feat(manifest-v2): runtime manifest + OR-backed dashboards

[rubenvdlinde]

Summary

Phase 1e of the v2 manifest rollout (hydra ADR-036). Mydash becomes the proving ground for the runtime-manifest pattern: no bundled home page, no shell pages — the manifest is per-user state read from OpenRegister at runtime.

This is the canonical shape OpenBuilt + future user-built apps will inherit.

What landed

Library + dependencies

• @conduction/nextcloud-vue: ^0.1.0-beta.17 → ^1.0.0-beta.57 (major bump; only Nc* re-exports used so no import changes needed)
• appinfo/info.xml: added <app>openregister</app> + bumped Nextcloud min-version 28 → 29
• src/manifest.json (new) — 8-line stub declaring v2 $schema + dependencies: ["openregister"]

OR schema for dashboards

• lib/Settings/mydash_register.json (new) — defines mydash/dashboard schema. Properties: slug, title, description, version, widgets[] (uniform v2 widget entries), sharedWith[], isDefault. Includes 2 seed objects.

Runtime manifest endpoint

• lib/Controller/ManifestController.php (new) — GET /apps/mydash/api/manifest. Lazy-loads ObjectService via the container (decidesk/procest pattern). Lists the current user's dashboards (owner + shared), builds a v2 manifest with one type: "dashboard" page per dashboard. Empty pages[]/menu[] for first-run users.

Migration: legacy tables → OR

• lib/Migration/Version002000Date20260519000000.php (new) — runs in postSchemaChange. Iterates mydash_dashboards + mydash_widget_placements, maps each to a v2 widget entry, calls ObjectService::saveObject(). Non-fatal on row failures. Legacy tables NOT dropped (read-only artefacts pending full CRUD migration).

Frontend runtime loader

• src/main.js + src/App.vue — inline runtime-manifest fetch on bootstrap; replaces the bundled stub entirely (no merge, per ADR-036). Views.vue + GridStack surface preserved during transition.

Quality

• composer lint (PHP syntax) ✓
• composer lint:spec-annotations ✓ (added 11 pre-existing + 2 new migration methods to allowlist)
• composer lint:initial-state ✓
• v2 schema validation on src/manifest.json ✓
• npm run build / lint: not runnable in the worktree (node_modules incomplete); CI runs via npm ci

What this PR does NOT do (deferred)

• DashboardService + DashboardApiController still read/write the legacy mydash tables. The OR pivot is only for the manifest read endpoint here. Full CRUD migration to OR is a follow-up spec.
• Views.vue + GridStack unchanged. Migration to CnPageRenderer + v2 widget grid is a separate follow-up.
• Existing widgets (TileCard, WidgetWrapper, etc.) not registered via the 5-kind registry yet — that lands with the Views.vue rewrite.

Supersedes

Memory mydash-no-or-dependency.md marked SUPERSEDED by ADR-036. The new direction: mydash depends on OR for dashboard storage. BI/chart features still go via OR's GraphQL runtime endpoint (no install-time dep needed there).

Hydra labels

Not adding ready-for-code-review / ready-for-security-review — Hydra is paused. Ready for manual review.

Test plan

• Install OpenRegister; install mydash; verify info.xml dependency resolves
• On a fresh user: hit /apps/mydash/api/manifest → returns empty pages[]/menu[] (empty-state path)
• Run migration with existing mydash_dashboards data: verify OR objects created, manifest endpoint returns them
• User with shared dashboards sees them in their manifest
• v2 schema validation passes against the endpoint's response
• Existing DashboardApiController CRUD endpoints still work (legacy tables unchanged)

[github-actions]

Quality Report — ConductionNL/mydash @ 6bfab93

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	❌
phpmd	✅
psalm	✅
phpstan	❌
phpmetrics	✅
eslint		❌
stylelint		❌
composer			✅	✅ 100/100
npm			❌	❌
PHPUnit					⏭️
Newman					⏭️
Playwright					⏭️

---

Quality workflow — 2026-05-19 12:00 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/mydash @ 6d722c3

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		❌
stylelint		❌
composer			✅	✅ 100/100
npm			❌	❌
PHPUnit					⏭️
Newman					⏭️
Playwright					⏭️

---

Quality workflow — 2026-05-19 12:15 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/mydash @ 2f52b98

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
composer			✅	✅ 100/100
npm			✅	✅ 522/522
PHPUnit					✅
Newman					✅
Playwright					⏭️

Coverage: 90.7% (127/140 statements)

---

Quality workflow — 2026-05-19 12:21 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/mydash @ eebb3b3

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
composer			✅	✅ 100/100
npm			✅	✅ 522/522
PHPUnit					✅
Newman					✅
Playwright					⏭️

Coverage: 90.7% (127/140 statements)

---

Quality workflow — 2026-05-19 13:24 UTC

Download the full PDF report from the workflow artifacts.