emdash 0.36.0 → 0.38.0

package/src/api/handlers/manifest.ts

@@ -2,13 +2,57 @@
  * Manifest generation handlers
  */
 
+import type { Kysely } from "kysely";
+
+import type { Database } from "../../database/types.js";
+import { SchemaRegistry } from "../../schema/registry.js";
+import { MAX_COLLECTION_LIST_COLUMNS } from "../../schema/types.js";
+import type { Field, FieldType } from "../../schema/types.js";
 import { hashString } from "../../utils/hash.js";
-import type { ManifestResponse, FieldDescriptor } from "../types.js";
+import type {
+	FieldDescriptor,
+	ManifestCollectionMap,
+	ManifestFieldDescriptor,
+	ManifestResponse,
+} from "../types.js";
 
 /** Pattern to add spaces before capital letters */
 const CAMEL_CASE_PATTERN = /([A-Z])/g;
 const FIRST_CHAR_PATTERN = /^./;
 
+/**
+ * Map schema field types to editor field kinds.
+ */
+/** Field types that can be surfaced as list columns in the admin. */
+const LIST_COLUMN_FIELD_TYPES: ReadonlySet<FieldType> = new Set([
+	"string",
+	"number",
+	"integer",
+	"boolean",
+	"datetime",
+	"select",
+	"multiSelect",
+]);
+
+const FIELD_TYPE_TO_KIND: Record<FieldType, string> = {
+	string: "string",
+	slug: "string",
+	url: "url",
+	text: "richText",
+	number: "number",
+	integer: "number",
+	boolean: "boolean",
+	datetime: "datetime",
+	select: "select",
+	multiSelect: "multiSelect",
+	portableText: "portableText",
+	image: "image",
+	file: "file",
+	reference: "reference",
+	json: "json",
+	repeater: "repeater",
+};
+
 // Collection definition shape for manifest generation
 interface CollectionDefinition {
 	schema: {
@@ -24,6 +68,10 @@ interface CollectionDefinition {
 }
 type CollectionMap = Record<string, CollectionDefinition>;
 
+interface GenerateManifestOptions {
+	db?: Kysely<Database> | null;
+}
+
 /**
  * Generate admin manifest from collections
  */
@@ -36,8 +84,33 @@ export async function generateManifest(
 			widgets?: string[];
 		}
 	> = {},
+	options: GenerateManifestOptions = {},
 ): Promise<ManifestResponse> {
-	const manifestCollections: ManifestResponse["collections"] = {};
+	const manifestCollections = await buildManifestCollections(collections, options.db);
+
+	// Generate hash from collections (for cache invalidation)
+	const hash = await hashString(JSON.stringify(manifestCollections));
+
+	return {
+		version: "0.1.0",
+		hash,
+		collections: manifestCollections,
+		plugins,
+	};
+}
+
+/**
+ * Build collection descriptors from build-time config plus live database rows.
+ *
+ * Config collections are added first and win on slug conflicts. Runtime/manual
+ * collections have no Zod schema to inspect, so their field descriptors are
+ * synthesized from `_emdash_fields`.
+ */
+export async function buildManifestCollections(
+	collections: CollectionMap,
+	db?: Kysely<Database> | null,
+): Promise<ManifestCollectionMap> {
+	const manifestCollections: ManifestCollectionMap = {};
 
 	for (const [name, definition] of Object.entries(collections)) {
 		// Extract field descriptors from Zod schema
@@ -47,20 +120,66 @@ export async function generateManifest(
 			label: definition.admin.label,
 			labelSingular: definition.admin.labelSingular || definition.admin.label,
 			supports: definition.admin.supports || [],
+			hasSeo: (definition.admin.supports || []).includes("seo"),
 			routable: definition.admin.routable ?? true,
 			fields,
 		};
 	}
 
-	// Generate hash from collections (for cache invalidation)
-	const hash = await hashString(JSON.stringify(manifestCollections));
+	if (!db) return manifestCollections;
 
-	return {
-		version: "0.1.0",
-		hash,
-		collections: manifestCollections,
-		plugins,
-	};
+	try {
+		const registry = new SchemaRegistry(db);
+		const dbCollections = await registry.listCollectionsWithFields();
+		for (const collection of dbCollections) {
+			if (manifestCollections[collection.slug]) continue;
+
+			const fields: Record<string, ManifestFieldDescriptor> = {};
+			for (const field of collection.fields) {
+				fields[field.slug] = dbFieldDescriptor(field);
+			}
+
+			const configuredListColumns = collection.admin?.listColumns ?? [];
+			const fieldTypes = new Map(collection.fields.map((field) => [field.slug, field.type]));
+			const listColumns: string[] = [];
+			for (const slug of configuredListColumns) {
+				if (listColumns.includes(slug)) continue;
+				const fieldType = fieldTypes.get(slug);
+				if (!fieldType || !LIST_COLUMN_FIELD_TYPES.has(fieldType)) {
+					console.warn(
+						`EmDash: Ignoring unsupported or unknown list column "${slug}" in collection "${collection.slug}".`,
+					);
+					continue;
+				}
+				if (listColumns.length >= MAX_COLLECTION_LIST_COLUMNS) {
+					console.warn(
+						`EmDash: Collection "${collection.slug}" declares more than ${MAX_COLLECTION_LIST_COLUMNS} list columns; extra columns are ignored.`,
+					);
+					break;
+				}
+				listColumns.push(slug);
+			}
+
+			manifestCollections[collection.slug] = {
+				label: collection.label,
+				labelSingular: collection.labelSingular || collection.label,
+				supports: collection.supports || [],
+				hasSeo: collection.hasSeo,
+				urlPattern: collection.urlPattern,
+				routable: collection.routable !== false,
+				titleField: collection.titleField,
+				dateField: collection.dateField,
+				...(collection.hidden ? { hidden: true } : {}),
+				...(collection.group ? { group: collection.group } : {}),
+				listColumns: listColumns.length > 0 ? listColumns : undefined,
+				fields,
+			};
+		}
+	} catch (error) {
+		console.debug("EmDash: Could not load database collections for manifest:", error);
+	}
+
+	return manifestCollections;
 }
 
 /**
@@ -70,8 +189,8 @@ export async function generateManifest(
 function extractFieldDescriptors(schema: {
 	_def?: { shape?: () => Record<string, unknown> };
 	shape?: Record<string, unknown>;
-}): Record<string, FieldDescriptor> {
-	const fields: Record<string, FieldDescriptor> = {};
+}): Record<string, ManifestFieldDescriptor> {
+	const fields: Record<string, ManifestFieldDescriptor> = {};
 
 	// Handle Zod object schema
 	const shape = typeof schema._def?.shape === "function" ? schema._def.shape() : schema.shape || {};
@@ -149,6 +268,37 @@ function extractFieldType(name: string, schema: unknown): FieldDescriptor {
 	}
 }
 
+function dbFieldDescriptor(field: Field): ManifestFieldDescriptor {
+	const entry: ManifestFieldDescriptor = {
+		kind: FIELD_TYPE_TO_KIND[field.type] ?? "string",
+		label: field.label,
+		required: field.required,
+		id: field.id,
+	};
+
+	if (field.widget) entry.widget = field.widget;
+	if (field.options) entry.options = field.options;
+
+	// Legacy: select/multiSelect enum options live on `field.validation.options`.
+	// They win over widget options to preserve existing select behavior.
+	if (field.validation?.options) {
+		entry.options = field.validation.options.map((value) => ({
+			value,
+			label: value.charAt(0).toUpperCase() + value.slice(1),
+		}));
+	}
+
+	// Include validation only for field widgets that need it client-side.
+	if (
+		(field.type === "repeater" || field.type === "file" || field.type === "image") &&
+		field.validation
+	) {
+		entry.validation = { ...field.validation };
+	}
+
+	return entry;
+}
+
 /**
  * Format field name as label
  */

package/src/api/handlers/marketplace.ts

@@ -22,6 +22,7 @@ import {
 	type MarketplaceVersionSummary,
 	type PluginBundle,
 } from "../../plugins/marketplace.js";
+import { withUnavailableReason } from "../../plugins/sandbox/types.js";
 import type { SandboxRunner } from "../../plugins/sandbox/types.js";
 import { PluginStateRepository } from "../../plugins/state.js";
 import {
@@ -363,7 +364,10 @@ export async function handleMarketplaceInstall(
 			success: false,
 			error: {
 				code: "SANDBOX_NOT_AVAILABLE",
-				message: "Sandbox runner is required for marketplace plugins",
+				message: withUnavailableReason(
+					"Sandbox runner is required for marketplace plugins",
+					sandboxRunner,
+				),
 			},
 		};
 	}
@@ -584,7 +588,10 @@ export async function handleMarketplaceUpdate(
 	if (!opts?.sandboxBypassed && (!sandboxRunner || !sandboxRunner.isAvailable())) {
 		return {
 			success: false,
-			error: { code: "SANDBOX_NOT_AVAILABLE", message: "Sandbox runner is required" },
+			error: {
+				code: "SANDBOX_NOT_AVAILABLE",
+				message: withUnavailableReason("Sandbox runner is required", sandboxRunner),
+			},
 		};
 	}
 
@@ -658,6 +665,21 @@ export async function handleMarketplaceUpdate(
 		const oldCaps = oldBundle?.manifest.capabilities ?? [];
 		const capabilityChanges = diffCapabilities(oldCaps, bundle.manifest.capabilities);
 		const hasEscalation = capabilityChanges.added.length > 0;
+		const routeVisibilityChanges = diffRouteVisibility(oldBundle?.manifest, bundle.manifest);
+		const hasNewPublicRoutes = routeVisibilityChanges.newlyPublic.length > 0;
+		const oldMcpTools = [...(oldBundle?.manifest.mcp?.tools ?? [])].toSorted((a, b) =>
+			a.name.localeCompare(b.name),
+		);
+		const newMcpTools = [...(bundle.manifest.mcp?.tools ?? [])].toSorted((a, b) =>
+			a.name.localeCompare(b.name),
+		);
+		const hasMcpChanges = JSON.stringify(oldMcpTools) !== JSON.stringify(newMcpTools);
+		const mcpTools = newMcpTools.map(({ inputSchema: _, outputSchema: __, ...tool }) => tool);
+		const consentDetails = {
+			capabilityChanges,
+			routeVisibilityChanges: hasNewPublicRoutes ? routeVisibilityChanges : undefined,
+			mcpTools: hasMcpChanges ? mcpTools : undefined,
+		};
 
 		// If capabilities escalated, require explicit confirmation
 		if (hasEscalation && !opts?.confirmCapabilityChanges) {
@@ -666,42 +688,31 @@ export async function handleMarketplaceUpdate(
 				error: {
 					code: "CAPABILITY_ESCALATION",
 					message: "Plugin update requires new capabilities",
-					details: { capabilityChanges },
+					details: consentDetails,
 				},
 			};
 		}
 
 		// Diff route visibility — routes going from private to public are a
 		// security-sensitive change that exposes unauthenticated endpoints.
-		const routeVisibilityChanges = diffRouteVisibility(oldBundle?.manifest, bundle.manifest);
-		const hasNewPublicRoutes = routeVisibilityChanges.newlyPublic.length > 0;
-
 		if (hasNewPublicRoutes && !opts?.confirmRouteVisibilityChanges) {
 			return {
 				success: false,
 				error: {
 					code: "ROUTE_VISIBILITY_ESCALATION",
 					message: "Plugin update exposes new public (unauthenticated) routes",
-					details: { routeVisibilityChanges, capabilityChanges },
+					details: consentDetails,
 				},
 			};
 		}
 
-		const oldMcpTools = [...(oldBundle?.manifest.mcp?.tools ?? [])].toSorted((a, b) =>
-			a.name.localeCompare(b.name),
-		);
-		const newMcpTools = [...(bundle.manifest.mcp?.tools ?? [])].toSorted((a, b) =>
-			a.name.localeCompare(b.name),
-		);
-		if (JSON.stringify(oldMcpTools) !== JSON.stringify(newMcpTools) && !opts?.confirmMcpTools) {
+		if (hasMcpChanges && !opts?.confirmMcpTools) {
 			return {
 				success: false,
 				error: {
 					code: "MCP_TOOL_CONSENT_REQUIRED",
 					message: "Plugin update changes its MCP tools",
-					details: {
-						mcpTools: newMcpTools.map(({ inputSchema: _, outputSchema: __, ...tool }) => tool),
-					},
+					details: consentDetails,
 				},
 			};
 		}
@@ -721,9 +732,6 @@ export async function handleMarketplaceUpdate(
 
 		await syncDeclaredStorageIndexes(db, [bundle.manifest]);
 
-		// Clean up old bundle from R2 (best-effort)
-		deleteBundleFromR2(storage, pluginId, oldVersion).catch(() => {});
-
 		return {
 			success: true,
 			data: {

package/src/api/handlers/media.ts

@@ -149,6 +149,7 @@ export async function handleMediaCreate(
 		blurhash?: string;
 		dominantColor?: string;
 		authorId?: string;
+		folderId?: string | null;
 	},
 ): Promise<ApiResult<MediaResponse>> {
 	try {
@@ -228,6 +229,35 @@ export async function handleMediaUpdate(
 	}
 }
 
+export async function handleMediaReplaceMetadata(
+	db: Kysely<Database>,
+	id: string,
+	expectedStorageKey: string,
+	input: { size: number; width: number; height: number; contentHash: string },
+): Promise<ApiResult<MediaResponse>> {
+	try {
+		const item = await new MediaRepository(db).replaceReadyFile(id, expectedStorageKey, input);
+		if (!item) {
+			return {
+				success: false,
+				error: {
+					code: "MEDIA_REPLACE_METADATA_ERROR",
+					message: "Failed to update replaced media metadata",
+				},
+			};
+		}
+		return { success: true, data: { item } };
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "MEDIA_REPLACE_METADATA_ERROR",
+				message: "Failed to update replaced media metadata",
+			},
+		};
+	}
+}
+
 function isForeignKeyViolation(error: unknown): boolean {
 	if (error && typeof error === "object") {
 		if ("code" in error && error.code === "23503") return true;

package/src/api/handlers/menus.ts

@@ -173,6 +173,15 @@ export async function handleMenuCreate(
 					error: { code: "NOT_FOUND", message: "Source menu for translation not found" },
 				};
 			}
+			if (source.name !== input.name) {
+				return {
+					success: false,
+					error: {
+						code: "VALIDATION_ERROR",
+						message: `A translation of menu "${source.name}" must use the same name`,
+					},
+				};
+			}
 		}
 
 		// Duplicate guard: same (name, locale). Falls back to the configured