@stacksjs/defaults 0.75.482 → 0.75.484

package/ai/skills/stacks-actions/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: stacks-actions
-description: Use when working with Stacks server actions - creating actions in app/Actions/, auto-generated API actions from the useApi model trait, the 676 default framework actions (auth, dashboard, commerce, content, deployment, jobs), action request/response handling, or action registration. Covers @stacksjs/actions and storage/framework/defaults/app/Actions/.
+description: Use when working with Stacks server actions - creating actions in app/Actions/, auto-generated API actions from the useApi model trait, the 683 default framework actions (auth, dashboard, commerce, content, deployment, jobs), action request/response handling, or action registration. Covers @stacksjs/actions and storage/framework/defaults/app/Actions/.
 license: MIT
 compatibility: Bun >= 1.3.0, TypeScript
 allowed-tools: Read Edit Write Bash Grep Glob

package/ai/skills/stacks-native/CATALOG.md

@@ -11,7 +11,7 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | Package | Task guidance | Source entry | Retained tests |
 |---|---|---|---|
 | `@stacksjs/action-runner` | [`stacks-actions`](../stacks-actions/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/action-runner/src/index.ts) | 1 |
-| `@stacksjs/actions` | [`stacks-actions`](../stacks-actions/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/index.ts) | 102 |
+| `@stacksjs/actions` | [`stacks-actions`](../stacks-actions/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/index.ts) | 103 |
 | `@stacksjs/ai` | [`stacks-ai`](../stacks-ai/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/index.ts) | 21 |
 | `@stacksjs/alias` | [`stacks-alias`](../stacks-alias/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/alias/src/index.ts) | 3 |
 | `@stacksjs/analytics` | [`stacks-analytics`](../stacks-analytics/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/analytics/src/index.ts) | 7 |
@@ -71,7 +71,7 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/payments` | [`stacks-payments`](../stacks-payments/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/payments/src/index.ts) | 39 |
 | `@stacksjs/push` | [`stacks-push`](../stacks-push/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/push/src/index.ts) | 8 |
 | `@stacksjs/query-builder` | [`stacks-query-builder`](../stacks-query-builder/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/query-builder/src/index.ts) | 7 |
-| `@stacksjs/queue` | [`stacks-queue`](../stacks-queue/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/queue/src/index.ts) | 55 |
+| `@stacksjs/queue` | [`stacks-queue`](../stacks-queue/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/queue/src/index.ts) | 56 |
 | `@stacksjs/realtime` | [`stacks-realtime`](../stacks-realtime/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/realtime/src/index.ts) | 13 |
 | `@stacksjs/registry` | [`stacks-registry`](../stacks-registry/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/registry/src/index.ts) | 1 |
 | `@stacksjs/repl` | [`stacks-repl`](../stacks-repl/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/repl/src/index.ts) | 2 |
@@ -119,7 +119,7 @@ Declared runtime exports: `BlogAdminError`, `DEFAULT_IOS_DEPENDENCIES`, `DEFAULT
 
 Local source modules: [src/action.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/action.ts), [src/add.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/add.ts), [src/blog-admin.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/blog-admin.ts), [src/build/ios-toolchain.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/build/ios-toolchain.ts), [src/build/macos-native.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/build/macos-native.ts), [src/commit.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/commit.ts), [src/dev/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/dev/index.ts), [src/discover-packages.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/discover-packages.ts), [src/generate/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/generate/index.ts), [src/github-release.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/github-release.ts), [src/helpers/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/helpers/index.ts), [src/library/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/library/index.ts), [src/lint/lint.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/lint/lint.ts), [src/lint/stx-gate.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/lint/stx-gate.ts), [src/make-command.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/make-command.ts), [src/make-job.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/make-job.ts), [src/make-policy.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/make-policy.ts), [src/make-resource.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/make-resource.ts), [src/make.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/make.ts), [src/publication-preflight.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/publication-preflight.ts), [src/release-evidence.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/release-evidence.ts), [src/reviewos-evidence.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/reviewos-evidence.ts), [src/scaffold-crud.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/scaffold-crud.ts), [src/setup/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/setup/index.ts), [src/stacks.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/stacks.ts), [src/stx-source.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/stx-source.ts), [src/upgrade/package-project.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/upgrade/package-project.ts), [src/upgrade/route-actions.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/upgrade/route-actions.ts).
 
-Evidence directory: [102 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [103 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/ai
 
@@ -699,7 +699,7 @@ Declared runtime exports: `Batch`, `DispatchedBatch`, `FailedJobNotifier`, `JOB_
 
 Local source modules: [src/action-runner.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/queue/src/action-runner.ts), [src/action.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/queue/src/action.ts), [src/batch.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/queue/src/batch.ts), [src/bun-queue.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/queue/src/bun-queue.ts), [src/circuit-breaker.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/queue/src/circuit-breaker.ts), [src/dead-letter.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/queue/src/dead-letter.ts), [src/discovery.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/queue/src/discovery.ts), [src/driver.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/queue/src/driver.ts), [src/drivers/redis.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/queue/src/drivers/redis.ts), [src/envelope.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/queue/src/envelope.ts), [src/events.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/queue/src/events.ts), [src/health.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/queue/src/health.ts), [src/idempotency.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/queue/src/idempotency.ts), [src/job-progress.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/queue/src/job-progress.ts), [src/job.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/queue/src/job.ts), [src/notifications.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/queue/src/notifications.ts), [src/poison.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/queue/src/poison.ts), [src/scheduler.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/queue/src/scheduler.ts), [src/testing.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/queue/src/testing.ts), [src/worker.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/queue/src/worker.ts).
 
-Evidence directory: [55 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/queue/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [56 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/queue/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/realtime
 

package/ai/skills/stacks-queue/DURABLE-WORKFLOWS.md

@@ -119,3 +119,15 @@ state for all workers in a fleet.
 Evidence: `tests/dlq-quarantine-wiring.test.ts`, `failure-path-correctness.test.ts`,
 `worker-declared-retries.test.ts`, `graceful-shutdown-wiring.test.ts` and
 `worker-queues.test.ts`. Driver status comes from `core/config/src/capabilities.ts`.
+
+## Graceful database-worker shutdown
+
+`stopProcessor` drains database batches from the start of their reservation through
+handler completion. A reservation whose SQL response arrives during shutdown still
+finishes its committed job within the existing grace window. A selection returning
+after shutdown does not start a new reservation. An exhausted grace window still
+falls back to the normal stale-reservation recovery; it does not clear another
+worker's reservation or change attempts or retry deadlines.
+
+Evidence: `tests/worker-reservation-drain.test.ts` blocks real SQLite/PostgreSQL
+selection and committed reservation responses while shutdown begins.

package/app/Actions/Dashboard/Content/CommentIndexAction.ts

@@ -1,97 +1,17 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions/runtime'
-import { db } from '@stacksjs/database/runtime'
+import { response } from '@stacksjs/router'
 import { dashboardOperationalError } from '../dashboard-response'
-import type { CommentableRow, DashboardComment } from './comment-input'
-import { commentableRecord, isMissingTableError, isSafeTableName, newestFirst, normalizeCommentStatus } from './comment-input'
-
-interface CommentRow {
-  id: number
-  author_name: string | null
-  author_email: string | null
-  content: string | null
-  body: string | null
-  post_title: string | null
-  status: string | null
-  is_approved: number | null
-  created_at: string | null
-  updated_at: string | null
-}
-
-/**
- * What each trait comment was left on, keyed `type:id`: the owner's title, else
- * its name, else `posts #3`. `commentables_type` is the owner's table, so this
- * is a join done per type, because one SQL join cannot follow a polymorphic
- * key. A type that is not a safe identifier, has no such table, or has neither
- * column falls back to the plain label rather than failing the whole list.
- */
-async function ownerLabels(rows: CommentableRow[]): Promise<Map<string, string>> {
-  const labels = new Map<string, string>()
-  const idsByType = new Map<string, number[]>()
-
-  for (const row of rows) {
-    const type = String(row.commentables_type || '')
-    labels.set(`${type}:${row.commentables_id}`, `${type} #${row.commentables_id}`)
-    if (isSafeTableName(type))
-      idsByType.set(type, [...(idsByType.get(type) ?? []), Number(row.commentables_id)])
-  }
-
-  for (const [type, ids] of idsByType) {
-    for (const column of ['title', 'name']) {
-      try {
-        const owners = await (db as any)
-          .selectFrom(type)
-          .select(['id', column])
-          .whereIn('id', [...new Set(ids)])
-          .execute() as Array<Record<string, unknown>>
-
-        for (const owner of owners) {
-          const label = String(owner[column] ?? '').trim()
-          if (label)
-            labels.set(`${type}:${owner.id}`, label)
-        }
-        break
-      }
-      catch {
-        // No such table or no such column: try the next column, then keep
-        // the fallback label.
-      }
-    }
-  }
-
-  return labels
-}
-
-/**
- * Comments the `commentable` trait wrote. An app that has never migrated the
- * trait tables has none, which is not an error; any other failure is.
- */
-async function commentableComments(): Promise<DashboardComment[]> {
-  let rows: CommentableRow[]
-  try {
-    rows = await db
-      .selectFrom('commentables')
-      .selectAll()
-      .orderBy('created_at', 'desc')
-      .execute() as unknown as CommentableRow[]
-  }
-  catch (error) {
-    if (isMissingTableError(error))
-      return []
-    throw error
-  }
-
-  const labels = await ownerLabels(rows)
-
-  return rows.map(row => commentableRecord(row, labels.get(`${row.commentables_type}:${row.commentables_id}`) ?? ''))
-}
+import { parseCommentListQuery, readCommentPage } from './comment-list'
 
 /**
  * `GET /api/dashboard/comments` — backs `views/dashboard/content/comments/index.stx`.
  *
- * Lists both places a comment can live, newest first: the model-backed
- * `comments` table and the polymorphic `commentables` table the `commentable`
- * trait writes. Their ids overlap, so every record carries its `source` and a
- * `key` unique across both, and the moderation writes take `source` back.
+ * Lists both places a comment can live, newest first, one page at a time:
+ * the model-backed `comments` table and the polymorphic `commentables` table
+ * the `commentable` trait writes (`comment-list.ts`, stacksjs/stacks#3193).
+ * Their ids overlap, so every record carries its `source` and a `key` unique
+ * across both, and the moderation writes take `source` back.
  *
  * Reads the `comments` table via `db`. The previous `Comment.orderBy(...)` call
  * threw on every request (the ORM model exposes no query methods) and the catch
@@ -107,31 +27,21 @@ export default new Action({
   description: 'Returns CMS comments for the dashboard.',
   method: 'GET',
   apiResponse: true,
-  async handle() {
-    try {
-      const rows = await db
-        .selectFrom('comments')
-        .selectAll()
-        .orderBy('created_at', 'desc')
-        .execute() as unknown as CommentRow[]
-
-      const legacy: DashboardComment[] = rows.map(row => ({
-        key: `comments:${row.id}`,
-        source: 'comments',
-        id: Number(row.id),
-        author_name: String(row.author_name || ''),
-        author_email: String(row.author_email || ''),
-        content: String(row.content || row.body || ''),
-        post_title: String(row.post_title || ''),
-        status: normalizeCommentStatus(row.status),
-        is_approved: Boolean(row.is_approved),
-        created_at: row.created_at || null,
-        updated_at: row.updated_at || null,
-      }))
-
-      const comments = [...legacy, ...await commentableComments()].sort(newestFirst)
+  async handle(request: RequestInstance) {
+    const query = parseCommentListQuery(key => request.get<unknown>(key, ''))
+    if ('error' in query)
+      return response.json({ message: query.error }, 422)
 
-      return { comments }
+    try {
+      const result = await readCommentPage(query)
+
+      return {
+        comments: result.rows,
+        total: result.total,
+        page: result.page,
+        perPage: query.perPage,
+        counts: result.counts,
+      }
     }
     catch (error) {
       return dashboardOperationalError(error, 'Comments could not be loaded.', 'CommentIndexAction')

package/app/Actions/Dashboard/Content/PageIndexAction.ts

@@ -1,44 +1,36 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions/runtime'
-import { db } from '@stacksjs/database/runtime'
+import { response } from '@stacksjs/router'
 import { dashboardOperationalError } from '../dashboard-response'
-
-interface PageRow {
-  id: number
-  title: string | null
-  template: string | null
-  views: number | null
-  conversions: number | null
-  published_at: string | null
-  author_id: number | null
-  created_at: string | null
-  updated_at: string | null
-}
+import { parsePageListQuery, readPageListPage } from './page-list'
 
 /**
  * `GET /api/dashboard/pages` — backs `views/dashboard/content/pages/index.stx`.
  *
- * Reads the `pages` table via `db`. The previous `Page.orderBy(...)` call threw
- * on every request (the ORM model exposes no query methods) and the catch
- * turned that into an empty list, so a broken read looked like a CMS with no
+ * Reads one page of the `pages` table, searched, sorted and counted by the
+ * database (`page-list.ts`, stacksjs/stacks#3192). The previous
+ * `Page.orderBy(...)` call threw on every request (the ORM model exposes no
+ * query methods) and the catch turned that into an empty list, so a broken read looked like a CMS with no
  * pages. It also mapped `slug` and `status`, which this table does not have —
  * a page is a title, a template, and its traffic counters.
  *
- * Ordered newest-first because the page's Newest tile reads the first row.
+ * Newest first by default. The Newest tile reads `newestTitle`, which is the
+ * newest page whatever the search or sort.
  */
 export default new Action({
   name: 'PageIndexAction',
   description: 'Returns CMS pages for the dashboard.',
   method: 'GET',
   apiResponse: true,
-  async handle() {
+  async handle(request: RequestInstance) {
+    const query = parsePageListQuery(key => request.get<unknown>(key, ''))
+    if ('error' in query)
+      return response.json({ message: query.error }, 422)
+
     try {
-      const rows = await db
-        .selectFrom('pages')
-        .selectAll()
-        .orderBy('created_at', 'desc')
-        .execute() as unknown as PageRow[]
+      const result = await readPageListPage(query)
 
-      const pages = rows.map(row => ({
+      const pages = result.rows.map(row => ({
         id: Number(row.id),
         title: String(row.title || ''),
         template: String(row.template || 'default'),
@@ -50,7 +42,16 @@ export default new Action({
         updated_at: row.updated_at || null,
       }))
 
-      return { pages }
+      return {
+        pages,
+        total: result.total,
+        page: result.page,
+        perPage: query.perPage,
+        allCount: result.allCount,
+        totalViews: result.totalViews,
+        totalConversions: result.totalConversions,
+        newestTitle: result.newestTitle,
+      }
     }
     catch (error) {
       return dashboardOperationalError(error, 'Pages could not be loaded.', 'PageIndexAction')

package/app/Actions/Dashboard/Content/PostIndexAction.ts

@@ -1,21 +1,9 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions/runtime'
 import { db } from '@stacksjs/database/runtime'
+import { response } from '@stacksjs/router'
 import { dashboardOperationalError } from '../dashboard-response'
-
-interface PostRow {
-  id: number
-  title: string
-  excerpt: string | null
-  content: string | null
-  poster: string | null
-  status: string | null
-  views: number | null
-  published_at: string | null
-  created_at: string | null
-  updated_at: string | null
-  author_id: number | null
-  is_featured: number | null
-}
+import { parsePostListQuery, readPostPage } from './post-list'
 
 interface PivotRow {
   relatedId: number
@@ -44,20 +32,14 @@ function normalizeStatus(status: string | null): string {
   return value === 'published' || value === 'archived' ? value : 'draft'
 }
 
-function counts(posts: Array<{ status: string }>) {
-  return {
-    publishedCount: posts.filter(p => p.status === 'published').length,
-    draftCount: posts.filter(p => p.status === 'draft').length,
-    archivedCount: posts.filter(p => p.status === 'archived').length,
-  }
-}
-
 /**
  * `GET /api/dashboard/posts` — backs `views/dashboard/content/posts/index.stx`.
  *
- * Uses one bounded query per persisted dataset and groups pivot ids in maps,
- * avoiding relation N+1 queries. Writes use the same model-declared pivots on
- * one native database transaction.
+ * Reads one page of posts, searched, filtered, sorted and counted by the
+ * database (`post-list.ts`, stacksjs/stacks#3191), and the category and tag
+ * links for that page only, grouped in maps to avoid relation N+1 queries.
+ * Writes use the same model-declared pivots on one native database
+ * transaction.
  *
  * There is deliberately no mock-data fallback. This action used to catch every
  * error and serve placeholder rows, which made a page that was 404ing against
@@ -69,19 +51,19 @@ export default new Action({
   description: 'Returns CMS posts for the dashboard.',
   method: 'GET',
   apiResponse: true,
-  async handle() {
+  async handle(request: RequestInstance) {
+    const query = parsePostListQuery(key => request.get<unknown>(key, ''))
+    if ('error' in query)
+      return response.json({ message: query.error }, 422)
+
     try {
-      const rows = await db
-        .selectFrom('posts')
-        .selectAll()
-        .orderBy('created_at', 'desc')
-        .execute() as unknown as PostRow[]
+      const page = await readPostPage(query)
 
-      const posts = rows.map(row => ({
+      const posts = page.rows.map(row => ({
         id: Number(row.id),
         title: String(row.title || ''),
         excerpt: String(row.excerpt || ''),
-        content: String(row.content || ''),
+        preview: String(row.preview || ''),
         poster: String(row.poster || ''),
         status: normalizeStatus(row.status),
         views: Number(row.views || 0),
@@ -121,7 +103,20 @@ export default new Action({
         tagIds: tagIdsByPost.get(post.id) || [],
       }))
 
-      return { posts: withRelations, categories, tags, authors, ...counts(posts) }
+      return {
+        posts: withRelations,
+        categories,
+        tags,
+        authors,
+        total: page.total,
+        page: page.page,
+        perPage: query.perPage,
+        allCount: page.allCount,
+        publishedCount: page.publishedCount,
+        draftCount: page.draftCount,
+        archivedCount: page.archivedCount,
+        totalViews: page.totalViews,
+      }
     }
     catch (error) {
       return dashboardOperationalError(error, 'Posts could not be loaded.', 'PostIndexAction')

package/app/Actions/Dashboard/Content/PostShowAction.ts

@@ -0,0 +1,41 @@
+import type { RequestInstance } from '@stacksjs/types'
+import { Action } from '@stacksjs/actions/runtime'
+import { db } from '@stacksjs/database/runtime'
+import { response } from '@stacksjs/router'
+import { dashboardOperationalError } from '../dashboard-response'
+
+/**
+ * `GET /api/dashboard/posts/{id}` — the body of one post, for the editor.
+ *
+ * The posts list carries a short preview of each body rather than the whole
+ * article (stacksjs/stacks#3191), so the editor reads the body here when it
+ * opens. Everything else it shows is already on the list row.
+ */
+export default new Action({
+  name: 'PostShowAction',
+  description: 'Returns the body of one CMS post for the dashboard editor.',
+  method: 'GET',
+  apiResponse: true,
+  async handle(request: RequestInstance) {
+    const id = Number(request.getParam('id'))
+
+    if (!Number.isInteger(id) || id <= 0)
+      return response.json({ message: 'A valid post id is required.' }, 422)
+
+    try {
+      const post = await db
+        .selectFrom('posts')
+        .select(['id', 'content'])
+        .where('id', '=', id)
+        .executeTakeFirst() as { id: number, content: string | null } | undefined
+
+      if (!post)
+        return response.json({ message: 'Post not found.' }, 404)
+
+      return { id: Number(post.id), content: String(post.content || '') }
+    }
+    catch (error) {
+      return dashboardOperationalError(error, 'Post could not be loaded.', 'PostShowAction')
+    }
+  },
+})

package/app/Actions/Dashboard/Content/comment-input.ts

@@ -95,6 +95,27 @@ export interface CommentableRow {
   updated_at?: string | null
 }
 
+/** Decode the raw SQL boundary, including integer strings and SQL Date values. */
+export function parseCommentableRow(row: Record<string, unknown>): CommentableRow {
+  const text = (value: unknown, field: string): string | null => {
+    if (value == null) return null
+    if (typeof value !== 'string') throw new TypeError(`Comment ${field} must be text or null`)
+    return value
+  }
+  const id = (value: unknown, field: string): number => {
+    const number = typeof value === 'number' || (typeof value === 'string' && /^\d+$/.test(value)) ? Number(value) : Number.NaN
+    if (!Number.isSafeInteger(number) || number <= 0) throw new TypeError(`Comment ${field} must be a positive integer`)
+    return number
+  }
+  const timestamp = (value: unknown, field: string): string | null => value instanceof Date ? value.toISOString() : text(value, field)
+  return {
+    id: id(row.id, 'id'), title: text(row.title, 'title'), body: text(row.body, 'body'), status: text(row.status, 'status'),
+    commentables_id: id(row.commentables_id, 'owner id'), commentables_type: text(row.commentables_type, 'owner type') ?? '',
+    user_id: row.user_id == null ? null : id(row.user_id, 'user id'), author_name: text(row.author_name, 'author name'), author_email: text(row.author_email, 'author email'),
+    created_at: timestamp(row.created_at, 'created at'), updated_at: timestamp(row.updated_at, 'updated at'),
+  }
+}
+
 /** One row of the dashboard's comment list, from either table. */
 export interface DashboardComment {
   key: string
@@ -152,7 +173,10 @@ export function isSafeTableName(value: string): boolean {
  * every space-separated one on the same day.
  */
 export function newestFirst(a: DashboardComment, b: DashboardComment): number {
-  const at = (value: string | null) => str(value).replace('T', ' ').slice(0, 19)
+  // PostgreSQL and MySQL hand timestamps back as Dates, and `String(date)`
+  // starts with the weekday, so it compared Thursday before Wednesday whatever
+  // the year (stacksjs/stacks#3193).
+  const at = (value: string | Date | null) => (value instanceof Date ? value.toISOString() : str(value)).replace('T', ' ').slice(0, 19)
 
   return at(b.created_at).localeCompare(at(a.created_at)) || b.key.localeCompare(a.key)
 }