dropsh 0.3.3 → 0.5.1

package/README.md

@@ -55,14 +55,18 @@ Optional modules unlock stricter schemas or builder-specific support:
 | Feature | Drupal modules |
 | --- | --- |
 | OAuth2 login | `simple_oauth` |
-| Authoritative schemas | `schemata`, `schemata_json_schema` |
+| Authoritative schemas (Drupal 10.1+/11) | `jsonapi_schema` |
+| Authoritative schemas (legacy; 500s on D11/PHP 8.4) | `schemata`, `schemata_json_schema` |
 | Canvas schemas | `canvas`, `jsonapi_sdc` |
 | Display Builder schemas | `display_builder`, `display_builder_entity_view`, `jsonapi_sdc` |
 
-dropsh works without the Schemata modules. In that case, `dropsh schema` falls
-back to a shallow schema inferred from JSON:API sample records. Installing
-`schemata` and `schemata_json_schema` lets `@dropsh/plugin-schemata` return a
-more precise schema with Drupal's required fields and constraints.
+dropsh works without an authoritative-schema module. In that case, `dropsh
+schema` falls back to a shallow schema inferred from JSON:API sample records.
+Installing `jsonapi_schema` lets `@dropsh/plugin-jsonapi-schema` return a more
+precise schema with Drupal's required fields, formats, and constraints — so
+`create`/`update` reject malformed payloads client-side. On **Drupal 11 / PHP
+8.4** prefer `jsonapi_schema`: the older `schemata_json_schema` endpoint returns
+HTTP 500 there.
 
 ### Installing the Drupal modules
 
@@ -77,16 +81,21 @@ drush en jsonapi
 composer require drupal/simple_oauth
 drush en simple_oauth
 
-# Optional: authoritative schemas (schemata_json_schema is a submodule
-# of the schemata project)
-composer require drupal/schemata
-drush en schemata schemata_json_schema
-drush role:perm:add "content_editor" "access schemata data models"
+# Optional: authoritative schemas (Drupal 10.1+/11, PHP 8.4) — recommended
+composer require drupal/jsonapi_schema
+drush en jsonapi_schema
+
+# Legacy alternative — the schemata endpoint returns HTTP 500 on
+# Drupal 11 / PHP 8.4; prefer jsonapi_schema there.
+# composer require drupal/schemata
+# drush en schemata schemata_json_schema
+# drush role:perm:add "content_editor" "access schemata data models"
 ```
 
-Grant `access schemata data models` to the role used by dropsh. For OAuth2, that
-means the user role or client credential access context that reads the Schemata
-endpoint.
+`jsonapi_schema` serves its routes under the JSON:API prefix (`/jsonapi/*`), so
+the role/consumer used by dropsh needs no extra permission beyond JSON:API
+access. (The legacy `schemata` endpoint instead needs `access schemata data
+models` on that role.)
 
 By default JSON:API only accepts read operations. To create, update, or delete
 entities through dropsh, set **Accept all JSON:API create, read, update, and
@@ -103,7 +112,7 @@ store.
 ```js
 import { basicAuthPlugin } from "dropsh";
 import { oauth2Plugin } from "@dropsh/plugin-oauth2";
-import { schemataPlugin } from "@dropsh/plugin-schemata";
+import { jsonapiSchemaPlugin } from "@dropsh/plugin-jsonapi-schema";
 
 export default {
   site: {
@@ -121,7 +130,7 @@ export default {
       client_id: "my-client",
       token_url: "https://my-drupal.example.com/oauth/token",
     }),
-    schemataPlugin(),
+    jsonapiSchemaPlugin(),
   ],
 };
 ```

package/dist/src/core/config.js

@@ -1,13 +1,76 @@
+import { createRequire } from "node:module";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { ConfigError } from "../errors.js";
 function isRecord(v) {
     return !!v && typeof v === "object" && !Array.isArray(v);
 }
+/**
+ * A plugin descriptor is plain config data that names a plugin package as a
+ * string (`plugin`). This lets a committed config stay import-free: the config
+ * carries only data, and dropsh resolves + constructs the plugin from its own
+ * install — so nothing has to resolve the plugin package from the config file's
+ * own `import` statements (which resolve relative to the config file, not the CLI).
+ */
+function isPluginDescriptor(e) {
+    return isRecord(e) && typeof e.plugin === "string";
+}
+/**
+ * Resolve a named plugin package the way ESLint resolves plugins: by string
+ * name, relative to the config file first, then the cwd, then dropsh's own
+ * install (so a plugin installed alongside dropsh — a dropsh dep, or globally
+ * next to a global dropsh, or via `npx -p`— is found). The config never imports
+ * the package itself.
+ */
+async function loadNamedPlugin(entry, configPath) {
+    const name = entry.plugin;
+    const bases = [
+        pathToFileURL(configPath).href,
+        pathToFileURL(`${process.cwd()}/`).href,
+        import.meta.url,
+    ];
+    let resolved;
+    for (const base of bases) {
+        try {
+            resolved = createRequire(base).resolve(name);
+            break;
+        }
+        catch {
+            // try the next base
+        }
+    }
+    if (resolved === undefined)
+        throw new ConfigError(`cannot resolve plugin '${name}'. Install it next to dropsh (project dep, dropsh dep, global next to a global dropsh, or 'npx -p dropsh -p ${name}').`);
+    let mod;
+    try {
+        mod = (await import(pathToFileURL(resolved).href));
+    }
+    catch (err) {
+        throw new ConfigError(`cannot load plugin '${name}'`, { cause: String(err) });
+    }
+    const exportName = typeof entry.export === "string" ? entry.export : "default";
+    const factory = mod[exportName];
+    if (typeof factory !== "function")
+        throw new ConfigError(`plugin '${name}' has no callable export '${exportName}'`);
+    return factory(entry.with ?? entry.options);
+}
+/**
+ * Expands `plugins[]` entries: named-package descriptors are resolved + built
+ * into real plugins; already-constructed plugins pass through unchanged
+ * (backward compat).
+ */
+async function resolvePlugins(raw, configPath) {
+    if (!Array.isArray(raw))
+        return [];
+    return Promise.all(raw.map((entry) => isPluginDescriptor(entry)
+        ? loadNamedPlugin(entry, configPath)
+        : Promise.resolve(entry)));
+}
 export async function loadConfig(filePath) {
+    const configPath = resolve(filePath);
     let mod;
     try {
-        mod = await import(pathToFileURL(resolve(filePath)).href);
+        mod = await import(pathToFileURL(configPath).href);
     }
     catch (err) {
         throw new ConfigError(`Cannot load config file: ${filePath}`, { cause: String(err) });
@@ -21,7 +84,7 @@ export async function loadConfig(filePath) {
     if (typeof site.base_url !== "string" || site.base_url.length === 0)
         throw new ConfigError("site.base_url required");
     const defaults = isRecord(raw.defaults) ? raw.defaults : {};
-    const plugins = Array.isArray(raw.plugins) ? raw.plugins : [];
+    const plugins = await resolvePlugins(raw.plugins, configPath);
     return {
         site: {
             base_url: site.base_url,

package/dist/src/core/schema/jsonschema-source.js

@@ -4,7 +4,13 @@ export async function fetchJsonSchema(deps) {
     const { entity, bundle } = deps;
     const target = { entity_type: entity, bundle };
     const plugins = deps.plugins ?? [];
-    const ctx = { http: deps.http, auth: deps.auth, baseUrl: deps.baseUrl };
+    const ctx = {
+        http: deps.http,
+        auth: deps.auth,
+        baseUrl: deps.baseUrl,
+        jsonapiPrefix: deps.jsonapiPrefix,
+        warn: deps.warn,
+    };
     // Build heuristic base schema
     let heuristicResult;
     try {

package/dist/src/core/schema/validate.js

@@ -1,9 +1,16 @@
 import Ajv from "ajv";
 import draft6MetaSchema from "ajv/dist/refs/json-schema-draft-06.json" with { type: "json" };
 import draft7MetaSchema from "ajv/dist/refs/json-schema-draft-07.json" with { type: "json" };
+import addFormats from "ajv-formats";
 import { ValidationError } from "../../errors.js";
 export function validatePayload(schema, payload, target) {
     const ajv = new Ajv({ allErrors: true, strict: false, validateSchema: false, logger: false });
+    // Enforce standard `format` keywords (uri, date-time, uuid, email, …) so a
+    // constraint-bearing schema (e.g. from the jsonapi-schema plugin) rejects a
+    // malformed value — such as an SCP-style git remote where a URI is required —
+    // client-side, before the request is sent. Schemas without `format` are
+    // unaffected.
+    addFormats(ajv);
     // Schemata (Drupal module) may emit Draft-04 schemas that use `id` instead of `$id`.
     // AJV v8 hard-throws on `id`; removing the keyword makes AJV silently ignore it.
     ajv.removeKeyword("id");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dropsh",
-  "version": "0.3.3",
+  "version": "0.5.1",
   "description": "Entity-agnostic helper CLI for Drupal 11 JSON:API, used by the dropsh Claude skill for editorial publishing workflows.",
   "type": "module",
   "bin": {
@@ -34,6 +34,7 @@
   },
   "dependencies": {
     "ajv": "^8.18.0",
+    "ajv-formats": "^3.0.1",
     "commander": "^12.1.0",
     "drupal-jsonapi-params": "^3.0.1",
     "open": "^11.0.0"