mnfst 0.5.274 → 0.5.275

package/lib/manifest.appwrite.data.js

@@ -2,7 +2,7 @@
 
 (function () {
 
-const MANIFEST_BUILD_VERSION = '0.5.274';
+const MANIFEST_BUILD_VERSION = '0.5.275';
 
 /* Manifest Data Sources - Appwrite Integration */
 
@@ -1731,4 +1731,124 @@ window.ManifestDataPagination = {
 };
 
 
+/* Manifest Data Sources - Contract checks */
+
+// Rows of Appwrite sources whose table the contract declares throw when app code
+// reads a column that is undeclared and never seen on a row. Dev hosts by default.
+(function () {
+    const proxies = new WeakMap();
+    const targets = new WeakMap();
+    const warned = new Set();
+    // Read by the framework on every row; storage columns are added per source
+    const ALLOWED = new Set(['then', 'catch', 'finally', 'toJSON', 'length', 'contentType', 'fileIds']);
+    let enabled;
+    let tables = null;
+    const tableBySource = new Map();
+    const seenBySource = new Map();
+    let appwriteSources = null;
+
+    function devHost(h) {
+        return h === 'localhost' || h === '127.0.0.1' || h === '[::1]' || h === '::1' || h === '0.0.0.0' ||
+            h.endsWith('.localhost') || h.endsWith('.local') || h.endsWith('.test');
+    }
+
+    function hostMatches(pattern, host) {
+        const re = new RegExp('^' + String(pattern).toLowerCase().replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '[^.]*') + '$');
+        return re.test(host);
+    }
+
+    function config(manifest) {
+        const c = manifest && manifest.contract;
+        if (typeof c === 'string') return { module: c, checks: 'dev' };
+        if (c && typeof c === 'object' && typeof c.module === 'string') return { module: c.module, checks: c.checks === undefined ? 'dev' : c.checks };
+        return null;
+    }
+
+    function decide(manifest) {
+        const cfg = config(manifest);
+        if (!cfg || cfg.checks === false) return false;
+        const host = String(location.hostname || '').toLowerCase();
+        if (cfg.checks === true) return cfg;
+        if (devHost(host)) return cfg;
+        return Array.isArray(cfg.checks) && cfg.checks.some(p => hostMatches(p, host)) ? cfg : false;
+    }
+
+    function load(manifest, cfg) {
+        import(new URL(cfg.module, location.origin + '/').href).then(mod => {
+            tables = mod && mod.tables && typeof mod.tables === 'object' ? mod.tables : {};
+            const defaultDb = manifest.appwrite && (manifest.appwrite.databaseId || manifest.appwrite.database);
+            for (const [source, src] of Object.entries(manifest.data || {})) {
+                if (!src || typeof src.appwriteTableId !== 'string') continue;
+                const db = src.appwriteDatabaseId || defaultDb;
+                const hit = Object.entries(tables).find(([key, t]) => t && (t.id || key) === src.appwriteTableId && (!t.database || !db || t.database === db));
+                if (!hit || !Array.isArray(hit[1].columns)) continue;
+                const columns = new Set(hit[1].columns);
+                for (const c of Object.values(src.storage || {})) columns.add(typeof c === 'string' ? c : (c && c.column) || 'fileIds');
+                tableBySource.set(source, { key: hit[0], columns });
+            }
+        }).catch(e => {
+            console.warn(`[Manifest] contract ${cfg.module} failed to load; column checks are off`, e);
+            tables = {};
+        });
+    }
+
+    function isEnabled() {
+        if (enabled !== undefined) return enabled;
+        const manifest = window.__manifestLoaded;
+        if (!manifest) return false;
+        const cfg = decide(manifest);
+        enabled = !!cfg;
+        if (cfg) {
+            appwriteSources = new Set(Object.entries(manifest.data || {}).filter(([, s]) => s && typeof s.appwriteTableId === 'string').map(([k]) => k));
+            load(manifest, cfg);
+        }
+        return enabled;
+    }
+
+    const known = (key, table) => key[0] === '$' || key[0] === '_' || ALLOWED.has(key) || table.columns.has(key);
+
+    function drift(source, table, row) {
+        for (const key of Object.keys(row)) {
+            if (known(key, table) || warned.has(source + '\0' + key)) continue;
+            warned.add(source + '\0' + key);
+            console.warn(`[Manifest] data source "${source}" has column "${key}", which the contract does not declare for "${table.key}"`);
+        }
+    }
+
+    function guard(source, row) {
+        if (!row || typeof row !== 'object' || Array.isArray(row) || !isEnabled() || !appwriteSources.has(source)) return row;
+        const existing = proxies.get(row);
+        if (existing) return existing;
+        let seen = seenBySource.get(source);
+        if (!seen) seenBySource.set(source, seen = new Set());
+        for (const key of Object.keys(row)) seen.add(key);
+        let checked = false;
+        const proxy = new Proxy(row, {
+            // App reads arrive through Alpine's reactive proxy; its own old-value reads use this one
+            get(target, key, receiver) {
+                if (typeof key === 'string' && tables && receiver !== proxy) {
+                    const table = tableBySource.get(source);
+                    if (table) {
+                        if (!checked) { checked = true; drift(source, table, target); }
+                        if (!known(key, table) && !(key in target) && !seen.has(key)) {
+                            throw new Error(`[Manifest] "${key}" is not a column of "${table.key}" in the contract (data source "${source}")`);
+                        }
+                    }
+                }
+                return Reflect.get(target, key, receiver);
+            }
+        });
+        proxies.set(row, proxy);
+        proxies.set(proxy, proxy);
+        targets.set(proxy, row);
+        return proxy;
+    }
+
+    // Framework reads go through the unchecked row
+    const raw = (obj) => (obj && targets.get(obj)) || obj;
+
+    window.ManifestDataContract = { guard, raw };
+})();
+
+
 })();

package/lib/manifest.data.js

@@ -2,7 +2,7 @@
 
 (function () {
 
-const MANIFEST_BUILD_VERSION = '0.5.274';
+const MANIFEST_BUILD_VERSION = '0.5.275';
 
 /* Manifest Data Sources - Configuration */
 
@@ -397,7 +397,7 @@ function mergeRowFields(target, fields, dataSourceName) {
         if (key === '$files') continue;
         const value = fields[key];
         if (sameScalarOrList(raw[key], value)) continue;
-        target[key] = createReactiveReferences(value, dataSourceName);
+        target[key] = createReactiveReferences(value, dataSourceName, true);
     }
 }
 
@@ -799,24 +799,25 @@ function getRawData(dataSourceName) {
 }
 
 // New object/array references (incl. nested arrays like fileIds) so Alpine tracks changes
-function createReactiveReferences(data, dataSourceName = null) {
+function createReactiveReferences(data, dataSourceName = null, nested = false) {
     if (data === null || data === undefined) {
         return data;
     }
 
     if (Array.isArray(data)) {
         // Create new array with new references for each item
-        return data.map(item => createReactiveReferences(item, dataSourceName));
+        return data.map(item => createReactiveReferences(item, dataSourceName, nested));
     }
 
     if (typeof data === 'object') {
         // Object.keys, not for…in + .hasOwnProperty (see deepSeal). Hot path for
         // every Appwrite mutation result and realtime event.
         const newObj = {};
+        let self = newObj;
         for (const key of Object.keys(data)) {
             const value = data[key];
             // Recursively create new references for nested objects/arrays
-            newObj[key] = createReactiveReferences(value, dataSourceName);
+            newObj[key] = createReactiveReferences(value, dataSourceName, true);
         }
 
         // Detect file objects (have mimeType or sizeOriginal)
@@ -855,7 +856,7 @@ function createReactiveReferences(data, dataSourceName = null) {
                             data.$id,
                             bucketName,
                             columnName,
-                            { owner: newObj }
+                            { owner: self }
                         );
 
                         // Assign computed array to entry
@@ -1042,7 +1043,11 @@ function createReactiveReferences(data, dataSourceName = null) {
             });
         }
 
-        return newObj;
+        // Contract checks wrap top-level Appwrite rows (dev and opted-in hosts)
+        if (!nested && isDatabaseEntry && dataSourceName && window.ManifestDataContract) {
+            self = window.ManifestDataContract.guard(dataSourceName, newObj);
+        }
+        return self;
     }
 
     // Primitives can be returned as-is

package/lib/manifest.integrity.json

@@ -1,6 +1,6 @@
 {
   "manifest.appwrite.auth.js": "sha384-gWLSeVPqCLMiUZB8MU7GqMg3x2yULFUsp8nTTZrPp/9Dlkix42rBn9yIimvwrHqZ",
-  "manifest.appwrite.data.js": "sha384-7gDP0QYT/sjPnPxKB0DahCW7wGTjVeKzqRHJSkqv4R4J8CtcmB7b6qTEsyK4iGoh",
+  "manifest.appwrite.data.js": "sha384-DL3DcEUoVXDqLwODzd/CBtnTyBPqeFl6RVx01oBv1lCwgMkNEGQeeKdA9l132m2m",
   "manifest.appwrite.presences.js": "sha384-LINPhIPTCK+rA8zd+HPUzMSEgH6Sl2vQMEyItT97bnEE2FYGYKqjXX+CWdt6nl9z",
   "manifest.bindings.js": "sha384-lPtMf8Ykaic9gNVZKq8Scia1881ZeMAyxer3WCIkUNwwrgzGBWto1OXADUwjvORF",
   "manifest.charts.js": "sha384-AFbP7mQnigy7DU1s+YE30yKTeQAKfgNazhbfSNbfd9ZpLgeulZKaPi/fAq3gJHDO",
@@ -11,7 +11,7 @@
   "manifest.combobox.js": "sha384-/lJo6vaxKjgnBSRs/dzkhK1dzGk3GBw8FISoNJZB70mwAVwu1k5veZyBXjOb4keS",
   "manifest.components.js": "sha384-1el5WMdgmzu/2ocaYN21OjLi/lfjllvA8aju1J3knYuOizw+XFfJU1+rvGqYW7qk",
   "manifest.computed.js": "sha384-GYML/e81gQfN+iDbqhPUgny8bINCyL+SrbTofoGk4hlCnLLjv51mCv42JMqq+ku5",
-  "manifest.data.js": "sha384-mV2B+tijlZgcD/MFDLzw6w+6fGd0rZpGTTOJEyv6LJYwRydD3XtekFaMvZCWzudH",
+  "manifest.data.js": "sha384-pOXyFP7tUdQG4c52usKJkWYgGxMN5g2a6dWAKYGAJEHrJL4gZDYRNgOsSq/+jnTm",
   "manifest.datepicker.js": "sha384-EzlMwvIxlla/0BuyhAEqxN0M8TGcWIWgEIg840V0akKQQK1uY648wPWMkobvtq/o",
   "manifest.defer.js": "sha384-PRp7+dCZHnnl55rX2xrHutLrQnszHo7o5o9Tq28M/yjLZPuXDzcwQNxCdvbtCYSz",
   "manifest.device.js": "sha384-YeQaS56L8IILqrQNBSeAOLwIh5DuAOrE60cYLK1+46qJtUrXlAvqGe2j5mbV4Vq7",
@@ -29,7 +29,7 @@
   "manifest.status.js": "sha384-ofu7nBnVIGZ1U1o2R9d2H3V8aEMPUCVbl5FO3gIToXqi0oa36fTviEdh5UU7Kitw",
   "manifest.submissions.js": "sha384-v9eS47ytAfTGIKAyVnbd0QWegucVS7yduvigqfsxxoqXmbaEoy0M2y+BiI4xeZBd",
   "manifest.svg.js": "sha384-qr/8H9+2cIhSXNbRWRtIdrDlTOxKlNJqwEefHvCYoiBNW/kKhPTFa109Orv/EBnb",
-  "manifest.sw.js": "sha384-tJoDnCGd8KNuPQSC2U45K3sFnVP+FKP/Qddzg4BoFsBjwhwQCk/FDo2i54aS/l+s",
+  "manifest.sw.js": "sha384-hyn8eZtfGN2VxD1+L4AxEyI7CQlPPguEkG5AgjB19A2Ca/W4HhOnTiF3QfoAMnLq",
   "manifest.tabs.js": "sha384-otU09H7jnawVKQdLAYpMCd3jx00tgyPVr42D2hLIBzN5dG4se505YesavdnMqEi1",
   "manifest.tailwind.js": "sha384-yuP3LEvWU+QVjxjkZ0YhErtC9RrGmhOmHjjFjhS9obqZbp5/KTIEnSR0CXDvHE0B",
   "manifest.toasts.js": "sha384-UpOz9fAdGeGUhL0NamBg5iPepEfIy73p9HYdcxfOQC5b7CVsl7Our0skdZzaLNcC",

package/lib/manifest.schema.json

@@ -137,6 +137,28 @@
                 "type": "string"
             }
         },
+        "contract": {
+            "description": "Shared contract module, a path from the project root (e.g. /shared/contract.js), whose `tables` export declares Appwrite tables and columns. mnfst-test checks data sources against it; on dev hosts (or hosts listed in `checks`) app code reading a column of an Appwrite row that is undeclared and absent from every row of the source throws.",
+            "oneOf": [
+                { "type": "string" },
+                {
+                    "type": "object",
+                    "properties": {
+                        "module": { "type": "string" },
+                        "checks": {
+                            "description": "Where column checks run: 'dev' (default, local hosts), true (everywhere), false (nowhere), or host patterns such as '*-staging.example.com' (dev hosts included).",
+                            "oneOf": [
+                                { "type": "boolean" },
+                                { "type": "string", "enum": ["dev"] },
+                                { "type": "array", "items": { "type": "string" } }
+                            ]
+                        }
+                    },
+                    "required": ["module"],
+                    "additionalProperties": false
+                }
+            ]
+        },
         "data": {
             "type": "object",
             "description": "Named data sources made available via $x.<sourceName>. Each value is either a string path/URL or a config object.",

package/lib/manifest.sw.js

@@ -16,7 +16,7 @@
 
 // Build stamps the published version here; unstamped (dev) falls back to the
 // registration URL's `v`, then 'dev'.
-const BUILD_VERSION = '0.5.274';
+const BUILD_VERSION = '0.5.275';
 const CACHE_PREFIX = 'mnfst-sw:';
 const META_CACHE = CACHE_PREFIX + 'meta';
 // Sized to hold a full precache.json warm-up (PRECACHE_MAX_ENTRIES server-side)

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mnfst",
-    "version": "0.5.274",
+    "version": "0.5.275",
     "private": false,
     "workspaces": [
         "templates/starter",
@@ -53,6 +53,7 @@
         "test:e2e:test-kit": "node tests/e2e/test-kit-journeys.e2e.mjs",
         "test:e2e:submissions": "node tests/e2e/submissions.e2e.mjs",
         "test:e2e:modules": "node tests/e2e/modules.e2e.mjs",
+        "test:e2e:contract": "node tests/e2e/contract.e2e.mjs && node tests/e2e/contract-checks.e2e.mjs",
         "lint": "echo 'No linting configured'",
         "release:docs": "node scripts/release-bump.mjs packages/docs && cd packages/docs && npm publish --auth-type=web",
         "release:check": "node scripts/release-check.mjs"