mnfst 0.5.166 → 0.5.167

package/lib/manifest.appwrite.auth.js

@@ -3215,29 +3215,50 @@ function mergeRoles(manifestRoles, userGeneratedRoles) {
     return merged;
 }
 
-// Normalize custom roles for Appwrite (add "owner" if any role requires it)
+// Appwrite membership role tokens allow only [a-zA-Z0-9._-]. Role definitions are
+// keyed by display name (which may contain spaces/unicode), so we store an
+// Appwrite-safe slug on the membership and resolve by matching slug(token) against
+// slug(defName). Idempotent, and "owner" (Appwrite's intrinsic role) passes through.
+function roleSlug(name) {
+    if (name === 'owner') return 'owner';
+    return String(name)
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9._-]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+}
+
+// Normalize custom roles for Appwrite: slugify tokens (so space/unicode names stay
+// assignable) and add "owner" if any role requires it.
 function normalizeRolesForAppwrite(customRoles, memberRoles, userGeneratedRoles = null) {
     if (!Array.isArray(customRoles)) {
         return customRoles;
     }
 
+    const slugged = customRoles.map(role => roleSlug(role));
+
     // Merge manifest and user-generated roles
     const allRoles = mergeRoles(memberRoles, userGeneratedRoles);
 
-    // If no roles config, return as-is (will use Appwrite's default behavior)
+    // If no roles config, return slugged tokens (Appwrite handles owner default)
     if (!allRoles || Object.keys(allRoles).length === 0) {
-        return customRoles;
+        return slugged;
     }
 
-    // Check if any custom role requires owner
-    const requiresOwner = customRoles.some(role => roleRequiresOwner(role, allRoles));
+    // Which definition slugs require owner — checked by slug so this works whether the
+    // incoming tokens are display names or already slugged.
+    const ownerSlugs = new Set();
+    for (const name of Object.keys(allRoles)) {
+        if (roleRequiresOwner(name, allRoles)) ownerSlugs.add(roleSlug(name));
+    }
+    const requiresOwner = slugged.some(s => ownerSlugs.has(s));
 
     // If owner is already in the list, don't duplicate
-    if (requiresOwner && !customRoles.includes('owner')) {
-        return [...customRoles, 'owner'];
+    if (requiresOwner && !slugged.includes('owner')) {
+        return [...slugged, 'owner'];
     }
 
-    return customRoles;
+    return slugged;
 }
 
 // Normalize Appwrite roles for display (filter "owner" if a custom role replaces it)
@@ -3249,10 +3270,15 @@ function normalizeRolesForDisplay(appwriteRoles, memberRoles, userGeneratedRoles
     // Merge manifest and user-generated roles
     const allRoles = mergeRoles(memberRoles, userGeneratedRoles);
 
-    // If custom roles are defined, always filter out "owner" (it's a background Appwrite role)
-    // "owner" is automatically added by Appwrite for permissions, but shouldn't be displayed
+    // If custom roles are defined, filter out "owner" (a background Appwrite role) and
+    // translate slug tokens back to their display names (legacy exact-name tokens map
+    // through slug() too; unknown tokens pass through as-is).
     if (allRoles && Object.keys(allRoles).length > 0) {
-        return appwriteRoles.filter(role => role !== 'owner');
+        const bySlug = {};
+        for (const name of Object.keys(allRoles)) bySlug[roleSlug(name)] = name;
+        return appwriteRoles
+            .filter(role => role !== 'owner')
+            .map(role => bySlug[roleSlug(role)] || role);
     }
 
     // If no custom roles config, show "owner" as-is (legacy behavior)
@@ -3303,9 +3329,13 @@ function hasPermission(userRoles, permission, memberRoles, userGeneratedRoles =
         return true;
     }
 
-    // Check if any of the user's custom roles has this permission
+    // Check if any of the user's custom roles has this permission. Match by slug so
+    // display-name definitions resolve against slugged membership tokens, and legacy
+    // exact-name tokens still resolve.
+    const bySlug = {};
+    for (const [name, perms] of Object.entries(allRoles)) bySlug[roleSlug(name)] = perms;
     for (const roleName of customRoles) {
-        const rolePermissions = allRoles[roleName];
+        const rolePermissions = bySlug[roleSlug(roleName)];
         if (rolePermissions && Array.isArray(rolePermissions) && rolePermissions.includes(permission)) {
             return true;
         }
@@ -3360,6 +3390,10 @@ function initializeTeamsRoles() {
                 return getOwnerPermissions();
             };
 
+            store.roleSlug = function (name) {
+                return roleSlug(name);
+            };
+
             store.validateRoleConfig = async function () {
                 const appwriteConfig = await config.getAppwriteConfig();
                 const memberRoles = appwriteConfig?.memberRoles || null;
@@ -3532,6 +3566,7 @@ window.ManifestAppwriteAuthTeamsRoles = {
     roleHasAllOwnerPermissions,
     getUserGeneratedRoles,
     mergeRoles,
+    roleSlug,
     normalizeRolesForAppwrite,
     normalizeRolesForDisplay,
     getPrimaryDisplayRole,
@@ -5446,7 +5481,19 @@ function initializeTeamsConvenience() {
                     const userMembership = this.currentTeamMemberships.find(
                         m => m.userId === this.user.$id
                     );
-                    return userMembership?.roles || [];
+                    const raw = userMembership?.roles || [];
+                    // Membership tokens are Appwrite-safe slugs; translate them back to the
+                    // author's display names using the cached role map. "owner" and unknown
+                    // tokens pass through unchanged.
+                    const slug = this.roleSlug;
+                    const allRoles = (this.allTeamRoles && this.allTeamRoles(this.currentTeam)) || {};
+                    const keys = Object.keys(allRoles);
+                    if (typeof slug !== 'function' || !keys.length) {
+                        return raw;
+                    }
+                    const bySlug = {};
+                    for (const name of keys) bySlug[slug(name)] = name;
+                    return raw.map(r => (r === 'owner' ? 'owner' : (bySlug[slug(r)] || r)));
                 };
 
                 // Check if current user has a specific permission in the current team
@@ -5494,9 +5541,13 @@ function initializeTeamsConvenience() {
                     }
 
                     // Granted if any of the user's custom roles includes this permission
-                    // (built-in or custom key).
+                    // (built-in or custom key). Match by slug so slugged/legacy membership
+                    // tokens resolve against display-name definitions.
+                    const slug = this.roleSlug || (x => x);
+                    const bySlug = {};
+                    for (const [name, perms] of Object.entries(allRoles)) bySlug[slug(name)] = perms;
                     for (const roleName of customRoles) {
-                        const rolePermissions = allRoles[roleName];
+                        const rolePermissions = bySlug[slug(roleName)];
                         if (Array.isArray(rolePermissions) && rolePermissions.includes(permission)) {
                             return true;
                         }
@@ -5510,7 +5561,8 @@ function initializeTeamsConvenience() {
                         return false;
                     }
                     const userRoles = this.getCurrentTeamRoles();
-                    return userRoles.includes(roleName);
+                    const slug = this.roleSlug || (x => x);
+                    return userRoles.some(r => slug(r) === slug(roleName));
                 };
 
                 // Get current user's primary role in current team

package/lib/manifest.chat.js

@@ -3,7 +3,7 @@
 /*  https://manifestx.dev
 /*
 /*  Handle = reactive conversation view fed by an adapter; drives intents. The
-/*  plugin transports/stores nothing — see CHAT-PLUGIN-DESIGN.md.
+/*  plugin transports/stores nothing — see templates/chat-adapter/README.md.
 */
 
 (function () {
@@ -287,8 +287,11 @@
         function mk(cid, channel, parts, msgs, closed) {
             convs.set(cid, { id: cid, channel, closed: !!closed, participants: parts, messages: msgs });
         }
-        const m = (cid, author, text, minsAgo, extra) =>
-            Object.assign({ id: id('m'), conversationId: cid, author, body: { text }, ts: t(minsAgo), status: 'delivered' }, extra || {});
+        const m = (cid, author, text, minsAgo, extra) => {
+            const msg = Object.assign({ id: id('m'), conversationId: cid, author, body: { text }, ts: t(minsAgo), status: 'delivered' }, extra || {});
+            if (msg.media) { msg.body.media = msg.media; delete msg.media; }   // media lives on body
+            return msg;
+        };
 
         // 1:1 AI co-pilot
         mk('dm-ai', 'webchat', [me, bot], [
@@ -296,6 +299,26 @@
             m('dm-ai', me, 'How many free credits do I get?', 11)
         ]);
 
+        // Attachment showcase — one of every media kind, both directions
+        // (harness-only conversation; asset paths resolve in the test project)
+        mk('media-1', 'webchat', [me, bot], [
+            m('media-1', me, 'Here is the artwork and the brief.', 22, {
+                media: [
+                    { kind: 'image', url: '/test/media/sample.png', name: 'artwork.png', mediaType: 'image/png' },
+                    { kind: 'document', url: '/test/media/sample.pdf', name: 'brief.pdf', mediaType: 'application/pdf' }
+                ]
+            }),
+            m('media-1', bot, 'Received — and here is everything back in every format:', 20, {
+                media: [
+                    { kind: 'image', url: '/test/media/sample.png', name: 'render.png', mediaType: 'image/png' },
+                    { kind: 'audio', url: '/test/media/sample.wav', name: 'jingle.wav', mediaType: 'audio/wav' },
+                    { kind: 'voice', url: '/test/media/sample.wav', name: 'voice note', mediaType: 'audio/wav' },
+                    { kind: 'video', url: 'https://interactive-examples.mdn.mozilla.net/media/cc0-videos/flower.mp4', name: 'clip.mp4', mediaType: 'video/mp4' },
+                    { kind: 'document', url: '/test/media/sample.pdf', name: 'summary.pdf', mediaType: 'application/pdf' }
+                ]
+            })
+        ]);
+
         // group with reactions + a small reply tree
         const g1 = m('grp-1', ana, 'Ship the v2 doc today?', 30);
         mk('grp-1', 'webchat', [me, ana, bo], [
@@ -378,7 +401,20 @@
                 setTimeout(() => deliver(target, msg), 60);   // server echo (reconciles media/status by id)
                 return { id: msg.id, ts: msg.ts, conversationId: target.id };
             },
-            async react(cid, mid, emoji) { const c = backend.convs.get(cid); const msg = c && c.messages.find(x => x.id === mid); if (msg) { msg.reactions = [{ emoji, count: 1, byMe: true, by: [backend.me.id] }]; emit(cid, h => h.onReaction && h.onReaction(mid, msg.reactions)); } return { ok: true }; },
+            async react(cid, mid, emoji) {
+                // toggle: off if I reacted, join if others did, add if new
+                const c = backend.convs.get(cid); const msg = c && c.messages.find(x => x.id === mid);
+                if (msg) {
+                    const rs = (msg.reactions || []).map(r => Object.assign({}, r));
+                    const r = rs.find(x => x.emoji === emoji);
+                    if (r && r.byMe) { r.count--; r.byMe = false; }
+                    else if (r) { r.count++; r.byMe = true; }
+                    else rs.push({ emoji, count: 1, byMe: true });
+                    msg.reactions = rs.filter(x => x.count > 0);
+                    emit(cid, h => h.onReaction && h.onReaction(mid, msg.reactions));
+                }
+                return { ok: true };
+            },
             async addParticipant(cid, p) { const c = backend.convs.get(cid); if (c && !c.participants.some(x => x.id === p.id)) { c.participants.push(p); emit(cid, h => h.onParticipant && h.onParticipant(p, 'added')); } return { ok: true }; },
             async transfer(cid, from, to, role) { emit(cid, h => h.onParticipant && h.onParticipant({ id: to, role: role || 'assignee' }, 'changed')); return { ok: true }; },
             async setTyping(cid, on) { emit(cid, h => h.onTyping && h.onTyping(backend.me.id, on)); },
@@ -413,11 +449,11 @@
 
     // ---- simulation hooks (button-driven; deterministic for verification) ---
     const sim = {
-        // stream an AI reply token-by-token into a conversation
-        aiReply(cid, text) {
+        // stream an AI reply token-by-token into a conversation (media attaches on completion)
+        aiReply(cid, text, media) {
             const c = backend.convs.get(cid); if (!c) return;
             const mid = backend.id('m');
-            const msg = { id: mid, conversationId: cid, author: backend.bot, body: { text: '' }, ts: backend.t(0), status: 'streaming', meta: { authoredBy: 'u_me' } };
+            const msg = { id: mid, conversationId: cid, author: backend.bot, body: { text: '', media: media || undefined }, ts: backend.t(0), status: 'streaming', meta: { authoredBy: 'u_me' } };
             c.messages.push(msg);
             emit(cid, h => h.onMessage && h.onMessage(msg));
             const words = (text || 'Every account starts with 5,000 free credits each month.').split(' ');
@@ -482,7 +518,8 @@
             // Same-origin relay mnfst-run serves for an `ai` block; override via
             // opts.endpoint / window.CHAT_LLM_ENDPOINT.
             const endpoint = opts.endpoint || window.CHAT_LLM_ENDPOINT || '/_ai/chat';
-            const system = opts.system || 'You are a helpful assistant for the Manifest framework docs. Answer in concise markdown.';
+            // only when set — the relay's ai block (system + grounding) is the default
+            const system = opts.system || undefined;
             const handlers = {};   // conversationId -> subscribe handlers
             let seq = 0;
             const id = (p) => p + '_' + Date.now().toString(36) + '_' + (++seq);
@@ -498,12 +535,15 @@
             const toMsg = (r) => ({ id: r.id, conversationId: null, author: r.role === 'assistant' ? BOT : USER, body: { text: r.text }, ts: r.ts, status: 'delivered' });
 
             // Build the Anthropic messages array; attachments → image/document blocks.
+            // Only what the API accepts is forwarded (images + PDFs with data);
+            // audio/video/voice render locally but don't reach the model.
             function apiMessages(cid, draft) {
                 const hist = loadStore(cid).map(r => ({ role: r.role, content: r.text }));
-                const media = (draft.body && draft.body.media) || [];
+                const media = ((draft.body && draft.body.media) || []).filter(a =>
+                    a.data && (a.kind === 'image' || a.mediaType === 'application/pdf'));
                 const blocks = media.map(a => a.kind === 'image'
                     ? { type: 'image', source: { type: 'base64', media_type: a.mediaType, data: a.data } }
-                    : { type: 'document', source: { type: 'base64', media_type: a.mediaType || 'application/pdf', data: a.data } });
+                    : { type: 'document', source: { type: 'base64', media_type: 'application/pdf', data: a.data } });
                 const text = (draft.body && draft.body.text) || draft.text || '';
                 const last = blocks.length ? { role: 'user', content: [...blocks, { type: 'text', text }] } : { role: 'user', content: text };
                 return [...hist, last];
@@ -555,6 +595,129 @@
 })();
 
 
+/*  Manifest Chat — Appwrite adapter (conversations as app data)
+ *  By Andrew Matlock under MIT license
+ *  https://manifestx.dev
+ *
+ *  Messages live as rows in an Appwrite table; inbound arrives over Appwrite
+ *  Realtime; identity comes from $auth (guest sessions cover anonymous use).
+ *  Built for comments, support threads, and small-group chat — high-volume
+ *  messaging belongs on a purpose-built bus behind a custom adapter.
+ *
+ *  Config: opts { databaseId, tableId, ttlHours } or manifest.json
+ *  chat: { appwriteDatabaseId, appwriteTableId, ttlHours }.
+ *  Table columns: conversationId (indexed) · text · authorId · authorName ·
+ *  authorColor? · replyTo?  — ts/id come from $createdAt/$id.
+ */
+
+(function () {
+    'use strict';
+
+    function ready(fn) {
+        if (window.ManifestChatAdapters) return fn();
+        const t = setInterval(() => { if (window.ManifestChatAdapters) { clearInterval(t); fn(); } }, 20);
+        setTimeout(() => clearInterval(t), 5000);
+    }
+
+    ready(function () {
+        function hashColor(id) {
+            let h = 0; for (const ch of String(id)) h = (h * 31 + ch.charCodeAt(0)) >>> 0;
+            return `hsl(${h % 360} 60% 45%)`;
+        }
+
+        function appwriteAdapter(opts) {
+            opts = opts || {};
+            let cfg = null;
+
+            async function config() {
+                if (cfg) return cfg;
+                let databaseId = opts.databaseId, tableId = opts.tableId, ttlHours = opts.ttlHours;
+                if ((!databaseId || !tableId) && window.ManifestDataConfig && window.ManifestDataConfig.ensureManifest) {
+                    const m = await window.ManifestDataConfig.ensureManifest();
+                    const c = (m && m.chat) || {};
+                    databaseId = databaseId || c.appwriteDatabaseId;
+                    tableId = tableId || c.appwriteTableId;
+                    if (ttlHours == null) ttlHours = c.ttlHours;
+                }
+                if (!databaseId || !tableId) console.warn('[Manifest Chat] appwrite adapter needs databaseId + tableId (opts or manifest.json chat block).');
+                cfg = { databaseId, tableId, ttlHours };
+                return cfg;
+            }
+
+            function me() {
+                const auth = window.Alpine ? window.Alpine.store('auth') : null;
+                const u = auth && auth.user;
+                if (u && u.$id) return { id: u.$id, kind: 'human', displayName: u.name || u.email || 'Guest', color: hashColor(u.$id) };
+                let gid = null;
+                try { gid = localStorage.getItem('mnfst.chat.gid'); if (!gid) { gid = 'g_' + Math.random().toString(36).slice(2, 10); localStorage.setItem('mnfst.chat.gid', gid); } } catch (_) { gid = 'g_anon'; }
+                return { id: gid, kind: 'human', displayName: 'Guest', color: hashColor(gid) };
+            }
+
+            function toMsg(row) {
+                return {
+                    id: row.$id, conversationId: row.conversationId,
+                    author: { id: row.authorId, kind: 'human', displayName: row.authorName, color: row.authorColor || hashColor(row.authorId) },
+                    body: { text: row.text }, replyTo: row.replyTo || undefined,
+                    ts: row.$createdAt, status: 'delivered'
+                };
+            }
+
+            return {
+                identity: () => me(),
+
+                async load(cid) {
+                    const { databaseId, tableId, ttlHours } = await config();
+                    if (!databaseId) return { messages: [], participants: [] };
+                    // tablesDB directly (not loadTableRows): public read("any") tables
+                    // must load before any session exists — no auth gate on reads.
+                    const services = await window.ManifestDataAppwrite.getAppwriteDataServices();
+                    const Q = window.Appwrite.Query;
+                    const queries = [Q.equal('conversationId', cid), Q.orderDesc('$createdAt'), Q.limit(100)];
+                    if (ttlHours) queries.push(Q.greaterThan('$createdAt', new Date(Date.now() - ttlHours * 3600e3).toISOString()));
+                    const res = await services.tablesDB.listRows({ databaseId, tableId, queries });
+                    return { messages: res.rows.map(toMsg).reverse(), participants: [] };
+                },
+
+                subscribe(cid, handlers) {
+                    let unsub = null, closed = false;
+                    (async () => {
+                        const { databaseId, tableId } = await config();
+                        if (!databaseId) return;
+                        const services = await window.ManifestDataAppwrite.getAppwriteDataServices();
+                        if (!services || !services.realtime || closed) return;
+                        unsub = services.realtime.subscribe(`databases.${databaseId}.tables.${tableId}.rows`, (res) => {
+                            if (!res || !res.payload || res.payload.conversationId !== cid) return;
+                            const events = Array.isArray(res.events) ? res.events : [res.events];
+                            if (events.some(e => typeof e === 'string' && e.endsWith('.create'))) handlers.onMessage(toMsg(res.payload));
+                        });
+                        if (handlers.onConnection) handlers.onConnection(true);
+                    })();
+                    return () => { closed = true; try { unsub && unsub(); } catch (_) { } };
+                },
+
+                async send(cid, draft) {
+                    const { databaseId, tableId } = await config();
+                    const auth = window.Alpine ? window.Alpine.store('auth') : null;
+                    if (auth && !auth.isAuthenticated && typeof auth.requestGuest === 'function') {
+                        try { await auth.requestGuest(); } catch (_) { }   // guests may create
+                    }
+                    const who = me();
+                    const text = (draft.body && draft.body.text) || draft.text || '';
+                    const row = await window.ManifestDataAppwrite.createRow(databaseId, tableId, {
+                        conversationId: cid, text,
+                        authorId: who.id, authorName: who.displayName, authorColor: who.color,
+                        replyTo: draft.replyTo || null
+                    });
+                    return { id: row.$id, ts: row.$createdAt };
+                }
+            };
+        }
+
+        window.ManifestChatAdapters.register('appwrite', appwriteAdapter);
+    });
+})();
+
+
 /*  Manifest Chat — magic + init
 /*  By Andrew Matlock under MIT license
 /*  https://manifestx.dev

package/lib/manifest.combobox.css

@@ -72,16 +72,25 @@
         gap: var(--spacing, 0.25rem);
         max-width: 100%;
         height: calc(var(--spacing-field-height, 2.25rem) - var(--spacing, 0.25rem) * 2.5);
+        margin: 0;
+        padding: 0;
         padding-inline-start: calc(var(--spacing, 0.25rem) * 2);
         font-size: 0.875rem;
+        line-height: normal;
         color: var(--color-content-stark, oklch(43.9% 0 0));
         background-color: var(--color-popover-surface, oklch(100% 0 0));
+        border: 0;
         border-radius: calc(var(--radius, 0.5rem) * 0.7);
         overflow: hidden;
         user-select: none;
 
         /* Label */
         &>span {
+            min-width: 0;
+            margin: 0;
+            padding: 0;
+            border: 0;
+            font: inherit;
             overflow: hidden;
             text-overflow: ellipsis;
             white-space: nowrap
@@ -92,15 +101,23 @@
             display: inline-flex;
             align-items: center;
             justify-content: center;
+            box-sizing: border-box;
+            flex: none;
+            width: auto !important;
             min-width: 0;
+            max-width: none;
             height: 100%;
+            min-height: 0;
             aspect-ratio: 1 / 1;
+            margin: 0;
             padding: 0;
+            border: 0;
+            border-radius: 0;
             font-size: 1em;
             line-height: 1;
             color: var(--color-content-neutral, oklch(43.9% 0 0));
             background: transparent;
-            border-radius: 0;
+            box-shadow: none;
             cursor: pointer;
 
             &:hover {