (Array.isArray(rows) ? rows : []).map((row) => {
-          const flat: Record<string, unknown> = {}
-          for (const col of response.columns)
-            flat[col] = safeGet(row, col, null)
-          return flat
-        })
-      }
-      catch (e) {
-        if (e instanceof SearchUnsupported) {
-          response.source = 'sqlite-fallback'
-        }
-        else {
-          return routerResponse.json({
-            message: `Could not query model ${modelName}: ${e instanceof Error ? e.message : String(e)}`,
-          }, 503)
-        }
-      }
+    let Model: any
+    try {
+      Model = resolveOrmModel(modelName) ?? await loadModelIfExists(modelName)
     }
-    else {
-      response.source = 'sqlite-fallback'
+    catch (error) {
+      return dashboardOperationalError(error, `${modelName} could not be loaded.`, 'ModelShowAction.resolve')
     }
+    if (!Model || typeof Model.where !== 'function')
+      return routerResponse.json({ message: `No ORM model named ${modelName}.` }, 404)
 
-    if (response.source === 'sqlite-fallback') {
-      try {
-        const { Database } = await import('bun:sqlite')
-        const db = new Database(env.DB_DATABASE_PATH || 'database/stacks.sqlite', { readonly: true })
-        try {
-          if (!/^[A-Za-z_]\w*$/.test(response.tableName))
-            return routerResponse.json({ message: `Model table "${response.tableName}" is not a safe SQL identifier.` }, 500)
-
-          const tableInfo = db.query(`PRAGMA table_info(${response.tableName})`).all() as Array<{ name: string, type: string }>
-          if (tableInfo.length === 0)
-            return routerResponse.json({ message: `Model table "${response.tableName}" does not exist.` }, 404)
-
-          response.columns = tableInfo.map(c => c.name)
-
-          if (response.columns.length > 0) {
-            const allowed = new Set(response.columns.filter(c => !HIDDEN_COLUMNS.has(c)))
-            const unknownFilter = Object.keys(filters).find(column => !isSafeColumn(column, allowed))
-            if (unknownFilter)
-              return routerResponse.json({ message: `Unknown model filter column "${unknownFilter}".` }, 422)
-            if (requestedSort && !isSafeColumn(requestedSort, allowed))
-              return routerResponse.json({ message: `Unknown model sort column "${requestedSort}".` }, 422)
-
-            const sort = isSafeColumn(requestedSort, allowed)
-              ? requestedSort
-              : (allowed.has('id') ? 'id' : response.columns[0])
-            response.sort = sort
-
-            // Every value is bound; only identifiers are interpolated, and
-            // those come from the allowlist built out of PRAGMA above.
-            const wheres: string[] = []
-            const values: unknown[] = []
-            for (const [column, value] of Object.entries(filters)) {
-              if (!isSafeColumn(column, allowed)) continue
-              wheres.push(`${column} = ?`)
-              values.push(value)
-            }
-            if (q) {
-              const textColumns = tableInfo
-                .filter(c => allowed.has(c.name) && /char|text|clob/i.test(c.type || ''))
-                .map(c => c.name)
-              if (textColumns.length > 0) {
-                wheres.push(`(${textColumns.map(c => `${c} LIKE ?`).join(' OR ')})`)
-                for (const _ of textColumns) values.push(`%${q}%`)
-              }
-            }
-            const whereSql = wheres.length > 0 ? ` WHERE ${wheres.join(' AND ')}` : ''
-
-            const countRow = db.query(`SELECT COUNT(*) as count FROM ${response.tableName}${whereSql}`).get(...values as any[]) as { count?: number } | null
-            response.totalCount = countRow?.count ?? 0
-            response.rows = db
-              .query(`SELECT * FROM ${response.tableName}${whereSql} ORDER BY ${sort} ${dir.toUpperCase()} LIMIT ? OFFSET ?`)
-              .all(...values as any[], perPage, (page - 1) * perPage) as Array<Record<string, unknown>>
-            response.error = null
-          }
+    try {
+      response.tableName = String(Model.table || tableName)
+      const probe = await Model.orderByDesc('id').take(1).get() as Array<Record<string, unknown>>
+      const first = Array.isArray(probe) ? probe[0] : undefined
+      const shape = first && typeof first === 'object'
+        ? ((first as { attributes?: Record<string, unknown> }).attributes ?? first)
+        : {}
+      const hiddenColumns = hiddenModelColumns(Model)
+      response.columns = Object.keys(shape).filter(k => typeof k === 'string' && !k.startsWith('_') && !hiddenColumns.has(k))
+      if (response.columns.length === 0)
+        response.columns = modelSchemaColumns(Model).filter(column => !hiddenColumns.has(column))
+
+      const allowed = new Set(response.columns)
+      const unknownFilter = Object.keys(filters).find(column => !isSafeColumn(column, allowed))
+      if (unknownFilter)
+        return routerResponse.json({ message: `Unknown model filter column "${unknownFilter}".` }, 422)
+      if (requestedSort && !isSafeColumn(requestedSort, allowed))
+        return routerResponse.json({ message: `Unknown model sort column "${requestedSort}".` }, 422)
+
+      const sort = isSafeColumn(requestedSort, allowed)
+        ? requestedSort
+        : (allowed.has('id') ? 'id' : (response.columns[0] ?? ''))
+      response.sort = sort
+      const searchColumns = [...allowed].filter(c => typeof safeGet(first, c, null) === 'string')
+
+      const build = () => {
+        let chain = Model.query() as any
+        for (const [column, value] of Object.entries(filters)) {
+          if (!isSafeColumn(column, allowed)) continue
+          chain = chain.where(column, value)
         }
-        finally {
-          db.close()
+        if (q && searchColumns.length > 0) {
+          chain = chain.whereGroup((group: any) => {
+            for (const [index, column] of searchColumns.entries()) {
+              group = index === 0
+                ? group.whereLike(column, `%${q}%`)
+                : group.orWhereLike(column, `%${q}%`)
+            }
+            return group
+          })
         }
+        return chain
       }
-      catch (e) {
-        return routerResponse.json({
-          message: `Could not query table ${response.tableName}: ${e instanceof Error ? e.message : String(e)}`,
-        }, 503)
-      }
+
+      response.totalCount = q && searchColumns.length === 0
+        ? 0
+        : await build().count()
+      const rows = response.totalCount === 0
+        ? []
+        : await build()
+            .orderBy(sort, dir)
+            .skip((page - 1) * perPage)
+            .take(perPage)
+            .get() as Array<Record<string, unknown>>
+
+      response.rows = (Array.isArray(rows) ? rows : []).map((row) => {
+        const flat: Record<string, unknown> = {}
+        for (const col of response.columns)
+          flat[col] = safeGet(row, col, null)
+        return flat
+      })
+    }
+    catch (error) {
+      return dashboardOperationalError(error, `${modelName} records could not be loaded.`, 'ModelShowAction.query')
     }
 
-    // Writability follows the model's declared useApi routes, not which
-    // engine answered this particular query. A multi-column search can be
-    // served by SQLite for a model that still creates and updates through
-    // the ORM.
-    response.writeCapabilities = hasOrm
-      ? modelWriteCapabilities(Model)
-      : { create: false, update: false, destroy: false }
+    response.writeCapabilities = modelWriteCapabilities(Model)
     response.writable = Object.values(response.writeCapabilities).some(Boolean)
     response.createFields = response.writeCapabilities.create ? modelCreateFields(Model) : []
-    response.displayColumns = response.columns.filter(col => !HIDDEN_COLUMNS.has(col) && !col.startsWith('_'))
+    response.displayColumns = response.columns.filter(col => !col.startsWith('_'))
     response.columnMeta = response.displayColumns.map(name => ({
       name,
       label: humanize(name),

package/app/Actions/Dashboard/Models/ModelStoreAction.ts

@@ -1,6 +1,8 @@
 import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { toSnakeCaseKeys } from '@stacksjs/orm'
+import { response } from '@stacksjs/router'
+import { dashboardOperationalError } from '../dashboard-response'
 import { prepareModelFields, resolveWritableModel } from './model-write'
 
 interface ModelWriteInput {
@@ -15,7 +17,7 @@ export default new Action({
   async handle(request: RequestInstance<ModelWriteInput>) {
     const resolved = await resolveWritableModel(request.getParam('slug'), 'store')
     if ('error' in resolved)
-      return { ok: false, error: resolved.error }
+      return response.json({ message: resolved.error }, resolved.status)
 
     const input = request.all()
     const raw = input.fields
@@ -23,9 +25,9 @@ export default new Action({
     const { data, errors } = prepareModelFields(resolved.Model, body)
 
     if (Object.keys(errors).length > 0)
-      return { ok: false, error: 'Validation failed.', errors }
+      return response.json({ message: 'Validation failed.', errors }, 422)
     if (Object.keys(data).length === 0)
-      return { ok: false, error: 'No fillable fields in the request body.' }
+      return response.json({ message: 'No fillable fields in the request body.' }, 422)
 
     try {
       const row = await resolved.Model.create(toSnakeCaseKeys(data))
@@ -33,7 +35,7 @@ export default new Action({
       return { ok: true, id }
     }
     catch (error) {
-      return { ok: false, error: error instanceof Error ? error.message : String(error) }
+      return dashboardOperationalError(error, 'The model record could not be created.', 'ModelStoreAction', 500)
     }
   },
 })

package/app/Actions/Dashboard/Models/ModelUpdateAction.ts

@@ -1,6 +1,8 @@
 import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { toSnakeCaseKeys } from '@stacksjs/orm'
+import { response } from '@stacksjs/router'
+import { dashboardOperationalError } from '../dashboard-response'
 import { parseRowId, prepareModelFields, resolveWritableModel } from './model-write'
 
 interface ModelWriteInput {
@@ -23,11 +25,11 @@ export default new Action({
   async handle(request: RequestInstance<ModelWriteInput>) {
     const resolved = await resolveWritableModel(request.getParam('slug'), 'update')
     if ('error' in resolved)
-      return { ok: false, error: resolved.error }
+      return response.json({ message: resolved.error }, resolved.status)
 
     const id = parseRowId(request.getParam('id'))
     if (id === null)
-      return { ok: false, error: 'A numeric row id is required.' }
+      return response.json({ message: 'A numeric row id is required.' }, 400)
 
     // Edits arrive nested under `fields`. The router's input bag merges the
     // body with route params and query, so a flat payload would silently
@@ -40,20 +42,20 @@ export default new Action({
     const body = (raw && typeof raw === 'object' && !Array.isArray(raw)) ? raw as Record<string, unknown> : {}
     const prepared = prepareModelFields(resolved.Model, body, true)
     if (Object.keys(prepared.errors).length > 0)
-      return { ok: false, error: 'Validation failed.', errors: prepared.errors }
+      return response.json({ message: 'Validation failed.', errors: prepared.errors }, 422)
     const changes = toSnakeCaseKeys(prepared.data)
     if (Object.keys(changes).length === 0)
-      return { ok: false, error: 'No writable fields in the request body.' }
+      return response.json({ message: 'No writable fields in the request body.' }, 422)
 
     try {
       const row = await resolved.Model.find(id)
       if (!row)
-        return { ok: false, error: `${resolved.modelName} ${id} not found.` }
+        return response.json({ message: `${resolved.modelName} ${id} not found.` }, 404)
       await resolved.Model.update(id, changes)
       return { ok: true, id, changed: Object.keys(changes) }
     }
-    catch (e) {
-      return { ok: false, error: e instanceof Error ? e.message : String(e) }
+    catch (error) {
+      return dashboardOperationalError(error, 'The model record could not be updated.', 'ModelUpdateAction', 500)
     }
   },
 })