@coffer-org/plugin-transit 1.5.0 → 2.1.0

package/dist/bus_route/index.js

@@ -6,7 +6,7 @@ export default defineShelf({
     label: 'transit.bus_route.label',
     icon: 'lucide:bus',
     views: {
-        table: ['route_number', 'from', 'to'],
+        list: { fields: ['route_number', 'from', 'to'] },
     },
     fields: [
         field.title({ key: 'name', label: 'core.fields.name' }),

package/dist/schema.js

@@ -4609,6 +4609,25 @@ function internalApiToken(o) {
 		]
 	});
 }
+/**
+* Internal "connected apps" list — the OAuth clients (claude.ai & co) the user
+* has authorized for MCP access. Same "internal" caveat and custom-renderer
+* trick as internalApiToken(): read-only rows + a revoke action, never part of
+* the parent form's save.
+*/
+function internalOauthGrants(o) {
+	return group({
+		key: o.key,
+		label: o.label ?? o.key,
+		multiple: true,
+		view: { kind: "internalOauthGrants" },
+		fields: [
+			string({ key: "clientName" }),
+			string({ key: "createdAt" }),
+			string({ key: "lastUsedAt" })
+		]
+	});
+}
 var SLUG_RE = /^[a-z0-9-]+$/;
 function slug(raw) {
 	const o = normalizeOpts(raw);
@@ -5038,7 +5057,8 @@ var presets = {
 	weight,
 	dimensions,
 	country,
-	internalApiToken
+	internalApiToken,
+	internalOauthGrants
 };
 //#endregion
 //#region ../../node_modules/iso-639-1/src/data.js
@@ -5867,7 +5887,7 @@ function group(o) {
 		required: o.required,
 		unique: r.unique,
 		label: o.label,
-		icon: v.icon,
+		icon: o.icon,
 		display: v.display ?? "wrap",
 		kind: v.kind,
 		fixed: r.fixed,
@@ -5878,11 +5898,9 @@ function group(o) {
 function row(o) {
 	return group({
 		label: o.label,
+		icon: o.icon,
 		fields: o.fields,
-		view: {
-			...o.view,
-			display: "scroll"
-		}
+		view: { display: "scroll" }
 	});
 }
 /** Tabular collection (array of rows → <table>, aligned by columns). Sugar. */
@@ -5890,14 +5908,12 @@ function table(o) {
 	return group({
 		key: o.key,
 		label: o.label,
+		icon: o.icon,
 		fields: o.fields,
 		multiple: true,
 		required: o.required,
 		rules: o.rules,
-		view: {
-			...o.view,
-			display: "table"
-		}
+		view: { display: "table" }
 	});
 }
 /**
@@ -5913,11 +5929,9 @@ function sheet(o) {
 	});
 	return group({
 		label: o.label,
+		icon: o.icon,
 		fields: flat,
-		view: {
-			...o.view,
-			display: "sheet"
-		}
+		view: { display: "sheet" }
 	});
 }
 /**
@@ -5949,8 +5963,8 @@ function keyed(o) {
 	return {
 		...(o.container ?? group)({
 			label: o.label,
-			fields: [o.by, ...o.fields],
-			view: o.view
+			icon: o.icon,
+			fields: [o.by, ...o.fields]
 		}),
 		key: o.key,
 		multiple: true,
@@ -6387,7 +6401,7 @@ function relation(raw) {
 		},
 		relation: {
 			library: raw.options.library,
-			type: raw.options.shelf
+			shelf: raw.options.shelf
 		},
 		...multi && { json: true },
 		zod: optionalize(s, required)
@@ -6767,15 +6781,44 @@ function period(raw) {
 		zod: optionalize(s, required)
 	});
 }
+/** Keys a file entry may carry. Everything else is rejected — see fileEntryIssue. */
+var FILE_KEYS = /* @__PURE__ */ new Set([
+	"name",
+	"mime",
+	"size"
+]);
+/** Keys that mean "the author pasted a remote address" — the one mistake worth naming. */
+var FILE_URL_KEYS = [
+	"url",
+	"src",
+	"href",
+	"link"
+];
+/**
+* A file entry points at a file already uploaded to the server: `{ name }`, where
+* name is the bare filename returned by POST /api/upload. Anything else — a remote
+* URL, an extra key, a path — is refused here, so a record can never hold a
+* reference the server cannot serve. `mime`/`size` are accepted (legacy payloads
+* and the web uploader send them) but the server overwrites them from disk.
+* Returns a vmsg code, or null when the entry is well-formed.
+*/
+function fileEntryIssue(it) {
+	if (typeof it !== "object" || it === null || Array.isArray(it)) return "file_structure";
+	const rec = it;
+	if (FILE_URL_KEYS.some((k) => k in rec)) return "file_remote_url";
+	const name = rec["name"];
+	if (typeof name !== "string" || name === "") return "file_structure";
+	if (name.includes("://") || name.startsWith("//")) return "file_remote_url";
+	if (/[\\/]/.test(name) || name.includes("..")) return "file_name";
+	for (const k of Object.keys(rec)) if (!FILE_KEYS.has(k)) return "file_unknown_key";
+	if (rec["mime"] !== void 0 && typeof rec["mime"] !== "string") return "file_structure";
+	if (rec["size"] !== void 0 && typeof rec["size"] !== "number") return "file_structure";
+	return null;
+}
 function makeFile(kind, raw) {
 	const o = normalizeOpts(raw);
 	const required = o.required ?? false;
 	const multiple = o.multiple ?? false;
-	const rowSchema = object({
-		name: string$1().min(1),
-		mime: string$1().optional(),
-		size: number$1().optional()
-	});
 	const s = unknown().superRefine((raw, ctx) => {
 		if (typeof raw === "string") try {
 			JSON.parse(raw);
@@ -6788,12 +6831,15 @@ function makeFile(kind, raw) {
 		}
 		const parsed = jsonValue(raw);
 		const items = Array.isArray(parsed) ? parsed : [parsed];
-		for (const it of items) if (!rowSchema.safeParse(it).success) {
-			ctx.addIssue({
-				code: ZodIssueCode.custom,
-				message: vmsg("file_structure")
-			});
-			return;
+		for (const it of items) {
+			const code = fileEntryIssue(it);
+			if (code) {
+				ctx.addIssue({
+					code: ZodIssueCode.custom,
+					message: vmsg(code)
+				});
+				return;
+			}
 		}
 	});
 	return wrapKey(o, {
@@ -7729,7 +7775,7 @@ function defineShelf(m) {
 	const keys = fieldEntries(m.fields).map(([k]) => k);
 	const dup = keys.find((k, i) => keys.indexOf(k) !== i);
 	if (dup) throw new Error(`[shelf] ${m.library}/${m.shelf}: duplicate key '${dup}'`);
-	if (m.standalone !== false && !m.views?.table?.length) console.warn(`[shelf] ${m.library}/${m.shelf}: standalone shelf without an explicit views.table`);
+	if (m.standalone !== false && !m.views?.list?.fields?.length) console.warn(`[shelf] ${m.library}/${m.shelf}: standalone shelf without an explicit views.list`);
 	return m;
 }
 //#endregion
@@ -7745,11 +7791,11 @@ var bus_route_default = defineShelf({
 	library: "transit",
 	label: "transit.bus_route.label",
 	icon: "lucide:bus",
-	views: { table: [
+	views: { list: { fields: [
 		"route_number",
 		"from",
 		"to"
-	] },
+	] } },
 	fields: [
 		field.title({
 			key: "name",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffer-org/plugin-transit",
-  "version": "1.5.0",
+  "version": "2.1.0",
   "type": "module",
   "engines": {
     "node": ">=24"
@@ -25,9 +25,9 @@
     "test": "node --import tsx/esm --test 'src/runtime/*.test.ts'"
   },
   "dependencies": {
-    "@coffer-org/sdk": "^1.5.0",
-    "@coffer-org/server": "^1.8.0",
-    "@coffer-org/dav": "^1.5.0"
+    "@coffer-org/sdk": "^2.1.0",
+    "@coffer-org/server": "^2.2.0",
+    "@coffer-org/dav": "^2.1.0"
   },
   "coffer": {
     "schema": "dist/schema.js"