@stacksjs/defaults 0.72.5 → 0.72.7

package/app/Actions/Dashboard/Queue/QueueStatsAction.ts

@@ -1,6 +1,6 @@
 import { Action } from '@stacksjs/actions'
 import { FailedJob, Job } from '@stacksjs/orm'
-import { getGlobalMetrics } from '@stacksjs/queue'
+import { getGlobalMetrics, queuedJobState } from '@stacksjs/queue'
 import { dashboardOperationalError } from '../dashboard-response'
 
 interface QueueBucket {
@@ -11,9 +11,11 @@ interface QueueBucket {
   total: number
 }
 
-const isPending = (status: string) => status === 'pending' || status === 'waiting' || status === 'queued'
-const isActive = (status: string) => status === 'processing' || status === 'active'
-const isCompleted = (status: string) => status === 'completed' || status === 'done'
+// A queued job has no `status` column - `queuedJobState` in @stacksjs/queue
+// holds the rule (reserved_at means a worker has it; available_at in the
+// future means it is not eligible yet), and the queue's own health check reads
+// the same one. A row that finished is deleted by the worker, so 'completed'
+// is not a state the jobs table can be in; failures live in `failed_jobs`.
 
 export default new Action({
   name: 'QueueStatsAction',
@@ -21,19 +23,29 @@ export default new Action({
   method: 'GET',
   async handle() {
     try {
-      const [totalJobs, failedJobCount, allJobs] = await Promise.all([
+      const [totalJobs, failedJobCount, allJobs, allFailedJobs] = await Promise.all([
         Job.count(),
         FailedJob.count(),
         Job.all(),
+        FailedJob.all(),
       ])
 
       const queueMap: Record<string, QueueBucket> = {}
+
+      // Per-queue failure counts come from failed_jobs, which is where a
+      // failure actually lands. This column read `status === 'failed'` off the
+      // jobs table before, and so was always zero.
+      const failedByQueue = new Map<string, number>()
+      for (const f of allFailedJobs) {
+        const queueName = String(f.get('queue') || 'default')
+        failedByQueue.set(queueName, (failedByQueue.get(queueName) ?? 0) + 1)
+      }
       let active = 0
-      let completed = 0
+      const completed = 0
 
       for (const j of allJobs) {
         const queueName = String(j.get('queue') || 'default')
-        const status = String(j.get('status') || 'pending')
+        const status = queuedJobState({ reserved_at: j.get('reserved_at'), available_at: j.get('available_at') })
 
         if (!queueMap[queueName]) {
           queueMap[queueName] = { pending: 0, active: 0, completed: 0, failed: 0, total: 0 }
@@ -41,16 +53,13 @@ export default new Action({
         const bucket = queueMap[queueName]
         bucket.total++
 
-        if (isPending(status)) bucket.pending++
-        else if (isActive(status)) {
+        if (status === 'processing') {
           bucket.active++
           active++
         }
-        else if (isCompleted(status)) {
-          bucket.completed++
-          completed++
+        else {
+          bucket.pending++
         }
-        else if (status === 'failed') bucket.failed++
       }
 
       const queues = Object.entries(queueMap).map(([name, data]) => ({
@@ -59,7 +68,7 @@ export default new Action({
         pending: data.pending,
         active: data.active,
         completed: data.completed,
-        failed: data.failed,
+        failed: failedByQueue.get(name) ?? data.failed,
         total: data.total,
       }))
 

package/app/Actions/Dashboard/Search/GlobalSearchAction.ts

@@ -131,7 +131,7 @@ async function loadSearchableModels(): Promise<SearchableModel[]> {
       const search = definition.traits?.useSearch
       if (!search || typeof search !== 'object' || !Array.isArray(search.searchable)) continue
 
-      const fields = search.searchable
+      const fields: string[] = (search.searchable as unknown[])
         .map((field: unknown) => snakeCase(String(field)))
         .filter((field: string) => isSafeIdentifier(field) && !HIDDEN_FIELDS.has(field))
       const table = String(definition.table || pluralize(snakeCase(name)))

package/app/Actions/Dashboard/Settings/mail-settings.ts

@@ -51,11 +51,19 @@ export interface MailSettingsState {
   }
 }
 
+/**
+ * Whatever the settings form posted.
+ *
+ * Every field is optional AND `unknown`: this is the raw request body, and
+ * `updateMailSettings` runs each value through `stringValue` and validates it.
+ * Declaring the four core fields as required meant `request.all()` - the only
+ * thing any caller has - did not satisfy the type it was written for.
+ */
 export interface MailSettingsInput {
-  revision: unknown
-  driver: unknown
-  fromName: unknown
-  fromAddress: unknown
+  revision?: unknown
+  driver?: unknown
+  fromName?: unknown
+  fromAddress?: unknown
   smtp?: Record<string, unknown>
   ses?: Record<string, unknown>
   sendgrid?: Record<string, unknown>

package/app/Actions/Dashboard/Source/source-inventory.ts

@@ -50,8 +50,12 @@ export function parseCommandSource(
   modifiedAt = '',
 ): SourceInventoryItem {
   const command = source.match(/\.command\(\s*['"`]([^'"`]+)['"`]\s*(?:,\s*['"`]([^'"`]+)['"`])?/)
-  const sourceAliases = [...source.matchAll(/\.alias\(\s*['"`]([^'"`]+)['"`]\s*\)/g)].map(match => match[1])
-  const options = [...source.matchAll(/\.option\(\s*['"`]([^'"`]+)['"`]/g)].map(match => match[1])
+  const sourceAliases = [...source.matchAll(/\.alias\(\s*['"`]([^'"`]+)['"`]\s*\)/g)]
+    .map(match => match[1])
+    .filter((alias): alias is string => alias !== undefined)
+  const options = [...source.matchAll(/\.option\(\s*['"`]([^'"`]+)['"`]/g)]
+    .map(match => match[1])
+    .filter((option): option is string => option !== undefined)
 
   return {
     name: command?.[1] || registeredSignature,

package/app/Actions/Dashboard/dashboard-response.ts

@@ -1,10 +1,11 @@
+import type { ResponseStatus } from '@stacksjs/bun-router'
 import { response } from '@stacksjs/router'
 
 export function dashboardOperationalError(
   error: unknown,
   message: string,
   action: string,
-  status = 503,
+  status: ResponseStatus = 503,
 ): Response {
   console.error(`[dashboard/api] ${action} failed:`, error)
   return response.json({ message }, status)

package/app/Actions/HealthAction.ts

@@ -1,7 +1,7 @@
 // Health check action with detailed service status
 // This overrides the default framework health check
 
-import { route } from '@stacksjs/router'
+import { response, route } from '@stacksjs/router'
 
 export default {
   name: 'Health',
@@ -70,13 +70,17 @@ async function getServiceHealth() {
 
   // Queue Health
   try {
-    const { Job } = await import('@stacksjs/orm')
+    // The queue package owns what "healthy" means for a queue - depth
+    // thresholds, stuck workers, jobs whose reserve has gone stale - and its
+    // own worker health endpoint reads the same function. This used to count
+    // rows where `status = 'pending'`, a column the jobs table does not have.
+    const { checkQueueHealth } = await import('@stacksjs/queue')
     const queueStart = Date.now()
-    const pendingJobs = await Job.where('status', 'pending').count()
+    const queueHealth = await checkQueueHealth()
     const queueLatency = Date.now() - queueStart
     services.push({
       name: 'Queue',
-      status: pendingJobs < 100 ? 'healthy' : pendingJobs < 1000 ? 'degraded' : 'critical',
+      status: queueHealth.status === 'unhealthy' ? 'critical' : queueHealth.status,
       latency: `${queueLatency}ms`,
       uptime: '99.9%',
     })
@@ -104,9 +108,10 @@ async function getServiceHealth() {
 // Also register as a route for redundancy
 route.get('/health', async () => {
   const services = await getServiceHealth()
-  return {
+  // A route handler returns a Response; a bare object is not one.
+  return response.json({
     status: 'ok',
     timestamp: Date.now(),
     services,
-  }
+  })
 })

package/app/Actions/Locale/SetLocaleAction.ts

@@ -45,7 +45,9 @@ export default new Action({
 
     return createLocaleSwitchResponse(request as unknown as Request, String(request.param('locale') ?? ''), {
       locales,
-      defaultLocale: app?.locale ?? locales[0],
+      // `locales[0]` is `string | undefined` under noUncheckedIndexedAccess,
+      // and this list is never empty by construction - but say so.
+      defaultLocale: app?.locale ?? locales[0] ?? 'en',
     })
   },
 })

package/app/Actions/Monitoring/ErrorShowAction.ts

@@ -7,7 +7,12 @@ export default new Action({
   description: 'Fetch a single error by ID',
   method: 'GET',
   async handle(request: RequestInstance) {
+    // `getParamAsInt` returns null for a param that is not an integer, which
+    // is a bad request rather than a lookup for id `null`.
     const id = request.getParamAsInt('id')
+    if (id === null)
+      return response.json({ error: 'A numeric error id is required' }, 422)
+
     const result = await errors.fetchById(id)
 
     if (!result) {

package/app/Actions/Payment/CreatePaymentIntentAction.ts

@@ -21,7 +21,9 @@ export default new Action({
     }
 
     const paymentIntent = await user?.paymentIntent({
-      amount: Number(product.unit_price),
+      // The Product model's column is `price`; `unit_price` has never been
+      // one, so this read was undefined and the intent was created for NaN.
+      amount: Number(product.get('price')),
       currency: 'usd',
       payment_method_types: ['card'],
     })

package/app/Actions/SendWelcomeEmail.ts

@@ -7,7 +7,9 @@ export interface WelcomeEmailParams {
   name?: string
 }
 
-export default new Action({
+// Invoked by the event system with the `user:registered` payload rather than
+// by the router with a request - see app/Events.ts.
+export default new Action<string, undefined, '', WelcomeEmailParams>({
   name: 'SendWelcomeEmail',
   description: 'Sends a welcome email to newly registered users',
 

package/app/Actions/Teams/team-response.ts

@@ -1,3 +1,4 @@
+import type { ResponseStatus } from '@stacksjs/bun-router'
 import { response } from '@stacksjs/router'
 
 export class TeamStateConflictError extends Error {
@@ -11,7 +12,7 @@ export function teamOperationalError(
   error: unknown,
   message: string,
   action: string,
-  status = 503,
+  status: ResponseStatus = 503,
 ): Response {
   console.error(`[teams/api] ${action} failed:`, error)
   return response.json({ message }, status)

package/app/Actions/TestErrorAction.ts

@@ -5,7 +5,7 @@
  * Append ?type=<scenario> to trigger a specific exception.
  */
 
-import type { EnhancedRequest } from 'bun-router'
+import type { EnhancedRequest } from '@stacksjs/bun-router'
 import { dirname, join } from 'node:path'
 import process from 'node:process'
 import { fileURLToPath } from 'node:url'

package/app/Jobs/PruneModelsJob.ts

@@ -33,7 +33,7 @@ export default class PruneModelsJob {
     try {
       log.info('Running model pruning job')
 
-      const { prunable } = await import('../../orm/src/utils/prunable')
+      const { prunable } = await import('@stacksjs/orm')
 
       const results: Array<{ table: string, pruned: number }> = []
       let total = 0

package/app/Jobs/PruneQueryLogsJob.ts

@@ -37,7 +37,9 @@ export default class PruneQueryLogsJob {
       }
 
       // Prune old query logs
-      const result = await QueryController.pruneQueryLogs()
+      // `pruneQueryLogs` is an instance method - the routes reach it through
+      // 'Controllers/QueryController@method', which instantiates for them.
+      const result = await new QueryController().pruneQueryLogs()
 
       log.info(`Successfully pruned ${result.pruned} query logs older than ${result.retentionDays} days`)
 

package/app/Mail/OrderConfirmation.ts

@@ -1,5 +1,5 @@
 import { config } from '@stacksjs/config'
-import { mail, template } from '@stacksjs/email'
+import { escapeHtml, mail, safe, template } from '@stacksjs/email'
 
 export interface OrderConfirmationItem {
   name: string
@@ -38,7 +38,10 @@ export async function sendOrderConfirmation(options: OrderConfirmationOptions):
       orderId: options.orderId,
       orderUrl: options.orderUrl,
       customerName: options.customerName || 'there',
-      items: options.items,
+      // A template variable is a scalar - an array would be interpolated as
+      // "[object Object],[object Object]". The rows are rendered here and
+      // marked safe, with every value the customer supplied escaped first.
+      itemRows: safe(renderItemRows(options.items)),
       subtotal: options.subtotal,
       shipping: options.shipping,
       total: options.total,
@@ -57,4 +60,17 @@ export async function sendOrderConfirmation(options: OrderConfirmationOptions):
   })
 }
 
+function formatMoney(amount: number): string {
+  return (amount / 100).toFixed(2)
+}
+
+function renderItemRows(items: OrderConfirmationItem[]): string {
+  return items
+    .map(item => `<tr>
+      <td style="padding: 12px 0; color: #d4d4d4; font-size: 15px;">${escapeHtml(item.name)} &times; ${Number(item.qty) || 0}</td>
+      <td style="padding: 12px 0; color: #ececec; font-size: 15px; text-align: right;">${formatMoney(Number(item.lineTotal) || 0)}</td>
+    </tr>`)
+    .join('\n')
+}
+
 export default sendOrderConfirmation

package/app/Middleware/Abilities.ts

@@ -36,7 +36,9 @@ export default new Middleware({
       throw new HttpError(401, 'Unauthenticated.')
     }
 
-    const tokenAbilities: string[] = token.abilities || []
+    // `_currentAccessToken` is declared `unknown` (the token row is
+    // project-defined), so name the one field this middleware reads.
+    const tokenAbilities: string[] = (token as { abilities?: string[] }).abilities || []
 
     // Wildcard grants all permissions
     if (tokenAbilities.includes('*')) {

package/app/Middleware/Can.ts

@@ -1,4 +1,4 @@
-import { AuthorizationException, authorize } from '@stacksjs/auth'
+import { authenticatedUser, AuthorizationException, authorize } from '@stacksjs/auth'
 import { HttpError } from '@stacksjs/error-handling'
 import { Middleware, resolveRouteModel, setRouteModelFallback } from '@stacksjs/router'
 
@@ -76,7 +76,7 @@ export default new Middleware({
     }
 
     // Get the authenticated user
-    const user = request.user || request._user || null
+    const user = await authenticatedUser(request)
 
     // Prepare arguments for the gate check
     const args: any[] = []
@@ -109,7 +109,7 @@ export default new Middleware({
 
     // Perform the authorization check
     try {
-      await authorize(ability, user, ...args)
+      await authorize(ability, user ?? null, ...args)
     }
     catch (error) {
       if (error instanceof AuthorizationException) {

package/app/Middleware/Compress.ts

@@ -180,7 +180,9 @@ export async function applyCompression(request: Request, response: Response): Pr
     newHeaders.set('Vary', 'Accept-Encoding')
   }
 
-  return new Response(compressed, {
+  // Node's Buffer satisfies BodyInit at runtime but not in the DOM lib's
+  // types; the underlying bytes are what Response wants either way.
+  return new Response(new Uint8Array(compressed), {
     status: response.status,
     statusText: response.statusText,
     headers: newHeaders,

package/app/Middleware/Csrf.ts

@@ -1,6 +1,7 @@
 import { randomBytes, timingSafeEqual } from 'node:crypto'
 import { Buffer } from 'node:buffer'
 import { HttpError } from '@stacksjs/error-handling'
+import type { EnhancedRequest } from '@stacksjs/bun-router'
 import { Middleware } from '@stacksjs/router'
 
 /**
@@ -218,7 +219,7 @@ const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS'])
  * the router, such as the local dashboard config editor, can enforce the same
  * double-submit and bearer-token rules without duplicating security logic.
  */
-export async function validateCsrfRequest(request: Request): Promise<void> {
+export async function validateCsrfRequest(request: Request | EnhancedRequest): Promise<void> {
   const method = request.method.toUpperCase()
 
   // Safe methods don't mutate state — no token check needed.
@@ -236,15 +237,20 @@ export async function validateCsrfRequest(request: Request): Promise<void> {
   // (webhooks, third-party callbacks). The router stamps a hint on
   // the request when it resolves such an action; if that hint is
   // present, skip enforcement.
-  if (request._skipCsrf === true) return
+  const enhanced = request as EnhancedRequest
+  if (enhanced._skipCsrf === true) return
 
   // Look up the submitted token. Header is the SPA path; body field
   // is the traditional form-post path. We accept either.
   const headerToken = request.headers.get(CSRF_HEADER_NAME)
     || request.headers.get('X-CSRF-Token')
     || request.headers.get('X-Csrf-Token')
-  const body = request.jsonBody || request.formBody || {}
-  const bodyToken: string | undefined = body?._token ?? body?.csrf_token
+  const body = enhanced.jsonBody || enhanced.formBody || {}
+  // A parsed body is `unknown`-valued: the token is validated as a string
+  // two lines down, so read it as one rather than asserting it is one.
+  const rawBodyToken = (body as Record<string, unknown> | undefined)?._token
+    ?? (body as Record<string, unknown> | undefined)?.csrf_token
+  const bodyToken: string | undefined = typeof rawBodyToken === 'string' ? rawBodyToken : undefined
 
   const submitted = (typeof headerToken === 'string' && headerToken)
     || (typeof bodyToken === 'string' && bodyToken)

package/app/Middleware/EnsureEmailIsVerified.ts

@@ -1,3 +1,4 @@
+import { authenticatedUser } from '@stacksjs/auth'
 import { HttpError } from '@stacksjs/error-handling'
 import { Middleware } from '@stacksjs/router'
 
@@ -15,7 +16,7 @@ export default new Middleware({
   priority: 4,
 
   async handle(request) {
-    const user = request.user || request._user || null
+    const user = await authenticatedUser(request)
 
     if (!user) {
       throw new HttpError(401, 'Unauthenticated.')

package/app/Middleware/Permission.ts

@@ -1,3 +1,4 @@
+import { authenticatedUser } from '@stacksjs/auth'
 import { HttpError } from '@stacksjs/error-handling'
 import { Middleware } from '@stacksjs/router'
 
@@ -25,7 +26,7 @@ export default new Middleware({
 
     if (requiredPermissions.length === 0) return
 
-    const user = request.user || request._user || null
+    const user = await authenticatedUser(request)
 
     if (!user) {
       throw new HttpError(401, 'Unauthenticated.')

package/app/Middleware/Role.ts

@@ -1,3 +1,4 @@
+import { authenticatedUser } from '@stacksjs/auth'
 import { HttpError } from '@stacksjs/error-handling'
 import { Middleware } from '@stacksjs/router'
 
@@ -24,7 +25,7 @@ export default new Middleware({
 
     if (requiredRoles.length === 0) return
 
-    const user = request.user || request._user || null
+    const user = await authenticatedUser(request)
 
     if (!user) {
       throw new HttpError(401, 'Unauthenticated.')

package/app/Middleware/Team.ts

@@ -1,3 +1,4 @@
+import { authenticatedUser } from '@stacksjs/auth'
 import { HttpError } from '@stacksjs/error-handling'
 import { Middleware } from '@stacksjs/router'
 
@@ -16,7 +17,7 @@ export default new Middleware({
   priority: 3,
 
   async handle(request) {
-    const user = request.user || request._user || request._authenticatedUser
+    const user = await authenticatedUser(request)
 
     if (!user) {
       throw new HttpError(401, 'Unauthenticated.')

package/app/Middleware/Throttle.ts

@@ -47,7 +47,7 @@ export default new Middleware({
     let limiter = limiterCache.get(params)
     if (!limiter) {
       try {
-        const config = parseThrottleString(params)
+        const config = parseThrottleString(params as Parameters<typeof parseThrottleString>[0])
         limiter = createRateLimitMiddleware(config, `throttle:${params}`)
         limiterCache.set(params, limiter)
       }

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.72.5",
+  "version": "0.72.7",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.72.5",
+  "version": "0.72.7",
   "description": "The complete managed Stacks application scaffold, including runtime defaults, AI guidance, editor metadata, and npm-backed project support files.",
   "author": "Chris Breuer",
   "license": "MIT",
@@ -46,7 +46,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.27",
-    "@stacksjs/mobile": "^0.72.5",
+    "@stacksjs/mobile": "^0.72.7",
     "@stacksjs/sanitizer": "^0.2.113"
   },
   "scripts": {

package/resources/functions/dashboard/data.ts

@@ -342,7 +342,7 @@ export function groupByDay(
     const d = new Date(raw)
     if (Number.isNaN(d.getTime())) continue
     const k = d.toISOString().slice(0, 10)
-    if (k in buckets) buckets[k]++
+    if (k in buckets) buckets[k] = (buckets[k] ?? 0) + 1
   }
   return Object.entries(buckets).map(([date, count]) => ({ date, count }))
 }
@@ -372,7 +372,7 @@ export function sumByDay(
     if (Number.isNaN(d.getTime())) continue
     const k = d.toISOString().slice(0, 10)
     if (!(k in buckets)) continue
-    buckets[k] += Number(safeGet(r, valueKey, 0)) || 0
+    buckets[k] = (buckets[k] ?? 0) + (Number(safeGet(r, valueKey, 0)) || 0)
   }
   return Object.entries(buckets).map(([date, total]) => ({ date, total }))
 }