@stacksjs/defaults 0.74.33 → 0.74.34

package/app/Models/StorageItem.ts

@@ -0,0 +1,123 @@
+import { defineModel } from '@stacksjs/orm'
+import { schema } from '@stacksjs/validation'
+
+/**
+ * Dashboard metadata for one file on one disk (stacksjs/stacks#2577).
+ *
+ * Every file-manager operation shipped before this maps to a `StorageAdapter`
+ * method - `write`, `list`, `moveFile`, `changeVisibility`, `deleteFile`. A disk
+ * knows a path, some bytes, a size and an ACL. It does not know that somebody
+ * starred a file, and there is nowhere on a disk to write that down: extended
+ * attributes do not survive a copy and cost a syscall per file, and S3 object
+ * metadata is set at write time, so starring a 2 GB video would rewrite 2 GB.
+ * Both are a database row wearing a disguise, so this is the row.
+ *
+ * ## The disk is authoritative, this table is advisory
+ *
+ * That is the question #2577 asks to settle first, and it decides everything
+ * else. A bucket several systems write to changes without the dashboard's
+ * knowledge, so a table that claimed to describe its contents would be wrong
+ * within a day of being right. Instead:
+ *
+ * - The listing comes from the disk and is joined to these rows. A path with no
+ *   row is a file with no stars, which is the normal case and needs no row.
+ * - A row whose path no longer exists is an orphan and is simply not shown. The
+ *   listing pass already enumerates every path in the subtree, so it sweeps the
+ *   orphans it can prove are orphans - the ones under a prefix it just walked -
+ *   at no extra cost. Nothing walks the whole disk to garbage collect.
+ * - Renames and deletes made THROUGH the dashboard reconcile eagerly, so a
+ *   starred file keeps its star the moment it moves rather than waiting for a
+ *   sweep. A folder rename is a prefix update, because moving a folder moves
+ *   every file beneath it.
+ *
+ * The consequence worth stating: a file renamed outside the dashboard loses its
+ * metadata, because nothing connects the old path to the new one. That is not
+ * a gap to close later - a copy and a rename are indistinguishable to a bucket
+ * listing, so any reconciliation would be guessing.
+ *
+ * Keyed by `(disk, path)` rather than by a file id, because a disk has no file
+ * ids to key by.
+ *
+ * ## Tags are the existing vocabulary, reached the way the CMS reaches it
+ *
+ * #2577 asks for the existing vocabulary rather than a second one. That is the
+ * `tags` table, joined through the `taggable_models` pivot, with
+ * `taggable_type` keeping one model's attachments away from another's - which
+ * is what the dashboard's own tag manager writes and reads.
+ *
+ * `file-metadata-store.ts` queries it directly rather than declaring a
+ * `belongsToMany` here, because every operation is a set operation over a
+ * subtree and the relation would do them a row at a time. The relation would
+ * resolve correctly, though: `taggable_models.tag_id` is a `tags` id, which
+ * took stacksjs/stacks#2579 to establish - the migration comment and four
+ * queries in `@stacksjs/cms` said `taggables`, a different table belonging to a
+ * different mechanism.
+ */
+export default defineModel({
+  name: 'StorageItem',
+  table: 'storage_items',
+  primaryKey: 'id',
+  autoIncrement: true,
+
+  /**
+   * One row per file, enforced rather than assumed.
+   *
+   * Every write here is a get-or-create keyed on this pair, and a duplicate
+   * would not be a visible bug - it would be a file that is starred and also
+   * not starred, depending which row the query happened to read first.
+   */
+  indexes: [
+    {
+      name: 'storage_items_disk_path_unique',
+      columns: ['disk', 'path'],
+      unique: true,
+    },
+  ],
+
+  traits: {
+    useUuid: true,
+    useTimestamps: true,
+
+    useSearch: {
+      displayable: ['id', 'disk', 'path', 'favorite'],
+      searchable: ['path'],
+      sortable: ['path', 'createdAt'],
+      filterable: ['disk', 'favorite'],
+    },
+
+    useSeeder: { count: 0 },
+  },
+
+  attributes: {
+    disk: {
+      order: 1,
+      fillable: true,
+      // The disk NAME, not its driver: two disks can point at one bucket with
+      // different prefixes, and they are different namespaces to the dashboard.
+      validation: { rule: schema.string().required().min(1).max(64) },
+      factory: () => 'public',
+    },
+
+    path: {
+      order: 2,
+      fillable: true,
+      // Disk-relative and without a leading slash, exactly as the file manager
+      // reports it, so a lookup is an equality match rather than a normalization
+      // problem at every call site.
+      validation: { rule: schema.string().required().min(1).max(2048) },
+      factory: faker => `${faker.system.fileName()}`,
+    },
+
+    favorite: {
+      order: 3,
+      fillable: true,
+      default: false,
+      validation: { rule: schema.boolean() },
+      factory: () => false,
+    },
+  },
+
+  // Managed from the file manager, not as a top-level model row: a list of
+  // (disk, path, favorite) tuples is not a thing anybody wants to browse.
+  dashboard: { enabled: false },
+} as const)

package/app/Models/StorageItemTask.ts

@@ -0,0 +1,134 @@
+import { defineModel } from '@stacksjs/orm'
+import { schema } from '@stacksjs/validation'
+
+/**
+ * One unit of background processing for one file (stacksjs/stacks#2578).
+ *
+ * The three things #245 asked for that could not happen inside a request -
+ * image optimization, video transcode, AI tagging - share the same shape:
+ * dispatch work and show what happened to it. Transcoding is minutes, not
+ * milliseconds; a vision call is a round trip to a third party. An upload
+ * handler that waits for either is an upload handler that times out.
+ *
+ * ## Why this is not a column on `StorageItem`
+ *
+ * A file can have three of these at once and they succeed and fail
+ * independently - a video whose transcode finished and whose tagging failed is
+ * a normal state, and a single `processing` column cannot say it. The file
+ * manager aggregates these rows into the one word a UI shows; the rows are what
+ * a retry and an error message need.
+ *
+ * It is also keyed by `(disk, path, kind)` rather than by a `storage_items` id,
+ * deliberately. A `storage_items` row exists only while somebody has starred or
+ * tagged the file - it is deleted when it has nothing left to say - and most
+ * uploads are neither. Hanging a task off it would mean creating a metadata row
+ * for every upload just to have somewhere to put the task.
+ *
+ * Same reconciliation rules as `storage_items`, through the same store: a
+ * rename moves these rows, a delete forgets them, and a completed listing
+ * sweeps the ones whose file is gone.
+ */
+export default defineModel({
+  name: 'StorageItemTask',
+  table: 'storage_item_tasks',
+  primaryKey: 'id',
+  autoIncrement: true,
+
+  /**
+   * One task per kind per file.
+   *
+   * Re-running replaces the row rather than adding a second, so "what happened
+   * to the transcode" has one answer. The history of previous attempts is the
+   * queue's to keep, not this table's.
+   */
+  indexes: [
+    {
+      name: 'storage_item_tasks_disk_path_kind_unique',
+      columns: ['disk', 'path', 'kind'],
+      unique: true,
+    },
+  ],
+
+  traits: {
+    useUuid: true,
+    useTimestamps: true,
+
+    useSearch: {
+      displayable: ['id', 'disk', 'path', 'kind', 'state'],
+      searchable: ['path'],
+      sortable: ['path', 'createdAt'],
+      filterable: ['disk', 'kind', 'state'],
+    },
+
+    useSeeder: { count: 0 },
+  },
+
+  attributes: {
+    disk: {
+      order: 1,
+      fillable: true,
+      validation: { rule: schema.string().required().min(1).max(64) },
+      factory: () => 'public',
+    },
+
+    path: {
+      order: 2,
+      fillable: true,
+      validation: { rule: schema.string().required().min(1).max(2048) },
+      factory: faker => faker.system.fileName(),
+    },
+
+    kind: {
+      order: 3,
+      fillable: true,
+      // `optimize` (images), `transcode` (video), `tag` (AI). An enum rather
+      // than free text so a typo in a dispatch is a validation error instead of
+      // a task nothing will ever run.
+      validation: { rule: schema.enum(['optimize', 'transcode', 'tag']) },
+      factory: () => 'optimize',
+    },
+
+    state: {
+      order: 4,
+      fillable: true,
+      default: 'queued',
+      validation: { rule: schema.enum(['queued', 'running', 'done', 'failed']) },
+      factory: () => 'queued',
+    },
+
+    attempts: {
+      order: 5,
+      fillable: true,
+      default: 0,
+      // Counted here as well as in the queue, because the queue's count is gone
+      // once the job leaves it and this is what the dashboard reads.
+      validation: { rule: schema.number() },
+      factory: () => 0,
+    },
+
+    error: {
+      order: 6,
+      fillable: true,
+      // The failure as the worker saw it. Truncated by the writer rather than
+      // by the column, so a stack trace does not silently lose its first line.
+      validation: { rule: schema.string().max(2000) },
+      factory: () => '',
+    },
+
+    startedAt: {
+      order: 7,
+      fillable: true,
+      validation: { rule: schema.string() },
+      factory: () => '',
+    },
+
+    finishedAt: {
+      order: 8,
+      fillable: true,
+      validation: { rule: schema.string() },
+      factory: () => '',
+    },
+  },
+
+  dashboard: { enabled: false },
+} as const)

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.74.33",
+  "version": "0.74.34",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.74.33",
+  "version": "0.74.34",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.27",
-    "@stacksjs/mobile": "^0.74.33",
+    "@stacksjs/mobile": "^0.74.34",
     "@stacksjs/sanitizer": "^0.2.113",
     "ts-qr-codes": "^0.1.8"
   }

package/routes/dashboard-api.ts

@@ -247,6 +247,16 @@ route.group({ prefix: '/api/dashboard', apiResponse: true }, () => {
   guard(route.post('/files/uploads', 'Actions/Dashboard/Content/FileUploadAction'))
   guard(route.patch('/files', 'Actions/Dashboard/Content/FileRenameAction'))
   guard(route.put('/files/visibility', 'Actions/Dashboard/Content/FileVisibilityAction'))
+  // Favourites and tags are the metadata layer, not a storage operation: a disk
+  // has nowhere to record either, so both write `storage_items` and the listing
+  // above joins them back on (stacksjs/stacks#2577).
+  guard(route.put('/files/favorite', 'Actions/Dashboard/Content/FileFavoriteAction'))
+  guard(route.put('/files/tags', 'Actions/Dashboard/Content/FileTagsAction'))
+  // Re-running the background processing (stacksjs/stacks#2578). Not optional:
+  // the first version of any of these produces output somebody wants
+  // regenerated - a better ladder, a model that has improved, an optimization
+  // that ran before a preset changed.
+  guard(route.post('/files/reprocess', 'Actions/Dashboard/Content/FileReprocessAction'))
   guard(route.post('/files/duplicates', 'Actions/Dashboard/Content/FileDuplicateAction'))
   guard(route.delete('/files', 'Actions/Dashboard/Content/FileDestroyAction'))
 

package/vcs/github/workflows/buddy-bot.yml

@@ -0,0 +1,109 @@
+# The one dependency bot a generated app gets.
+#
+# The template used to ship a `renovate.json` instead, which opted every new app
+# into a bot the framework's own policy does not use (AGENTS.md: "buddy-bot
+# handles dependency updates, not renovatebot"). Running both is what
+# stacksjs/stacks#2574 is about: the same bump arrives twice, two dashboards
+# disagree, and a human picks a winner with nothing recording why.
+#
+# This is the app-shaped version of the framework's own buddy-bot workflow -
+# the three scheduled jobs and the manual trigger, without the framework's
+# release plumbing. Configure it in `config/buddy-bot.ts`.
+name: Buddy Bot
+
+on:
+  schedule:
+    # Look for updates every two hours, then refresh the dashboard 15 minutes
+    # later so it reflects the pull requests that run just opened.
+    - cron: '0 */2 * * *'
+    - cron: '15 */2 * * *'
+    # Daily: close pull requests whose update already landed, and clean up the
+    # branches left behind.
+    - cron: '0 4 * * *'
+
+  workflow_dispatch:
+    inputs:
+      job:
+        description: Which job to run
+        required: false
+        default: all
+        type: choice
+        options:
+          - all
+          - check
+          - update
+          - dashboard
+      strategy:
+        description: Update strategy
+        required: false
+        default: patch
+        type: choice
+        options:
+          - all
+          - major
+          - minor
+          - patch
+      dry_run:
+        description: Dry run (preview only)
+        required: false
+        default: false
+        type: boolean
+
+env:
+  # The built-in token is enough for commits, pull requests and issues.
+  # BUDDY_BOT_TOKEN (a PAT with `repo` and `workflow` scope) is only needed if
+  # you want buddy-bot to update workflow files themselves.
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  BUDDY_BOT_TOKEN: ${{ secrets.BUDDY_BOT_TOKEN }}
+
+permissions:
+  contents: write
+  pull-requests: write
+  issues: write
+
+# Serialize runs so a scheduled tick and a manual one cannot race on the same
+# branches. `cancel-in-progress: false` lets the running job finish rather than
+# being killed part-way through a commit.
+concurrency:
+  group: buddy-bot-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  buddy-bot:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          # Rebasing an open branch needs the history it was cut from.
+          fetch-depth: 0
+          persist-credentials: true
+
+      - name: Setup Pantry
+        uses: pantry-pm/pantry/packages/action@fa35547da630b14beda5b26a2625490864d5c963 # v0.11.60
+        with:
+          version: '0.11.60'
+          install: 'false'
+
+      - name: Install Dependencies
+        run: bun install
+
+      - name: Configure Git
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Open and refresh update pull requests
+        if: ${{ github.event.schedule == '0 */2 * * *' || (github.event_name == 'workflow_dispatch' && contains(fromJSON('["all", "update"]'), inputs.job)) }}
+        run: bunx buddy-bot update --strategy "${{ inputs.strategy || 'patch' }}" ${{ inputs.dry_run && '--dry-run' || '' }}
+
+      - name: Update the dependency dashboard
+        if: ${{ github.event.schedule == '15 */2 * * *' || (github.event_name == 'workflow_dispatch' && contains(fromJSON('["all", "dashboard"]'), inputs.job)) }}
+        run: bunx buddy-bot dashboard ${{ inputs.dry_run && '--dry-run' || '' }}
+
+      - name: Close landed pull requests and clean up branches
+        if: ${{ github.event.schedule == '0 4 * * *' || (github.event_name == 'workflow_dispatch' && contains(fromJSON('["all", "check"]'), inputs.job)) }}
+        run: bunx buddy-bot update-check ${{ inputs.dry_run && '--dry-run' || '' }}

package/vcs/github/workflows/ci.yml

@@ -30,7 +30,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Pantry
-        uses: pantry-pm/pantry/packages/action@c1417d98f5613290bc3b1f96d35086b834684659 # v0.10.47 + the socket-hang-up retry fix
+        uses: pantry-pm/pantry/packages/action@fa35547da630b14beda5b26a2625490864d5c963 # v0.11.60
         with:
           install: 'false'
 
@@ -61,7 +61,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Pantry
-        uses: pantry-pm/pantry/packages/action@c1417d98f5613290bc3b1f96d35086b834684659 # v0.10.47 + the socket-hang-up retry fix
+        uses: pantry-pm/pantry/packages/action@fa35547da630b14beda5b26a2625490864d5c963 # v0.11.60
         with:
           install: 'false'
 
@@ -95,7 +95,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Pantry
-        uses: pantry-pm/pantry/packages/action@c1417d98f5613290bc3b1f96d35086b834684659 # v0.10.47 + the socket-hang-up retry fix
+        uses: pantry-pm/pantry/packages/action@fa35547da630b14beda5b26a2625490864d5c963 # v0.11.60
         with:
           install: 'false'
 

package/vcs/github/workflows/release.yml

@@ -21,7 +21,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Pantry
-        uses: pantry-pm/pantry/packages/action@c1417d98f5613290bc3b1f96d35086b834684659 # v0.10.47 + the socket-hang-up retry fix
+        uses: pantry-pm/pantry/packages/action@fa35547da630b14beda5b26a2625490864d5c963 # v0.11.60
         with:
           install: 'false'
 

package/vcs/github/renovate.json

@@ -1,5 +0,0 @@
-{
-  "extends": [
-    "github>ow3org/renovate-config"
-  ]
-}