@stacksjs/defaults 0.70.356 → 0.70.358

package/app/Actions/Dashboard/Marketing/ListStoreAction.ts

@@ -2,7 +2,8 @@ import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { EmailList } from '@stacksjs/orm'
 import { response } from '@stacksjs/router'
-import { marketingListWriteData } from './marketing-list-records'
+import { marketingListWriteData, validateMarketingListWriteData } from './marketing-list-records'
+import { marketingModelError } from './marketing-response'
 
 export default new Action({
   name: 'MarketingListStoreAction',
@@ -11,26 +12,38 @@ export default new Action({
   model: EmailList,
 
   async handle(request: RequestInstance) {
-    await request.validate()
     const data = marketingListWriteData(await request.all())
+    const validationError = validateMarketingListWriteData(data)
+    if (validationError)
+      return response.json({ message: validationError }, 422)
 
-    const duplicate = await EmailList.where('slug', data.slug).first()
-    if (duplicate)
-      return response.json({ message: 'An email list with this slug already exists.' }, 422)
+    try {
+      const duplicate = await EmailList.where('slug', data.slug).first()
+      if (duplicate)
+        return response.json({ message: 'An email list with this slug already exists.' }, 422)
 
-    const list = await EmailList.create({
-      name: data.name,
-      slug: data.slug,
-      description: data.description,
-      status: data.status,
-      is_public: data.isPublic,
-      double_opt_in: data.doubleOptIn,
-      subscriber_count: 0,
-      active_count: 0,
-      unsubscribed_count: 0,
-      bounced_count: 0,
-    })
+      const list = await EmailList.create({
+        name: data.name,
+        slug: data.slug,
+        description: data.description,
+        status: data.status,
+        is_public: data.isPublic,
+        double_opt_in: data.doubleOptIn,
+        subscriber_count: 0,
+        active_count: 0,
+        unsubscribed_count: 0,
+        bounced_count: 0,
+      })
 
-    return response.json({ id: list.get('id') }, 201)
+      return response.json({ id: list.get('id') }, 201)
+    }
+    catch (error) {
+      return marketingModelError(
+        error,
+        'Email list could not be created.',
+        'ListStoreAction',
+        'An email list with this slug already exists.',
+      )
+    }
   },
 })

package/app/Actions/Dashboard/Marketing/ListUpdateAction.ts

@@ -2,7 +2,8 @@ import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { EmailList } from '@stacksjs/orm'
 import { response } from '@stacksjs/router'
-import { marketingListWriteData } from './marketing-list-records'
+import { marketingListWriteData, validateMarketingListWriteData } from './marketing-list-records'
+import { marketingModelError, marketingRecordId } from './marketing-response'
 
 export default new Action({
   name: 'MarketingListUpdateAction',
@@ -11,25 +12,40 @@ export default new Action({
   model: EmailList,
 
   async handle(request: RequestInstance) {
-    await request.validate()
-    const id = Number(request.getParam('id'))
-    const list = await EmailList.find(id)
-    if (!list)
-      return response.json({ message: 'Email list not found.' }, 404)
-
+    const id = marketingRecordId(request)
+    if (!id)
+      return response.json({ message: 'A valid email list id is required.' }, 400)
     const data = marketingListWriteData(await request.all())
-    const duplicates = await EmailList.where('slug', data.slug).get()
-    if (duplicates.some(record => Number(record.get('id')) !== id))
-      return response.json({ message: 'An email list with this slug already exists.' }, 422)
+    const validationError = validateMarketingListWriteData(data)
+    if (validationError)
+      return response.json({ message: validationError }, 422)
+
+    try {
+      const list = await EmailList.find(id)
+      if (!list)
+        return response.json({ message: 'Email list not found.' }, 404)
+
+      const duplicates = await EmailList.where('slug', data.slug).get()
+      if (duplicates.some(record => Number(record.get('id')) !== id))
+        return response.json({ message: 'An email list with this slug already exists.' }, 422)
 
-    await list.update({
-      name: data.name,
-      slug: data.slug,
-      description: data.description,
-      status: data.status,
-      is_public: data.isPublic,
-      double_opt_in: data.doubleOptIn,
-    })
-    return response.json({ id })
+      await list.update({
+        name: data.name,
+        slug: data.slug,
+        description: data.description,
+        status: data.status,
+        is_public: data.isPublic,
+        double_opt_in: data.doubleOptIn,
+      })
+      return response.json({ id })
+    }
+    catch (error) {
+      return marketingModelError(
+        error,
+        'Email list could not be updated.',
+        'ListUpdateAction',
+        'An email list with this slug already exists.',
+      )
+    }
   },
 })

package/app/Actions/Dashboard/Marketing/SocialPostDestroyAction.ts

@@ -2,6 +2,7 @@ import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { SocialPost } from '@stacksjs/orm'
 import { response } from '@stacksjs/router'
+import { marketingModelError, marketingRecordId } from './marketing-response'
 
 export default new Action({
   name: 'SocialPostDestroyAction',
@@ -9,10 +10,19 @@ export default new Action({
   method: 'DELETE',
 
   async handle(request: RequestInstance) {
-    const post = await SocialPost.find(Number(request.getParam('id')))
-    if (!post)
-      return response.json({ message: 'Social post not found.' }, 404)
-    await post.delete()
-    return response.noContent()
+    const id = marketingRecordId(request)
+    if (!id)
+      return response.json({ message: 'A valid social post id is required.' }, 400)
+
+    try {
+      const post = await SocialPost.find(id)
+      if (!post)
+        return response.json({ message: 'Social post not found.' }, 404)
+      await post.delete()
+      return response.noContent()
+    }
+    catch (error) {
+      return marketingModelError(error, 'Social post could not be deleted.', 'SocialPostDestroyAction')
+    }
   },
 })

package/app/Actions/Dashboard/Marketing/SocialPostIndexAction.ts

@@ -1,5 +1,6 @@
 import { Action } from '@stacksjs/actions'
 import { SocialPost, User } from '@stacksjs/orm'
+import { dashboardOperationalError } from '../dashboard-response'
 import { normalizeSocialPosts } from './social-post-records'
 
 export default new Action({
@@ -9,10 +10,15 @@ export default new Action({
   apiResponse: true,
 
   async handle() {
-    const [posts, users] = await Promise.all([
-      SocialPost.orderByDesc('id').limit(500).get(),
-      User.orderBy('name', 'asc').limit(500).get(),
-    ])
-    return normalizeSocialPosts(posts, users)
+    try {
+      const [posts, users] = await Promise.all([
+        SocialPost.orderByDesc('id').limit(500).get(),
+        User.orderBy('name', 'asc').limit(500).get(),
+      ])
+      return normalizeSocialPosts(posts, users)
+    }
+    catch (error) {
+      return dashboardOperationalError(error, 'Social posts could not be loaded.', 'SocialPostIndexAction')
+    }
   },
 })

package/app/Actions/Dashboard/Marketing/SocialPostStoreAction.ts

@@ -2,7 +2,8 @@ import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { SocialPost } from '@stacksjs/orm'
 import { response } from '@stacksjs/router'
-import { socialPostWriteData, validateSocialPostSchedule } from './social-post-records'
+import { marketingModelError } from './marketing-response'
+import { socialPostWriteData, validateSocialPostWriteData } from './social-post-records'
 
 export default new Action({
   name: 'SocialPostStoreAction',
@@ -11,19 +12,24 @@ export default new Action({
   model: SocialPost,
 
   async handle(request: RequestInstance) {
-    await request.validate()
     const data = socialPostWriteData(await request.all())
-    const scheduleError = validateSocialPostSchedule(data)
-    if (scheduleError)
-      return response.json({ message: scheduleError }, 422)
+    const validationError = validateSocialPostWriteData(data)
+    if (validationError)
+      return response.json({ message: validationError }, 422)
 
-    const post = await SocialPost.create({
-      ...data,
-      likes: 0,
-      shares: 0,
-      comments: 0,
-      reach: 0,
-    })
-    return response.json({ id: post.get('id') }, 201)
+    try {
+      const post = await SocialPost.create({
+        ...data,
+        platform: data.platform as Exclude<typeof data.platform, ''>,
+        likes: 0,
+        shares: 0,
+        comments: 0,
+        reach: 0,
+      })
+      return response.json({ id: post.get('id') }, 201)
+    }
+    catch (error) {
+      return marketingModelError(error, 'Social post could not be created.', 'SocialPostStoreAction')
+    }
   },
 })

package/app/Actions/Dashboard/Marketing/SocialPostUpdateAction.ts

@@ -2,7 +2,8 @@ import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { SocialPost } from '@stacksjs/orm'
 import { response } from '@stacksjs/router'
-import { socialPostWriteData, validateSocialPostSchedule } from './social-post-records'
+import { marketingModelError, marketingRecordId } from './marketing-response'
+import { socialPostWriteData, validateSocialPostWriteData } from './social-post-records'
 
 export default new Action({
   name: 'SocialPostUpdateAction',
@@ -11,18 +12,27 @@ export default new Action({
   model: SocialPost,
 
   async handle(request: RequestInstance) {
-    await request.validate()
-    const id = Number(request.getParam('id'))
-    const post = await SocialPost.find(id)
-    if (!post)
-      return response.json({ message: 'Social post not found.' }, 404)
-
+    const id = marketingRecordId(request)
+    if (!id)
+      return response.json({ message: 'A valid social post id is required.' }, 400)
     const data = socialPostWriteData(await request.all())
-    const scheduleError = validateSocialPostSchedule(data)
-    if (scheduleError)
-      return response.json({ message: scheduleError }, 422)
+    const validationError = validateSocialPostWriteData(data)
+    if (validationError)
+      return response.json({ message: validationError }, 422)
+
+    try {
+      const post = await SocialPost.find(id)
+      if (!post)
+        return response.json({ message: 'Social post not found.' }, 404)
 
-    await post.update(data)
-    return response.json({ id })
+      await post.update({
+        ...data,
+        platform: data.platform as Exclude<typeof data.platform, ''>,
+      })
+      return response.json({ id })
+    }
+    catch (error) {
+      return marketingModelError(error, 'Social post could not be updated.', 'SocialPostUpdateAction')
+    }
   },
 })

package/app/Actions/Dashboard/Marketing/campaign-delivery.ts

@@ -1,5 +1,39 @@
+import { db } from '@stacksjs/database'
+import { Campaign, EmailList } from '@stacksjs/orm'
+
 export type CampaignDeliveryOperation = 'send' | 'schedule' | 'cancel'
 
+export interface CampaignDeliveryContext {
+  campaign: any | null
+  activeMembers: number
+  listStatus: string
+}
+
+export async function loadCampaignDeliveryContext(id: number): Promise<CampaignDeliveryContext> {
+  const campaign = await Campaign.find(id)
+  if (!campaign)
+    return { campaign: null, activeMembers: 0, listStatus: '' }
+
+  const listId = Number(campaign.get('email_list_id') || 0)
+  const [list, memberRow] = listId
+    ? await Promise.all([
+        EmailList.find(listId),
+        db
+          .selectFrom('email_list_subscribers')
+          .select(db.fn.count('id').as('count'))
+          .where('email_list_id', '=', listId)
+          .where('status', '=', 'subscribed')
+          .executeTakeFirst(),
+      ])
+    : [null, null]
+
+  return {
+    campaign,
+    activeMembers: Number(memberRow?.count || 0),
+    listStatus: String(list?.get('status') || ''),
+  }
+}
+
 function value(record: any, ...keys: string[]): unknown {
   for (const key of keys) {
     const result = typeof record?.get === 'function' ? record.get(key) : record?.[key]

package/app/Actions/Dashboard/Marketing/marketing-list-records.test.ts

@@ -3,6 +3,7 @@ import {
   marketingListWriteData,
   normalizeMarketingLists,
   slugifyMarketingList,
+  validateMarketingListWriteData,
 } from './marketing-list-records'
 
 describe('marketing list records', () => {
@@ -68,4 +69,13 @@ describe('marketing list records', () => {
       doubleOptIn: 0,
     })
   })
+
+  test('rejects empty and oversized dashboard writes before model defaults apply', () => {
+    expect(validateMarketingListWriteData(marketingListWriteData({})))
+      .toBe('List name must be between 2 and 100 characters.')
+    expect(validateMarketingListWriteData(marketingListWriteData({
+      name: 'Product News',
+      description: 'x'.repeat(501),
+    }))).toBe('List description must be 500 characters or fewer.')
+  })
 })

package/app/Actions/Dashboard/Marketing/marketing-list-records.ts

@@ -159,3 +159,13 @@ export function marketingListWriteData(input: Record<string, unknown>): {
     doubleOptIn: boolean(input.doubleOptIn ?? input.double_opt_in) ? 1 : 0,
   }
 }
+
+export function validateMarketingListWriteData(data: ReturnType<typeof marketingListWriteData>): string {
+  if (data.name.length < 2 || data.name.length > 100)
+    return 'List name must be between 2 and 100 characters.'
+  if (!data.slug || data.slug.length > 120)
+    return 'List slug must be between 1 and 120 characters.'
+  if (data.description.length > 500)
+    return 'List description must be 500 characters or fewer.'
+  return ''
+}

package/app/Actions/Dashboard/Marketing/marketing-response.ts

@@ -0,0 +1,28 @@
+import type { RequestInstance } from '@stacksjs/types'
+import { isUniqueViolation, ModelValidationError } from '@stacksjs/orm'
+import { response } from '@stacksjs/router'
+import { dashboardOperationalError } from '../dashboard-response'
+
+export function marketingRecordId(request: RequestInstance): number | null {
+  const id = Number(request.getParam('id'))
+  return Number.isSafeInteger(id) && id > 0 ? id : null
+}
+
+export function marketingModelError(
+  error: unknown,
+  message: string,
+  action: string,
+  duplicateMessage?: string,
+): Response {
+  if (error instanceof ModelValidationError) {
+    return response.json({
+      message: 'Validation failed.',
+      errors: error.errors,
+    }, 422)
+  }
+
+  if (duplicateMessage && isUniqueViolation(error))
+    return response.json({ message: duplicateMessage }, 422)
+
+  return dashboardOperationalError(error, message, action, 500)
+}

package/app/Actions/Dashboard/Marketing/social-post-records.test.ts

@@ -3,6 +3,7 @@ import {
   normalizeSocialPosts,
   socialPostWriteData,
   validateSocialPostSchedule,
+  validateSocialPostWriteData,
 } from './social-post-records'
 
 const now = new Date('2026-07-29T12:00:00.000Z')
@@ -68,4 +69,16 @@ describe('social post records', () => {
     }, now)
     expect(validateSocialPostSchedule(stale, now)).toBe('Schedule time must be in the future.')
   })
+
+  test('rejects missing content, invalid platforms, and unsafe image URLs', () => {
+    expect(validateSocialPostWriteData(socialPostWriteData({})))
+      .toBe('Post content must be between 1 and 2000 characters.')
+    expect(validateSocialPostWriteData(socialPostWriteData({ content: 'Ready to publish' })))
+      .toBe('Choose a valid social platform.')
+    expect(validateSocialPostWriteData(socialPostWriteData({
+      content: 'Ready to publish',
+      platform: 'linkedin',
+      imageUrl: 'javascript:alert(1)',
+    }))).toBe('Image URL must use HTTP or HTTPS.')
+  })
 })

package/app/Actions/Dashboard/Marketing/social-post-records.ts

@@ -55,11 +55,11 @@ function number(input: unknown): number {
   return Number.isFinite(result) && result >= 0 ? result : 0
 }
 
-function platform(input: unknown): SocialPostPlatform {
+function platform(input: unknown): SocialPostPlatform | '' {
   const normalized = text(input).toLowerCase()
   return ['twitter', 'facebook', 'instagram', 'linkedin', 'tiktok', 'youtube'].includes(normalized)
     ? normalized as SocialPostPlatform
-    : 'twitter'
+    : ''
 }
 
 function status(input: unknown): SocialPostStatus {
@@ -89,7 +89,7 @@ export function normalizeSocialPosts(
     return {
       id: text(value(post, 'id')),
       content: text(value(post, 'content')),
-      platform: platform(value(post, 'platform')),
+      platform: platform(value(post, 'platform')) || 'twitter',
       status: status(value(post, 'status')),
       scheduledAt: text(value(post, 'scheduled_at', 'scheduledAt')),
       publishedAt: text(value(post, 'published_at', 'publishedAt')),
@@ -124,7 +124,7 @@ export function normalizeSocialPosts(
 
 export function socialPostWriteData(input: Record<string, unknown>, now = new Date()): {
   content: string
-  platform: SocialPostPlatform
+  platform: SocialPostPlatform | ''
   status: SocialPostStatus
   scheduled_at: string | null
   published_at: string | null
@@ -161,3 +161,21 @@ export function validateSocialPostSchedule(data: ReturnType<typeof socialPostWri
     return 'Schedule time must be in the future.'
   return ''
 }
+
+export function validateSocialPostWriteData(data: ReturnType<typeof socialPostWriteData>): string {
+  if (data.content.length < 1 || data.content.length > 2000)
+    return 'Post content must be between 1 and 2000 characters.'
+  if (!data.platform)
+    return 'Choose a valid social platform.'
+  if (data.image_url) {
+    try {
+      const url = new URL(data.image_url)
+      if (!['http:', 'https:'].includes(url.protocol))
+        return 'Image URL must use HTTP or HTTPS.'
+    }
+    catch {
+      return 'Image URL must be a valid URL.'
+    }
+  }
+  return validateSocialPostSchedule(data)
+}

package/app/Actions/Dashboard/Models/GetModels.ts

@@ -3,15 +3,18 @@ import { Glob } from 'bun'
 import { Action } from '@stacksjs/actions'
 import { path } from '@stacksjs/path'
 import { countRows } from '../../../../resources/functions/dashboard/data'
+import { dashboardOperationalError } from '../dashboard-response'
 
 export default new Action({
   name: 'GetModels',
   description: 'Gets the application models.',
+  method: 'GET',
 
   async handle() {
-    const glob = new Glob('**/*.ts')
-    const scanOptions = { cwd: path.userModelsPath(), onlyFiles: true }
-    const displayModels: Model[] = []
+    try {
+      const glob = new Glob('**/*.ts')
+      const scanOptions = { cwd: path.userModelsPath(), onlyFiles: true }
+      const displayModels: Model[] = []
 
     for await (const file of glob.scan(scanOptions)) {
       const model = (await import(path.userModelsPath(file))).default as Model
@@ -31,9 +34,13 @@ export default new Action({
       displayModels.length = 8
     displayModels.sort((a, b) => (a.name || '').localeCompare(b.name || ''))
 
-    return await Promise.all(displayModels.map(async model => ({
-      model: model.name,
-      total: await countRows(model),
-    })))
+      return await Promise.all(displayModels.map(async model => ({
+        model: model.name,
+        total: await countRows(model),
+      })))
+    }
+    catch (error) {
+      return dashboardOperationalError(error, 'Dashboard models could not be loaded.', 'GetModels')
+    }
   },
 })

package/app/Actions/Dashboard/Models/GetSubscriberCount.ts

@@ -1,12 +1,19 @@
 import { Action } from '@stacksjs/actions'
 import { Subscriber } from '@stacksjs/orm'
+import { dashboardOperationalError } from '../dashboard-response'
 
 export default new Action({
   name: 'GetSubscriberCount',
   description: 'Gets the total number of subscribers.',
+  method: 'GET',
   apiResponse: true,
 
   async handle() {
-    return await Subscriber.count()
+    try {
+      return await Subscriber.count()
+    }
+    catch (error) {
+      return dashboardOperationalError(error, 'Subscriber total could not be loaded.', 'GetSubscriberCount')
+    }
   },
 })

package/app/Actions/Dashboard/Models/GetUserCount.ts

@@ -1,12 +1,19 @@
 import { Action } from '@stacksjs/actions'
 import { User } from '@stacksjs/orm'
+import { dashboardOperationalError } from '../dashboard-response'
 
 export default new Action({
   name: 'GetUserCount',
   description: 'Gets the total number of users.',
+  method: 'GET',
   apiResponse: true,
 
   async handle() {
-    return User.count()
+    try {
+      return await User.count()
+    }
+    catch (error) {
+      return dashboardOperationalError(error, 'User total could not be loaded.', 'GetUserCount')
+    }
   },
 })

package/app/Actions/Dashboard/Releases/ReleaseIndexAction.ts

@@ -1,5 +1,6 @@
 import { Action } from '@stacksjs/actions'
 import { Release } from '@stacksjs/orm'
+import { dashboardOperationalError } from '../dashboard-response'
 import { normalizeReleaseRecord, summarizeReleases } from './release-records'
 
 export default new Action({
@@ -9,12 +10,17 @@ export default new Action({
   apiResponse: true,
 
   async handle() {
-    const records = await Release.orderByDesc('id').limit(200).get()
-    const releases = records.map(normalizeReleaseRecord)
+    try {
+      const records = await Release.orderByDesc('id').limit(200).get()
+      const releases = records.map(normalizeReleaseRecord)
 
-    return {
-      releases,
-      summary: summarizeReleases(releases),
+      return {
+        releases,
+        summary: summarizeReleases(releases),
+      }
+    }
+    catch (error) {
+      return dashboardOperationalError(error, 'Release history could not be loaded.', 'ReleaseIndexAction')
     }
   },
 })

package/app/Actions/Dashboard/Settings/MailSettingsGetAction.ts

@@ -1,4 +1,5 @@
 import { Action } from '@stacksjs/actions'
+import { dashboardOperationalError } from '../dashboard-response'
 import { readMailSettings } from './mail-settings'
 
 export default new Action({
@@ -8,9 +9,14 @@ export default new Action({
   apiResponse: true,
 
   async handle() {
-    return Response.json(
-      { settings: await readMailSettings() },
-      { headers: { 'Cache-Control': 'no-store', Pragma: 'no-cache' } },
-    )
+    try {
+      return Response.json(
+        { settings: await readMailSettings() },
+        { headers: { 'Cache-Control': 'no-store', Pragma: 'no-cache' } },
+      )
+    }
+    catch (error) {
+      return dashboardOperationalError(error, 'Mail settings could not be loaded.', 'MailSettingsGetAction')
+    }
   },
 })

package/app/Actions/Dashboard/Settings/MailSettingsUpdateAction.ts

@@ -1,6 +1,7 @@
 import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { response } from '@stacksjs/router'
+import { dashboardOperationalError } from '../dashboard-response'
 import { updateMailSettings } from './mail-settings'
 
 export default new Action({
@@ -10,7 +11,13 @@ export default new Action({
   apiResponse: true,
 
   async handle(request: RequestInstance) {
-    const result = await updateMailSettings(await request.all())
+    let result
+    try {
+      result = await updateMailSettings(await request.all())
+    }
+    catch (error) {
+      return dashboardOperationalError(error, 'Mail settings could not be saved.', 'MailSettingsUpdateAction', 500)
+    }
 
     if ('validation' in result) {
       return response.json({

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.70.356",
+  "version": "0.70.358",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.70.356",
+  "version": "0.70.358",
   "description": "The complete managed Stacks application scaffold, including runtime defaults, AI guidance, editor metadata, and npm-backed project support files.",
   "author": "Chris Breuer",
   "license": "MIT",