domma-cms 0.101.7 → 0.101.9

package/admin/dist/domma/domma-tools.css

@@ -1,9 +1,9 @@
 /*!
- * Domma Tools CSS v0.50.3
+ * Domma Tools CSS v0.51.0
  * Dynamic Object Manipulation & Modeling API
  * (c) 2026 Darryl Waterhouse & DCBW-IT
- * Built: 2026-09-28T16:16:38.439Z
- * Commit: 6399d99
+ * Built: 2026-09-29T07:41:00.052Z
+ * Commit: f264aeb
  */
 
 /*!

package/admin/dist/domma/domma-tools.min.js

@@ -1,9 +1,9 @@
 /*!
- * Domma Tools v0.50.3
+ * Domma Tools v0.51.0
  * Developer tools: Theme Roller & Page Roller
  * (c) 2026 Darryl Waterhouse & DCBW-IT
- * Built: 2026-09-28T16:16:25.037Z
- * Commit: 6399d99
+ * Built: 2026-09-29T07:40:46.433Z
+ * Commit: f264aeb
  *
  * Requires: domma.min.js
  */

package/admin/js/lib/collections-arrange.js

@@ -1 +1 @@
-export const SYSTEM_SLUGS=["roles","user-profiles"],FILTERS=["all","own","builtin","plugin"];const u="core";export function slugify(n){return String(n??"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,"")}export function kindOf(n){return n?.builtIn===!0||n?.preset===!0||SYSTEM_SLUGS.includes(n?.slug)?"builtin":n?.plugin?"plugin":"own"}export const projectOf=n=>n?.meta?.project||u;export function arrangeCollections(n,{filter:e="all",query:t="",project:r=null}={}){const i=String(t).trim().toLowerCase();return[...n||[]].filter(o=>!r||projectOf(o)===r).filter(o=>e==="all"||kindOf(o)===e).filter(o=>!i||[o.title,o.slug,o.description,o.plugin].some(l=>String(l||"").toLowerCase().includes(i))).sort((o,l)=>String(o.title||o.slug).localeCompare(String(l.title||l.slug)))}export function kindCounts(n,{project:e=null}={}){const t=(n||[]).filter(i=>!e||projectOf(i)===e),r={all:t.length,own:0,builtin:0,plugin:0};for(const i of t)r[kindOf(i)]++;return r}const a=(n,e,t=`${e}s`)=>`${n} ${n===1?e:t}`;export function collectionRow(n){const e=kindOf(n),t=Array.isArray(n.fields)?n.fields.length:0,r=Number(n.entryCount)||0,i=n.storage?.adapter==="mongodb",o=n.meta?.project||"";return{slug:n.slug,title:n.title||n.slug,meta:[n.slug,a(t,"field"),o?`project ${o}`:""].filter(Boolean).join(" \xB7 "),entries:r,entriesText:r.toLocaleString("en-GB"),mongo:i,mongoTitle:i?`MongoDB - connection "${n.storage.connection||"default"}"`:"",builtin:e==="builtin",bundled:e!=="builtin"&&n.bundled===!0,plugin:n.plugin||"",pluginTitle:n.plugin?`Managed by the ${n.plugin} plugin`:"",canDelete:e!=="builtin",hasForm:!SYSTEM_SLUGS.includes(n.slug)}}export function checkNewCollection(n,e=[]){const t=String(n??"").trim(),r=slugify(t);return t?r?e.includes(r)?{slug:r,error:`"${r}" is already a collection.`}:{slug:r,error:""}:{slug:r,error:"The title needs at least one letter or number."}:{slug:"",error:""}}let s=0;export function connectionRows(n){return Object.entries(n||{}).filter(([e])=>e!=="_comment").map(([e,t])=>({id:`c${++s}`,name:e,uri:String(t?.uri||""),database:String(t?.database||"")}))}export function newConnectionRow(n){const e=new Set((n||[]).map(r=>r.name));let t=(n||[]).length+1;for(;e.has(`connection${t}`);)t++;return{id:`c${++s}`,name:t===1&&!e.has("default")?"default":`connection${t}`,uri:"",database:""}}export function connectionsFromRows(n){const e=[],t={};for(const r of n||[]){const i=String(r.name??"").trim();if(!i){e.push("Every connection needs a name.");continue}if(t[i]){e.push(`Two connections are called "${i}".`);continue}const o=String(r.uri??"").trim(),l=String(r.database??"").trim();o||e.push(`"${i}" needs a URI.`),l||e.push(`"${i}" needs a database.`),t[i]={type:"mongodb",uri:o,database:l,options:{}}}return{errors:e,config:t}}export function parseConnectionsJson(n){let e;try{e=JSON.parse(String(n??"").trim()||"{}")}catch(t){return{error:`Not valid JSON: ${t.message}`,config:null}}return!e||typeof e!="object"||Array.isArray(e)?{error:"The JSON must be an object of named connections.",config:null}:{error:"",config:e}}export function maskUri(n){return String(n??"").replace(/(\/\/[^:/@]+:)([^@]+)(@)/,"$1\u2022\u2022\u2022$3")}
+export const SYSTEM_SLUGS=["roles","user-profiles"],FILTERS=["all","own","builtin","plugin"];const u="core";export function slugify(n){return String(n??"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,"")}export function kindOf(n){return n?.builtIn===!0||n?.preset===!0||SYSTEM_SLUGS.includes(n?.slug)?"builtin":n?.plugin?"plugin":"own"}export const projectOf=n=>n?.meta?.project||u;export function arrangeCollections(n,{filter:t="all",query:e="",project:o=null}={}){const i=String(e).trim().toLowerCase();return[...n||[]].filter(r=>!o||projectOf(r)===o).filter(r=>t==="all"||kindOf(r)===t).filter(r=>!i||[r.title,r.slug,r.description,r.plugin].some(l=>String(l||"").toLowerCase().includes(i))).sort((r,l)=>String(r.title||r.slug).localeCompare(String(l.title||l.slug)))}export function kindCounts(n,{project:t=null}={}){const e=(n||[]).filter(i=>!t||projectOf(i)===t),o={all:e.length,own:0,builtin:0,plugin:0};for(const i of e)o[kindOf(i)]++;return o}const a=(n,t,e=`${t}s`)=>`${n} ${n===1?t:e}`;export function collectionRow(n){const t=kindOf(n),e=Array.isArray(n.fields)?n.fields.length:0,o=Number(n.entryCount)||0,i=n.storage?.adapter==="mongodb",r=n.meta?.project||"";return{slug:n.slug,title:n.title||n.slug,meta:[n.slug,a(e,"field"),r?`project ${r}`:""].filter(Boolean).join(" \xB7 "),entries:o,entriesText:o.toLocaleString("en-GB"),mongo:i,mongoTitle:i?`MongoDB - connection "${n.storage.connection||"default"}"`:"",builtin:t==="builtin",bundled:t!=="builtin"&&n.bundled===!0,plugin:n.plugin||"",pluginTitle:n.plugin?`Managed by the ${n.plugin} plugin`:"",canDelete:t!=="builtin",hasForm:!SYSTEM_SLUGS.includes(n.slug)}}export function checkNewCollection(n,t=[]){const e=String(n??"").trim(),o=slugify(e);return e?o?t.includes(o)?{slug:o,error:`"${o}" is already a collection.`}:{slug:o,error:""}:{slug:o,error:"The title needs at least one letter or number."}:{slug:"",error:""}}let s=0;export function connectionRows(n){return Object.entries(n||{}).filter(([t])=>t!=="_comment").map(([t,e])=>({id:`c${++s}`,name:t,uri:String(e?.uri||""),database:String(e?.database||""),options:e?.options&&typeof e.options=="object"?e.options:{}}))}export function newConnectionRow(n){const t=new Set((n||[]).map(o=>o.name));let e=(n||[]).length+1;for(;t.has(`connection${e}`);)e++;return{id:`c${++s}`,name:e===1&&!t.has("default")?"default":`connection${e}`,uri:"",database:""}}export function connectionsFromRows(n){const t=[],e={};for(const o of n||[]){const i=String(o.name??"").trim();if(!i){t.push("Every connection needs a name.");continue}if(e[i]){t.push(`Two connections are called "${i}".`);continue}const r=String(o.uri??"").trim(),l=String(o.database??"").trim();r||t.push(`"${i}" needs a URI.`),l||t.push(`"${i}" needs a database.`),e[i]={type:"mongodb",uri:r,database:l,options:o.options&&typeof o.options=="object"?o.options:{}}}return{errors:t,config:e}}export function parseConnectionsJson(n){let t;try{t=JSON.parse(String(n??"").trim()||"{}")}catch(e){return{error:`Not valid JSON: ${e.message}`,config:null}}return!t||typeof t!="object"||Array.isArray(t)?{error:"The JSON must be an object of named connections.",config:null}:{error:"",config:t}}export function maskUri(n){return String(n??"").replace(/(\/\/[^:/@]+:)([^@]+)(@)/,"$1\u2022\u2022\u2022$3")}

package/admin/js/templates/collections.html

@@ -40,7 +40,7 @@
             <div class="clx-card">
                 <div class="clx-bar">
                     <strong>MongoDB connections</strong>
-                    <span data-help-title="Database connections" data-help="Collections are stored as files unless their storage is set to MongoDB, which needs a connection here - usually one called default. Each needs a URI (mongodb://…) and a database name. Kept in config/connections.json; with none, every collection stays on files. Ctrl+S saves."></span>
+                    <span data-help-title="Database connections" data-help="Collections are stored as files unless their storage is set to MongoDB, which needs a connection here - usually one called default. Each needs a URI (mongodb://…) and a database name. Passwords are never shown: a saved one appears as dots - leave them to keep it, or type a new one. Change the host, user or options and you must type it again. Kept in config/connections.json; with none, every collection stays on files. Ctrl+S saves."></span>
                     <span class="clx-spacer"></span>
                     <label class="clx-toggle"><input type="checkbox" data-model="raw.value"> Raw JSON</label>
                     <button type="button" class="btn btn-sm btn-ghost" data-on-click="addConnection" data-bind-hidden="raw.value">

package/admin/js/templates/docs/api-actions.html

@@ -1,5 +1,5 @@
 <div class="view-header">
-  <h1><span data-icon="code"></span> API · Actions API</h1>
+  <h1><span data-icon="code"></span> API &middot; Actions API</h1>
   <a href="#/api-reference" class="btn btn-ghost btn-sm"><span data-icon="arrow-left"></span> API overview</a>
 </div>
 <style>

package/admin/js/templates/docs/api-authentication.html

@@ -1,5 +1,5 @@
 <div class="view-header">
-  <h1><span data-icon="code"></span> API · Authentication</h1>
+  <h1><span data-icon="code"></span> API &middot; Authentication</h1>
   <a href="#/api-reference" class="btn btn-ghost btn-sm"><span data-icon="arrow-left"></span> API overview</a>
 </div>
 <style>

package/admin/js/templates/docs/api-builder.html

@@ -1,5 +1,5 @@
 <div class="view-header">
-  <h1><span data-icon="code"></span> API · API Builder</h1>
+  <h1><span data-icon="code"></span> API &middot; API Builder</h1>
   <a href="#/api-reference" class="btn btn-ghost btn-sm"><span data-icon="arrow-left"></span> API overview</a>
 </div>
 <style>

package/admin/js/templates/docs/api-collections.html

@@ -1,5 +1,5 @@
 <div class="view-header">
-  <h1><span data-icon="code"></span> API · Collections</h1>
+  <h1><span data-icon="code"></span> API &middot; Collections</h1>
   <a href="#/api-reference" class="btn btn-ghost btn-sm"><span data-icon="arrow-left"></span> API overview</a>
 </div>
 <style>
@@ -150,11 +150,14 @@
 <h3><span class="method-badge method-get">GET</span><span class="endpoint-path">/api/collections/connections</span></h3>
 <p class="auth-note">Requires Bearer token + an admin role (level 0 or 1).</p>
 <p>The MongoDB connections in <code>config/connections.json</code>. <code>PUT</code> saves them; each needs
-    <code>type</code>, <code>uri</code> and <code>database</code>.</p>
+    <code>type</code>, <code>uri</code> and <code>database</code>. Passwords are never sent: the one in a URI, and any
+    secret-looking option, comes back as <code>••••••••</code>. Send the mask back unchanged to keep the stored value; it is restored only while scheme, user, hosts, query
+    and options are unchanged.</p>
 <pre class="code-block"><code>// Response 200
-{ "default": { "type": "mongodb", "uri": "mongodb://localhost:27017", "database": "my_cms" } }
+{ "default": { "type": "mongodb", "uri": "mongodb://site:••••••••@localhost:27018/my_cms", "database": "my_cms" } }
 // PUT - Error 400
-{ "error": "Connection \"default\" requires type, uri, and database" }</code></pre>
+{ "error": "Connection \"default\" requires type, uri, and database" }
+{ "error": "Connection \"default\": type the password again - it was hidden, and the connection now points somewhere else or it was never saved" }</code></pre>
 
 <h3 style="margin-top:24px;font-size:15px;text-transform:uppercase;letter-spacing:.5px;opacity:.6">
     Admin Entry CRUD</h3>

package/admin/js/templates/docs/api-external.html

@@ -1,5 +1,5 @@
 <div class="view-header">
-  <h1><span data-icon="code"></span> API · External API</h1>
+  <h1><span data-icon="code"></span> API &middot; External API</h1>
   <a href="#/api-reference" class="btn btn-ghost btn-sm"><span data-icon="arrow-left"></span> API overview</a>
 </div>
 <style>

package/admin/js/templates/docs/api-forms.html

@@ -1,5 +1,5 @@
 <div class="view-header">
-  <h1><span data-icon="code"></span> API · Forms API</h1>
+  <h1><span data-icon="code"></span> API &middot; Forms API</h1>
   <a href="#/api-reference" class="btn btn-ghost btn-sm"><span data-icon="arrow-left"></span> API overview</a>
 </div>
 <style>

package/admin/js/templates/docs/api-layouts.html

@@ -1,5 +1,5 @@
 <div class="view-header">
-  <h1><span data-icon="code"></span> API · Layouts</h1>
+  <h1><span data-icon="code"></span> API &middot; Layouts</h1>
   <a href="#/api-reference" class="btn btn-ghost btn-sm"><span data-icon="arrow-left"></span> API overview</a>
 </div>
 <style>

package/admin/js/templates/docs/api-media.html

@@ -1,5 +1,5 @@
 <div class="view-header">
-  <h1><span data-icon="code"></span> API · Media</h1>
+  <h1><span data-icon="code"></span> API &middot; Media</h1>
   <a href="#/api-reference" class="btn btn-ghost btn-sm"><span data-icon="arrow-left"></span> API overview</a>
 </div>
 <style>

package/admin/js/templates/docs/api-navigation.html

@@ -1,5 +1,5 @@
 <div class="view-header">
-  <h1><span data-icon="code"></span> API · Navigation</h1>
+  <h1><span data-icon="code"></span> API &middot; Navigation</h1>
   <a href="#/api-reference" class="btn btn-ghost btn-sm"><span data-icon="arrow-left"></span> API overview</a>
 </div>
 <style>

package/admin/js/templates/docs/api-pages.html

@@ -1,5 +1,5 @@
 <div class="view-header">
-  <h1><span data-icon="code"></span> API · Pages</h1>
+  <h1><span data-icon="code"></span> API &middot; Pages</h1>
   <a href="#/api-reference" class="btn btn-ghost btn-sm"><span data-icon="arrow-left"></span> API overview</a>
 </div>
 <style>

package/admin/js/templates/docs/api-plugins.html

@@ -1,5 +1,5 @@
 <div class="view-header">
-  <h1><span data-icon="code"></span> API · Plugins</h1>
+  <h1><span data-icon="code"></span> API &middot; Plugins</h1>
   <a href="#/api-reference" class="btn btn-ghost btn-sm"><span data-icon="arrow-left"></span> API overview</a>
 </div>
 <style>

package/admin/js/templates/docs/api-scaffold.html

@@ -1,5 +1,5 @@
 <div class="view-header">
-  <h1><span data-icon="code"></span> API · Scaffold API</h1>
+  <h1><span data-icon="code"></span> API &middot; Scaffold API</h1>
   <a href="#/api-reference" class="btn btn-ghost btn-sm"><span data-icon="arrow-left"></span> API overview</a>
 </div>
 <style>

package/admin/js/templates/docs/api-settings.html

@@ -1,5 +1,5 @@
 <div class="view-header">
-  <h1><span data-icon="code"></span> API · Settings</h1>
+  <h1><span data-icon="code"></span> API &middot; Settings</h1>
   <a href="#/api-reference" class="btn btn-ghost btn-sm"><span data-icon="arrow-left"></span> API overview</a>
 </div>
 <style>

package/admin/js/templates/docs/api-users.html

@@ -1,5 +1,5 @@
 <div class="view-header">
-  <h1><span data-icon="code"></span> API · Users</h1>
+  <h1><span data-icon="code"></span> API &middot; Users</h1>
   <a href="#/api-reference" class="btn btn-ghost btn-sm"><span data-icon="arrow-left"></span> API overview</a>
 </div>
 <style>

package/admin/js/templates/docs/api-views.html

@@ -1,5 +1,5 @@
 <div class="view-header">
-  <h1><span data-icon="code"></span> API · Views API</h1>
+  <h1><span data-icon="code"></span> API &middot; Views API</h1>
   <a href="#/api-reference" class="btn btn-ghost btn-sm"><span data-icon="arrow-left"></span> API overview</a>
 </div>
 <style>

package/admin/js/templates/docs/usage-cta-shortcode.html

@@ -51,7 +51,7 @@
                           <td><code>style</code></td>
                           <td>No</td>
                           <td><code>"primary"</code></td>
-                          <td>primary · secondary · ghost · danger</td>
+                          <td>primary &middot; secondary &middot; ghost &middot; danger</td>
                       </tr>
                       <tr>
                           <td><code>icon</code></td>
@@ -63,7 +63,7 @@
                           <td><code>size</code></td>
                           <td>No</td>
                           <td>-</td>
-                          <td>sm · md · lg</td>
+                          <td>sm &middot; md &middot; lg</td>
                       </tr>
                       <tr>
                           <td><code>confirm</code></td>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "0.101.7",
+  "version": "0.101.9",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",
@@ -84,7 +84,7 @@
     "@fastify/rate-limit": "^10.3.0",
     "@fastify/static": "9.1.1",
     "bcryptjs": "^3.0.3",
-    "domma-js": "0.50.3",
+    "domma-js": "0.51.0",
     "dotenv": "^17.2.3",
     "fastify": "5.8.5",
     "gray-matter": "^4.0.3",

package/plugins/blog/blocks/blog-card-row.html

@@ -4,7 +4,7 @@
 -->
 <a class="br-media {{imageClass}}" href="{{url}}" tabindex="-1" aria-hidden="true">{{{image}}}</a>
 <div class="br-body">
-  <p class="br-meta"><time datetime="{{publishedAt}}">{{publishedAt:DD/MM/YYYY}}</time> · {{readingTime}}</p>
+  <p class="br-meta"><time datetime="{{publishedAt}}">{{publishedAt:DD/MM/YYYY}}</time> &middot; {{readingTime}}</p>
   <h2 class="br-title"><a href="{{url}}">{{title}}</a></h2>
   <p class="br-excerpt">{{excerpt}}</p>
   <div class="br-foot"><span class="br-cats">{{{categories}}}</span><a class="br-author" href="{{authorUrl}}">{{authorName}}</a></div>

package/plugins/blog/blocks/blog-card.html

@@ -12,5 +12,5 @@
   <div class="bc-kicker">{{{categories}}}</div>
   <h2 class="bc-title"><a href="{{url}}">{{title}}</a></h2>
   <p class="bc-excerpt">{{excerpt}}</p>
-  <p class="bc-meta"><a href="{{authorUrl}}">{{authorName}}</a> · <time datetime="{{publishedAt}}">{{publishedAt:DD/MM/YYYY}}</time> · {{readingTime}}</p>
+  <p class="bc-meta"><a href="{{authorUrl}}">{{authorName}}</a> &middot; <time datetime="{{publishedAt}}">{{publishedAt:DD/MM/YYYY}}</time> &middot; {{readingTime}}</p>
 </div>

package/plugins/blog/blocks/blog-post-classic.html

@@ -14,7 +14,7 @@
     <div class="pc-kicker">{{{categories}}}</div>
     <h1 class="pc-title">{{title}}</h1>
     <p class="pc-standfirst">{{excerpt}}</p>
-    <p class="pc-meta">By <a href="{{authorUrl}}">{{authorName}}</a> · <time datetime="{{publishedAt}}">{{publishedAt:DD/MM/YYYY}}</time> · {{readingTime}}</p>
+    <p class="pc-meta">By <a href="{{authorUrl}}">{{authorName}}</a> &middot; <time datetime="{{publishedAt}}">{{publishedAt:DD/MM/YYYY}}</time> &middot; {{readingTime}}</p>
   </header>
   <figure class="pc-figure {{imageClass}}">{{{image}}}</figure>
   <div class="pc-body blog-content">{{{content}}}</div>

package/plugins/blog/blocks/blog-post-feature.html

@@ -14,7 +14,7 @@
       <div class="pf-kicker">{{{categories}}}</div>
       <h1 class="pf-title">{{title}}</h1>
       <p class="pf-standfirst">{{excerpt}}</p>
-      <p class="pf-meta"><a href="{{authorUrl}}">{{authorName}}</a> · <time datetime="{{publishedAt}}">{{publishedAt:DD/MM/YYYY}}</time> · {{readingTime}}</p>
+      <p class="pf-meta"><a href="{{authorUrl}}">{{authorName}}</a> &middot; <time datetime="{{publishedAt}}">{{publishedAt:DD/MM/YYYY}}</time> &middot; {{readingTime}}</p>
     </div>
   </header>
   <div class="pf-wrap">

package/plugins/blog/blocks/blog-post-minimal.html

@@ -9,7 +9,7 @@
 -->
 <article class="pm">
   <header class="pm-head">
-    <p class="pm-meta"><time datetime="{{publishedAt}}">{{publishedAt:DD/MM/YYYY}}</time> · {{readingTime}}</p>
+    <p class="pm-meta"><time datetime="{{publishedAt}}">{{publishedAt:DD/MM/YYYY}}</time> &middot; {{readingTime}}</p>
     <h1 class="pm-title">{{title}}</h1>
     <p class="pm-by">by <a href="{{authorUrl}}">{{authorName}}</a></p>
   </header>

package/plugins/blog/blocks/blog-post-sidebar.html

@@ -25,7 +25,7 @@
         <p class="ps-label">Written by</p>
         <p class="ps-author"><a href="{{authorUrl}}">{{authorName}}</a></p>
         <p class="ps-label">Published</p>
-        <p><time datetime="{{publishedAt}}">{{publishedAt:DD/MM/YYYY}}</time> · {{readingTime}}</p>
+        <p><time datetime="{{publishedAt}}">{{publishedAt:DD/MM/YYYY}}</time> &middot; {{readingTime}}</p>
         <div class="ps-tags">{{{tags}}}</div>
         {{{share}}}
       </div>

package/plugins/blog/blocks/blog-post-split.html

@@ -16,7 +16,7 @@
       <div class="pt-kicker">{{{categories}}}</div>
       <h1 class="pt-title">{{title}}</h1>
       <p class="pt-standfirst">{{excerpt}}</p>
-      <p class="pt-meta"><a href="{{authorUrl}}">{{authorName}}</a><br><time datetime="{{publishedAt}}">{{publishedAt:DD/MM/YYYY}}</time> · {{readingTime}}</p>
+      <p class="pt-meta"><a href="{{authorUrl}}">{{authorName}}</a><br><time datetime="{{publishedAt}}">{{publishedAt:DD/MM/YYYY}}</time> &middot; {{readingTime}}</p>
     </div>
   </header>
   <div class="pt-wrap">

package/plugins/blog/plugin.public.js

@@ -133,7 +133,7 @@ ${items || ''}
             },
             {title, urlPath: request.url.split('?')[0], baseUrl: originOf(request)}
         );
-        return reply.type('text/html').send(html);
+        return reply.type('text/html; charset=utf-8').send(html);
     }
 
     /** One handler per page; `matchBlogPath()` (lib/layouts.js) picks which. */
@@ -231,7 +231,7 @@ ${items}
                     item: {type: 'blog:post', id: post.id}
                 }
             );
-            return reply.type('text/html').send(html);
+            return reply.type('text/html; charset=utf-8').send(html);
         }
     };
 

package/plugins/free-tier.lock.json

@@ -1,6 +1,6 @@
 {
   "note": "Written by `make sync-free-tier` in dcms-marketplace. Do not edit these plugins here - edit them there and sync.",
-  "source": "dcms-marketplace@5dcb9db",
+  "source": "dcms-marketplace@45a0ace",
   "plugins": {
     "blog": {
       "version": "1.9.3",
@@ -22,21 +22,21 @@
         "blocks/blog-card-compact.css": "eb8e8ae9a6461c362bc021ea0396c6b4481047b6b36a50eeb59e47375e49be75",
         "blocks/blog-card-compact.html": "7e1e31923808e6108d57d34309d3442b5d93b4aa4396f0e471e870249934ab8f",
         "blocks/blog-card-row.css": "f5f0249c51a40cc71ff8d054bfa887353badc79730b0f323c76ac32f7d893b44",
-        "blocks/blog-card-row.html": "da6c25793afc14381dd8aa70cd01b859a1dcce20e859770f6b3b24cea4b0f868",
+        "blocks/blog-card-row.html": "c08148ab5b5addc86f1148841c21ffb11f9a1b94f28fbdc08bc9650167920374",
         "blocks/blog-card.css": "d480a80a7378bd55659e9549bb30d8c106bdae1a9cd450a8c0114bfaefa94cd2",
-        "blocks/blog-card.html": "60a45772f7642856fe462dc1ef7e15f6b85a451d9b1a307af7ba814f0a6b1e73",
+        "blocks/blog-card.html": "61e222fe36c6fe9167f2e0b5750a9ddb724c90c0c4719d4a671197baf525f52f",
         "blocks/blog-post-classic.css": "9acac617847b5a10dabd5efccb601572e2751f792c4038475325f11e24142584",
-        "blocks/blog-post-classic.html": "380c55a638645ca5bf5810836bcf9327d050123b513007027012f451f2d16558",
+        "blocks/blog-post-classic.html": "3fb19c554108e34c6602d2b01715067a2e181544ff206193dd9116482d0d852b",
         "blocks/blog-post-essay.css": "d1842443927ea7c93772a06ade69fc834099e6820d99767e0aab8e80981a3784",
         "blocks/blog-post-essay.html": "85bb2eafd07192f97fdf7a9690e80aab266edd43277d64fa0e91ebbc37c2d243",
         "blocks/blog-post-feature.css": "7d8a242b627f3826df21d5470e643b386967122ea3585e69f96cce9ffc2452e9",
-        "blocks/blog-post-feature.html": "d34cb682f2285f6688a86b539e76f9d2229db4cce61ef0200cf5940148983a80",
+        "blocks/blog-post-feature.html": "7b38c8f50c7c31db2506abc672856cad6ac522597ae9ce551320083e910d053e",
         "blocks/blog-post-minimal.css": "2323b84a7d0a99e1c85c30faa18bb2ee16763ff08cfe87f181ffadf8cff84dd0",
-        "blocks/blog-post-minimal.html": "b0fa2e33389b186fc6834e839a424ef0b3122d13e31219cb91dd58ccd82021b9",
+        "blocks/blog-post-minimal.html": "71e3c461b5f8ac7f72055810bae611045aac84148dcf8f227a9d526bfecf0b49",
         "blocks/blog-post-sidebar.css": "3c66109fa48ca448605eb5acd0c998f43649fb3747813b4a811992ec89886007",
-        "blocks/blog-post-sidebar.html": "2fb6e1348c4800ae5cea08db02fc842916e16f64ab91ef6a20a47f7db310bba1",
+        "blocks/blog-post-sidebar.html": "1e18f334950617cb38d5fb22c7d9ba29d76b744a28e761997c9f4e03de10187b",
         "blocks/blog-post-split.css": "61ae29850d6c324ffbfc2110a917d5980ad17b0635870656ccd885d20ac9ec86",
-        "blocks/blog-post-split.html": "1b5fa63eee45b06d62757c96bd069645ace69e3b5a6e145ba1612626b2e4c7a2",
+        "blocks/blog-post-split.html": "65e291e203bf7b9c7e07e705a56605d5a4c316781bdcbb0cb8c537d0b8281478",
         "collections/categories/schema.json": "0728e522ed8e3c623fd45e137cd03e0960aa5158e70613ec8628c8b3928e0929",
         "collections/comments/schema.json": "29cbd289cbfcfc4158c9357a218db4ce06eddc3370bfbf9afb7d7f52065a849e",
         "collections/posts/schema.json": "19a5a770d3eefea73f4117454bd1312a7a7e3d727cfcdfde141139fbc81cabd7",
@@ -51,7 +51,7 @@
         "lib/samples.js": "e8cdb77ce22e43937707f6854d3a5cb722437dc584e22ac7b24480bef686cf85",
         "plugin.js": "0aa46a01b5298065497f39729b88e34a9f56ac684b0a14f8d94ab6007f0221d0",
         "plugin.json": "f74ba12c5dfef7d0b9accd267cc0c4e333ea61a936cc8afa565db82da5b02389",
-        "plugin.public.js": "ab23fadd5655fab8eea0e636a3e1f8ced78432d6da929059a4a147f0805ff3a4",
+        "plugin.public.js": "67e109da613237d9ec52e7cc2f3442bb61ca5a51cb184448b9f0d993e50f7ae3",
         "public/blog.css": "fd733e6b624190da1e70dc1b6613e2376efd7f7570a28fab311d81006d03d960",
         "public/blog.js": "d01c72a9834dcc7c5241923371f2b164ac30d20ac9f1a5c5dc5b71fa3cb09f08",
         "public/samples/aurora.svg": "feb29e2b46465913fc29de9eda221b00b1541f1fa3ea7120f0c1d1cd11a9a4f6",
@@ -157,7 +157,7 @@
         "lib/summary.js": "a510386e28eb19d9617f488551d1057819ae9f76fc85c744f2e5dbce492607fe",
         "plugin.js": "594c2174e36566f90ac1e9ff11cb76656ad111dc392dc8e9556d731b7dd0a41a",
         "plugin.json": "1d76fea187dea958b82e752e5d6e7a729217b08b061490c8590e2c6e6537496e",
-        "plugin.public.js": "176383dfa7af913c433e0397584c46a67a21ab3307b80a08f0aaf50da2634f9e",
+        "plugin.public.js": "ad901378eb28758d18b9f257e4a76d5a453f89fb984ed02a10f62f1a13cd2a62",
         "public/cart.js": "fcc706773a36e4bfd02ea235bcdad629137e996218e0a0e23892e33c689f2a6e",
         "public/lib/money.js": "d22b2b6f80dde6f7887b69e24188c05ea93c02217aba639b5331aa3bd616f4fc",
         "public/lib/orders.js": "09478e20d238adc8e387b3d9efcb13c441898fab18387ce6a1a8a92304ac4c5b",

package/plugins/shopping-cart/plugin.public.js

@@ -55,7 +55,7 @@ export default async function shopPublic(fastify) {
             title, description, ogImage: image, urlPath, noindex,
             baseUrl: `${request.protocol}://${request.host || request.headers.host || request.hostname}`
         });
-        return reply.type('text/html').header('Cache-Control', 'no-store').send(html);
+        return reply.type('text/html; charset=utf-8').header('Cache-Control', 'no-store').send(html);
     }
 
     const pages = {

package/server/routes/api/collections.js

@@ -63,6 +63,7 @@ import {ensureFormForCollection} from '../../services/forms.js';
 import {hooks} from '../../services/hooks.js';
 import {scopeAllows, validateToken} from '../../services/apiTokens.js';
 import {isProjectEnabled, resolveArtefactProject} from '../../services/projects.js';
+import {maskConnections, restoreConnections} from '../../services/connectionSecrets.js';
 
 const ALL_PRESET_SLUGS = new Set(['roles', 'user-profiles', ...PRESET_COLLECTION_SLUGS]);
 
@@ -323,7 +324,7 @@ export async function collectionsRoutes(fastify) {
   fastify.get('/collections/connections', {preHandler: [authenticate, requireAdmin]}, async () => {
     try {
       const {_comment, ...rest} = getConfig('connections');
-      return rest;
+      return maskConnections(rest);
     } catch {
       return {};
     }
@@ -339,7 +340,11 @@ export async function collectionsRoutes(fastify) {
         return reply.status(400).send({error: `Connection "${name}" requires type, uri, and database`});
       }
     }
-    saveConfig('connections', data);
+    let stored = {};
+    try { stored = getConfig('connections'); } catch { /* nothing saved yet */ }
+    const {config, error} = restoreConnections(data, stored);
+    if (error) return reply.status(400).send({error});
+    saveConfig('connections', stored._comment !== undefined ? {_comment: stored._comment, ...config} : config);
     return {success: true};
   });
 

package/server/routes/docs-public.js

@@ -26,16 +26,16 @@ export async function docsPublicRoutes(fastify) {
         // Hard kill-switch: docs disabled → 404 the entire surface.
         if (!(await isProjectEnabled(DOCS_PROJECT_SLUG))) {
             reply.status(404);
-            return reply.type('text/html').send(await render404(request.url.split('?')[0]));
+            return reply.type('text/html; charset=utf-8').send(await render404(request.url.split('?')[0]));
         }
 
         const docPath = String(request.params['*'] || '');
         const html = await renderDocPage(docPath, {user: null, baseUrl: getBaseUrl(request)});
         if (html == null) {
             reply.status(404);
-            return reply.type('text/html').send(await render404(`/domma-docs${docPath ? '/' + docPath : ''}`));
+            return reply.type('text/html; charset=utf-8').send(await render404(`/domma-docs${docPath ? '/' + docPath : ''}`));
         }
-        return reply.type('text/html').send(html);
+        return reply.type('text/html; charset=utf-8').send(html);
     };
 
     fastify.get('/domma-docs', handle);    // exact - params['*'] === '' (home landing)

package/server/routes/public.js

@@ -87,7 +87,7 @@ function sendHtml(request, reply, html) {
     // Deliberately no reply.code() here: the 404 handlers have already called
     // reply.status(404), and forcing 200 would turn every not-found into a
     // soft 404 that search engines index as a real page.
-    return reply.type('text/html').send(html);
+    return reply.type('text/html; charset=utf-8').send(html);
 }
 
 export async function publicRoutes(fastify) {
@@ -170,7 +170,7 @@ export async function publicRoutes(fastify) {
                 shared: {expiresAt: link.expiresAt, label: link.label}
             }
         });
-        return reply.type('text/html').send(html);
+        return reply.type('text/html; charset=utf-8').send(html);
     });
 
     // Public pages catch-all
@@ -246,7 +246,7 @@ export async function publicRoutes(fastify) {
 
         if (!isPublic && !checkVisibility(userObj, vis)) {
             reply.status(403);
-            return reply.type('text/html').send(accessDeniedHtml(urlPath));
+            return reply.type('text/html; charset=utf-8').send(accessDeniedHtml(urlPath));
         }
 
         const baseUrl = getBaseUrl(request);
@@ -270,7 +270,7 @@ export async function publicRoutes(fastify) {
         if (isDraft) {
             reply.header('cache-control', 'no-store, private');
             reply.header('x-robots-tag', 'noindex, nofollow');
-            return reply.type('text/html').send(await render());
+            return reply.type('text/html; charset=utf-8').send(await render());
         }
 
         // A row-scoped [view] shows each signed-in user their OWN rows, so the

package/server/server.js

@@ -164,6 +164,16 @@ await app.register(compress, {
     encodings: ['br', 'gzip', 'deflate']
 });
 
+// Ensure any text/html responses always declare charset=utf-8 to prevent browsers,
+// proxies, and scrapers from falling back to ISO-8859-1 or Windows-1252.
+app.addHook('onSend', async (request, reply, payload) => {
+    const contentType = reply.getHeader('content-type');
+    if (typeof contentType === 'string' && contentType.startsWith('text/html') && !contentType.toLowerCase().includes('charset')) {
+        reply.header('content-type', `${contentType}; charset=utf-8`);
+    }
+    return payload;
+});
+
 // ---------------------------------------------------------------------------
 // Static Assets
 // ---------------------------------------------------------------------------

package/server/services/connectionSecrets.js

@@ -0,0 +1,160 @@
+/**
+ * Database connection secrets never reach the browser.
+ *
+ * GET /collections/connections sends each URI with its password, and any secret query
+ * parameter (tlsCertificateKeyFilePassword, proxyPassword, authMechanismProperties), replaced
+ * by CONNECTION_MASK, and any option whose key looks secret (auth.password) as the mask too.
+ * PUT sends the mask back for anything left untouched and restoreConnections() puts the stored
+ * value back - but only from a stored connection with the same endpoint (scheme, user, host
+ * list, query and driver options, secrets aside). Change where or how a connection
+ * authenticates and its secrets must be typed again, or a masked URI aimed at another host or
+ * proxy would carry the stored password there. The database path may change freely. A mask
+ * that cannot be matched is refused, never saved as the password. A URI whose credentials
+ * cannot be told apart from its query (a raw ? in the password) is masked whole.
+ */
+
+export const CONNECTION_MASK = '••••••••';
+
+const SECRET_KEY = /pass(word)?|secret|token|api[-_]?key|private|credential/i;
+const SECRET_PARAM = /pass(word)?|secret|token|authMechanismProperties/i;
+
+/**
+ * scheme://[user[:password]@]hosts[/path][?query]. The query is split off first and the LAST
+ * @ before it ends the credentials, so an @ in the query or an unescaped one in the password
+ * cannot move the split.
+ */
+function parseUri(uri) {
+    if (typeof uri !== 'string') return null;
+    const m = uri.trim().match(/^([a-z][a-z0-9+.-]*:\/\/)(.*)$/is);
+    if (!m) return null;
+    const rest = m[2];
+    const qi = rest.indexOf('?');
+    const main = qi < 0 ? rest : rest.slice(0, qi);
+    const at = main.lastIndexOf('@');
+    // An @ only after the first ? is either in the query or behind a raw ? in the password:
+    // unknowable, so the whole URI is treated as one secret.
+    if (rest === CONNECTION_MASK || (at < 0 && qi >= 0 && rest.indexOf('@', qi) >= 0)) {
+        return {opaque: true, scheme: m[1].toLowerCase(), uri: uri.trim()};
+    }
+    const userinfo = at < 0 ? null : main.slice(0, at);
+    const hp = at < 0 ? main : main.slice(at + 1);
+    const si = hp.indexOf('/');
+    const ci = userinfo === null ? -1 : userinfo.indexOf(':');
+    return {
+        scheme: m[1].toLowerCase(),
+        user: userinfo === null ? null : (ci < 0 ? userinfo : userinfo.slice(0, ci)),
+        pass: ci < 0 ? null : userinfo.slice(ci + 1),
+        hosts: si < 0 ? hp : hp.slice(0, si),
+        path: si < 0 ? '' : hp.slice(si),
+        params: qi < 0 ? null : rest.slice(qi + 1).split('&').map(p => {
+            const e = p.indexOf('=');
+            return e < 0 ? [p, null] : [p.slice(0, e), p.slice(e + 1)];
+        })
+    };
+}
+
+function formatUri(p) {
+    if (p.opaque) return p.scheme + CONNECTION_MASK;
+    const cred = p.user === null ? '' : p.user + (p.pass === null ? '' : ':' + p.pass) + '@';
+    const query = p.params === null ? '' : '?' + p.params.map(([k, v]) => (v === null ? k : `${k}=${v}`)).join('&');
+    return p.scheme + cred + p.hosts + p.path + query;
+}
+
+const maskParams = (params) => params && params.map(([k, v]) => [k, v && SECRET_PARAM.test(k) ? CONNECTION_MASK : v]);
+
+// Key order must not matter when comparing options.
+const canonical = (v) => Array.isArray(v) ? v.map(canonical)
+    : v && typeof v === 'object' ? Object.fromEntries(Object.keys(v).sort().map(k => [k, canonical(v[k])])) : v;
+
+/** Where and how a connection authenticates, secrets aside - whether stored secrets may follow it. */
+function endpoint(p, options) {
+    const opts = canonical(maskOptions(options ?? {}));
+    if (p.opaque) return JSON.stringify(['opaque', p.scheme, opts]);
+    return JSON.stringify([p.scheme, p.user, p.hosts.toLowerCase(), maskParams(p.params), opts]);
+}
+
+/** A URI with its password and secret query parameters masked. */
+export function maskConnectionUri(uri) {
+    const p = parseUri(uri);
+    if (!p) return uri;
+    if (p.opaque) return formatUri(p);
+    return formatUri({...p, pass: p.pass ? CONNECTION_MASK : p.pass, params: maskParams(p.params)});
+}
+
+function maskOptions(value, key = '') {
+    if (Array.isArray(value)) return value.map(v => maskOptions(v, key));
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, maskOptions(v, k)]));
+    }
+    return SECRET_KEY.test(key) && typeof value === 'string' && value !== '' ? CONNECTION_MASK : value;
+}
+
+// A mask with nothing stored behind it stays a mask, so the caller refuses the save.
+function restoreOptions(incoming, stored) {
+    if (incoming === CONNECTION_MASK) return typeof stored === 'string' ? stored : incoming;
+    if (Array.isArray(incoming)) {
+        const before = Array.isArray(stored) ? stored : [];
+        return incoming.map((v, i) => restoreOptions(v, before[i]));
+    }
+    if (incoming && typeof incoming === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(incoming)) {
+            out[k] = restoreOptions(v, stored && typeof stored === 'object' ? stored[k] : undefined);
+        }
+        return out;
+    }
+    return incoming;
+}
+
+function restoreUri(incoming, stored) {
+    const pi = parseUri(incoming);
+    const ps = parseUri(stored);
+    if (pi.opaque) return ps.uri;
+    const pass = pi.pass === CONNECTION_MASK ? ps.pass : pi.pass;
+    const params = pi.params && pi.params.map(([k, v], i) => [k, v === CONNECTION_MASK ? ps.params[i][1] : v]);
+    return formatUri({...pi, pass, params});
+}
+
+/** The connections as the browser may see them. */
+export function maskConnections(connections) {
+    const out = {};
+    for (const [name, conn] of Object.entries(connections || {})) {
+        if (!conn || typeof conn !== 'object') { out[name] = conn; continue; }
+        const masked = {...conn, uri: maskConnectionUri(conn.uri)};
+        if (conn.options !== undefined) masked.options = maskOptions(conn.options);
+        out[name] = masked;
+    }
+    return out;
+}
+
+/**
+ * The connections to save: masks put back from what is stored.
+ * @returns {{config?: object, error?: string}}
+ */
+export function restoreConnections(incoming, stored) {
+    const before = stored && typeof stored === 'object' ? stored : {};
+    const config = {};
+    for (const [name, conn] of Object.entries(incoming)) {
+        if (!conn || typeof conn !== 'object' || !JSON.stringify(conn).includes(CONNECTION_MASK)) {
+            config[name] = conn;
+            continue;
+        }
+        const pi = parseUri(conn.uri);
+        // The same name first, then any other stored connection at the same endpoint (a rename).
+        const candidates = [before[name], ...Object.entries(before).filter(([n]) => n !== name).map(([, c]) => c)];
+        const source = pi && candidates.find(c => {
+            const ps = c && typeof c === 'object' ? parseUri(c.uri) : null;
+            return ps && endpoint(ps, c.options) === endpoint(pi, conn.options);
+        });
+        const out = {...conn};
+        if (source) {
+            out.uri = restoreUri(conn.uri, source.uri);
+            if (conn.options !== undefined) out.options = restoreOptions(conn.options, source.options);
+        }
+        if (JSON.stringify(out).includes(CONNECTION_MASK)) {
+            return {error: `Connection "${name}": type the password again - it was hidden, and the connection now points somewhere else or it was never saved`};
+        }
+        config[name] = out;
+    }
+    return {config};
+}