@stacksjs/defaults 0.70.357 → 0.70.362

package/app/Actions/Dashboard/Marketing/SocialPostUpdateAction.ts

@@ -2,7 +2,8 @@ import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { SocialPost } from '@stacksjs/orm'
 import { response } from '@stacksjs/router'
-import { socialPostWriteData, validateSocialPostSchedule } from './social-post-records'
+import { marketingModelError, marketingRecordId } from './marketing-response'
+import { socialPostWriteData, validateSocialPostWriteData } from './social-post-records'
 
 export default new Action({
   name: 'SocialPostUpdateAction',
@@ -11,18 +12,27 @@ export default new Action({
   model: SocialPost,
 
   async handle(request: RequestInstance) {
-    await request.validate()
-    const id = Number(request.getParam('id'))
-    const post = await SocialPost.find(id)
-    if (!post)
-      return response.json({ message: 'Social post not found.' }, 404)
-
+    const id = marketingRecordId(request)
+    if (!id)
+      return response.json({ message: 'A valid social post id is required.' }, 400)
     const data = socialPostWriteData(await request.all())
-    const scheduleError = validateSocialPostSchedule(data)
-    if (scheduleError)
-      return response.json({ message: scheduleError }, 422)
+    const validationError = validateSocialPostWriteData(data)
+    if (validationError)
+      return response.json({ message: validationError }, 422)
+
+    try {
+      const post = await SocialPost.find(id)
+      if (!post)
+        return response.json({ message: 'Social post not found.' }, 404)
 
-    await post.update(data)
-    return response.json({ id })
+      await post.update({
+        ...data,
+        platform: data.platform as Exclude<typeof data.platform, ''>,
+      })
+      return response.json({ id })
+    }
+    catch (error) {
+      return marketingModelError(error, 'Social post could not be updated.', 'SocialPostUpdateAction')
+    }
   },
 })

package/app/Actions/Dashboard/Marketing/campaign-delivery.ts

@@ -1,5 +1,39 @@
+import { db } from '@stacksjs/database'
+import { Campaign, EmailList } from '@stacksjs/orm'
+
 export type CampaignDeliveryOperation = 'send' | 'schedule' | 'cancel'
 
+export interface CampaignDeliveryContext {
+  campaign: any | null
+  activeMembers: number
+  listStatus: string
+}
+
+export async function loadCampaignDeliveryContext(id: number): Promise<CampaignDeliveryContext> {
+  const campaign = await Campaign.find(id)
+  if (!campaign)
+    return { campaign: null, activeMembers: 0, listStatus: '' }
+
+  const listId = Number(campaign.get('email_list_id') || 0)
+  const [list, memberRow] = listId
+    ? await Promise.all([
+        EmailList.find(listId),
+        db
+          .selectFrom('email_list_subscribers')
+          .select(db.fn.count('id').as('count'))
+          .where('email_list_id', '=', listId)
+          .where('status', '=', 'subscribed')
+          .executeTakeFirst(),
+      ])
+    : [null, null]
+
+  return {
+    campaign,
+    activeMembers: Number(memberRow?.count || 0),
+    listStatus: String(list?.get('status') || ''),
+  }
+}
+
 function value(record: any, ...keys: string[]): unknown {
   for (const key of keys) {
     const result = typeof record?.get === 'function' ? record.get(key) : record?.[key]

package/app/Actions/Dashboard/Marketing/marketing-list-records.test.ts

@@ -3,6 +3,7 @@ import {
   marketingListWriteData,
   normalizeMarketingLists,
   slugifyMarketingList,
+  validateMarketingListWriteData,
 } from './marketing-list-records'
 
 describe('marketing list records', () => {
@@ -68,4 +69,13 @@ describe('marketing list records', () => {
       doubleOptIn: 0,
     })
   })
+
+  test('rejects empty and oversized dashboard writes before model defaults apply', () => {
+    expect(validateMarketingListWriteData(marketingListWriteData({})))
+      .toBe('List name must be between 2 and 100 characters.')
+    expect(validateMarketingListWriteData(marketingListWriteData({
+      name: 'Product News',
+      description: 'x'.repeat(501),
+    }))).toBe('List description must be 500 characters or fewer.')
+  })
 })

package/app/Actions/Dashboard/Marketing/marketing-list-records.ts

@@ -159,3 +159,13 @@ export function marketingListWriteData(input: Record<string, unknown>): {
     doubleOptIn: boolean(input.doubleOptIn ?? input.double_opt_in) ? 1 : 0,
   }
 }
+
+export function validateMarketingListWriteData(data: ReturnType<typeof marketingListWriteData>): string {
+  if (data.name.length < 2 || data.name.length > 100)
+    return 'List name must be between 2 and 100 characters.'
+  if (!data.slug || data.slug.length > 120)
+    return 'List slug must be between 1 and 120 characters.'
+  if (data.description.length > 500)
+    return 'List description must be 500 characters or fewer.'
+  return ''
+}

package/app/Actions/Dashboard/Marketing/marketing-response.ts

@@ -0,0 +1,28 @@
+import type { RequestInstance } from '@stacksjs/types'
+import { isUniqueViolation, ModelValidationError } from '@stacksjs/orm'
+import { response } from '@stacksjs/router'
+import { dashboardOperationalError } from '../dashboard-response'
+
+export function marketingRecordId(request: RequestInstance): number | null {
+  const id = Number(request.getParam('id'))
+  return Number.isSafeInteger(id) && id > 0 ? id : null
+}
+
+export function marketingModelError(
+  error: unknown,
+  message: string,
+  action: string,
+  duplicateMessage?: string,
+): Response {
+  if (error instanceof ModelValidationError) {
+    return response.json({
+      message: 'Validation failed.',
+      errors: error.errors,
+    }, 422)
+  }
+
+  if (duplicateMessage && isUniqueViolation(error))
+    return response.json({ message: duplicateMessage }, 422)
+
+  return dashboardOperationalError(error, message, action, 500)
+}

package/app/Actions/Dashboard/Marketing/social-post-records.test.ts

@@ -3,6 +3,7 @@ import {
   normalizeSocialPosts,
   socialPostWriteData,
   validateSocialPostSchedule,
+  validateSocialPostWriteData,
 } from './social-post-records'
 
 const now = new Date('2026-07-29T12:00:00.000Z')
@@ -68,4 +69,16 @@ describe('social post records', () => {
     }, now)
     expect(validateSocialPostSchedule(stale, now)).toBe('Schedule time must be in the future.')
   })
+
+  test('rejects missing content, invalid platforms, and unsafe image URLs', () => {
+    expect(validateSocialPostWriteData(socialPostWriteData({})))
+      .toBe('Post content must be between 1 and 2000 characters.')
+    expect(validateSocialPostWriteData(socialPostWriteData({ content: 'Ready to publish' })))
+      .toBe('Choose a valid social platform.')
+    expect(validateSocialPostWriteData(socialPostWriteData({
+      content: 'Ready to publish',
+      platform: 'linkedin',
+      imageUrl: 'javascript:alert(1)',
+    }))).toBe('Image URL must use HTTP or HTTPS.')
+  })
 })

package/app/Actions/Dashboard/Marketing/social-post-records.ts

@@ -55,11 +55,11 @@ function number(input: unknown): number {
   return Number.isFinite(result) && result >= 0 ? result : 0
 }
 
-function platform(input: unknown): SocialPostPlatform {
+function platform(input: unknown): SocialPostPlatform | '' {
   const normalized = text(input).toLowerCase()
   return ['twitter', 'facebook', 'instagram', 'linkedin', 'tiktok', 'youtube'].includes(normalized)
     ? normalized as SocialPostPlatform
-    : 'twitter'
+    : ''
 }
 
 function status(input: unknown): SocialPostStatus {
@@ -89,7 +89,7 @@ export function normalizeSocialPosts(
     return {
       id: text(value(post, 'id')),
       content: text(value(post, 'content')),
-      platform: platform(value(post, 'platform')),
+      platform: platform(value(post, 'platform')) || 'twitter',
       status: status(value(post, 'status')),
       scheduledAt: text(value(post, 'scheduled_at', 'scheduledAt')),
       publishedAt: text(value(post, 'published_at', 'publishedAt')),
@@ -124,7 +124,7 @@ export function normalizeSocialPosts(
 
 export function socialPostWriteData(input: Record<string, unknown>, now = new Date()): {
   content: string
-  platform: SocialPostPlatform
+  platform: SocialPostPlatform | ''
   status: SocialPostStatus
   scheduled_at: string | null
   published_at: string | null
@@ -161,3 +161,21 @@ export function validateSocialPostSchedule(data: ReturnType<typeof socialPostWri
     return 'Schedule time must be in the future.'
   return ''
 }
+
+export function validateSocialPostWriteData(data: ReturnType<typeof socialPostWriteData>): string {
+  if (data.content.length < 1 || data.content.length > 2000)
+    return 'Post content must be between 1 and 2000 characters.'
+  if (!data.platform)
+    return 'Choose a valid social platform.'
+  if (data.image_url) {
+    try {
+      const url = new URL(data.image_url)
+      if (!['http:', 'https:'].includes(url.protocol))
+        return 'Image URL must use HTTP or HTTPS.'
+    }
+    catch {
+      return 'Image URL must be a valid URL.'
+    }
+  }
+  return validateSocialPostSchedule(data)
+}

package/app/Actions/Dashboard/Models/GetModels.ts

@@ -3,15 +3,18 @@ import { Glob } from 'bun'
 import { Action } from '@stacksjs/actions'
 import { path } from '@stacksjs/path'
 import { countRows } from '../../../../resources/functions/dashboard/data'
+import { dashboardOperationalError } from '../dashboard-response'
 
 export default new Action({
   name: 'GetModels',
   description: 'Gets the application models.',
+  method: 'GET',
 
   async handle() {
-    const glob = new Glob('**/*.ts')
-    const scanOptions = { cwd: path.userModelsPath(), onlyFiles: true }
-    const displayModels: Model[] = []
+    try {
+      const glob = new Glob('**/*.ts')
+      const scanOptions = { cwd: path.userModelsPath(), onlyFiles: true }
+      const displayModels: Model[] = []
 
     for await (const file of glob.scan(scanOptions)) {
       const model = (await import(path.userModelsPath(file))).default as Model
@@ -31,9 +34,13 @@ export default new Action({
       displayModels.length = 8
     displayModels.sort((a, b) => (a.name || '').localeCompare(b.name || ''))
 
-    return await Promise.all(displayModels.map(async model => ({
-      model: model.name,
-      total: await countRows(model),
-    })))
+      return await Promise.all(displayModels.map(async model => ({
+        model: model.name,
+        total: await countRows(model),
+      })))
+    }
+    catch (error) {
+      return dashboardOperationalError(error, 'Dashboard models could not be loaded.', 'GetModels')
+    }
   },
 })

package/app/Actions/Dashboard/Models/GetSubscriberCount.ts

@@ -1,12 +1,19 @@
 import { Action } from '@stacksjs/actions'
 import { Subscriber } from '@stacksjs/orm'
+import { dashboardOperationalError } from '../dashboard-response'
 
 export default new Action({
   name: 'GetSubscriberCount',
   description: 'Gets the total number of subscribers.',
+  method: 'GET',
   apiResponse: true,
 
   async handle() {
-    return await Subscriber.count()
+    try {
+      return await Subscriber.count()
+    }
+    catch (error) {
+      return dashboardOperationalError(error, 'Subscriber total could not be loaded.', 'GetSubscriberCount')
+    }
   },
 })

package/app/Actions/Dashboard/Models/GetUserCount.ts

@@ -1,12 +1,19 @@
 import { Action } from '@stacksjs/actions'
 import { User } from '@stacksjs/orm'
+import { dashboardOperationalError } from '../dashboard-response'
 
 export default new Action({
   name: 'GetUserCount',
   description: 'Gets the total number of users.',
+  method: 'GET',
   apiResponse: true,
 
   async handle() {
-    return User.count()
+    try {
+      return await User.count()
+    }
+    catch (error) {
+      return dashboardOperationalError(error, 'User total could not be loaded.', 'GetUserCount')
+    }
   },
 })

package/app/Actions/Dashboard/Releases/ReleaseIndexAction.ts

@@ -1,5 +1,6 @@
 import { Action } from '@stacksjs/actions'
 import { Release } from '@stacksjs/orm'
+import { dashboardOperationalError } from '../dashboard-response'
 import { normalizeReleaseRecord, summarizeReleases } from './release-records'
 
 export default new Action({
@@ -9,12 +10,17 @@ export default new Action({
   apiResponse: true,
 
   async handle() {
-    const records = await Release.orderByDesc('id').limit(200).get()
-    const releases = records.map(normalizeReleaseRecord)
+    try {
+      const records = await Release.orderByDesc('id').limit(200).get()
+      const releases = records.map(normalizeReleaseRecord)
 
-    return {
-      releases,
-      summary: summarizeReleases(releases),
+      return {
+        releases,
+        summary: summarizeReleases(releases),
+      }
+    }
+    catch (error) {
+      return dashboardOperationalError(error, 'Release history could not be loaded.', 'ReleaseIndexAction')
     }
   },
 })

package/app/Actions/Dashboard/Settings/MailSettingsGetAction.ts

@@ -1,4 +1,5 @@
 import { Action } from '@stacksjs/actions'
+import { dashboardOperationalError } from '../dashboard-response'
 import { readMailSettings } from './mail-settings'
 
 export default new Action({
@@ -8,9 +9,14 @@ export default new Action({
   apiResponse: true,
 
   async handle() {
-    return Response.json(
-      { settings: await readMailSettings() },
-      { headers: { 'Cache-Control': 'no-store', Pragma: 'no-cache' } },
-    )
+    try {
+      return Response.json(
+        { settings: await readMailSettings() },
+        { headers: { 'Cache-Control': 'no-store', Pragma: 'no-cache' } },
+      )
+    }
+    catch (error) {
+      return dashboardOperationalError(error, 'Mail settings could not be loaded.', 'MailSettingsGetAction')
+    }
   },
 })

package/app/Actions/Dashboard/Settings/MailSettingsUpdateAction.ts

@@ -1,6 +1,7 @@
 import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { response } from '@stacksjs/router'
+import { dashboardOperationalError } from '../dashboard-response'
 import { updateMailSettings } from './mail-settings'
 
 export default new Action({
@@ -10,7 +11,13 @@ export default new Action({
   apiResponse: true,
 
   async handle(request: RequestInstance) {
-    const result = await updateMailSettings(await request.all())
+    let result
+    try {
+      result = await updateMailSettings(await request.all())
+    }
+    catch (error) {
+      return dashboardOperationalError(error, 'Mail settings could not be saved.', 'MailSettingsUpdateAction', 500)
+    }
 
     if ('validation' in result) {
       return response.json({

package/app/Actions/LogAction.ts

@@ -1,15 +1,16 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { log } from '@stacksjs/logging'
+import { response } from '@stacksjs/router'
 import { schema } from '@stacksjs/validation'
 
-interface Request {
-  message: string
-  level: 'info' | 'warn' | 'error'
-}
+type LogLevel = 'info' | 'warn' | 'error'
 
 export default new Action({
   name: 'Dummy Logger',
   description: 'This action is used to demo how to POST to a server and upon success, log a message.',
+  method: 'POST',
+  apiResponse: true,
 
   // the request object is optional, but if it is provided, it will be used for validation
   validations: {
@@ -29,14 +30,13 @@ export default new Action({
     },
   },
 
-  // handle(request: { message: string, level: 'info' | 'warn' | 'error' }) {
-  handle(request?: Request) {
-    if (!request)
-      return 'No request was provided.'
+  async handle(request: RequestInstance) {
+    await request.validate()
 
-    // TODO: need to validate with ts-validation
-    log[request.level](request.message)
+    const message = String(request.get('message') || '').trim()
+    const level = String(request.get('level')) as LogLevel
+    log[level](message)
 
-    return `Logged "${request.message}" at "${request.level}" level`
+    return response.json({ level, message: `Logged at ${level} level.` })
   },
 })

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.70.357",
+  "version": "0.70.362",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.70.357",
+  "version": "0.70.362",
   "description": "The complete managed Stacks application scaffold, including runtime defaults, AI guidance, editor metadata, and npm-backed project support files.",
   "author": "Chris Breuer",
   "license": "MIT",

package/resources/components/Dashboard/Marketing/CampaignDeleteDialog.stx

@@ -6,17 +6,16 @@ const record = useReactiveProp('record', null as CampaignRecord | null)
 const busy = useReactiveProp('busy', false)
 const error = useReactiveProp('error', '')
 const emit = defineEmits()
+const description = derived(() => `The persisted campaign ${record()?.name || ''} will be permanently removed. Campaigns with delivery history are retained.`)
 </script>
 
-<div :if="open()" class="flex fixed inset-0 z-50 items-center justify-center p-4 dashboard-modal-layer">
-  <button type="button" aria-label="Close delete campaign dialog" class="absolute inset-0 bg-black/45" @click="emit('close')"></button>
-  <section role="dialog" aria-modal="true" aria-labelledby="campaign-delete-title" class="relative p-6 max-w-md w-full bg-white dark:bg-neutral-800 border border-gray-200 rounded-xl dark:border-neutral-700 shadow-xl">
-    <h2 id="campaign-delete-title" class="font-semibold text-gray-900 text-lg dark:text-white">Delete campaign?</h2>
-    <p class="mt-2 text-gray-500 text-sm dark:text-neutral-400">The persisted campaign <strong>{{ record()?.name || '' }}</strong> will be permanently removed. Campaigns with delivery history are retained.</p>
-    <div :if="error()" role="alert" class="mt-4 p-3 text-red-700 text-sm dark:text-red-300 bg-red-50 dark:bg-red-950/30 border border-red-200 rounded-lg dark:border-red-900">{{ error() }}</div>
-    <div class="flex gap-2 justify-end mt-6">
-      <Button :disabled="busy()" variant="secondary" @click="emit('close')">Cancel</Button>
-      <Button :loading="busy()" variant="danger" @click="emit('confirm')">Delete campaign</Button>
-    </div>
-  </section>
-</div>
+<ConfirmDialog
+  :isOpen="open()"
+  title="Delete campaign?"
+  :description="description()"
+  confirmLabel="Delete campaign"
+  :busy="busy()"
+  :error="error()"
+  @close="emit('close')"
+  @confirm="emit('confirm')"
+/>

package/resources/components/Dashboard/Marketing/MarketingListDeleteDialog.stx

@@ -6,20 +6,20 @@ const record = useReactiveProp('record', null as MarketingListRecord | null)
 const busy = useReactiveProp('busy', false)
 const error = useReactiveProp('error', '')
 const emit = defineEmits()
+const protectedRecord = derived(() => Boolean(record()?.subscriberCount) || Boolean(record()?.campaignCount))
+const description = derived(() => protectedRecord()
+  ? `${record()?.name || 'This email list'} has membership or campaign history. Archive it instead to preserve relationships.`
+  : `${record()?.name || 'This email list'} will be permanently removed.`)
 </script>
 
-<div :if="open()" class="flex fixed inset-0 z-50 items-center justify-center p-4 dashboard-modal-layer">
-  <button type="button" aria-label="Close delete email list dialog" class="absolute inset-0 bg-black/45" @click="emit('close')"></button>
-  <section role="dialog" aria-modal="true" aria-labelledby="marketing-list-delete-title" class="relative p-6 max-w-md w-full bg-white dark:bg-neutral-800 border border-gray-200 rounded-xl dark:border-neutral-700 shadow-xl">
-    <h2 id="marketing-list-delete-title" class="font-semibold text-gray-900 text-lg dark:text-white">Delete email list?</h2>
-    <p class="mt-2 text-gray-600 text-sm dark:text-neutral-300"><span class="font-medium">{{ record()?.name }}</span> will be permanently removed.</p>
-    <p :if="record()?.subscriberCount || record()?.campaignCount" class="mt-3 p-3 text-amber-800 text-sm dark:text-amber-200 bg-amber-50 dark:bg-amber-950/30 rounded-lg">This list has membership or campaign history. Archive it instead to preserve relationships.</p>
-    <p :if="error()" role="alert" class="mt-3 p-3 text-red-700 text-sm dark:text-red-300 bg-red-50 dark:bg-red-950/30 rounded-lg">{{ error() }}</p>
-    <footer class="flex gap-2 justify-end mt-6">
-      <Button :disabled="busy()" variant="secondary" @click="emit('close')">Cancel</Button>
-      <Button :disabled="busy() || Boolean(record()?.subscriberCount) || Boolean(record()?.campaignCount)" :loading="busy()" variant="danger" @click="emit('confirm')">
-        Delete email list
-      </Button>
-    </footer>
-  </section>
-</div>
+<ConfirmDialog
+  :isOpen="open()"
+  title="Delete email list?"
+  :description="description()"
+  confirmLabel="Delete email list"
+  :busy="busy()"
+  :disabled="protectedRecord()"
+  :error="error()"
+  @close="emit('close')"
+  @confirm="emit('confirm')"
+/>

package/resources/components/Dashboard/Marketing/SocialPostDeleteDialog.stx

@@ -6,17 +6,16 @@ const record = useReactiveProp('record', null as SocialPostRecord | null)
 const busy = useReactiveProp('busy', false)
 const error = useReactiveProp('error', '')
 const emit = defineEmits()
+const description = derived(() => `The persisted ${record()?.platform || 'social'} post will be permanently removed. This does not remove a post already published on the external platform.`)
 </script>
 
-<div :if="open()" class="flex fixed inset-0 z-50 items-center justify-center p-4 dashboard-modal-layer">
-  <button type="button" aria-label="Close delete social post dialog" class="absolute inset-0 bg-black/45" @click="emit('close')"></button>
-  <section role="dialog" aria-modal="true" aria-labelledby="social-post-delete-title" class="relative p-6 max-w-md w-full bg-white dark:bg-neutral-800 border border-gray-200 rounded-xl dark:border-neutral-700 shadow-xl">
-    <h2 id="social-post-delete-title" class="font-semibold text-gray-900 text-lg dark:text-white">Delete social post?</h2>
-    <p class="mt-2 text-gray-600 text-sm dark:text-neutral-300">The persisted {{ record()?.platform }} post will be permanently removed. This does not remove a post already published on the external platform.</p>
-    <p :if="error()" role="alert" class="mt-3 p-3 text-red-700 text-sm dark:text-red-300 bg-red-50 dark:bg-red-950/30 rounded-lg">{{ error() }}</p>
-    <footer class="flex gap-2 justify-end mt-6">
-      <Button :disabled="busy()" variant="secondary" @click="emit('close')">Cancel</Button>
-      <Button :loading="busy()" variant="danger" @click="emit('confirm')">Delete social post</Button>
-    </footer>
-  </section>
-</div>
+<ConfirmDialog
+  :isOpen="open()"
+  title="Delete social post?"
+  :description="description()"
+  confirmLabel="Delete social post"
+  :busy="busy()"
+  :error="error()"
+  @close="emit('close')"
+  @confirm="emit('confirm')"
+/>