domma-cms 0.73.0 → 0.75.0

package/server/routes/api/menus.js

@@ -2,6 +2,7 @@
  * Menus API
  *
  * GET    /api/menus                  - list (metadata only)
+ * GET    /api/menus/_count           - the sidebar badge (the underscore can never be a slug)
  * GET    /api/menus/:slug            - full menu
  * POST   /api/menus                  - create
  * PUT    /api/menus/:slug            - replace
@@ -21,6 +22,7 @@ import {
     createMenu,
     deleteMenu,
     duplicateMenu,
+    getLocationRegistry,
     getLocations,
     getMenu,
     listMenus,
@@ -28,6 +30,43 @@ import {
 } from '../../services/menus.js';
 import * as cache from '../../services/cache/index.js';
 
+/**
+ * The sidebar badge on Menus (its countUrl): how many menus, which locations
+ * have none, and which menus are in no location. A count to glance at, not a
+ * warning. Plain text throughout - the popover sets it with textContent.
+ *
+ * "Not in a location" is not "unused": a `[menu]` shortcode can show any menu.
+ * The overlay slot is left out of "empty" - it is optional by design.
+ *
+ * @param {{menus: object[], locations: Record<string, string>, registry: object[]}} state
+ * @returns {{count: number, label: string, tone: string, details: object}}
+ */
+export function menusBadge({menus = [], locations = {}, registry = []} = {}) {
+    const mapped = new Set(Object.values(locations || {}).filter(Boolean));
+    const placed = (m) => mapped.has(m.slug) || Boolean(m.binding?.slot);
+    const unplaced = menus.filter(m => !placed(m));
+    const bindable = registry.filter(r => r.slot !== 'overlay');
+    const empty = bindable.filter(r => !locations?.[r.slot]);
+    const n = menus.length;
+    return {
+        count: n,
+        label: `${n} menu${n === 1 ? '' : 's'}${unplaced.length ? `, ${unplaced.length} not in a location` : ''}`,
+        tone: 'info',
+        details: {
+            title: 'Menus',
+            rows: [
+                {label: 'In a location', value: `${n - unplaced.length} of ${n}`},
+                {label: 'Locations filled', value: `${bindable.length - empty.length} of ${bindable.length}`}
+            ],
+            items: [
+                ...empty.map(r => ({text: r.label || r.slot, meta: 'location - no menu'})),
+                ...unplaced.map(m => ({text: m.name || m.slug, meta: `${m.slug} · not in a location`}))
+            ].slice(0, 8),
+            empty: 'Every location has a menu, and every menu is in one.'
+        }
+    };
+}
+
 /**
  * Register the menus routes.
  *
@@ -44,17 +83,25 @@ export async function menusRoutes(fastify, opts = {}) {
     const canUpdate = {preHandler: [authenticate, requirePermission('menus', 'update')]};
     const canDelete = {preHandler: [authenticate, requirePermission('menus', 'delete')]};
 
-    fastify.get('/menus', canRead, async (request) => {
+    /** The menus this user may see - listMenus is metadata only, so each is read for its meta. */
+    async function visibleMenus(user) {
         const {canSeeArtefact} = await import('../../services/projects.js');
-        const all = await listMenus();
         const filtered = [];
-        for (const m of all) {
-            // listMenus returns metadata only; getMenu returns full record with meta
+        for (const m of await listMenus()) {
             const full = await getMenu(m.slug);
-            if (canSeeArtefact(request.user, full)) filtered.push(m);
+            if (canSeeArtefact(user, full)) filtered.push(m);
         }
         return filtered;
-    });
+    }
+
+    fastify.get('/menus', canRead, async (request) => visibleMenus(request.user));
+
+    // Registered before /menus/:slug; `_` is outside the slug alphabet, so no menu can shadow it.
+    fastify.get('/menus/_count', canRead, async (request) => menusBadge({
+        menus: await visibleMenus(request.user),
+        locations: await getLocations(),
+        registry: getLocationRegistry()
+    }));
 
     fastify.get('/menus/:slug', canRead, async (request, reply) => {
         const menu = await getMenu(request.params.slug);

package/server/routes/api/pages.js

@@ -1,6 +1,7 @@
 /**
  * Pages API
  * GET    /api/pages          - list all pages
+ * GET    /api/pages/_count   - the sidebar badge on Pages (drafts)
  * GET    /api/pages/*        - get single page by URL path
  * POST   /api/pages          - create page
  * PUT    /api/pages/*        - update page
@@ -23,6 +24,44 @@ import {
 import {getVersionCount} from '../../services/versions.js';
 import {authenticate, requirePermission} from '../../middleware/auth.js';
 import {getConfig, saveConfig} from '../../config.js';
+import {ago, clip, plural} from '../../services/sidebarBadges.js';
+
+/**
+ * The sidebar badge on Pages (its countUrl): the drafts - unpublished work -
+ * with a popover of what is published, restricted and recently changed, and
+ * the drafts themselves, newest first. No drafts, no badge. Plain text
+ * throughout: the popover sets it with textContent.
+ *
+ * @param {object[]} pages - listPages()
+ * @param {number} [now]
+ */
+export function pagesBadge(pages, now = Date.now()) {
+    const list = pages || [];
+    const drafts = list.filter(p => p.status !== 'published')
+        .sort((a, b) => String(b.updatedAt || '').localeCompare(String(a.updatedAt || '')));
+    const restricted = list.filter(p => p.visibility && p.visibility !== 'public').length;
+    const week = list.filter(p => p.updatedAt && now - new Date(p.updatedAt).getTime() < 7 * 86_400_000).length;
+    return {
+        // The number stays what the sidebar has always shown on Pages (all of them); drafts are the label.
+        count: list.length,
+        label: drafts.length ? `${plural(list.length, 'page')}, ${plural(drafts.length, 'draft')}` : `${plural(list.length, 'page')}, no drafts`,
+        tone: 'info',
+        details: {
+            title: 'Pages',
+            rows: [
+                {label: 'Published', value: String(list.length - drafts.length)},
+                {label: 'Drafts', value: String(drafts.length)},
+                {label: 'Not public', value: String(restricted)},
+                {label: 'Changed this week', value: String(week)}
+            ],
+            items: drafts.slice(0, 6).map(p => ({
+                text: clip(p.title || p.urlPath),
+                meta: [p.urlPath, p.updatedAt ? ago(p.updatedAt, now) : ''].filter(Boolean).join(' · ')
+            })),
+            empty: 'No drafts - everything is published.'
+        }
+    };
+}
 
 export async function pagesRoutes(fastify) {
     const canRead = {preHandler: [authenticate, requirePermission('pages', 'read')]};
@@ -116,6 +155,9 @@ export async function pagesRoutes(fastify) {
         return { tags: [...tagSet].sort() };
     });
 
+    // The sidebar badge. Static, so it is matched before the /pages/* wildcard below.
+    fastify.get('/pages/_count', canRead, async () => pagesBadge(await listPages()));
+
     // List all pages
     fastify.get('/pages', canRead, async (request, reply) => {
         const pages = await listPages();
@@ -133,6 +175,10 @@ export async function pagesRoutes(fastify) {
             tags: p.tags || [],
             project: p.project ?? null,
             resolvedProject: p.resolvedProject ?? null,
+            // The list's "managed by a plugin" chip and delete warning read these;
+            // they were dropped here, so neither ever showed.
+            plugin: p.plugin || null,
+            bundled: p.bundled === true,
             updatedAt: p.updatedAt,
             createdAt: p.createdAt,
             versionCount: counts[i]

package/server/routes/api/projects.js

@@ -1,7 +1,8 @@
 /**
  * Projects API
  *
- * GET    /api/projects                       - list visible projects
+ * GET    /api/projects                       - list visible projects (?counts=1 adds per-type artefact counts)
+ * GET    /api/projects/_count                - the sidebar badge (the underscore can never be a slug)
  * GET    /api/projects/:slug                 - full project
  * POST   /api/projects                       - create
  * PUT    /api/projects/:slug                 - edit (slug immutable)
@@ -19,9 +20,12 @@ import {
     CORE_PROJECT_SLUG,
     createProject,
     deleteProject,
+    emptyGroups,
+    getArtefactsByProject,
     getArtefactsForProject,
     getProject,
     listProjectsForUser,
+    projectsBadge,
     untagAllForProject,
     updateProject
 } from '../../services/projects.js';
@@ -44,9 +48,19 @@ export async function projectsRoutes(fastify, opts = {}) {
     const canDelete = {preHandler: [authenticate, requirePermission('projects', 'delete')]};
 
     fastify.get('/projects', canRead, async (request) => {
-        return listProjectsForUser(request.user);
+        const list = await listProjectsForUser(request.user);
+        if (request.query?.counts !== '1') return list;
+        // One request for the Manage projects screen and the sidebar, and one pass over the artefacts.
+        const groups = await getArtefactsByProject().catch(() => ({}));
+        return list.map((p) => ({
+            ...p,
+            counts: Object.fromEntries(Object.entries(groups[p.slug] || emptyGroups()).map(([k, v]) => [k, v.length]))
+        }));
     });
 
+    // Registered before /projects/:slug; `_` is outside the slug alphabet, so no project can shadow it.
+    fastify.get('/projects/_count', canRead, async (request) => projectsBadge(await listProjectsForUser(request.user)));
+
     fastify.get('/projects/:slug', canRead, async (request, reply) => {
         const project = await getProject(request.params.slug);
         if (!project) return reply.status(404).send({error: 'Project not found'});

package/server/routes/api/theme.js

@@ -10,6 +10,7 @@
  *                            user - everyone's admin needs one)
  * POST /api/theme/compile  - compile a candidate config to CSS without saving,
  *                            so the admin previews exactly what the page gets
+ * GET  /api/theme/count    - the sidebar badge on Theme (themeBadge below)
  *
  * Auth middlewares are injectable so tests can pass no-ops, the same DI pattern
  * as menus.js and context-menus.js.
@@ -32,6 +33,57 @@ import {
     validateThemeConfig
 } from '../../services/themeSettings.js';
 
+/**
+ * The sidebar badge on Content › Theme. It REPLACES the core count the sidebar
+ * shows there (how many element overrides - a registered countUrl wins), so it
+ * keeps that number, and adds two things: a popover saying what is live where,
+ * and a red count when a theme in use no longer exists (a custom theme whose
+ * plugin went away - the page keeps its base, but the look it was given is
+ * gone). Plain text throughout.
+ *
+ * Mirrors themeProblems() in admin/js/lib/theme-settings-arrange.js.
+ *
+ * @param {object} cfg
+ * @param {string[]} builtins - listThemeIds()
+ * @param {string[]} custom   - ids of the custom themes plugins offer now
+ */
+/** Themes Domma knows without the stylesheet declaring them (resolveThemeClasses passes them through). */
+export const DOMMA_OWN_THEMES = ['core-light', 'core-dark'];
+
+export function themeBadge(cfg = {}, builtins = [], custom = []) {
+    // No catalogue (the stylesheet did not load) means nothing can be judged -
+    // the same rule as themeProblems() in admin/js/lib/theme-settings-arrange.js.
+    const known = builtins.length ? new Set([...builtins, ...custom, ...DOMMA_OWN_THEMES]) : null;
+    const auto = cfg.autoTheme?.enabled ? cfg.autoTheme : null;
+    const problems = [];
+    const check = (where, id) => { if (known && id && !known.has(id)) problems.push({where, id}); };
+    if (auto) { check('Day theme', auto.dayTheme); check('Night theme', auto.nightTheme); }
+    else check('Site theme', cfg.theme);
+    check('Admin theme', cfg.adminTheme);
+    const overrides = Array.isArray(cfg.overrides) ? cfg.overrides : [];
+    overrides.forEach((o, i) => check(`Override "${o.label || o.scope || i + 1}"`, o.theme));
+    const on = overrides.filter(o => o.enabled !== false).length;
+    const n = problems.length;
+    const plural = (k, one) => `${k} ${one}${k === 1 ? '' : 's'}`;
+    return {
+        count: n || overrides.length,
+        label: n ? `${plural(n, 'theme')} in use no longer available` : plural(overrides.length, 'element override'),
+        tone: n ? 'danger' : 'info',
+        details: {
+            title: 'Theme',
+            rows: [
+                auto
+                    ? {label: 'Site (day / night)', value: `${auto.dayTheme} / ${auto.nightTheme}`}
+                    : {label: 'Site theme', value: String(cfg.theme || '-')},
+                {label: 'Admin theme', value: String(cfg.adminTheme || '-')},
+                {label: 'Element overrides', value: `${on} on${overrides.length - on ? `, ${overrides.length - on} off` : ''}`}
+            ],
+            items: problems.slice(0, 8).map(p => ({text: `${p.where}: ${p.id}`, meta: 'no longer available - showing its base', tone: 'danger'})),
+            empty: 'Every theme in use is available.'
+        }
+    };
+}
+
 export async function themeRoutes(fastify, opts = {}) {
     const authenticate      = opts.authenticate      || defaultAuthenticate;
     const requirePermission = opts.requirePermission || defaultRequirePermission;
@@ -41,6 +93,9 @@ export async function themeRoutes(fastify, opts = {}) {
 
     fastify.get('/theme', canRead, async () => loadThemeConfig());
 
+    fastify.get('/theme/count', canRead, async () =>
+        themeBadge(await loadThemeConfig(), listThemeIds(), listCustomThemes().map(t => t.id)));
+
     // The editor's theme picker and token picker build themselves from this
     // rather than from a hardcoded list that would drift from the CSS.
     fastify.get('/theme/catalog', canRead, async () => ({

package/server/routes/api/views.js

@@ -2,7 +2,8 @@
  * Views API
  *
  * Admin endpoints (authenticated + views permission):
- * GET    /views                     - List all view configs
+ * GET    /views                     - List all view configs (?sources=1 adds `sourceInfo` per view)
+ * GET    /views/_count              - The sidebar badge (the underscore is outside the slug alphabet)
  * POST   /views                     - Create view config
  * GET    /views/:slug               - Get view config
  * PUT    /views/:slug               - Update view config
@@ -13,11 +14,17 @@
  * Public endpoint (role-checked per view access config):
  * GET    /views/:slug/public        - Execute view publicly
  */
-import {createView, deleteView, executeView, getView, listViews, updateView} from '../../services/views.js';
+import {createView, deleteView, executeView, getView, listViews, updateView, viewsBadge} from '../../services/views.js';
 import {authenticate, requirePermission} from '../../middleware/auth.js';
 import {getRoleLevel} from '../../services/roles.js';
 import {getEffectiveLevel} from '../../services/userRoles.js';
 
+/** Every collection by slug - a missing one is a view whose source was deleted. */
+async function collectionsBySlug() {
+    const {listCollections} = await import('../../services/collections.js');
+    return new Map((await listCollections().catch(() => [])).map(c => [c.slug, c]));
+}
+
 export async function viewsRoutes(fastify) {
     const canRead = {preHandler: [authenticate, requirePermission('views', 'read')]};
     const canCreate = {preHandler: [authenticate, requirePermission('views', 'create')]};
@@ -33,7 +40,18 @@ export async function viewsRoutes(fastify) {
             const {canSeeArtefact} = await import('../../services/projects.js');
             const all = await listViews();
             // listViews returns full records with meta inline - filter directly
-            return all.filter(v => canSeeArtefact(request.user, v));
+            const visible = all.filter(v => canSeeArtefact(request.user, v));
+            if (request.query?.sources !== '1') return visible;
+            // The Views screen: what each view reads from - whether that collection still
+            // exists, its title and its storage (MongoDB runs native aggregation, file
+            // collections the JS pipeline). A views user need not hold collections.read.
+            const bySlug = await collectionsBySlug();
+            return visible.map(v => {
+                const c = bySlug.get(v.pipeline?.source);
+                return {...v, sourceInfo: c
+                    ? {exists: true, title: c.title || c.slug, adapter: c.storage?.adapter || 'file'}
+                    : {exists: false}};
+            });
         } catch (err) {
             return reply.status(503).send({ error: err.message });
         }
@@ -49,6 +67,12 @@ export async function viewsRoutes(fastify) {
         }
     });
 
+    fastify.get('/views/_count', canRead, async (request) => {
+        const {canSeeArtefact} = await import('../../services/projects.js');
+        const visible = (await listViews()).filter(v => canSeeArtefact(request.user, v));
+        return viewsBadge(visible, new Set((await collectionsBySlug()).keys()));
+    });
+
     // Static sub-routes must be declared before the parameterised :slug route
     // so Fastify's radix router gives them priority.
     fastify.get('/views/collection/:collectionSlug', canRead, async (request, reply) => {

package/server/server.js

@@ -525,6 +525,25 @@ registerSidebarItem({item: {source: 'Built in', text: 'Notes', url: '#/notes', i
 registerSidebarItem({item: {source: 'Built in', text: 'Todo', url: '#/todo', icon: 'check-square', permission: 'todo', countUrl: '/api/todo/count'}});
 registerSidebarItem({item: {source: 'Built in', text: 'Analytics', url: '#/analytics', icon: 'chart-bar', permission: 'analytics', countUrl: '/api/analytics/active-count'}});
 registerSidebarItem({item: {source: 'Built in', text: 'Contacts', url: '#/contacts', icon: 'users', permission: 'contacts'}});
+// Manage projects lives in the menu (the Projects folder, sidebar-migration.js);
+// registering it here only adds its badge - the renderer merges a registered
+// item into the menu node with the same url rather than adding a second one.
+registerSidebarItem({folder: 'projects', item: {source: 'Built in', text: 'Manage projects', url: '#/projects', icon: 'folder', permission: 'projects', countUrl: '/api/projects/_count', inventory: true}});
+// Content and Data: the same - each merges into its menu entry and brings its badge
+// (which keeps the number the sidebar always showed there; the popover says more).
+// `inventory`: a how-many count, left out of a closed folder's total (sidebar-renderer).
+registerSidebarItem({folder: 'content', item: {source: 'Built in', text: 'Pages', url: '#/pages', icon: 'file-text', permission: 'pages', countUrl: '/api/pages/_count', inventory: true}});
+registerSidebarItem({folder: 'content', item: {source: 'Built in', text: 'Media', url: '#/media', icon: 'image', permission: 'media', countUrl: '/api/media/_count', inventory: true}});
+registerSidebarItem({folder: 'content', item: {source: 'Built in', text: 'Menus', url: '#/menus', icon: 'menu', permission: 'menus', countUrl: '/api/menus/_count', inventory: true}});
+registerSidebarItem({folder: 'content', item: {source: 'Built in', text: 'Context Menus', url: '#/context-menus', icon: 'menu', permission: 'context-menus', countUrl: '/api/context-menus/_count', inventory: true}});
+registerSidebarItem({folder: 'content', item: {source: 'Built in', text: 'Theme', url: '#/theme', icon: 'droplet', permission: 'theme', countUrl: '/api/theme/count', inventory: true}});
+registerSidebarItem({folder: 'data', item: {source: 'Built in', text: 'Collections', url: '#/collections', icon: 'database', permission: 'collections', countUrl: '/api/collections/_count', inventory: true}});
+registerSidebarItem({folder: 'data', item: {source: 'Built in', text: 'Forms', url: '#/forms', icon: 'layout', permission: 'collections', countUrl: '/api/forms/_count', inventory: true}});
+registerSidebarItem({folder: 'data', item: {source: 'Built in', text: 'Views', url: '#/views', icon: 'eye', permission: 'views', countUrl: '/api/views/_count', inventory: true}});
+registerSidebarItem({folder: 'data', item: {source: 'Built in', text: 'Actions', url: '#/actions', icon: 'zap', permission: 'actions', countUrl: '/api/actions/_count', inventory: true}});
+registerSidebarItem({folder: 'data', item: {source: 'Built in', text: 'API Builder', url: '#/api-endpoints', icon: 'code', permission: 'api-endpoints', countUrl: '/api/api-endpoints/_count', inventory: true}});
+registerSidebarItem({folder: 'data', item: {source: 'Built in', text: 'Blocks', url: '#/blocks', icon: 'box', permission: 'pages', countUrl: '/api/blocks/_count', inventory: true}});
+registerSidebarItem({folder: 'data', item: {source: 'Built in', text: 'Components', url: '#/components', icon: 'component', permission: 'components', countUrl: '/api/components/_count', inventory: true}});
 
 await registerPlugins(app);
 

package/server/services/contextMenus.js

@@ -475,3 +475,44 @@ export function toClientPayload(menu) {
         items: menu.items || []
     };
 }
+
+/**
+ * The sidebar badge on Context Menus (its countUrl, GET /api/context-menus/_count):
+ * how many menus there are, with the ones switched off and the ones whose
+ * binding matches nothing called out - an enabled menu that never appears is
+ * the one thing here worth a second look. Plain text throughout: the popover
+ * sets it with textContent.
+ *
+ * @param {object[]} menus - as listContextMenus returns them
+ * @returns {{count: number, label: string, tone: string, details: object}}
+ */
+export function contextMenusBadge(menus = []) {
+    const list = [...menus].sort((a, b) => String(a.name || a.slug).localeCompare(String(b.name || b.slug)));
+    const off = list.filter(m => m.enabled === false);
+    const never = list.filter(m => m.enabled !== false && m.binding
+        && !(m.binding.projects || []).length && !(m.binding.pages || []).length);
+    const siteWide = list.filter(m => m.enabled !== false && !m.binding).length;
+    const n = list.length;
+    const bits = [off.length && `${off.length} off`, never.length && `${never.length} never matching`].filter(Boolean);
+    return {
+        count: n,
+        label: `${n} context menu${n === 1 ? '' : 's'}${bits.length ? `, ${bits.join(', ')}` : ''}`,
+        tone: never.length ? 'attention' : 'info',
+        details: {
+            title: 'Context Menus',
+            rows: [
+                {label: 'On', value: String(n - off.length)},
+                {label: 'Off', value: String(off.length)},
+                {label: 'Site-wide', value: String(siteWide)},
+                {label: 'Never matching', value: String(never.length), ...(never.length && {tone: 'danger'})}
+            ],
+            items: list.slice(0, 8).map(m => ({
+                text: String(m.name || m.slug),
+                meta: [m.selector || 'no target', `${m.itemsCount ?? 0} item${m.itemsCount === 1 ? '' : 's'}`,
+                    m.enabled === false ? 'off' : '', never.includes(m) ? 'never matches' : ''].filter(Boolean).join(' · '),
+                ...(never.includes(m) && {tone: 'danger'})
+            })),
+            empty: 'No context menus yet.'
+        }
+    };
+}

package/server/services/projects.js

@@ -108,8 +108,16 @@ export async function getProject(slug) {
  * @returns {Promise<object>} The persisted project record.
  * @throws {Error} If validation fails or the slug already exists.
  */
+/**
+ * Slugs a NEW project cannot take: `#/projects/new` and `#/projects/edit/…`
+ * are admin addresses, so a project called either could never be opened.
+ * (Checked on create only - an existing record keeps working.)
+ */
+export const RESERVED_PROJECT_SLUGS = ['new', 'edit'];
+
 export async function createProject(input) {
     const errors = validateProject(input);
+    if (RESERVED_PROJECT_SLUGS.includes(input?.slug)) errors.push(`"${input.slug}" is reserved - the admin uses it in its own addresses`);
     if (errors.length) throw new Error('Validation failed: ' + errors.join('; '));
     if (await getProject(input.slug)) {
         throw new Error(`Project "${input.slug}" already exists`);
@@ -397,23 +405,28 @@ export async function getProjectForPage(urlPath, explicitProject) {
     return best ?? coreFallback;
 }
 
+/** The per-type buckets every project's artefacts are grouped into. */
+export function emptyGroups() {
+    return {
+        pages: [], collections: [], forms: [], actions: [],
+        menus: [], blocks: [], components: [], views: [], roles: [], users: [], apis: []
+    };
+}
+
 /**
- * Enumerate every artefact belonging to the given project. Returns a flat
- * grouping by type - each value is an array of artefact summary objects.
- * Used by the project detail page (counts + per-type tabs).
+ * Every artefact, grouped by the project it resolves to - ONE pass over each
+ * artefact type, however many projects there are. The Manage projects list
+ * (GET /api/projects?counts=1) needs every project's counts, and asking
+ * getArtefactsForProject once per project re-read every artefact N times.
  *
- * Membership is by resolution, not tag equality: artefacts without a
- * `meta.project` tag belong to the core project, so
- * `getArtefactsForProject('core')` enumerates everything unclaimed.
+ * Membership is by resolution, not tag equality: an artefact without a
+ * `meta.project` tag lands under core.
  *
- * @param {string} projectSlug
- * @returns {Promise<{pages:object[], collections:object[], forms:object[], actions:object[], menus:object[], blocks:object[], components:object[], views:object[], roles:object[], users:object[], apis:object[]}>}
+ * @returns {Promise<Record<string, ReturnType<typeof emptyGroups>>>} keyed by project slug; a project with nothing is absent
  */
-export async function getArtefactsForProject(projectSlug) {
-    const out = {
-        pages: [], collections: [], forms: [], actions: [],
-        menus: [], blocks: [], components: [], views: [], roles: [], users: [], apis: []
-    };
+export async function getArtefactsByProject() {
+    const groups = {};
+    const out = (slug) => (groups[slug] ??= emptyGroups());
 
     // The three loops below re-read each artefact by slug; guard PER ITEM so a
     // single unreadable artefact (e.g. a form whose internal slug doesn't match
@@ -423,7 +436,7 @@ export async function getArtefactsForProject(projectSlug) {
         for (const m of await listMenus()) {
             try {
                 const full = await getMenu(m.slug);
-                if (resolveArtefactProject(full) === projectSlug) out.menus.push(m);
+                out(resolveArtefactProject(full)).menus.push(m);
             } catch { /* skip broken menu */ }
         }
     } catch { /* service unavailable */ }
@@ -433,7 +446,7 @@ export async function getArtefactsForProject(projectSlug) {
         for (const f of await listForms()) {
             try {
                 const full = await readForm(f.slug);
-                if (resolveArtefactProject(full) === projectSlug) out.forms.push(f);
+                out(resolveArtefactProject(full)).forms.push(f);
             } catch { /* skip broken form */ }
         }
     } catch { /* skip */ }
@@ -443,7 +456,7 @@ export async function getArtefactsForProject(projectSlug) {
         for (const c of await listCollections()) {
             try {
                 const full = await getCollection(c.slug);
-                if (resolveArtefactProject(full) === projectSlug) out.collections.push(c);
+                out(resolveArtefactProject(full)).collections.push(c);
             } catch { /* skip broken collection */ }
         }
     } catch { /* skip */ }
@@ -451,7 +464,7 @@ export async function getArtefactsForProject(projectSlug) {
     try {
         const {listActions} = await import('./actions.js');
         for (const a of await listActions()) {
-            if (resolveArtefactProject(a) === projectSlug) out.actions.push(a);
+            out(resolveArtefactProject(a)).actions.push(a);
         }
     } catch { /* skip */ }
 
@@ -460,7 +473,7 @@ export async function getArtefactsForProject(projectSlug) {
         // per-block read is needed. (Blocks are keyed by `name`, not `slug`.)
         const {listBlocks} = await import('./blocks.js');
         for (const b of await listBlocks()) {
-            if (resolveArtefactProject(b) === projectSlug) out.blocks.push(b);
+            out(resolveArtefactProject(b)).blocks.push(b);
         }
     } catch { /* skip */ }
 
@@ -469,28 +482,28 @@ export async function getArtefactsForProject(projectSlug) {
         // per-component read is needed. (Components are keyed by `name`.)
         const {listComponents} = await import('./components.js');
         for (const c of await listComponents()) {
-            if (resolveArtefactProject(c) === projectSlug) out.components.push(c);
+            out(resolveArtefactProject(c)).components.push(c);
         }
     } catch { /* skip */ }
 
     try {
         const {listViews} = await import('./views.js');
         for (const v of await listViews()) {
-            if (resolveArtefactProject(v) === projectSlug) out.views.push(v);
+            out(resolveArtefactProject(v)).views.push(v);
         }
     } catch { /* skip */ }
 
     try {
         const {getRoleMap} = await import('./roles.js');
         for (const role of getRoleMap().values()) {
-            if (resolveArtefactProject(role) === projectSlug) out.roles.push(role);
+            out(resolveArtefactProject(role)).roles.push(role);
         }
     } catch { /* skip */ }
 
     try {
         const {listUsers} = await import('./users.js');
         for (const u of await listUsers()) {
-            if (resolveArtefactProject(u) === projectSlug) out.users.push(u);
+            out(resolveArtefactProject(u)).users.push(u);
         }
     } catch { /* skip */ }
 
@@ -500,7 +513,7 @@ export async function getArtefactsForProject(projectSlug) {
             const url = p.url || p.urlPath || '/';
             const explicit = (p.project === undefined) ? undefined : p.project;
             const pageProject = await getProjectForPage(url, explicit);
-            if (pageProject === projectSlug) out.pages.push(p);
+            out(pageProject).pages.push(p);
         }
     } catch { /* skip */ }
 
@@ -509,13 +522,27 @@ export async function getArtefactsForProject(projectSlug) {
         // field - no untagged-→core fallback applies, so match directly).
         const {entries} = await listEntries('api-endpoints', {limit: 0});
         for (const e of entries) {
-            if (e.data?.project === projectSlug) {
-                out.apis.push({id: e.id, name: e.data.name, path: e.data.path, collection: e.data.collection});
+            if (e.data?.project) {
+                out(e.data.project).apis.push({id: e.id, name: e.data.name, path: e.data.path, collection: e.data.collection});
             }
         }
     } catch { /* skip */ }
 
-    return out;
+    return groups;
+}
+
+/**
+ * Enumerate every artefact belonging to the given project. Returns a flat
+ * grouping by type - each value is an array of artefact summary objects.
+ * Used by the project detail page (counts + per-type tabs).
+ *
+ * `getArtefactsForProject('core')` enumerates everything unclaimed.
+ *
+ * @param {string} projectSlug
+ * @returns {Promise<ReturnType<typeof emptyGroups>>}
+ */
+export async function getArtefactsForProject(projectSlug) {
+    return (await getArtefactsByProject())[projectSlug] ?? emptyGroups();
 }
 
 /**
@@ -644,3 +671,36 @@ export async function untagAllForProject(projectSlug) {
 
     return counts;
 }
+
+/**
+ * The sidebar badge on Manage projects (its countUrl, GET /api/projects/_count):
+ * how many projects this user sees - a count to glance at, not a warning -
+ * with the disabled ones called out. Plain text throughout: the
+ * popover sets it with textContent.
+ *
+ * @param {object[]} projects - as listProjectsForUser returns them
+ * @returns {{count: number, label: string, tone: string, details: object}}
+ */
+export function projectsBadge(projects = []) {
+    const list = [...projects].sort((a, b) => (a.sortOrder ?? 0) - (b.sortOrder ?? 0)
+        || String(a.name || a.slug).localeCompare(String(b.name || b.slug)));
+    const off = list.filter(p => p.enabled === false);
+    const n = list.length;
+    return {
+        count: n,
+        label: `${n} project${n === 1 ? '' : 's'}${off.length ? `, ${off.length} disabled` : ''}`,
+        tone: 'info',
+        details: {
+            title: 'Projects',
+            rows: [
+                {label: 'Enabled', value: String(n - off.length)},
+                {label: 'Disabled', value: String(off.length)}
+            ],
+            items: list.slice(0, 8).map(p => ({
+                text: String(p.name || p.slug),
+                meta: [p.slug, p.rootUrl, p.enabled === false ? 'disabled' : '', p.protected ? 'built in' : ''].filter(Boolean).join(' · ')
+            })),
+            empty: 'No projects yet.'
+        }
+    };
+}