domma-cms 0.114.0 → 0.115.0

package/server/routes/api/projects.js

@@ -9,6 +9,8 @@
  * DELETE /api/projects/:slug                 - delete (403 for core; 409 if any artefacts tagged)
  * GET    /api/projects/:slug/artefacts       - grouped artefacts
  * POST   /api/projects/:slug/untag-all       - escape hatch before delete (403 for core)
+ * POST   /api/projects/:slug/remove-contents - delete the project AND everything filed under it;
+ *                                              body {confirm: <slug>} (403 core/protected, 409 users/roles)
  *
  * Auth middlewares are accepted as DI options so tests can supply no-ops.
  */
@@ -26,6 +28,7 @@ import {
     getProject,
     listProjectsForUser,
     projectsBadge,
+    removeProjectContents,
     untagAllForProject,
     updateProject
 } from '../../services/projects.js';
@@ -112,6 +115,31 @@ export async function projectsRoutes(fastify, opts = {}) {
         return {success: true};
     });
 
+    // Deletes pages and data, so it asks for more than projects:delete: deleting pages and
+    // collections too, and access to this project (a project-scoped user cannot reach others).
+    const canRemoveAll = {preHandler: [authenticate, requirePermission('projects', 'delete'),
+        requirePermission('pages', 'delete'), requirePermission('collections', 'delete')]};
+    fastify.post('/projects/:slug/remove-contents', canRemoveAll, async (request, reply) => {
+        const {slug} = request.params;
+        const visible = await listProjectsForUser(request.user);
+        if (!visible.some(p => p.slug === slug)) return reply.status(404).send({error: 'Project not found'});
+        // The slug typed back: this deletes pages and data, and cannot be undone.
+        if (request.body?.confirm !== slug) {
+            return reply.status(400).send({error: `Type the project's slug ("${slug}") to confirm.`});
+        }
+        try {
+            const host = String(request.headers['x-forwarded-host'] || request.headers.host || '').split(',')[0].trim();
+            const result = await removeProjectContents(slug, {siteHost: host});
+            await cache.invalidateTags(['projects', `project:${slug}`, 'site', 'nav']);
+            if (result.failed.length) {
+                return reply.status(500).send({error: `Some things could not be removed, so the project was kept: ${result.failed.join('; ')}`, ...result});
+            }
+            return {success: true, ...result};
+        } catch (err) {
+            return reply.status(err.status || 400).send({error: err.message});
+        }
+    });
+
     fastify.get('/projects/:slug/artefacts', canRead, async (request, reply) => {
         if (!(await getProject(request.params.slug))) {
             return reply.status(404).send({error: 'Project not found'});

package/server/routes/favicon.js

@@ -0,0 +1,59 @@
+/**
+ * /favicon.svg and /favicon.ico - every site has an icon in the browser tab.
+ *
+ * There was none: no <link rel="icon">, no route, so every page load asked for
+ * /favicon.ico and got a 404. Now site.json `favicon`, else the brand logo
+ * (brand.logo) - a redirect, so the logo in Media stays the one source -
+ * and otherwise a generated icon: the first letter of the site's name.
+ *
+ * Read per request, so a new logo or title shows without a restart.
+ */
+import {getConfig} from '../config.js';
+
+/** A same-site path or an https URL - never a scheme that could run anything. */
+// A backslash is refused anywhere: browsers read /\evil.com as //evil.com.
+const SAFE_LOGO = /^(\/(?![/\\])[^\s"'<>\\]*|https:\/\/[^\s"'<>\\]+)$/i;
+
+/**
+ * The generated icon: a rounded square with the site's initial.
+ *
+ * @param {string} title - the site's name
+ * @returns {string} SVG
+ */
+export function letterIcon(title = '') {
+    const ch = (String(title).match(/[\p{L}\p{N}]/u) || ['D'])[0].toUpperCase();
+    const esc = ch.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+    return '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">'
+        + '<rect width="64" height="64" rx="14" fill="#4f46e5"/>'
+        + `<text x="32" y="44" text-anchor="middle" font-family="system-ui,-apple-system,Segoe UI,Roboto,sans-serif" font-size="36" font-weight="700" fill="#ffffff">${esc}</text>`
+        + '</svg>';
+}
+
+/**
+ * What to answer for the icon, from site.json.
+ *
+ * @param {object} site
+ * @returns {{redirect: string}|{svg: string}}
+ */
+export function faviconFor(site = {}) {
+    // site.json `favicon` (a Settings key) first, then the brand logo.
+    for (const v of [site?.favicon, site?.brand?.logo]) {
+        const url = typeof v === 'string' ? v.trim() : '';
+        if (url && SAFE_LOGO.test(url)) return {redirect: url};
+    }
+    return {svg: letterIcon(site?.title || site?.brand?.text || '')};
+}
+
+export async function faviconRoutes(fastify) {
+    const answer = async (request, reply) => {
+        let site = {};
+        try { site = getConfig('site') || {}; } catch { /* no site config: the letter D */ }
+        const out = faviconFor(site);
+        reply.header('Cache-Control', 'public, max-age=3600');
+        if (out.redirect) return reply.redirect(out.redirect, 302);
+        return reply.type('image/svg+xml').send(out.svg);
+    };
+    fastify.get('/favicon.svg', answer);
+    // Browsers ask for /favicon.ico whatever the page says; an SVG body is accepted by every current browser.
+    fastify.get('/favicon.ico', answer);
+}

package/server/server.js

@@ -31,6 +31,7 @@ import {refreshComponentTagAllowlist} from './services/markdown.js';
 import * as cache from './services/cache/index.js';
 import {parseTrustProxy} from './services/network.js';
 import {rateLimitOptions} from './services/rate-limit.js';
+import {frameSources} from './services/embedCsp.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const ROOT = path.resolve(__dirname, '..');
@@ -122,6 +123,8 @@ await app.register(helmet, {
             imgSrc: ["'self'", 'data:', 'blob:'],
             fontSrc: ["'self'", 'data:', 'https://fonts.gstatic.com'],
             connectSrc: ["'self'", 'https://cdn.jsdelivr.net'],
+            // [embed] players and config/embeds.json hosts - without this, default-src blocked them all.
+            frameSrc: frameSources((() => { try { return getConfig('embeds')?.allowedHosts; } catch { return []; } })()),
             upgradeInsecureRequests: null, // prevent browsers forcing HTTPS on HTTP deployments
         }
     },
@@ -710,6 +713,9 @@ await app.register(docsPublicRoutes);
 const { callPublicRoutes } = await import('./routes/call-public.js');
 await app.register(callPublicRoutes);
 
+// Before the pages: /favicon.* must never reach the page router.
+const { faviconRoutes } = await import('./routes/favicon.js');
+await app.register(faviconRoutes);
 const { publicRoutes } = await import('./routes/public.js');
 await app.register(publicRoutes);
 

package/server/services/embedCsp.js

@@ -0,0 +1,33 @@
+/**
+ * The frame-src the Content-Security-Policy needs for [embed].
+ *
+ * The CSP had no frame-src, so it fell back to default-src 'self' and the
+ * browser blocked every embedded player - YouTube and Vimeo included, which the
+ * [embed] shortcode documents as always allowed. The page rendered the iframe
+ * and the visitor saw a blocked frame.
+ *
+ * So: 'self' (the [demo] shortcode frames the site's own pages), the two players
+ * [embed] rewrites links to (youtube-nocookie.com, player.vimeo.com), and every
+ * host in config/embeds.json `allowedHosts` - the same list the renderer and the
+ * sanitiser already enforce (server.js passes getConfig('embeds'), as the
+ * renderer reads it). Read at boot: a change to embeds.json needs a restart to
+ * reach the header.
+ */
+/** The players [embed] always uses. */
+// youtube.com too: the HTML sanitiser lets its iframes through, so the policy must agree.
+export const ALWAYS_FRAMED = ['https://www.youtube-nocookie.com', 'https://www.youtube.com', 'https://youtube.com', 'https://player.vimeo.com'];
+
+/** A bare hostname, or nothing: a host in embeds.json must never smuggle in a scheme, path or wildcard. */
+const HOST_RE = /^(?=.{1,253}$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/;
+
+/**
+ * @param {string[]} allowedHosts - config/embeds.json allowedHosts
+ * @returns {string[]} frame-src sources
+ */
+export function frameSources(allowedHosts = []) {
+    const extra = (Array.isArray(allowedHosts) ? allowedHosts : [])
+        .map(h => String(h).trim().toLowerCase())
+        .filter(h => HOST_RE.test(h))
+        .map(h => `https://${h}`);
+    return [...new Set(["'self'", ...ALWAYS_FRAMED, ...extra])];
+}

package/server/services/markdown.js

@@ -694,7 +694,7 @@ function renderCollectionAccordion(entries, titleField, bodyField, multiple, emp
  * @param {string} opts.titleField   - entry data field used as item title
  * @param {string} [opts.dateField]  - optional field surfaced as data-date
  * @param {string} [opts.statusField]- optional field surfaced as data-status
- * @param {string} [opts.iconField]  - optional field surfaced as data-icon
+ * @param {string} [opts.iconField]  - optional field surfaced as data-event-icon
  * @param {string} [opts.bodyField]  - optional Markdown body field
  * @param {string} opts.layout       - vertical | centred | horizontal
  * @param {string} opts.theme        - minimal | corporate | modern
@@ -712,7 +712,9 @@ function renderCollectionTimeline(entries, opts, ctxOpts = {}) {
         const title = escapeHtmlText(String(e.data?.[titleField] ?? e.id ?? '(untitled)'));
         const date = dateField && e.data?.[dateField] != null ? ` data-date="${escapeAttr(String(e.data[dateField]))}"` : '';
         const status = statusField && e.data?.[statusField] != null ? ` data-status="${escapeAttr(String(e.data[statusField]))}"` : '';
-        const icon = iconField && e.data?.[iconField] != null ? ` data-icon="${escapeAttr(String(e.data[iconField]))}"` : '';
+        // data-event-icon, never data-icon: the icon scanner turns ANY [data-icon] element into an
+        // icon, replacing its children - which wiped each item's title and body before site.js read them.
+        const icon = iconField && e.data?.[iconField] != null ? ` data-event-icon="${escapeAttr(String(e.data[iconField]))}"` : '';
         const bodyHtml = bodyField
             ? marked.parse(String(e.data?.[bodyField] ?? ''))
             : '';
@@ -2581,6 +2583,9 @@ LAYOUT_RENDERERS['pricing'] = (attrs, body) => {
     const period = escapeAttr(attrs.period || '');
     const gradient = escapeAttr(attrs.gradient || 'indigo');
     const cta = escapeAttr(attrs.footer || 'Get started');
+    // Where the button goes - it always went to "#" before. Same handling as [button]'s href;
+    // the sanitiser removes a javascript: URL.
+    const href = escapeAttr(attrs.href || '#');
     const features = parseSubTagList(body, 'feature');
     const featHtml = features.map(f => `<div class="card-pricing-feature"><span class="card-pricing-check">\u2713</span>${escapeAttr(f.content)}</div>`).join('');
     return `${cardRoot(attrs)}<div class="card-header card-gradient-${gradient}">
@@ -2588,7 +2593,7 @@ LAYOUT_RENDERERS['pricing'] = (attrs, body) => {
     <div class="card-stat-value" style="color:#fff">${price}</div>
     ${period ? `<div style="opacity:.75;font-size:.8rem">${period}</div>` : ''}
   </div><div class="card-pricing-features">${featHtml}</div>
-  <a class="card-pricing-cta" href="#">${cta}</a></div>\n`;
+  <a class="card-pricing-cta" href="${href}">${cta}</a></div>\n`;
 };
 
 LAYOUT_RENDERERS['feature-comparison'] = (attrs, body) => {
@@ -3178,7 +3183,8 @@ function processTimelineBlocks(markdown) {
           const title = escapeAttr(ia.title || '');
           const date = ia.date ? ` data-date="${escapeAttr(ia.date)}"` : '';
           const status = ia.status ? ` data-status="${escapeAttr(ia.status)}"` : '';
-          const icon = ia.icon ? ` data-icon="${escapeAttr(ia.icon)}"` : '';
+          // data-event-icon, never data-icon - see renderCollectionTimeline: the icon scanner would empty the item.
+          const icon = ia.icon ? ` data-event-icon="${escapeAttr(ia.icon)}"` : '';
           const descHtml = marked.parse(processCardBlocks(processGridBlocks(processInlineShortcodes(restore(itemBody.trim())))));
           return `<div class="dm-progression-item"${date}${status}${icon}><div class="dm-progression-item-title">${title}</div><div class="dm-progression-item-body">${descHtml}</div></div>`;
         }

package/server/services/presetCollections.js

@@ -52,7 +52,9 @@ const PRESETS = [
             {name: 'rootUrl',     label: 'Root URL',    type: 'text'},
             {name: 'sortOrder',   label: 'Sort Order',  type: 'number',   default: 0},
             {name: 'enabled',     label: 'Enabled',     type: 'boolean',  default: true},
-            {name: 'protected',   label: 'Protected',   type: 'boolean',  default: false}
+            {name: 'protected',   label: 'Protected',   type: 'boolean',  default: false},
+            // Example content a starter bundle put on the site: the admin offers "Remove sample content".
+            {name: 'sample',      label: 'Sample content', type: 'boolean', default: false}
         ],
         api: {
             create: {enabled: false, access: 'admin'},

package/server/services/projects.js

@@ -510,7 +510,8 @@ export async function getArtefactsByProject() {
     try {
         const {listPages} = await import('./content.js');
         for (const p of await listPages()) {
-            const url = p.url || p.urlPath || '/';
+            // urlPath: the page's own address (its file) - what removal deletes, too.
+            const url = p.urlPath || p.url || '/';
             const explicit = (p.project === undefined) ? undefined : p.project;
             const pageProject = await getProjectForPage(url, explicit);
             out(pageProject).pages.push(p);
@@ -672,6 +673,203 @@ export async function untagAllForProject(projectSlug) {
     return counts;
 }
 
+/**
+ * The path a menu link leads to on THIS site, or null when it leads elsewhere.
+ * Relative, root-relative and absolute same-site links all count; the query and
+ * hash are dropped and a trailing slash ignored, so /a, /a/, /a?x=1, /a#top and
+ * https://<this site>/a are one page.
+ *
+ * @param {string} url
+ * @param {string} [siteHost] - this site's host, for absolute links
+ * @returns {string|null}
+ */
+export function linkPath(url, siteHost = '') {
+    if (typeof url !== 'string' || !url.trim()) return null;
+    let u;
+    try { u = new URL(url.trim(), 'http://this.site/'); } catch { return null; }
+    const absolute = /^[a-z][a-z0-9+.-]*:/i.test(url.trim()) || url.trim().startsWith('//');
+    if (absolute && !(siteHost && u.host.toLowerCase() === siteHost.toLowerCase())) return null;
+    if (!['http:', 'https:'].includes(u.protocol)) return null;
+    return u.pathname.replace(/\/+$/, '') || '/';
+}
+
+/**
+ * Menu items with the links to removed pages taken out, PURE. An item whose
+ * link leads to a removed page is dropped; its sub-items that still lead
+ * somewhere take its place, so removing a section never takes an unrelated
+ * page out of the nav.
+ *
+ * @param {object[]} items
+ * @param {Set<string>} goneUrls - normalised paths (see linkPath)
+ * @param {string} [siteHost]
+ * @returns {{items: object[], removed: number}}
+ */
+export function pruneMenuItems(items, goneUrls, siteHost = '') {
+    let removed = 0;
+    const walk = (list) => {
+        const out = [];
+        for (const item of Array.isArray(list) ? list : []) {
+            const kids = Array.isArray(item?.items) ? walk(item.items) : null;
+            const path = linkPath(item?.url, siteHost);
+            if (path && goneUrls.has(path)) {
+                removed++;
+                if (kids?.length) out.push(...kids);
+                continue;
+            }
+            out.push(kids ? {...item, items: kids} : item);
+        }
+        return out;
+    };
+    return {items: walk(items), removed};
+}
+
+/**
+ * What removing a project would refuse on, and why - checked BEFORE anything is
+ * deleted. People are never deleted with content; a menu in a site slot, or a
+ * built-in collection, is never deleted by a project removal either.
+ */
+async function removalBlockers(slug, grouped) {
+    const blockers = [];
+    if (grouped.users.length || grouped.roles.length) {
+        blockers.push(`${grouped.users.length} user(s) and ${grouped.roles.length} role(s) are filed under this project - move them to another project first; people are never deleted along with content`);
+    }
+    try {
+        const {getLocations} = await import('./menus.js');
+        const map = await getLocations();
+        for (const m of grouped.menus) {
+            const slot = Object.entries(map).find(([, s]) => s === m.slug)?.[0];
+            if (slot) blockers.push(`the menu "${m.slug}" is the site's ${slot} menu - map another menu to that slot, or move this one out of the project, first`);
+        }
+    } catch { /* no locations */ }
+    try {
+        const {PRESET_COLLECTION_SLUGS} = await import('./presetCollections.js');
+        const builtIn = new Set(['roles', 'user-profiles', ...PRESET_COLLECTION_SLUGS]);
+        for (const c of grouped.collections) {
+            if (builtIn.has(c.slug)) blockers.push(`the built-in collection "${c.slug}" is filed under this project - built-in collections are never deleted; move it out first`);
+        }
+    } catch { /* no presets */ }
+    return blockers;
+}
+
+/**
+ * Delete a project AND everything filed under it - "Remove sample content".
+ *
+ * Deletes its pages (with their versions and share links), collections (with
+ * their entries), forms, blocks, views, components, actions, menus, API
+ * endpoints and API tokens; takes the links to its pages out of every other
+ * menu; drops the project from menu and context-menu bindings, and deletes
+ * context menus that were bound only to its pages or to it; then deletes the
+ * project record.
+ *
+ * Refused - with nothing deleted - for core and protected projects, while any
+ * user or role is filed under it, while one of its menus fills a site slot,
+ * and while a built-in collection is filed under it. If anything fails part
+ * way, the project record is KEPT (so what is left can still be found under
+ * it) and the failures are reported.
+ *
+ * @param {string} slug
+ * @param {{siteHost?: string}} [opts] - this site's host, so absolute menu links to it are pruned too
+ * @returns {Promise<{removed: Record<string, number>, links: number, contextMenus: number, failed: string[], projectDeleted: boolean}>}
+ * @throws {Error} with `.status` 403 (core/protected), 404 (unknown) or 409 (blocked)
+ */
+export async function removeProjectContents(slug, {siteHost = ''} = {}) {
+    const fail = (status, message) => Object.assign(new Error(message), {status});
+    if (slug === CORE_PROJECT_SLUG) throw fail(403, 'The core project is the site itself - it cannot be removed.');
+    const project = await getProject(slug);
+    if (!project) throw fail(404, 'Project not found');
+    if (project.protected === true) throw fail(403, 'This project is protected and cannot be removed.');
+
+    const grouped = await getArtefactsForProject(slug);
+    const blockers = await removalBlockers(slug, grouped);
+    if (blockers.length) throw fail(409, `Nothing was removed: ${blockers.join('; ')}.`);
+
+    const removed = {pages: 0, collections: 0, forms: 0, blocks: 0, views: 0, components: 0, actions: 0, menus: 0, apis: 0, tokens: 0};
+    const failed = [];
+    const goneUrls = new Set();
+    const tryEach = async (list, fn, key, label) => {
+        for (const item of list) {
+            try {
+                const ok = await fn(item);
+                if (ok === false) throw new Error('not found');
+                removed[key]++;
+            } catch (err) {
+                failed.push(`${key} ${label(item)}: ${err.message}`);
+            }
+        }
+    };
+
+    const {deletePage} = await import('./content.js');
+    const {deletePreviewLinksForPage} = await import('./previewLinks.js');
+    // urlPath is where the page's file is - the same address membership resolves it by.
+    await tryEach(grouped.pages, async (p) => {
+        const url = p.urlPath || p.url;
+        await deletePage(url);
+        goneUrls.add(linkPath(url) || url);
+        try { await deletePreviewLinksForPage(url); } catch { /* none */ }
+    }, 'pages', (p) => p.urlPath || p.url);
+    const {deleteCollection} = await import('./collections.js');
+    await tryEach(grouped.collections, (c) => deleteCollection(c.slug), 'collections', (c) => c.slug);
+    const {deleteForm} = await import('./forms.js');
+    await tryEach(grouped.forms, (f) => deleteForm(f.slug), 'forms', (f) => f.slug);
+    const {deleteBlock} = await import('./blocks.js');
+    await tryEach(grouped.blocks, (b) => deleteBlock(b.name), 'blocks', (b) => b.name);
+    const {deleteView} = await import('./views.js');
+    await tryEach(grouped.views, (v) => deleteView(v.slug), 'views', (v) => v.slug);
+    const {deleteComponent} = await import('./components.js');
+    await tryEach(grouped.components, (c) => deleteComponent(c.name), 'components', (c) => c.name);
+    const {deleteAction} = await import('./actions.js');
+    await tryEach(grouped.actions, (a) => deleteAction(a.slug), 'actions', (a) => a.slug);
+    const menus = await import('./menus.js');
+    await tryEach(grouped.menus, (m) => menus.deleteMenu(m.slug), 'menus', (m) => m.slug);
+    // Through the endpoints service: it drops them from the live /api/x registry at once.
+    const {deleteEndpoint} = await import('./apiEndpoints.js');
+    await tryEach(grouped.apis, (e) => deleteEndpoint(e.id), 'apis', (e) => e.path || e.id);
+    // A token for this project would be a live key to whatever takes the slug next.
+    try {
+        const {API_TOKENS_COLLECTION_SLUG, revokeToken} = await import('./apiTokens.js');
+        const {entries} = await listEntries(API_TOKENS_COLLECTION_SLUG, {limit: 0});
+        await tryEach(entries.filter(e => e.data?.project === slug), (e) => revokeToken(e.id), 'tokens', (e) => e.data?.name || e.id);
+    } catch (err) { failed.push(`tokens: ${err.message}`); }
+
+    // Links to the removed pages, and bindings to the project, in the menus that remain.
+    let links = 0;
+    for (const m of await menus.listMenus().catch(() => [])) {
+        try {
+            const full = await menus.getMenu(m.slug);
+            if (!full) continue;
+            const {items, removed: n} = goneUrls.size ? pruneMenuItems(full.items, goneUrls, siteHost) : {items: full.items, removed: 0};
+            const bound = Array.isArray(full.binding?.projects) && full.binding.projects.includes(slug);
+            if (!n && !bound) continue;
+            const next = {...full, items};
+            if (bound) next.binding = {...full.binding, projects: full.binding.projects.filter(p => p !== slug)};
+            await menus.updateMenu(m.slug, next);
+            links += n;
+        } catch (err) { failed.push(`menu links in ${m.slug}: ${err.message}`); }
+    }
+
+    // Context menus: bound only to removed pages and/or this project -> deleted; otherwise the project unbound.
+    let contextMenus = 0;
+    try {
+        const ctx = await import('./contextMenus.js');
+        for (const m of await ctx.getAllContextMenus()) {
+            const pages = Array.isArray(m?.binding?.pages) ? m.binding.pages : [];
+            const projects = Array.isArray(m?.binding?.projects) ? m.binding.projects : [];
+            const livePages = pages.filter(p => !goneUrls.has(linkPath(p) || p));
+            const liveProjects = projects.filter(p => p !== slug);
+            if (livePages.length === pages.length && liveProjects.length === projects.length) continue;
+            try {
+                if (!livePages.length && !liveProjects.length) { await ctx.deleteContextMenu(m.slug); contextMenus++; }
+                else await ctx.updateContextMenu(m.slug, {...m, binding: {...m.binding, pages: livePages, projects: liveProjects}});
+            } catch (err) { failed.push(`context menu ${m.slug}: ${err.message}`); }
+        }
+    } catch { /* no context menus */ }
+
+    // Anything left behind keeps the project, so it can still be found and dealt with.
+    let projectDeleted = false;
+    if (!failed.length) projectDeleted = await deleteProject(slug);
+    return {removed, links, contextMenus, failed, projectDeleted};
+}
+
 /**
  * The sidebar badge on Manage projects (its countUrl, GET /api/projects/_count):
  * how many projects this user sees - a count to glance at, not a warning -

package/server/templates/page.html

@@ -5,6 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>{{seoTitle}}</title>
     <meta name="description" content="{{seoDescription}}">
+    <link rel="icon" href="/favicon.svg" type="image/svg+xml">
     {{seoTags}}
 
     <!-- Set on preview renders (editor preview, draft preview, share link).
@@ -24,7 +25,7 @@
     <link rel="stylesheet" href="/dist/domma/themes/domma-themes.css">
 
     <!-- Site CSS -->
-    <link rel="stylesheet" href="/public/css/site.css?v=20260929-card-span">
+    <link rel="stylesheet" href="/public/css/site.css?v=20261004-pricing-cta">
     <link rel="stylesheet" href="/public/css/forms.css?v=20260927-submit-btn-css">
     <!-- Menu item hover / current-page effects. Loaded after site.css so a
          menu's own highlight wins over the blanket link styling there. -->
@@ -136,7 +137,7 @@
     </script>
 
     <!-- Site initialisation -->
-    <script src="/public/js/site.js?v=20260927-submit-btn" type="module"></script>
+    <script src="/public/js/site.js?v=20261004-countdown" type="module"></script>
     <script src="/public/js/collection-context.js?v=20260927-ctx" type="module"></script>
     {{ctxMenusModule}}