@simmalugnt-se/payload-editor-assistant 0.12.2 → 0.13.1

package/dist/components/copy.js

@@ -13,6 +13,13 @@ export const COPY = {
         collapseLabel: "Collapse assistant",
         placeholder: "Message the assistant",
         send: "Send",
+        attachImage: "Add images",
+        removeImage: "Remove image",
+        imageOmitted: "Older image omitted",
+        imagePreparing: "Preparing images…",
+        imageLimit: "Attach up to three images per message.",
+        imageTooLarge: "These images are too large. Try fewer or smaller images.",
+        imageInvalid: "Choose a PNG, JPEG, WebP or GIF image up to 10 MB.",
         stop: "Stop",
         working: "Working…",
         steps: {
@@ -76,6 +83,13 @@ export const COPY = {
         collapseLabel: "Fäll ihop assistenten",
         placeholder: "Skriv till assistenten",
         send: "Skicka",
+        attachImage: "Lägg till bilder",
+        removeImage: "Ta bort bild",
+        imageOmitted: "Äldre bild utelämnad",
+        imagePreparing: "Förbereder bilder…",
+        imageLimit: "Bifoga högst tre bilder per meddelande.",
+        imageTooLarge: "Bilderna är för stora. Prova färre eller mindre bilder.",
+        imageInvalid: "Välj en PNG-, JPEG-, WebP- eller GIF-bild på högst 10 MB.",
         stop: "Stoppa",
         working: "Arbetar…",
         steps: {

package/dist/domain/batch.js

@@ -214,7 +214,10 @@ export async function applyBatchTarget(req, options, input) {
         return fail("tool_denied", finalized.error);
     }
     const paths = changedPaths(operations);
-    const relationError = relationValueError(fields, finalized.data, paths);
+    const relationError = relationValueError(fields, finalized.data, paths, {
+        user: req.user,
+        operation: "update",
+    });
     if (relationError) {
         return fail("tool_denied", relationError);
     }

package/dist/domain/decide.js

@@ -1,6 +1,7 @@
 import { compileOperations } from "../form/compile.js";
 import { hashFormRevision } from "../form/hash.js";
 import { isFormOperation } from "../form/operations.js";
+import { relationValueError } from "../form/relation-shape.js";
 import { loadRichText } from "../form/rich-text.js";
 import { finalizeCompiled, openRichText } from "../form/shape.js";
 import { DEFAULT_APPROVAL_SLUG } from "../package-name.js";
@@ -95,6 +96,14 @@ export async function decideChange(req, options, input) {
         await consume(req, record.id, "failed");
         return { ok: false, error: "tool_denied", message: finalized.error };
     }
+    const relationError = relationValueError(fields, finalized.data, operations.map((operation) => operation.path), {
+        user: req.user,
+        operation: record.capability === "draft.create" ? "create" : "update",
+    });
+    if (relationError) {
+        await consume(req, record.id, "failed");
+        return { ok: false, error: "tool_denied", message: relationError };
+    }
     const relations = await verifyDocumentRelations(req, fields, finalized.data, finalized.links);
     if (!relations.ok) {
         await consume(req, record.id, "failed");

package/dist/domain/new-block-review.d.ts

@@ -0,0 +1,7 @@
+import type { FieldNode } from "../schema/fields.ts";
+import type { ProposalLine } from "./propose.ts";
+/** Review block fields by ID so inserts and moves cannot mislabel other changes in the same list. */
+export declare function newBlockReview(fields: FieldNode[], current: Record<string, unknown>, after: Record<string, unknown>, language?: "en" | "sv", labels?: Map<string, string>): {
+    lines: ProposalLine[];
+    containers: Set<string>;
+};

package/dist/domain/new-block-review.js

@@ -0,0 +1,97 @@
+import { humanDiff } from "../form/diff.js";
+import { fieldPathInfo } from "../form/field-label.js";
+import { getAtPath, parseFieldPath } from "../form/path.js";
+/** Review block fields by ID so inserts and moves cannot mislabel other changes in the same list. */
+export function newBlockReview(fields, current, after, language = "en", labels) {
+    const lines = [];
+    const containers = new Set();
+    const visit = (scope, before, value, prefix = "", schemaPrefix = "", added = false, insideBlock = false) => {
+        for (const field of scope) {
+            // Named tabs are flattened in the schema but retain their name in each field path.
+            const relative = field.path.slice(schemaPrefix ? schemaPrefix.length + 1 : 0);
+            const path = prefix ? `${prefix}.${relative}` : relative;
+            const previous = getAtPath(before, parseFieldPath(relative));
+            const next = getAtPath(value, parseFieldPath(relative));
+            if (!added && !insideBlock && (next === undefined || next === null))
+                continue;
+            if ((field.type === "blocks" || field.type === "array") && Array.isArray(next)) {
+                if (field.type === "blocks")
+                    containers.add(path);
+                for (const [index, row] of next.entries()) {
+                    if (!isRecord(row))
+                        continue;
+                    const oldRow = Array.isArray(previous)
+                        ? row.id === undefined
+                            ? previous[index]
+                            : previous.find((entry) => isRecord(entry) && entry.id === row.id)
+                        : undefined;
+                    const newBlock = field.type === "blocks" && row.id !== undefined && !oldRow;
+                    const children = field.type === "blocks"
+                        ? field.blocks?.find((block) => block.slug === row.blockType)?.fields
+                        : field.fields;
+                    const start = lines.length;
+                    visit(children ?? [], oldRow, row, `${path}.${index}`, field.path, added || newBlock, insideBlock || field.type === "blocks");
+                    if (newBlock) {
+                        if (lines.length === start) {
+                            lines.push({
+                                path: `${path}.${index}`,
+                                groups: fieldPathInfo(fields, `${path}.${index}.__change`, after, language).groups,
+                                text: language === "sv" ? "Nytt block" : "New block",
+                            });
+                        }
+                        containers.add(path);
+                    }
+                }
+            }
+            else if (field.fields) {
+                visit(field.fields, previous, next, path, field.path, added, insideBlock);
+            }
+            else if ((added && next !== undefined && next !== null) ||
+                (insideBlock && !added && JSON.stringify(previous) !== JSON.stringify(next))) {
+                const { label, context, groups } = fieldPathInfo(fields, path, after, language);
+                const text = humanDiff({ value: previous }, [
+                    next === undefined
+                        ? { op: "unset", path: "value" }
+                        : { op: "set", path: "value", value: next },
+                ], language, labels, () => label)[0]?.text ?? label;
+                lines.push({
+                    path,
+                    label,
+                    context,
+                    groups,
+                    text,
+                    ...(field.type === "richText"
+                        ? { richText: { before: added ? undefined : previous, after: next } }
+                        : added
+                            ? { value: displayValue(next, field, labels) }
+                            : field.type === "text" || field.type === "textarea"
+                                ? {
+                                    edit: {
+                                        label,
+                                        before: typeof previous === "string" ? previous : "",
+                                        value: typeof next === "string" ? next : "",
+                                    },
+                                }
+                                : {}),
+                });
+            }
+        }
+    };
+    visit(fields, current, after);
+    return { lines, containers };
+}
+function displayValue(value, field, labels) {
+    if (field.type === "relationship" || field.type === "upload") {
+        const name = (entry) => {
+            const id = isRecord(entry)
+                ? (entry.id ?? (isRecord(entry.value) ? entry.value.id : entry.value))
+                : entry;
+            return labels?.get(String(id)) ?? String(id);
+        };
+        return Array.isArray(value) ? value.map(name).join(", ") : name(value);
+    }
+    return typeof value === "string" ? value : JSON.stringify(value);
+}
+function isRecord(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}

package/dist/domain/propose.d.ts

@@ -32,6 +32,8 @@ export type ProposalLine = {
         before: unknown;
         after: unknown;
     };
+    /** Full read-only value of a field supplied inside a new block. */
+    value?: string;
     edit?: {
         label: string;
         before: string;

package/dist/domain/propose.js

@@ -17,6 +17,7 @@ import { hasCapability, resolveAllowlist } from "./allowlist.js";
 import { writeAudit } from "./audit.js";
 import { readDocument } from "./content.js";
 import { localApi } from "./local-api.js";
+import { newBlockReview } from "./new-block-review.js";
 import { labelRelations, verifyDocumentRelations } from "./relations.js";
 /** Long enough to look at a change in the preview before keeping it. */
 const TTL_MS = 30 * 60_000;
@@ -69,7 +70,10 @@ export async function proposeChange(req, options, input) {
     if (!finalized.ok) {
         return { ok: false, error: "tool_denied", message: finalized.error };
     }
-    const relationError = relationValueError(fields, finalized.data, changedPaths(typedOperations));
+    const relationError = relationValueError(fields, finalized.data, typedOperations.map((operation) => operation.path), {
+        user: req.user,
+        operation: input.capability === "draft.create" ? "create" : "update",
+    });
     if (relationError) {
         return { ok: false, error: "tool_denied", message: relationError };
     }
@@ -98,8 +102,9 @@ export async function proposeChange(req, options, input) {
     const setIds = new Set(typedOperations.flatMap((operation) => operation.op === "set"
         ? [operation.value, getAtPath(current, parseFieldPath(operation.path))].flatMap(idsIn)
         : []));
-    const labels = setIds.size
-        ? await labelRelations(req, fields, [finalized.data, current], setIds)
+    const addsBlocks = typedOperations.some((operation) => operation.op === "blocks.insert" || operation.op === "blocks.replace");
+    const labels = setIds.size || addsBlocks
+        ? await labelRelations(req, fields, [finalized.data, current], addsBlocks ? undefined : setIds)
         : undefined;
     const inRichText = (operation) => "path" in operation &&
         richTextBefore.some(({ path }) => operation.path === path || operation.path.startsWith(`${path}.`));
@@ -108,8 +113,23 @@ export async function proposeChange(req, options, input) {
         ...humanDiff(current, typedOperations.filter((operation) => !inRichText(operation)), input.language, labels, (path) => fieldLabel(path).full),
         ...richTextBefore.flatMap(({ path, blocks, after }) => richTextLines(path, blocks, Array.isArray(after) ? after : [after], input.language, (path) => fieldLabel(path).full)),
     ];
-    const lines = diff
-        .filter((line) => !richTextBefore.some(({ path }) => path === line.path))
+    const added = addsBlocks
+        ? newBlockReview(fields, current, finalized.data, input.language, labels)
+        : { lines: [], containers: new Set() };
+    const addedPaths = new Set(added.lines.map((line) => line.path));
+    const reviewedBlockField = (path) => {
+        const field = fieldAtPath(fields, path, finalized.data) ?? fieldAtPath(fields, path, current);
+        return (field &&
+            !field.fields &&
+            !field.blocks &&
+            [...added.containers].some((container) => path.startsWith(`${container}.`)));
+    };
+    const reviewDiff = humanDiff(current, typedOperations.filter((operation) => !inRichText(operation) &&
+        !((operation.op === "set" || operation.op === "unset") &&
+            reviewedBlockField(operation.path)) &&
+        !(operation.op === "blocks.insert" && added.containers.has(operation.path))), input.language, labels, (path) => fieldLabel(path).full);
+    const lines = reviewDiff
+        .filter((line) => !addedPaths.has(line.path))
         .map((line) => {
         const { context, label, groups } = fieldLabel(line.path);
         return {
@@ -121,6 +141,8 @@ export async function proposeChange(req, options, input) {
         };
     });
     for (const { path } of richTextBefore) {
+        if (addedPaths.has(path) || reviewedBlockField(path))
+            continue;
         const { context, label, groups } = fieldLabel(path);
         lines.push({
             path,
@@ -137,6 +159,7 @@ export async function proposeChange(req, options, input) {
             },
         });
     }
+    lines.push(...added.lines);
     let created;
     try {
         created = await localApi(req).create({
@@ -310,7 +333,11 @@ function idsIn(value) {
         return [String(value)];
     }
     if (Array.isArray(value)) {
-        return value.flatMap((entry) => entry && typeof entry === "object" && "id" in entry ? idsIn(entry.id) : idsIn(entry));
+        return value.flatMap(idsIn);
+    }
+    if (value && typeof value === "object") {
+        const relation = value;
+        return idsIn(relation.id ?? relation.value);
     }
     return [];
 }

package/dist/endpoints/chat.d.ts

@@ -1,7 +1,10 @@
 import type { Endpoint } from "payload";
 import type { ValidatedEditorAssistantOptions } from "../config/validate.ts";
+import type { ChatMessage } from "../runtime/agent.ts";
 export declare function createChatEndpoint(options: ValidatedEditorAssistantOptions): Endpoint;
 /** Only a short list of form paths; the prompt names them as data. */
 export declare function sanitizeOpenProposal(value: unknown): {
     changedPaths: string[];
 } | undefined;
+/** No remote fetches: only bounded, typed image bytes on user messages. */
+export declare function validChatImages(messages: ChatMessage[]): boolean;

package/dist/endpoints/chat.js

@@ -1,3 +1,4 @@
+import { imageByteLength, isChatImage, MAX_CHAT_IMAGES, MAX_CHAT_IMAGES_BYTES, } from "../chat-images.js";
 import { ENDPOINT_PREFIX } from "../package-name.js";
 import { runAgentTurn } from "../runtime/agent.js";
 import { beginInflight, endInflight } from "../runtime/inflight.js";
@@ -34,18 +35,26 @@ export function createChatEndpoint(options) {
                     if (typeof req.json !== "function") {
                         return Response.json({ error: "tool_denied" }, { status: 400 });
                     }
+                    if (Number(req.headers.get("content-length")) > 4 * 1024 * 1024)
+                        return Response.json({ error: "tool_denied", message: "Chat request is too large." }, { status: 413 });
                     body = (await req.json());
+                    if (Buffer.byteLength(JSON.stringify(body)) > 4 * 1024 * 1024)
+                        return Response.json({ error: "tool_denied", message: "Chat request is too large." }, { status: 413 });
                 }
                 catch {
                     return Response.json({ error: "tool_denied" }, { status: 400 });
                 }
-                if (typeof body.message !== "string" || body.message.trim() === "") {
+                if (!body || typeof body !== "object" || typeof body.message !== "string") {
                     return Response.json({ error: "tool_denied" }, { status: 400 });
                 }
                 const locale = nonEmpty(body.bridge?.locale) ?? nonEmpty(body.locale) ?? defaultLocale(req);
                 const messages = Array.isArray(body.messages)
-                    ? body.messages.filter(isChatMessage)
+                    ? body.messages.filter(isChatMessage).slice(-20)
                     : [{ role: "user", text: body.message }];
+                if (!validChatImages(messages) ||
+                    (!body.message.trim() && !messages.at(-1)?.images?.length)) {
+                    return Response.json({ error: "tool_denied", message: "Invalid or oversized image attachments." }, { status: 400 });
+                }
                 const language = resolveChatLanguage(messages.filter((message) => message.role === "user").map((message) => message.text), nonEmpty(body.uiLanguage));
                 const run = (onEvent) => runAgentTurn(req, options, {
                     onEvent,
@@ -155,3 +164,23 @@ function isChatMessage(value) {
     return ((record.role === "user" || record.role === "assistant" || record.role === "system") &&
         typeof record.text === "string");
 }
+/** No remote fetches: only bounded, typed image bytes on user messages. */
+export function validChatImages(messages) {
+    let bytes = 0;
+    for (const message of messages) {
+        if (message.images === undefined)
+            continue;
+        if (message.role !== "user" ||
+            !Array.isArray(message.images) ||
+            message.images.length > MAX_CHAT_IMAGES)
+            return false;
+        for (const image of message.images) {
+            if (!isChatImage(image))
+                return false;
+            bytes += imageByteLength(image.data);
+            if (bytes > MAX_CHAT_IMAGES_BYTES)
+                return false;
+        }
+    }
+    return true;
+}

package/dist/endpoints/decide.js

@@ -1,6 +1,7 @@
 import { decideChange } from "../domain/decide.js";
 import { guardMutationRequest, readJsonBody } from "../domain/guard.js";
 import { ENDPOINT_PREFIX } from "../package-name.js";
+import { createAssistantDebug } from "../runtime/debug.js";
 export function createDecideEndpoint(options) {
     return {
         path: `${ENDPOINT_PREFIX}/decide`,
@@ -14,20 +15,40 @@ export function createDecideEndpoint(options) {
             if (!body?.action || !body.approvalId || !body.nonce || !body.locale) {
                 return Response.json({ error: "tool_denied" }, { status: 400 });
             }
-            const result = await decideChange(req, options, {
+            const debug = createAssistantDebug(req);
+            debug.write("decision.start", {
+                actor: req.user?.id,
                 action: body.action,
                 approvalId: body.approvalId,
-                nonce: body.nonce,
                 collection: body.collection,
                 global: body.global,
                 documentId: body.documentId,
                 locale: body.locale,
-                formData: body.formData,
             });
-            if (!result.ok) {
-                return Response.json({ error: result.error, message: result.message }, { status: 400 });
+            try {
+                const result = await decideChange(req, options, {
+                    action: body.action,
+                    approvalId: body.approvalId,
+                    nonce: body.nonce,
+                    collection: body.collection,
+                    global: body.global,
+                    documentId: body.documentId,
+                    locale: body.locale,
+                    formData: body.formData,
+                });
+                debug.write("decision.result", result);
+                if (!result.ok) {
+                    return Response.json({ error: result.error, message: result.message }, { status: 400 });
+                }
+                return Response.json(result);
+            }
+            catch (error) {
+                debug.write("decision.error", error);
+                throw error;
+            }
+            finally {
+                await debug.flush();
             }
-            return Response.json(result);
         },
     };
 }

package/dist/form/diff.js

@@ -46,8 +46,9 @@ export function humanDiff(current, operations, language = "en", labels, fieldLab
     const nameOf = (value) => {
         const id = typeof value === "string" || typeof value === "number"
             ? String(value)
-            : value && typeof value === "object" && "id" in value
-                ? String(value.id)
+            : value && typeof value === "object" && ("id" in value || "value" in value)
+                ? String(value.id ??
+                    value.value)
                 : undefined;
         return id !== undefined ? labels?.get(id) : undefined;
     };

package/dist/form/relation-shape.d.ts

@@ -1,9 +1,14 @@
+import type { PayloadRequest } from "payload";
 import { type FieldNode } from "../schema/fields.ts";
 /**
- * Checks the upload and relationship fields a proposal changes (`paths`, as `changedPaths` gives
- * them): one id for a single field; for a `hasMany` field a list of ids without repeats, within its
- * `minRows` and `maxRows` (an empty list is allowed). Fields pointing at several collections are
- * refused. Untouched fields are not checked, so a value the editor saved cannot block a proposal.
+ * Checks the upload and relationship fields a proposal changes (`paths` from the operations),
+ * including relations inside changed groups, rows and blocks. A single-collection
+ * polymorphic relation still needs { relationTo, value }. Missing required relationships in a
+ * changed group are checked against Payload's trusted field conditions and primitive defaults.
+ * Fields pointing at several collections are refused. Unrelated fields are not checked.
  * Whether the ids exist and are readable is `verifyDocumentRelations`' job.
  */
-export declare function relationValueError(fields: FieldNode[], data: Record<string, unknown>, paths: string[]): string | null;
+export declare function relationValueError(fields: FieldNode[], data: Record<string, unknown>, paths: string[], context?: {
+    user?: PayloadRequest["user"];
+    operation?: "create" | "update";
+}): string | null;

package/dist/form/relation-shape.js

@@ -1,36 +1,90 @@
-import { fieldAtPath } from "../schema/fields.js";
-import { getAtPath, parseFieldPath } from "./path.js";
+import { fieldCondition } from "../schema/fields.js";
+import { cloneData, getAtPath, parseFieldPath, setAtPath } from "./path.js";
 const ID = /^[\w-]+$/;
 /**
- * Checks the upload and relationship fields a proposal changes (`paths`, as `changedPaths` gives
- * them): one id for a single field; for a `hasMany` field a list of ids without repeats, within its
- * `minRows` and `maxRows` (an empty list is allowed). Fields pointing at several collections are
- * refused. Untouched fields are not checked, so a value the editor saved cannot block a proposal.
+ * Checks the upload and relationship fields a proposal changes (`paths` from the operations),
+ * including relations inside changed groups, rows and blocks. A single-collection
+ * polymorphic relation still needs { relationTo, value }. Missing required relationships in a
+ * changed group are checked against Payload's trusted field conditions and primitive defaults.
+ * Fields pointing at several collections are refused. Unrelated fields are not checked.
  * Whether the ids exist and are readable is `verifyDocumentRelations`' job.
  */
-export function relationValueError(fields, data, paths) {
-    const checked = new Set();
-    for (const changed of paths) {
-        const segments = changed.split(".");
-        // A change inside a list of ids (`images.2`) is checked on the whole field.
-        while (segments.length > 1 && /^\d+$/.test(segments.at(-1) ?? "")) {
-            segments.pop();
+export function relationValueError(fields, data, paths, context = {}) {
+    const touched = (path) => paths.some((changed) => changed === path || changed.startsWith(`${path}.`) || path.startsWith(`${changed}.`));
+    const visit = (scope, value, prefix = "", schemaPrefix = "", blockData) => {
+        if (!isRecord(value))
+            return null;
+        const needsSiblings = scope.some((field) => fieldCondition(field));
+        const siblings = needsSiblings ? cloneData(value) : value;
+        for (const field of needsSiblings ? scope : []) {
+            const relative = field.path.slice(schemaPrefix ? schemaPrefix.length + 1 : 0);
+            if (field.defaultValue !== undefined &&
+                getAtPath(siblings, parseFieldPath(relative)) == null) {
+                // Only condition evaluation gets defaults; never mutate the proposed data.
+                setAtPath(siblings, parseFieldPath(relative), field.defaultValue);
+            }
         }
-        const path = segments.join(".");
-        if (checked.has(path)) {
-            continue;
+        for (const field of scope) {
+            const relative = field.path.slice(schemaPrefix ? schemaPrefix.length + 1 : 0);
+            const path = prefix ? `${prefix}.${relative}` : relative;
+            const next = getAtPath(value, parseFieldPath(relative));
+            const relation = field.type === "relationship" || field.type === "upload";
+            const missing = next == null || next === "" || (Array.isArray(next) && next.length === 0);
+            const parent = path.split(".").slice(0, -1).join(".");
+            const required = relation && field.required && missing && touched(parent || path);
+            if (!touched(path) && !required)
+                continue;
+            const condition = fieldCondition(field);
+            if (condition) {
+                try {
+                    const relativeParent = parseFieldPath(relative).slice(0, -1);
+                    const conditionSiblings = relativeParent.length
+                        ? getAtPath(siblings, relativeParent)
+                        : siblings;
+                    if (!condition(data, conditionSiblings ?? {}, {
+                        blockData: blockData,
+                        operation: context.operation ?? "update",
+                        path: parseFieldPath(path),
+                        user: context.user ?? null,
+                    }))
+                        continue;
+                }
+                catch {
+                    return `"${path}" could not be checked against its field condition.`;
+                }
+            }
+            if (required) {
+                const format = field.polymorphic
+                    ? ` Set it to {"relationTo":"${field.relationTo?.[0]}","value":"<found document id>"}, not a URL.`
+                    : " Set it to a found document id, not a URL.";
+                return `"${path}" is required.${format}`;
+            }
+            if (relation) {
+                const error = fieldError(field, path, next);
+                if (error)
+                    return error;
+            }
+            else if ((field.type === "blocks" || field.type === "array") && Array.isArray(next)) {
+                for (const [index, row] of next.entries()) {
+                    if (!isRecord(row))
+                        continue;
+                    const children = field.type === "blocks"
+                        ? field.blocks?.find((block) => block.slug === row.blockType)?.fields
+                        : field.fields;
+                    const error = visit(children ?? [], row, `${path}.${index}`, field.path, field.type === "blocks" ? row : blockData);
+                    if (error)
+                        return error;
+                }
+            }
+            else if (field.fields) {
+                const error = visit(field.fields, next ?? {}, path, field.path, blockData);
+                if (error)
+                    return error;
+            }
         }
-        checked.add(path);
-        const field = fieldAtPath(fields, path, data);
-        if (!field || (field.type !== "upload" && field.type !== "relationship")) {
-            continue;
-        }
-        const error = fieldError(field, path, getAtPath(data, parseFieldPath(path)));
-        if (error) {
-            return error;
-        }
-    }
-    return null;
+        return null;
+    };
+    return visit(fields, data);
 }
 function fieldError(field, path, value) {
     const noun = field.type === "upload" ? "image" : "document";
@@ -41,7 +95,16 @@ function fieldError(field, path, value) {
         return null;
     }
     if (!field.hasMany) {
-        return Array.isArray(value) ? `"${path}" takes one ${noun}: set it to a single id.` : null;
+        if (Array.isArray(value))
+            return `"${path}" takes one ${noun}: set it to a single id.`;
+        return entryError(field, path, value, noun);
+    }
+    if (Array.isArray(value) && field.polymorphic) {
+        for (const entry of value) {
+            const error = entryError(field, path, entry, noun);
+            if (error)
+                return error;
+        }
     }
     const ids = Array.isArray(value) ? value.map(idOf) : undefined;
     if (!ids || ids.some((id) => id === undefined)) {
@@ -58,6 +121,19 @@ function fieldError(field, path, value) {
     }
     return null;
 }
+function entryError(field, path, value, noun) {
+    if (field.polymorphic) {
+        return isRecord(value) &&
+            value.relationTo === field.relationTo?.[0] &&
+            idOf(value.value) !== undefined
+            ? null
+            : `"${path}" needs {"relationTo":"${field.relationTo?.[0]}","value":"<found ${noun} id>"}. A URL or bare id cannot fill this field.`;
+    }
+    return idOf(value) !== undefined ? null : `"${path}" needs a valid ${noun} id, not a URL.`;
+}
+function isRecord(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
 /** An id, or a document as Admin may hold a chosen one. */
 function idOf(entry) {
     if (typeof entry === "number") {

package/dist/runtime/agent.d.ts

@@ -1,4 +1,5 @@
 import type { PayloadRequest } from "payload";
+import type { ChatImage } from "../chat-images.ts";
 import type { ValidatedEditorAssistantOptions } from "../config/validate.ts";
 import type { ProposalLine, ProposalPreview } from "../domain/propose.ts";
 import { type ToolContext, type ToolOutcome } from "./tools.ts";
@@ -30,9 +31,10 @@ export type AgentChatResult = {
     error: string;
     message?: string;
 };
-type ChatMessage = {
+export type ChatMessage = {
     role: "user" | "assistant" | "system";
     text: string;
+    images?: ChatImage[];
 };
 /** What the assistant is doing right now, for the panel to show while the turn runs. */
 export type AgentStep = "thinking" | "searching" | "reading" | "reading_form" | "viewing" | "proposing" | "drafting" | "navigating" | "writing";