domma-cms 0.36.14 → 0.36.16

package/CLAUDE.md

@@ -168,6 +168,7 @@ Add custom public-site JS to `public/js/site.js` or new files loaded from `publi
 | `email.js`              | SMTP mail sending (uses `config/site.json` SMTP settings)       |
 | `images.js`             | Image processing / thumbnail generation                         |
 | `plugins.js`            | Plugin discovery, validation, registration, injection snippets  |
+| `pluginScaffold.js`     | Scaffold new plugins from `plugins/_template` (`POST /api/plugins/scaffold`, pre-enabled, restart to activate) |
 | `cache/index.js`        | Pluggable response cache (Memory/None/Redis drivers) with tag-based invalidation. See `docs/cache.md`. |
 
 ## Storage Adapters

package/admin/js/api.js

@@ -1 +1 @@
-const a="/api";function d(){return S.get("auth_token")}function c(){return S.get("auth_refresh_token")}function l(e){S.set("auth_token",e)}function h(){S.remove("auth_token"),S.remove("auth_refresh_token"),S.remove("auth_user")}async function u(){const e=c();if(!e)throw new Error("No refresh token");const o=await fetch(`${a}/auth/refresh`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({refreshToken:e})});if(!o.ok)throw h(),R.navigate("/login"),new Error("Token refresh failed");const{token:s}=await o.json();return l(s),s}async function t(e,o={}){let s=d();const r=i=>({...o.body!==void 0?{"Content-Type":"application/json"}:{},...o.headers,...i?{Authorization:`Bearer ${i}`}:{}});let n=await fetch(`${a}${e}`,{...o,headers:r(s)});if(n.status===401&&c())try{s=await u(),n=await fetch(`${a}${e}`,{...o,headers:r(s)})}catch{return}if(!n.ok){const i=await n.json().catch(()=>({error:"Request failed"}));throw new Error(i.error||i.message||`HTTP ${n.status}`)}return n.status===204?null:n.json()}async function p(e,o){const s=d(),r=s?{Authorization:`Bearer ${s}`}:{},n=await fetch(`${a}${e}`,{method:"POST",headers:r,body:o});if(!n.ok){const i=await n.json().catch(()=>({error:"Upload failed"}));throw new Error(i.error||i.message||`HTTP ${n.status}`)}return n.json()}export const api={auth:{setupStatus:()=>t("/auth/setup-status",{method:"GET"}),setup:e=>t("/auth/setup",{method:"POST",body:JSON.stringify(e)}),login:e=>t("/auth/login",{method:"POST",body:JSON.stringify(e)}),me:()=>t("/auth/me",{method:"GET"}),updateMe:e=>t("/auth/me",{method:"PUT",body:JSON.stringify(e)}),refresh:e=>t("/auth/refresh",{method:"POST",body:JSON.stringify({refreshToken:e})}),forgotPassword:e=>t("/auth/forgot-password",{method:"POST",body:JSON.stringify({email:e})}),resetPassword:(e,o)=>t("/auth/reset-password",{method:"POST",body:JSON.stringify({token:e,password:o})})},pages:{list:()=>t("/pages",{method:"GET"}),get:e=>t(`/pages${e}`,{method:"GET"}),create:e=>t("/pages",{method:"POST",body:JSON.stringify(e)}),update:(e,o)=>t(`/pages${e}`,{method:"PUT",body:JSON.stringify(o)}),delete:e=>t(`/pages${e}`,{method:"DELETE"}),preview:e=>t("/pages/preview",{method:"POST",body:JSON.stringify({markdown:e})}),tags:()=>t("/pages/tags",{method:"GET"}).then(e=>e.tags||[])},settings:{get:()=>t("/settings",{method:"GET"}),save:e=>t("/settings",{method:"PUT",body:JSON.stringify(e)}),getCustomCss:()=>t("/settings/custom-css",{method:"GET"}),saveCustomCss:e=>t("/settings/custom-css",{method:"PUT",body:JSON.stringify({css:e})})},navigation:{get:()=>t("/navigation",{method:"GET"}),save:e=>t("/navigation",{method:"PUT",body:JSON.stringify(e)})},menus:{list:()=>t("/menus",{method:"GET"}),get:e=>t(`/menus/${encodeURIComponent(e)}`,{method:"GET"}),create:e=>t("/menus",{method:"POST",body:JSON.stringify(e)}),update:(e,o)=>t(`/menus/${encodeURIComponent(e)}`,{method:"PUT",body:JSON.stringify(o)}),remove:e=>t(`/menus/${encodeURIComponent(e)}`,{method:"DELETE"}),duplicate:e=>t(`/menus/${encodeURIComponent(e)}/duplicate`,{method:"POST"})},menuLocations:{get:()=>t("/menu-locations",{method:"GET"}),save:e=>t("/menu-locations",{method:"PUT",body:JSON.stringify(e)}),registry:()=>t("/menu-locations/registry",{method:"GET"})},projects:{list:()=>t("/projects",{method:"GET"}),get:e=>t(`/projects/${encodeURIComponent(e)}`,{method:"GET"}),create:e=>t("/projects",{method:"POST",body:JSON.stringify(e)}),update:(e,o)=>t(`/projects/${encodeURIComponent(e)}`,{method:"PUT",body:JSON.stringify(o)}),remove:e=>t(`/projects/${encodeURIComponent(e)}`,{method:"DELETE"}),artefacts:e=>t(`/projects/${encodeURIComponent(e)}/artefacts`,{method:"GET"}),untagAll:e=>t(`/projects/${encodeURIComponent(e)}/untag-all`,{method:"POST"})},apiTokens:{list:()=>t("/api-tokens",{method:"GET"}),create:e=>t("/api-tokens",{method:"POST",body:JSON.stringify(e)}),update:(e,o)=>t(`/api-tokens/${encodeURIComponent(e)}`,{method:"PUT",body:JSON.stringify(o)}),revoke:e=>t(`/api-tokens/${encodeURIComponent(e)}`,{method:"DELETE"})},apiEndpoints:{list:()=>t("/api-endpoints",{method:"GET"}),get:e=>t(`/api-endpoints/${encodeURIComponent(e)}`,{method:"GET"}),create:e=>t("/api-endpoints",{method:"POST",body:JSON.stringify(e)}),update:(e,o)=>t(`/api-endpoints/${encodeURIComponent(e)}`,{method:"PUT",body:JSON.stringify(o)}),remove:e=>t(`/api-endpoints/${encodeURIComponent(e)}`,{method:"DELETE"})},layouts:{get:()=>t("/layouts",{method:"GET"}),save:e=>t("/layouts",{method:"PUT",body:JSON.stringify(e)}),create:e=>t("/layouts",{method:"POST",body:JSON.stringify(e)}),update:(e,o)=>t(`/layouts/${e}`,{method:"PUT",body:JSON.stringify(o)}),remove:e=>t(`/layouts/${e}`,{method:"DELETE"}),getOptions:()=>t("/layouts/options",{method:"GET"}),saveOptions:e=>t("/layouts/options",{method:"PUT",body:JSON.stringify(e)})},media:{list:()=>t("/media",{method:"GET"}),upload:e=>p("/media",e),delete:e=>t(`/media/${encodeURIComponent(e)}`,{method:"DELETE"}),rename:(e,o)=>t(`/media/${encodeURIComponent(e)}`,{method:"PATCH",body:JSON.stringify({newName:o})}),info:e=>t(`/media/${encodeURIComponent(e)}/info`,{method:"GET"}),transform:(e,o)=>t(`/media/${encodeURIComponent(e)}/transform`,{method:"POST",body:JSON.stringify(o)})},users:{list:()=>t("/users",{method:"GET"}),get:e=>t(`/users/${e}`,{method:"GET"}),create:e=>t("/users",{method:"POST",body:JSON.stringify(e)}),update:(e,o)=>t(`/users/${e}`,{method:"PUT",body:JSON.stringify(o)}),delete:e=>t(`/users/${e}`,{method:"DELETE"})},plugins:{list:()=>t("/plugins",{method:"GET"}),update:(e,o)=>t(`/plugins/${e}`,{method:"PUT",body:JSON.stringify(o)}),adminConfig:()=>t("/plugins/admin-config",{method:"GET"})},marketplace:{catalogue:()=>t("/plugins/marketplace",{method:"GET"}),install:(e,o)=>t("/plugins/marketplace/install",{method:"POST",body:JSON.stringify({slug:e,version:o})}),uninstall:e=>t(`/plugins/marketplace/${encodeURIComponent(e)}`,{method:"DELETE"})},collections:{list:()=>t("/collections",{method:"GET"}),proStatus:()=>t("/collections/pro-status",{method:"GET"}),get:e=>t(`/collections/${e}`,{method:"GET"}),create:e=>t("/collections",{method:"POST",body:JSON.stringify(e)}),update:(e,o)=>t(`/collections/${e}`,{method:"PUT",body:JSON.stringify(o)}),delete:e=>t(`/collections/${e}`,{method:"DELETE"}),listEntries:(e,o={})=>{const s=new URLSearchParams(o).toString();return t(`/collections/${e}/entries${s?"?"+s:""}`,{method:"GET"})},getEntry:(e,o)=>t(`/collections/${e}/entries/${o}`,{method:"GET"}),createEntry:(e,o)=>t(`/collections/${e}/entries`,{method:"POST",body:JSON.stringify({data:o})}),updateEntry:(e,o,s)=>t(`/collections/${e}/entries/${o}`,{method:"PUT",body:JSON.stringify({data:s})}),deleteEntry:(e,o)=>t(`/collections/${e}/entries/${o}`,{method:"DELETE"}),clearEntries:e=>t(`/collections/${e}/entries`,{method:"DELETE"}),import:(e,o)=>t(`/collections/${e}/import`,{method:"POST",body:JSON.stringify({entries:o})}),publicList:(e,o={})=>{const s=new URLSearchParams(o).toString();return t(`/collections/${e}/public${s?"?"+s:""}`,{method:"GET"})},getConnections:()=>t("/collections/connections",{method:"GET"}),saveConnections:e=>t("/collections/connections",{method:"PUT",body:JSON.stringify(e)}),migrateStorage:(e,o)=>t(`/collections/${e}/migrate-storage`,{method:"POST",body:JSON.stringify({storage:o})})},forms:{list:()=>t("/forms",{method:"GET"}),create:e=>t("/forms",{method:"POST",body:JSON.stringify(e)}),get:e=>t(`/forms/${e}`,{method:"GET"}),update:(e,o)=>t(`/forms/${e}`,{method:"PUT",body:JSON.stringify(o)}),delete:e=>t(`/forms/${e}`,{method:"DELETE"}),listSubmissions:e=>t(`/forms/${e}/submissions`,{method:"GET"}),clearSubmissions:e=>t(`/forms/${e}/submissions`,{method:"DELETE"}),deleteSubmission:(e,o)=>t(`/forms/${e}/submissions/${o}`,{method:"DELETE"}),testEmail:e=>t("/forms/test-email",{method:"POST",body:JSON.stringify({to:e})})},views:{list:()=>t("/views",{method:"GET"}),get:e=>t(`/views/${e}`,{method:"GET"}),create:e=>t("/views",{method:"POST",body:JSON.stringify(e)}),update:(e,o)=>t(`/views/${e}`,{method:"PUT",body:JSON.stringify(o)}),delete:e=>t(`/views/${e}`,{method:"DELETE"}),execute:(e,o={})=>{const s=new URLSearchParams(o).toString();return t(`/views/${e}/execute${s?"?"+s:""}`,{method:"GET"})},forCollection:e=>t(`/views/collection/${e}`,{method:"GET"})},actions:{list:()=>t("/actions",{method:"GET"}),get:e=>t(`/actions/${e}`,{method:"GET"}),create:e=>t("/actions",{method:"POST",body:JSON.stringify(e)}),update:(e,o)=>t(`/actions/${e}`,{method:"PUT",body:JSON.stringify(o)}),delete:e=>t(`/actions/${e}`,{method:"DELETE"}),execute:(e,o)=>t(`/actions/${e}/execute`,{method:"POST",body:JSON.stringify({entryId:o})}),forCollection:e=>t(`/actions/collection/${e}`,{method:"GET"}),checkAccess:(e,o)=>t(`/actions/${e}/check-access`,{method:"POST",body:JSON.stringify({entryIds:o})})},versions:{list:e=>t(`/versions/list${e}`),get:(e,o)=>t(`/versions/get/${encodeURIComponent(o)}${e}`),create:(e,o)=>t(`/versions/create${e}`,{method:"POST",body:JSON.stringify({label:o})}),restore:(e,o)=>t(`/versions/restore/${encodeURIComponent(o)}${e}`,{method:"POST"}),delete:(e,o)=>t(`/versions/delete/${encodeURIComponent(o)}${e}`,{method:"DELETE"}),bulkDelete:(e,o)=>t(`/versions/bulk-delete${e}`,{method:"POST",body:JSON.stringify({filenames:o})}),prune:(e,o)=>t(`/versions/prune${e}`,{method:"POST",body:JSON.stringify({keep:o})})},blocks:{list:()=>t("/blocks",{method:"GET"}),get:e=>t(`/blocks/${encodeURIComponent(e)}`,{method:"GET"}),put:(e,o)=>t(`/blocks/${encodeURIComponent(e)}`,{method:"PUT",body:JSON.stringify(o)}),delete:e=>t(`/blocks/${encodeURIComponent(e)}`,{method:"DELETE"}),async exportBundle(e){const o=d(),s=await fetch(`${a}/blocks/${encodeURIComponent(e)}/export`,{headers:o?{Authorization:`Bearer ${o}`}:{}});if(!s.ok){const m=await s.json().catch(()=>({}));throw new Error(m.error||`Export failed (${s.status})`)}const r=await s.blob(),n=URL.createObjectURL(r),i=document.createElement("a");i.href=n,i.download=`${e}.dmblock.json`,document.body.appendChild(i),i.click(),i.remove(),URL.revokeObjectURL(n)},async importBundle(e,{overwrite:o=!1}={}){const s=await fetch(`${a}/blocks/import`,{method:"POST",headers:{"Content-Type":"application/json",...d()?{Authorization:`Bearer ${d()}`}:{}},body:JSON.stringify({...e,overwrite:o})});if(s.status===409){const r=await s.json().catch(()=>({})),n=new Error(r.error||"Block already exists");throw n.code="CONFLICT",n.name=r.name,n}if(!s.ok){const r=await s.json().catch(()=>({}));throw new Error(r.error||`Import failed (${s.status})`)}return s.json()}},components:{list:()=>t("/components",{method:"GET"}),get:e=>t(`/components/${encodeURIComponent(e)}`,{method:"GET"}),compile:(e,o)=>t("/components/compile",{method:"POST",body:JSON.stringify({name:e,source:o})}),put:(e,o)=>t(`/components/${encodeURIComponent(e)}`,{method:"PUT",body:JSON.stringify(o)}),delete:e=>t(`/components/${encodeURIComponent(e)}`,{method:"DELETE"}),async exportBundle(e){const o=d(),s=await fetch(`${a}/components/${encodeURIComponent(e)}/export`,{headers:o?{Authorization:`Bearer ${o}`}:{}});if(!s.ok){const m=await s.json().catch(()=>({}));throw new Error(m.error||`Export failed (${s.status})`)}const r=await s.blob(),n=URL.createObjectURL(r),i=document.createElement("a");i.href=n,i.download=`${e}.dmcomponent.json`,document.body.appendChild(i),i.click(),i.remove(),URL.revokeObjectURL(n)},async importBundle(e,{overwrite:o=!1}={}){const s=await fetch(`${a}/components/import`,{method:"POST",headers:{"Content-Type":"application/json",...d()?{Authorization:`Bearer ${d()}`}:{}},body:JSON.stringify({...e,overwrite:o})});if(s.status===409){const r=await s.json().catch(()=>({})),n=new Error(r.error||"Component already exists");throw n.code="CONFLICT",n.name=r.name,n}if(!s.ok){const r=await s.json().catch(()=>({}));throw new Error(r.error||`Import failed (${s.status})`)}return s.json()}},get:e=>t(e,{method:"GET"}),post:(e,o)=>t(e,{method:"POST",body:JSON.stringify(o)}),put:(e,o)=>t(e,{method:"PUT",body:JSON.stringify(o)}),delete:e=>t(e,{method:"DELETE"}),settingsExt:{testEmail:e=>t("/settings/test-email",{method:"POST",body:JSON.stringify({to:e})})},system:{notifications:{list:()=>t("/system/notifications",{method:"GET"}),unreadCount:()=>t("/system/notifications/unread-count",{method:"GET"}),markRead:e=>t(`/system/notifications/${e}/read`,{method:"POST"}),dismiss:e=>t(`/system/notifications/${e}/dismiss`,{method:"POST"}),remove:e=>t(`/system/notifications/${e}`,{method:"DELETE"})}},dashboard:{summary:()=>t("/dashboard/summary",{method:"GET"}),summaryLite:()=>t("/dashboard/summary?lite=1",{method:"GET"})}};export function isAuthenticated(){return!!d()}export function getUser(){return S.get("auth_user")}export function setAuthData({token:e,refreshToken:o,user:s}){e&&l(e),o&&S.set("auth_refresh_token",o),s&&S.set("auth_user",s)}export function logout(){const e=c();e&&fetch(`${a}/auth/logout`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({refreshToken:e})}).catch(()=>{}),h(),R.navigate("/login")}export{t as apiRequest,u as refreshAccessToken,d as getToken,h as clearAuth};
+const a="/api";function d(){return S.get("auth_token")}function c(){return S.get("auth_refresh_token")}function l(e){S.set("auth_token",e)}function h(){S.remove("auth_token"),S.remove("auth_refresh_token"),S.remove("auth_user")}async function u(){const e=c();if(!e)throw new Error("No refresh token");const o=await fetch(`${a}/auth/refresh`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({refreshToken:e})});if(!o.ok)throw h(),R.navigate("/login"),new Error("Token refresh failed");const{token:s}=await o.json();return l(s),s}async function t(e,o={}){let s=d();const r=i=>({...o.body!==void 0?{"Content-Type":"application/json"}:{},...o.headers,...i?{Authorization:`Bearer ${i}`}:{}});let n=await fetch(`${a}${e}`,{...o,headers:r(s)});if(n.status===401&&c())try{s=await u(),n=await fetch(`${a}${e}`,{...o,headers:r(s)})}catch{return}if(!n.ok){const i=await n.json().catch(()=>({error:"Request failed"}));throw new Error(i.error||i.message||`HTTP ${n.status}`)}return n.status===204?null:n.json()}async function y(e,o){const s=d(),r=s?{Authorization:`Bearer ${s}`}:{},n=await fetch(`${a}${e}`,{method:"POST",headers:r,body:o});if(!n.ok){const i=await n.json().catch(()=>({error:"Upload failed"}));throw new Error(i.error||i.message||`HTTP ${n.status}`)}return n.json()}export const api={auth:{setupStatus:()=>t("/auth/setup-status",{method:"GET"}),setup:e=>t("/auth/setup",{method:"POST",body:JSON.stringify(e)}),login:e=>t("/auth/login",{method:"POST",body:JSON.stringify(e)}),me:()=>t("/auth/me",{method:"GET"}),updateMe:e=>t("/auth/me",{method:"PUT",body:JSON.stringify(e)}),refresh:e=>t("/auth/refresh",{method:"POST",body:JSON.stringify({refreshToken:e})}),forgotPassword:e=>t("/auth/forgot-password",{method:"POST",body:JSON.stringify({email:e})}),resetPassword:(e,o)=>t("/auth/reset-password",{method:"POST",body:JSON.stringify({token:e,password:o})})},pages:{list:()=>t("/pages",{method:"GET"}),get:e=>t(`/pages${e}`,{method:"GET"}),create:e=>t("/pages",{method:"POST",body:JSON.stringify(e)}),update:(e,o)=>t(`/pages${e}`,{method:"PUT",body:JSON.stringify(o)}),delete:e=>t(`/pages${e}`,{method:"DELETE"}),preview:e=>t("/pages/preview",{method:"POST",body:JSON.stringify({markdown:e})}),tags:()=>t("/pages/tags",{method:"GET"}).then(e=>e.tags||[])},settings:{get:()=>t("/settings",{method:"GET"}),save:e=>t("/settings",{method:"PUT",body:JSON.stringify(e)}),getCustomCss:()=>t("/settings/custom-css",{method:"GET"}),saveCustomCss:e=>t("/settings/custom-css",{method:"PUT",body:JSON.stringify({css:e})})},navigation:{get:()=>t("/navigation",{method:"GET"}),save:e=>t("/navigation",{method:"PUT",body:JSON.stringify(e)})},menus:{list:()=>t("/menus",{method:"GET"}),get:e=>t(`/menus/${encodeURIComponent(e)}`,{method:"GET"}),create:e=>t("/menus",{method:"POST",body:JSON.stringify(e)}),update:(e,o)=>t(`/menus/${encodeURIComponent(e)}`,{method:"PUT",body:JSON.stringify(o)}),remove:e=>t(`/menus/${encodeURIComponent(e)}`,{method:"DELETE"}),duplicate:e=>t(`/menus/${encodeURIComponent(e)}/duplicate`,{method:"POST"})},menuLocations:{get:()=>t("/menu-locations",{method:"GET"}),save:e=>t("/menu-locations",{method:"PUT",body:JSON.stringify(e)}),registry:()=>t("/menu-locations/registry",{method:"GET"})},projects:{list:()=>t("/projects",{method:"GET"}),get:e=>t(`/projects/${encodeURIComponent(e)}`,{method:"GET"}),create:e=>t("/projects",{method:"POST",body:JSON.stringify(e)}),update:(e,o)=>t(`/projects/${encodeURIComponent(e)}`,{method:"PUT",body:JSON.stringify(o)}),remove:e=>t(`/projects/${encodeURIComponent(e)}`,{method:"DELETE"}),artefacts:e=>t(`/projects/${encodeURIComponent(e)}/artefacts`,{method:"GET"}),untagAll:e=>t(`/projects/${encodeURIComponent(e)}/untag-all`,{method:"POST"})},apiTokens:{list:()=>t("/api-tokens",{method:"GET"}),create:e=>t("/api-tokens",{method:"POST",body:JSON.stringify(e)}),update:(e,o)=>t(`/api-tokens/${encodeURIComponent(e)}`,{method:"PUT",body:JSON.stringify(o)}),revoke:e=>t(`/api-tokens/${encodeURIComponent(e)}`,{method:"DELETE"})},apiEndpoints:{list:()=>t("/api-endpoints",{method:"GET"}),get:e=>t(`/api-endpoints/${encodeURIComponent(e)}`,{method:"GET"}),create:e=>t("/api-endpoints",{method:"POST",body:JSON.stringify(e)}),update:(e,o)=>t(`/api-endpoints/${encodeURIComponent(e)}`,{method:"PUT",body:JSON.stringify(o)}),remove:e=>t(`/api-endpoints/${encodeURIComponent(e)}`,{method:"DELETE"})},layouts:{get:()=>t("/layouts",{method:"GET"}),save:e=>t("/layouts",{method:"PUT",body:JSON.stringify(e)}),create:e=>t("/layouts",{method:"POST",body:JSON.stringify(e)}),update:(e,o)=>t(`/layouts/${e}`,{method:"PUT",body:JSON.stringify(o)}),remove:e=>t(`/layouts/${e}`,{method:"DELETE"}),getOptions:()=>t("/layouts/options",{method:"GET"}),saveOptions:e=>t("/layouts/options",{method:"PUT",body:JSON.stringify(e)})},media:{list:()=>t("/media",{method:"GET"}),upload:e=>y("/media",e),delete:e=>t(`/media/${encodeURIComponent(e)}`,{method:"DELETE"}),rename:(e,o)=>t(`/media/${encodeURIComponent(e)}`,{method:"PATCH",body:JSON.stringify({newName:o})}),info:e=>t(`/media/${encodeURIComponent(e)}/info`,{method:"GET"}),transform:(e,o)=>t(`/media/${encodeURIComponent(e)}/transform`,{method:"POST",body:JSON.stringify(o)})},users:{list:()=>t("/users",{method:"GET"}),get:e=>t(`/users/${e}`,{method:"GET"}),create:e=>t("/users",{method:"POST",body:JSON.stringify(e)}),update:(e,o)=>t(`/users/${e}`,{method:"PUT",body:JSON.stringify(o)}),delete:e=>t(`/users/${e}`,{method:"DELETE"})},plugins:{list:()=>t("/plugins",{method:"GET"}),scaffold:e=>t("/plugins/scaffold",{method:"POST",body:JSON.stringify(e)}),update:(e,o)=>t(`/plugins/${e}`,{method:"PUT",body:JSON.stringify(o)}),adminConfig:()=>t("/plugins/admin-config",{method:"GET"})},marketplace:{catalogue:()=>t("/plugins/marketplace",{method:"GET"}),install:(e,o)=>t("/plugins/marketplace/install",{method:"POST",body:JSON.stringify({slug:e,version:o})}),uninstall:e=>t(`/plugins/marketplace/${encodeURIComponent(e)}`,{method:"DELETE"})},collections:{list:()=>t("/collections",{method:"GET"}),proStatus:()=>t("/collections/pro-status",{method:"GET"}),get:e=>t(`/collections/${e}`,{method:"GET"}),create:e=>t("/collections",{method:"POST",body:JSON.stringify(e)}),update:(e,o)=>t(`/collections/${e}`,{method:"PUT",body:JSON.stringify(o)}),delete:e=>t(`/collections/${e}`,{method:"DELETE"}),listEntries:(e,o={})=>{const s=new URLSearchParams(o).toString();return t(`/collections/${e}/entries${s?"?"+s:""}`,{method:"GET"})},getEntry:(e,o)=>t(`/collections/${e}/entries/${o}`,{method:"GET"}),createEntry:(e,o)=>t(`/collections/${e}/entries`,{method:"POST",body:JSON.stringify({data:o})}),updateEntry:(e,o,s)=>t(`/collections/${e}/entries/${o}`,{method:"PUT",body:JSON.stringify({data:s})}),deleteEntry:(e,o)=>t(`/collections/${e}/entries/${o}`,{method:"DELETE"}),clearEntries:e=>t(`/collections/${e}/entries`,{method:"DELETE"}),import:(e,o)=>t(`/collections/${e}/import`,{method:"POST",body:JSON.stringify({entries:o})}),publicList:(e,o={})=>{const s=new URLSearchParams(o).toString();return t(`/collections/${e}/public${s?"?"+s:""}`,{method:"GET"})},getConnections:()=>t("/collections/connections",{method:"GET"}),saveConnections:e=>t("/collections/connections",{method:"PUT",body:JSON.stringify(e)}),migrateStorage:(e,o)=>t(`/collections/${e}/migrate-storage`,{method:"POST",body:JSON.stringify({storage:o})})},forms:{list:()=>t("/forms",{method:"GET"}),create:e=>t("/forms",{method:"POST",body:JSON.stringify(e)}),get:e=>t(`/forms/${e}`,{method:"GET"}),update:(e,o)=>t(`/forms/${e}`,{method:"PUT",body:JSON.stringify(o)}),delete:e=>t(`/forms/${e}`,{method:"DELETE"}),listSubmissions:e=>t(`/forms/${e}/submissions`,{method:"GET"}),clearSubmissions:e=>t(`/forms/${e}/submissions`,{method:"DELETE"}),deleteSubmission:(e,o)=>t(`/forms/${e}/submissions/${o}`,{method:"DELETE"}),testEmail:e=>t("/forms/test-email",{method:"POST",body:JSON.stringify({to:e})})},views:{list:()=>t("/views",{method:"GET"}),get:e=>t(`/views/${e}`,{method:"GET"}),create:e=>t("/views",{method:"POST",body:JSON.stringify(e)}),update:(e,o)=>t(`/views/${e}`,{method:"PUT",body:JSON.stringify(o)}),delete:e=>t(`/views/${e}`,{method:"DELETE"}),execute:(e,o={})=>{const s=new URLSearchParams(o).toString();return t(`/views/${e}/execute${s?"?"+s:""}`,{method:"GET"})},forCollection:e=>t(`/views/collection/${e}`,{method:"GET"})},actions:{list:()=>t("/actions",{method:"GET"}),get:e=>t(`/actions/${e}`,{method:"GET"}),create:e=>t("/actions",{method:"POST",body:JSON.stringify(e)}),update:(e,o)=>t(`/actions/${e}`,{method:"PUT",body:JSON.stringify(o)}),delete:e=>t(`/actions/${e}`,{method:"DELETE"}),execute:(e,o)=>t(`/actions/${e}/execute`,{method:"POST",body:JSON.stringify({entryId:o})}),forCollection:e=>t(`/actions/collection/${e}`,{method:"GET"}),checkAccess:(e,o)=>t(`/actions/${e}/check-access`,{method:"POST",body:JSON.stringify({entryIds:o})})},versions:{list:e=>t(`/versions/list${e}`),get:(e,o)=>t(`/versions/get/${encodeURIComponent(o)}${e}`),create:(e,o)=>t(`/versions/create${e}`,{method:"POST",body:JSON.stringify({label:o})}),restore:(e,o)=>t(`/versions/restore/${encodeURIComponent(o)}${e}`,{method:"POST"}),delete:(e,o)=>t(`/versions/delete/${encodeURIComponent(o)}${e}`,{method:"DELETE"}),bulkDelete:(e,o)=>t(`/versions/bulk-delete${e}`,{method:"POST",body:JSON.stringify({filenames:o})}),prune:(e,o)=>t(`/versions/prune${e}`,{method:"POST",body:JSON.stringify({keep:o})})},blocks:{list:()=>t("/blocks",{method:"GET"}),get:e=>t(`/blocks/${encodeURIComponent(e)}`,{method:"GET"}),put:(e,o)=>t(`/blocks/${encodeURIComponent(e)}`,{method:"PUT",body:JSON.stringify(o)}),delete:e=>t(`/blocks/${encodeURIComponent(e)}`,{method:"DELETE"}),async exportBundle(e){const o=d(),s=await fetch(`${a}/blocks/${encodeURIComponent(e)}/export`,{headers:o?{Authorization:`Bearer ${o}`}:{}});if(!s.ok){const m=await s.json().catch(()=>({}));throw new Error(m.error||`Export failed (${s.status})`)}const r=await s.blob(),n=URL.createObjectURL(r),i=document.createElement("a");i.href=n,i.download=`${e}.dmblock.json`,document.body.appendChild(i),i.click(),i.remove(),URL.revokeObjectURL(n)},async importBundle(e,{overwrite:o=!1}={}){const s=await fetch(`${a}/blocks/import`,{method:"POST",headers:{"Content-Type":"application/json",...d()?{Authorization:`Bearer ${d()}`}:{}},body:JSON.stringify({...e,overwrite:o})});if(s.status===409){const r=await s.json().catch(()=>({})),n=new Error(r.error||"Block already exists");throw n.code="CONFLICT",n.name=r.name,n}if(!s.ok){const r=await s.json().catch(()=>({}));throw new Error(r.error||`Import failed (${s.status})`)}return s.json()}},components:{list:()=>t("/components",{method:"GET"}),get:e=>t(`/components/${encodeURIComponent(e)}`,{method:"GET"}),compile:(e,o)=>t("/components/compile",{method:"POST",body:JSON.stringify({name:e,source:o})}),put:(e,o)=>t(`/components/${encodeURIComponent(e)}`,{method:"PUT",body:JSON.stringify(o)}),delete:e=>t(`/components/${encodeURIComponent(e)}`,{method:"DELETE"}),async exportBundle(e){const o=d(),s=await fetch(`${a}/components/${encodeURIComponent(e)}/export`,{headers:o?{Authorization:`Bearer ${o}`}:{}});if(!s.ok){const m=await s.json().catch(()=>({}));throw new Error(m.error||`Export failed (${s.status})`)}const r=await s.blob(),n=URL.createObjectURL(r),i=document.createElement("a");i.href=n,i.download=`${e}.dmcomponent.json`,document.body.appendChild(i),i.click(),i.remove(),URL.revokeObjectURL(n)},async importBundle(e,{overwrite:o=!1}={}){const s=await fetch(`${a}/components/import`,{method:"POST",headers:{"Content-Type":"application/json",...d()?{Authorization:`Bearer ${d()}`}:{}},body:JSON.stringify({...e,overwrite:o})});if(s.status===409){const r=await s.json().catch(()=>({})),n=new Error(r.error||"Component already exists");throw n.code="CONFLICT",n.name=r.name,n}if(!s.ok){const r=await s.json().catch(()=>({}));throw new Error(r.error||`Import failed (${s.status})`)}return s.json()}},get:e=>t(e,{method:"GET"}),post:(e,o)=>t(e,{method:"POST",body:JSON.stringify(o)}),put:(e,o)=>t(e,{method:"PUT",body:JSON.stringify(o)}),delete:e=>t(e,{method:"DELETE"}),settingsExt:{testEmail:e=>t("/settings/test-email",{method:"POST",body:JSON.stringify({to:e})})},system:{notifications:{list:()=>t("/system/notifications",{method:"GET"}),unreadCount:()=>t("/system/notifications/unread-count",{method:"GET"}),markRead:e=>t(`/system/notifications/${e}/read`,{method:"POST"}),dismiss:e=>t(`/system/notifications/${e}/dismiss`,{method:"POST"}),remove:e=>t(`/system/notifications/${e}`,{method:"DELETE"})}},dashboard:{summary:()=>t("/dashboard/summary",{method:"GET"}),summaryLite:()=>t("/dashboard/summary?lite=1",{method:"GET"})}};export function isAuthenticated(){return!!d()}export function getUser(){return S.get("auth_user")}export function setAuthData({token:e,refreshToken:o,user:s}){e&&l(e),o&&S.set("auth_refresh_token",o),s&&S.set("auth_user",s)}export function logout(){const e=c();e&&fetch(`${a}/auth/logout`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({refreshToken:e})}).catch(()=>{}),h(),R.navigate("/login")}export{t as apiRequest,u as refreshAccessToken,d as getToken,h as clearAuth};

package/admin/js/templates/plugins.html

@@ -1,6 +1,11 @@
-<div class="view-header">
-    <h1><span data-icon="package"></span> Plugins</h1>
-    <p class="text-muted" style="margin:0;font-size:.875rem">Plugins extend the CMS with new features. Changes take effect after a server restart.</p>
+<div class="view-header d-flex justify-content-between align-items-center">
+    <div>
+        <h1><span data-icon="package"></span> Plugins</h1>
+        <p class="text-muted" style="margin:0;font-size:.875rem">Plugins extend the CMS with new features. Changes take effect after a server restart.</p>
+    </div>
+    <button id="new-plugin-btn" class="btn btn-primary">
+        <span data-icon="plus"></span> New Plugin
+    </button>
 </div>
 
 <div id="plugin-tabs" class="tabs">

package/admin/js/views/page-editor.js

@@ -84,7 +84,7 @@ In active development.
 Markdown content here.
 [/slideover]`,"Nested [card] and [grid] shortcodes work inside the slideover body.")),se.appendChild(r);const L=document.createElement("div");L.appendChild(X("DConfig \u2014 Declarative Behaviour")),L.appendChild(W("Define click handlers and class toggles without writing JavaScript. Use the DConfig section above or embed inline with [dconfig]...[/dconfig] in the content body. Inline shortcodes win on selector conflict.")),L.appendChild(A("Toggle a class on click",'{ "#my-btn": { "events": { "click": { "target": "#panel", "toggleClass": "hidden" } } } }','Selector keys use standard CSS selectors. "target" is optional \u2014 defaults to the element itself.')),L.appendChild(A("Inline shortcode syntax",`[dconfig]
 { "#my-btn": { "events": { "click": { "target": "#panel", "toggleClass": "hidden" } } } }
-[/dconfig]`,null)),we.appendChild(L);const B=document.createElement("div");B.appendChild(X("CSS Editor")),B.appendChild(W("The toolbar's </> button (left of the Split View icon) swaps the left pane between Markdown and Custom CSS. Edits are saved together with the page \u2014 one Save, one toast."));const N=document.createElement("table");N.style.cssText="width:100%;border-collapse:collapse;font-size:.85em;margin-bottom:.5rem;",[["</> button","Toggle between Markdown editor and Custom CSS editor"],["Split / Write / Preview","Standard view mode buttons to the right of </>"],["Save","Saves both page content and CSS in a single operation"]].forEach(([h,g])=>{const i=document.createElement("tr"),o=document.createElement("td");o.style.cssText="padding:.3rem .4rem;border-bottom:1px solid var(--dm-border,#333);vertical-align:top;",o.appendChild(U(h));const s=document.createElement("td");s.style.cssText="padding:.3rem .4rem;border-bottom:1px solid var(--dm-border,#333);vertical-align:top;color:var(--dm-text-muted,#aaa);",s.textContent=g,i.appendChild(o),i.appendChild(s),N.appendChild(i)}),B.appendChild(N),we.appendChild(B);const w=document.createElement("div");w.appendChild(X("Colour Picker")),w.appendChild(W("Insert \u2192 Colour Picker opens a centred colour picker. Pick a colour, then use Copy to copy the hex code to the clipboard or Insert to drop it at the cursor. Click outside the panel to dismiss.")),we.appendChild(w);const z=document.createElement("div");z.appendChild(X("Keyboard Shortcuts"));const b=document.createElement("table");b.style.cssText="width:100%;border-collapse:collapse;font-size:.85em;margin-bottom:.5rem;",[["Ctrl + B","Bold selected text"],["Ctrl + I","Italic selected text"],["Ctrl + K","Insert link dialog"],["Tab","Indent 2 spaces at cursor"],["Shift + Tab","Dedent 2 spaces on current line"],["Ctrl + X","Cut current line (no selection) or cut selection"],["Ctrl + C","Copy current line (no selection) or copy selection"],["Ctrl + V","Paste from clipboard"],["Ctrl + Z","Undo"],["Ctrl + Y","Redo"]].forEach(([h,g])=>{const i=document.createElement("tr"),o=document.createElement("td");o.style.cssText="padding:.3rem .4rem;border-bottom:1px solid var(--dm-border,#333);vertical-align:top;white-space:nowrap;",o.appendChild(U(h));const s=document.createElement("td");s.style.cssText="padding:.3rem .4rem;border-bottom:1px solid var(--dm-border,#333);vertical-align:top;color:var(--dm-text-muted,#aaa);",s.textContent=g,i.appendChild(o),i.appendChild(s),b.appendChild(i)}),z.appendChild(b),Be.appendChild(z);const k=document.createElement("div");k.appendChild(X("Tips"));const M=document.createElement("table");M.style.cssText="width:100%;border-collapse:collapse;font-size:.85em;margin-bottom:.5rem;",[['class="text-center"',"Centre text and inline elements on any shortcode"],['class="mx-auto"',"Centre a block element horizontally"],["[center]...[/center]","Shorthand wrapper for centred content"]].forEach(([h,g])=>{const i=document.createElement("tr"),o=document.createElement("td");o.style.cssText="padding:.3rem .4rem;border-bottom:1px solid var(--dm-border,#333);vertical-align:top;",o.appendChild(U(h));const s=document.createElement("td");s.style.cssText="padding:.3rem .4rem;border-bottom:1px solid var(--dm-border,#333);vertical-align:top;color:var(--dm-text-muted,#aaa);",s.textContent=g,i.appendChild(o),i.appendChild(s),M.appendChild(i)}),k.appendChild(M),k.appendChild(W("Most shortcodes accept a class attribute for custom styling.")),Be.appendChild(k),d.setContent($e),d.open(),E.tabs(Ae),I.scan($e)}function st(d,ce){const de=d.find("#history-tab").get(0),U=d.find("#version-list").get(0),X=d.find("#version-compare").get(0),$e=d.find("#version-compare-old").get(0),Ae=d.find("#version-compare-new").get(0),Me=d.find("#version-compare-label").get(0),_=d.find("#version-compare-back-btn").get(0),Ie=d.find("#version-restore-btn").get(0),Be=d.find("#history-save-named-btn").get(0),ve=d.find("#history-delete-selected-btn").get(0);let se=!1,Ce=null;function we(){U.style.display="",X.style.display="none",Ce=null}function qe(){U.style.display="none",X.style.display=""}async function pe(){U.textContent="";const ee=document.createElement("p");ee.style.color="var(--dm-text-muted)",ee.textContent="Loading\u2026",U.appendChild(ee);let le;try{le=(await Y.versions.list(ce)).versions||[]}catch(V){U.textContent="";const q=document.createElement("p");q.style.color="var(--dm-danger,#e55)",q.textContent="Failed to load versions: "+V.message,U.appendChild(q);return}if(U.textContent="",ve.style.display="none",!le.length){const V=document.createElement("p");V.style.color="var(--dm-text-muted)",V.textContent="No versions saved yet. Versions are created automatically on each save.",U.appendChild(V);return}const ge=document.createElement("table");ge.style.cssText="width:100%;border-collapse:collapse;font-size:.875rem;";const ae=document.createElement("thead"),W=document.createElement("tr"),A=document.createElement("th");A.style.cssText="padding:.5rem .75rem;width:2rem;border-bottom:1px solid var(--dm-border);";const oe=document.createElement("input");oe.type="checkbox",oe.setAttribute("aria-label","Select all versions"),A.appendChild(oe),W.appendChild(A),["Date","Author","Type","Label","Actions"].forEach(V=>{const q=document.createElement("th");q.style.cssText="text-align:left;padding:.5rem .75rem;border-bottom:1px solid var(--dm-border);font-size:.8rem;color:var(--dm-text-muted);",q.textContent=V,W.appendChild(q)}),ae.appendChild(W),ge.appendChild(ae);const me=[];function ze(){const V=me.some(ue=>ue.checked),q=me.length>0&&me.every(ue=>ue.checked);ve.style.display=V?"":"none",oe.checked=q,oe.indeterminate=V&&!q}oe.addEventListener("change",()=>{me.forEach(V=>{V.checked=oe.checked}),ze()});const De=document.createElement("tbody");le.forEach(V=>{const q=document.createElement("tr");q.style.borderBottom="1px solid var(--dm-border)";const ue=document.createElement("td");ue.style.padding=".5rem .75rem";const Ee=document.createElement("input");Ee.type="checkbox",Ee.value=V.filename,Ee.addEventListener("change",ze),ue.appendChild(Ee),me.push(Ee);const ke=document.createElement("td");ke.style.padding=".5rem .75rem",ke.textContent=D(V.createdAt).format("D MMM YYYY, HH:mm");const he=document.createElement("td");he.style.padding=".5rem .75rem",he.textContent=V.author||"\u2014";const Te=document.createElement("td");Te.style.padding=".5rem .75rem";const be=document.createElement("span");be.className="badge badge-"+(V.type==="manual"?"primary":"secondary"),be.style.cssText="font-size:.75rem;padding:.2rem .5rem;border-radius:4px;",be.textContent=V.type,Te.appendChild(be);const Ne=document.createElement("td");Ne.style.cssText="padding:.5rem .75rem;color:var(--dm-text-muted);",Ne.textContent=V.label||"\u2014";const fe=document.createElement("td");fe.style.padding=".5rem .75rem";const ne=document.createElement("button");ne.className="btn btn-ghost btn-xs",ne.style.marginRight=".4rem",ne.title="Compare",ne.innerHTML='<span data-icon="columns"></span>',ne.addEventListener("click",async()=>{try{const xe=await Y.versions.get(ce,V.filename);$e.textContent=xe.content,Ae.textContent=d.find("#markdown-editor").get(0).value,Me.textContent=D(V.createdAt).format("D MMM YYYY, HH:mm")+(V.label?` \u2014 ${V.label}`:""),Ce=V.filename,qe()}catch(xe){E.toast("Failed to load version: "+xe.message,{type:"error"})}});const ie=document.createElement("button");ie.className="btn btn-ghost btn-xs",ie.style.color="var(--dm-danger,#e55)",ie.title="Delete",ie.innerHTML='<span data-icon="trash"></span>',ie.addEventListener("click",async()=>{if(await E.confirm("Delete this version? This cannot be undone."))try{await Y.versions.delete(ce,V.filename),E.toast("Version deleted.",{type:"success"}),await pe()}catch(xe){E.toast("Failed to delete: "+xe.message,{type:"error"})}}),fe.appendChild(ne),fe.appendChild(ie),q.appendChild(ue),q.appendChild(ke),q.appendChild(he),q.appendChild(Te),q.appendChild(Ne),q.appendChild(fe),De.appendChild(q)}),ge.appendChild(De),U.appendChild(ge),I.scan(U)}de.addEventListener("click",async()=>{se||(se=!0,await pe())}),_.addEventListener("click",()=>{we()}),Ie.addEventListener("click",async()=>{if(!(!Ce||!await E.confirm("Restore this version? The current page content will be overwritten (a pre-restore snapshot will be saved automatically).")))try{await Y.versions.restore(ce,Ce),E.toast("Page restored. Reloading editor\u2026",{type:"success"}),R.navigate("/pages"),setTimeout(()=>R.navigate(`/pages/edit${ce}`),300)}catch(ee){E.toast("Restore failed: "+ee.message,{type:"error"})}}),ve.addEventListener("click",async()=>{const ee=[...U.querySelectorAll("tbody input[type=checkbox]:checked")].map(le=>le.value);if(!(!ee.length||!await E.confirm(`Delete ${ee.length} version${ee.length>1?"s":""}? This cannot be undone.`)))try{await Y.versions.bulkDelete(ce,ee),E.toast(`${ee.length} version${ee.length>1?"s":""} deleted.`,{type:"success"}),await pe()}catch(le){E.toast("Delete failed: "+le.message,{type:"error"})}}),Be.addEventListener("click",()=>{const ee=E.modal({title:"Save Named Version"}),le=document.createElement("div");le.style.padding="1rem";const ge=document.createElement("label");ge.className="form-label",ge.textContent="Version Label";const ae=document.createElement("input");ae.type="text",ae.className="form-input",ae.placeholder="e.g. Initial design, Before restructure",ae.style.marginBottom=".75rem";const W=document.createElement("button");W.className="btn btn-primary",W.textContent="Save Version",W.addEventListener("click",async()=>{const A=ae.value.trim();try{await Y.versions.create(ce,A||null),E.toast("Named version saved.",{type:"success"}),ee.close(),se=!1,de.classList.contains("active")&&(se=!0,await pe())}catch(oe){E.toast("Failed to save version: "+oe.message,{type:"error"})}}),le.appendChild(ge),le.appendChild(ae),le.appendChild(W),ee.element.appendChild(le),ee.open(),setTimeout(()=>ae.focus(),100)})}let Re=!1,Ge=null,je=!1;function rt(d){return d.split(`
+[/dconfig]`,null)),we.appendChild(L);const B=document.createElement("div");B.appendChild(X("CSS Editor")),B.appendChild(W("The toolbar's </> button (left of the Split View icon) swaps the left pane between Markdown and Custom CSS. Edits are saved together with the page \u2014 one Save, one toast."));const N=document.createElement("table");N.style.cssText="width:100%;border-collapse:collapse;font-size:.85em;margin-bottom:.5rem;",[["</> button","Toggle between Markdown editor and Custom CSS editor"],["Split / Write / Preview","Standard view mode buttons to the right of </>"],["Save","Saves both page content and CSS in a single operation"]].forEach(([h,g])=>{const i=document.createElement("tr"),o=document.createElement("td");o.style.cssText="padding:.3rem .4rem;border-bottom:1px solid var(--dm-border,#333);vertical-align:top;",o.appendChild(U(h));const s=document.createElement("td");s.style.cssText="padding:.3rem .4rem;border-bottom:1px solid var(--dm-border,#333);vertical-align:top;color:var(--dm-text-muted,#aaa);",s.textContent=g,i.appendChild(o),i.appendChild(s),N.appendChild(i)}),B.appendChild(N),we.appendChild(B);const w=document.createElement("div");w.appendChild(X("Colour Picker")),w.appendChild(W("Insert \u2192 Colour Picker opens a centred colour picker. Pick a colour, then use Copy to copy the hex code to the clipboard or Insert to drop it at the cursor. Click outside the panel to dismiss.")),we.appendChild(w);const z=document.createElement("div");z.appendChild(X("Keyboard Shortcuts"));const b=document.createElement("table");b.style.cssText="width:100%;border-collapse:collapse;font-size:.85em;margin-bottom:.5rem;",[["Ctrl + B","Bold selected text"],["Ctrl + I","Italic selected text"],["Ctrl + K","Insert link dialog"],["Tab","Indent 2 spaces at cursor"],["Shift + Tab","Dedent 2 spaces on current line"],["Ctrl + X","Cut current line (no selection) or cut selection"],["Ctrl + C","Copy current line (no selection) or copy selection"],["Ctrl + V","Paste from clipboard"],["Ctrl + Z","Undo"],["Ctrl + Y","Redo"]].forEach(([h,g])=>{const i=document.createElement("tr"),o=document.createElement("td");o.style.cssText="padding:.3rem .4rem;border-bottom:1px solid var(--dm-border,#333);vertical-align:top;white-space:nowrap;",o.appendChild(U(h));const s=document.createElement("td");s.style.cssText="padding:.3rem .4rem;border-bottom:1px solid var(--dm-border,#333);vertical-align:top;color:var(--dm-text-muted,#aaa);",s.textContent=g,i.appendChild(o),i.appendChild(s),b.appendChild(i)}),z.appendChild(b),Be.appendChild(z);const k=document.createElement("div");k.appendChild(X("Tips"));const M=document.createElement("table");M.style.cssText="width:100%;border-collapse:collapse;font-size:.85em;margin-bottom:.5rem;",[['class="text-center"',"Centre text and inline elements on any shortcode"],['class="mx-auto"',"Centre a block element horizontally"],["[center]...[/center]","Shorthand wrapper for centred content"]].forEach(([h,g])=>{const i=document.createElement("tr"),o=document.createElement("td");o.style.cssText="padding:.3rem .4rem;border-bottom:1px solid var(--dm-border,#333);vertical-align:top;",o.appendChild(U(h));const s=document.createElement("td");s.style.cssText="padding:.3rem .4rem;border-bottom:1px solid var(--dm-border,#333);vertical-align:top;color:var(--dm-text-muted,#aaa);",s.textContent=g,i.appendChild(o),i.appendChild(s),M.appendChild(i)}),k.appendChild(M),k.appendChild(W("Most shortcodes accept a class attribute for custom styling.")),Be.appendChild(k),d.setContent($e),d.open(),E.tabs(Ae),I.scan($e)}function st(d,ce){const de=d.find("#history-tab").get(0),U=d.find("#version-list").get(0),X=d.find("#version-compare").get(0),$e=d.find("#version-compare-old").get(0),Ae=d.find("#version-compare-new").get(0),Me=d.find("#version-compare-label").get(0),_=d.find("#version-compare-back-btn").get(0),Ie=d.find("#version-restore-btn").get(0),Be=d.find("#history-save-named-btn").get(0),ve=d.find("#history-delete-selected-btn").get(0);let se=!1,Ce=null;function we(){U.style.display="",X.style.display="none",Ce=null}function qe(){U.style.display="none",X.style.display=""}async function pe(){U.textContent="";const ee=document.createElement("p");ee.style.color="var(--dm-text-muted)",ee.textContent="Loading\u2026",U.appendChild(ee);let le;try{le=(await Y.versions.list(ce)).versions||[]}catch(V){U.textContent="";const q=document.createElement("p");q.style.color="var(--dm-danger,#e55)",q.textContent="Failed to load versions: "+V.message,U.appendChild(q);return}if(U.textContent="",ve.style.display="none",!le.length){const V=document.createElement("p");V.style.color="var(--dm-text-muted)",V.textContent="No versions saved yet. Versions are created automatically on each save.",U.appendChild(V);return}const ge=document.createElement("table");ge.style.cssText="width:100%;border-collapse:collapse;font-size:.875rem;";const ae=document.createElement("thead"),W=document.createElement("tr"),A=document.createElement("th");A.style.cssText="padding:.5rem .75rem;width:2rem;border-bottom:1px solid var(--dm-border);";const oe=document.createElement("input");oe.type="checkbox",oe.setAttribute("aria-label","Select all versions"),A.appendChild(oe),W.appendChild(A),["Date","Author","Type","Label","Actions"].forEach(V=>{const q=document.createElement("th");q.style.cssText="text-align:left;padding:.5rem .75rem;border-bottom:1px solid var(--dm-border);font-size:.8rem;color:var(--dm-text-muted);",q.textContent=V,W.appendChild(q)}),ae.appendChild(W),ge.appendChild(ae);const me=[];function ze(){const V=me.some(ue=>ue.checked),q=me.length>0&&me.every(ue=>ue.checked);ve.style.display=V?"":"none",oe.checked=q,oe.indeterminate=V&&!q}oe.addEventListener("change",()=>{me.forEach(V=>{V.checked=oe.checked}),ze()});const De=document.createElement("tbody");le.forEach(V=>{const q=document.createElement("tr");q.style.borderBottom="1px solid var(--dm-border)";const ue=document.createElement("td");ue.style.padding=".5rem .75rem";const Ee=document.createElement("input");Ee.type="checkbox",Ee.value=V.filename,Ee.addEventListener("change",ze),ue.appendChild(Ee),me.push(Ee);const ke=document.createElement("td");ke.style.padding=".5rem .75rem",ke.textContent=D(V.createdAt).format("D MMM YYYY, HH:mm");const he=document.createElement("td");he.style.padding=".5rem .75rem",he.textContent=V.author||"\u2014";const Te=document.createElement("td");Te.style.padding=".5rem .75rem";const be=document.createElement("span");be.className="badge badge-"+(V.type==="manual"?"primary":"secondary"),be.style.cssText="font-size:.75rem;padding:.2rem .5rem;border-radius:4px;",be.textContent=V.type,Te.appendChild(be);const Ne=document.createElement("td");Ne.style.cssText="padding:.5rem .75rem;color:var(--dm-text-muted);",Ne.textContent=V.label||"\u2014";const fe=document.createElement("td");fe.style.padding=".5rem .75rem";const ne=document.createElement("button");ne.className="btn btn-ghost btn-xs",ne.style.marginRight=".4rem",ne.title="Compare",ne.innerHTML='<span data-icon="columns"></span>',ne.addEventListener("click",async()=>{try{const xe=await Y.versions.get(ce,V.filename);$e.textContent=xe.content,Ae.textContent=d.find("#markdown-editor").get(0).value,Me.textContent=D(V.createdAt).format("D MMM YYYY, HH:mm")+(V.label?` \u2014 ${V.label}`:""),Ce=V.filename,qe()}catch(xe){E.toast("Failed to load version: "+xe.message,{type:"error"})}});const ie=document.createElement("button");ie.className="btn btn-ghost btn-xs",ie.style.color="var(--dm-danger,#e55)",ie.title="Delete",ie.innerHTML='<span data-icon="trash"></span>',ie.addEventListener("click",async()=>{if(await E.confirm("Delete this version? This cannot be undone."))try{await Y.versions.delete(ce,V.filename),E.toast("Version deleted.",{type:"success"}),await pe()}catch(xe){E.toast("Failed to delete: "+xe.message,{type:"error"})}}),fe.appendChild(ne),fe.appendChild(ie),q.appendChild(ue),q.appendChild(ke),q.appendChild(he),q.appendChild(Te),q.appendChild(Ne),q.appendChild(fe),De.appendChild(q)}),ge.appendChild(De),U.appendChild(ge),I.scan(U)}de.addEventListener("click",async()=>{se||(se=!0,await pe())}),_.addEventListener("click",()=>{we()}),Ie.addEventListener("click",async()=>{if(!(!Ce||!await E.confirm("Restore this version? The current page content will be overwritten (a pre-restore snapshot will be saved automatically).")))try{await Y.versions.restore(ce,Ce),E.toast("Page restored. Reloading editor\u2026",{type:"success"}),R.navigate("/pages"),setTimeout(()=>R.navigate(`/pages/edit${ce}`),300)}catch(ee){E.toast("Restore failed: "+ee.message,{type:"error"})}}),ve.addEventListener("click",async()=>{const ee=[...U.querySelectorAll("tbody input[type=checkbox]:checked")].map(le=>le.value);if(!(!ee.length||!await E.confirm(`Delete ${ee.length} version${ee.length>1?"s":""}? This cannot be undone.`)))try{await Y.versions.bulkDelete(ce,ee),E.toast(`${ee.length} version${ee.length>1?"s":""} deleted.`,{type:"success"}),await pe()}catch(le){E.toast("Delete failed: "+le.message,{type:"error"})}}),Be.addEventListener("click",()=>{const ee=E.slideover({title:"Save Named Version",size:"sm",position:"right"}),le=document.createElement("div");le.style.padding="1rem";const ge=document.createElement("label");ge.className="form-label",ge.textContent="Version Label";const ae=document.createElement("input");ae.type="text",ae.className="form-input",ae.placeholder="e.g. Initial design, Before restructure",ae.style.marginBottom=".75rem";const W=document.createElement("button");W.className="btn btn-primary",W.textContent="Save Version",W.addEventListener("click",async()=>{const A=ae.value.trim();try{await Y.versions.create(ce,A||null),E.toast("Named version saved.",{type:"success"}),ee.close(),se=!1,de.classList.contains("active")&&(se=!0,await pe())}catch(oe){E.toast("Failed to save version: "+oe.message,{type:"error"})}}),le.appendChild(ge),le.appendChild(ae),le.appendChild(W),ee.element.appendChild(le),ee.open(),setTimeout(()=>ae.focus(),100)})}let Re=!1,Ge=null,je=!1;function rt(d){return d.split(`
 `).map(ce=>ce.trimEnd()).join(`
 `).replace(/\n{3,}/g,`
 

package/admin/js/views/plugins.js

@@ -1,38 +1,38 @@
-import{api as i}from"../api.js";import{pluginMarketplaceView as f}from"./plugin-marketplace.js";export const pluginsView={templateUrl:"/admin/js/templates/plugins.html",async onMount(l){let c=!1;l.find('[data-tab="marketplace"]').on("click",async function(){if(c)return;const a=l.find("#marketplace-mount");try{const s=await H.get(f.templateUrl),u=new DOMParser().parseFromString(s,"text/html");for(;u.body.firstChild;)a.get(0).appendChild(u.body.firstChild);await f.onMount(a),c=!0}catch{E.toast("Failed to load marketplace.",{type:"error"})}}),E.tabs(l.find("#plugin-tabs").get(0));const r=E.loader(l.get(0),{type:"dots"});let e=[];try{e=await i.plugins.list()}catch(a){E.toast(`Failed to load plugins: ${a.message}`,{type:"error"})}if(r.destroy(),!e.length){l.find("#plugins-empty").show();return}y(l,e),Domma.icons.scan()}};function y(l,c){const r=l.find("#plugins-grid").empty();c.forEach(e=>{const a=e.enabled?"badge-success":"badge-secondary",s=e.enabled?"Enabled":"Disabled",o=e.enabled?"Disable":"Enable",u=e.enabled?"btn-ghost":"btn-primary",m=e.bundled?"var(--dm-info,#2563eb)":"var(--dm-secondary,#6b7280)",p=e.bundled?"Bundled \u2014 click to unbundle":"Not bundled \u2014 click to bundle",t=`<button class="badge badge-outline btn-bundle-plugin" data-name="${e.name}" data-bundled="${e.bundled?"1":"0"}" title="${p}" style="font-size:0.65rem;padding:1px 6px;cursor:pointer;background:none;border:1px solid;color:${m};border-color:${m};">${e.bundled?"Bundled":"Unbundled"}</button>`,d=e.author?`by ${n(e.author)}`:"",g=e.date?n(e.date):"",b=`
+import{api as g,getUser as h}from"../api.js";import{pluginMarketplaceView as v}from"./plugin-marketplace.js";export const pluginsView={templateUrl:"/admin/js/templates/plugins.html",async onMount(s){s.find("#new-plugin-btn").on("click",()=>x(s));let u=!1;s.find('[data-tab="marketplace"]').on("click",async function(){if(u)return;const a=s.find("#marketplace-mount");try{const n=await H.get(v.templateUrl),p=new DOMParser().parseFromString(n,"text/html");for(;p.body.firstChild;)a.get(0).appendChild(p.body.firstChild);await v.onMount(a),u=!0}catch{E.toast("Failed to load marketplace.",{type:"error"})}}),E.tabs(s.find("#plugin-tabs").get(0));const c=E.loader(s.get(0),{type:"dots"});let e=[];try{e=await g.plugins.list()}catch(a){E.toast(`Failed to load plugins: ${a.message}`,{type:"error"})}if(c.destroy(),!e.length){s.find("#plugins-empty").show();return}f(s,e),Domma.icons.scan()}};function x(s){const u=E.slideover({title:"New Plugin",size:"sm",position:"right"}),c=document.createElement("div");c.style.cssText="padding:.25rem 0 .5rem;";const e=h(),a=document.createElement("div");F.create({displayName:{type:"string",label:"Display Name",placeholder:"e.g. Event Manager",required:!0},slug:{type:"string",label:"Slug",placeholder:"event-manager",required:!0,help:"Folder name under plugins/ \u2014 lowercase letters, digits, hyphens."},description:{type:"string",label:"Description",placeholder:"What does this plugin do?"},author:{type:"string",label:"Author"},icon:{type:"string",label:"Icon",placeholder:"box",help:"A Domma icon name (as used in data-icon)."}},{author:e?.name||e?.username||"",icon:"box"},{showSubmitButton:!1}).renderTo(a),c.appendChild(a);const n=document.createElement("p");n.className="text-muted",n.style.cssText="font-size:.8rem;margin:.5rem 0 0;",n.textContent="The plugin is scaffolded from the built-in template with server routes, an admin view and a CLAUDE.md, and enabled automatically. Restart the server to activate it.",c.appendChild(n);const l=document.createElement("div");l.style.cssText="display:flex;justify-content:flex-end;gap:.5rem;margin-top:.75rem;";const p=document.createElement("button");p.className="btn btn-ghost",p.textContent="Cancel";const i=document.createElement("button");i.className="btn btn-primary",i.textContent="Create Plugin",l.appendChild(p),l.appendChild(i),c.appendChild(l),u.element.appendChild(c),u.open();const m=a.querySelector('input[name="displayName"]'),t=a.querySelector('input[name="slug"]');setTimeout(()=>m?.focus(),50);let o=!1;t?.addEventListener("input",()=>{o=!0}),m?.addEventListener("input",()=>{o||!t||(t.value=m.value.toLowerCase().trim().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"").slice(0,40))});async function b(){const d={};for(const y of["displayName","slug","description","author","icon"])d[y]=a.querySelector(`input[name="${y}"]`)?.value.trim()||"";if(!d.displayName||!d.slug){E.toast("Display name and slug are required.",{type:"error"});return}i.disabled=!0,i.textContent="Creating\u2026";try{await g.plugins.scaffold(d),u.close(),E.toast(`Plugin "${d.displayName}" created. Restart the server to activate it.`,{type:"success"});const y=await g.plugins.list();y.length&&(s.find("#plugins-empty").hide(),f(s,y))}catch(y){E.toast(y.message||"Failed to create plugin.",{type:"error"}),i.disabled=!1,i.textContent="Create Plugin"}}p.addEventListener("click",()=>u.close()),i.addEventListener("click",b),t?.addEventListener("keydown",d=>{d.key==="Enter"&&b()})}function f(s,u){const c=s.find("#plugins-grid").empty();u.forEach(e=>{const a=e.enabled?"badge-success":"badge-secondary",n=e.enabled?"Enabled":"Disabled",l=e.enabled?"Disable":"Enable",p=e.enabled?"btn-ghost":"btn-primary",i=e.bundled?"var(--dm-info,#2563eb)":"var(--dm-secondary,#6b7280)",m=e.bundled?"Bundled \u2014 click to unbundle":"Not bundled \u2014 click to bundle",t=`<button class="badge badge-outline btn-bundle-plugin" data-name="${e.name}" data-bundled="${e.bundled?"1":"0"}" title="${m}" style="font-size:0.65rem;padding:1px 6px;cursor:pointer;background:none;border:1px solid;color:${i};border-color:${i};">${e.bundled?"Bundled":"Unbundled"}</button>`,o=e.author?`by ${r(e.author)}`:"",b=e.date?r(e.date):"",d=`
             <div class="card plugin-card" data-plugin="${e.name}">
                 <div class="card-body">
                     <div class="plugin-header">
                         <div class="plugin-icon"><span data-icon="${e.icon||"package"}"></span></div>
                         <div class="plugin-meta">
-                            <div class="plugin-name">${n(e.displayName)}</div>
-                            <div class="plugin-version">v${n(e.version)}${d?` &middot; ${d}`:""}</div>
+                            <div class="plugin-name">${r(e.displayName)}</div>
+                            <div class="plugin-version">v${r(e.version)}${o?` &middot; ${o}`:""}</div>
                         </div>
                         <div style="display:flex;gap:.35rem;align-items:center;">
                             ${t}
-                            <span class="badge ${a}">${s}</span>
+                            <span class="badge ${a}">${n}</span>
                         </div>
                     </div>
-                    <p class="plugin-desc">${n(e.description)}</p>
-                    ${g?`<p class="plugin-date text-muted" style="font-size:.8rem;margin:0">Released ${g}</p>`:""}
+                    <p class="plugin-desc">${r(e.description)}</p>
+                    ${b?`<p class="plugin-date text-muted" style="font-size:.8rem;margin:0">Released ${b}</p>`:""}
                 </div>
                 <div class="plugin-footer">
                     <span class="text-muted" style="font-size:.8rem">Restart server after changes</span>
                     <div class="plugin-footer-actions">
                         ${e.settingsSchema?`<button class="btn btn-sm btn-ghost btn-plugin-settings" data-name="${e.name}"><span data-icon="settings"></span> Settings</button>`:""}
-                        <button class="btn btn-sm ${u} btn-toggle-plugin"
+                        <button class="btn btn-sm ${p} btn-toggle-plugin"
                                 data-name="${e.name}"
                                 data-enabled="${e.enabled?"1":"0"}">
-                            <span data-icon="${e.enabled?"pause":"play"}"></span> ${o}
+                            <span data-icon="${e.enabled?"pause":"play"}"></span> ${l}
                         </button>
                     </div>
                 </div>
-            </div>`;r.append(b)}),Domma.icons.scan(),Domma.effects.reveal(".plugin-card",{animation:"fade",stagger:60,duration:400}),Domma.effects.ripple(".btn-toggle-plugin"),r.on("click",".btn-plugin-settings",async function(){const e=$(this).data("name"),a=c.find(t=>t.name===e);if(!a?.settingsSchema)return;const o=`<form id="plugin-settings-form">${a.settingsSchema.map(t=>{const d=a.settings?.[t.key]??t.default??"";if(t.type==="select"){const g=t.options.map(b=>`<option value="${n(b.value)}"${String(d)===String(b.value)?" selected":""}>${n(b.label)}</option>`).join("");return`<div class="form-group">
-                    <label class="form-label">${n(t.label)}</label>
-                    <select class="form-control" name="${n(t.key)}">${g}</select>
+            </div>`;c.append(d)}),Domma.icons.scan(),Domma.effects.reveal(".plugin-card",{animation:"fade",stagger:60,duration:400}),Domma.effects.ripple(".btn-toggle-plugin"),c.on("click",".btn-plugin-settings",async function(){const e=$(this).data("name"),a=u.find(t=>t.name===e);if(!a?.settingsSchema)return;const l=`<form id="plugin-settings-form">${a.settingsSchema.map(t=>{const o=a.settings?.[t.key]??t.default??"";if(t.type==="select"){const b=t.options.map(d=>`<option value="${r(d.value)}"${String(o)===String(d.value)?" selected":""}>${r(d.label)}</option>`).join("");return`<div class="form-group">
+                    <label class="form-label">${r(t.label)}</label>
+                    <select class="form-control" name="${r(t.key)}">${b}</select>
                 </div>`}return t.type==="number"?`<div class="form-group">
-                    <label class="form-label">${n(t.label)}</label>
-                    <input class="form-control" type="number" name="${n(t.key)}" value="${n(String(d))}"${t.min!=null?` min="${t.min}"`:""}${t.max!=null?` max="${t.max}"`:""}>
+                    <label class="form-label">${r(t.label)}</label>
+                    <input class="form-control" type="number" name="${r(t.key)}" value="${r(String(o))}"${t.min!=null?` min="${t.min}"`:""}${t.max!=null?` max="${t.max}"`:""}>
                 </div>`:`<div class="form-group">
-                <label class="form-label">${n(t.label)}</label>
-                <input class="form-control" type="text" name="${n(t.key)}" value="${n(String(d))}">
-            </div>`}).join("")}</form>`;if(!await E.confirm(o,{title:`${n(a.displayName)} Settings`,confirmText:"Save",cancelText:"Cancel",html:!0}))return;const m=document.getElementById("plugin-settings-form");if(!m)return;const p={};a.settingsSchema.forEach(t=>{const d=m.elements[t.key];d&&(p[t.key]=t.type==="number"?Number(d.value):d.value)});try{await i.plugins.update(e,{settings:p}),a.settings={...a.settings,...p},E.toast("Settings saved.",{type:"success"})}catch(t){E.toast(`Failed to save: ${t.message}`,{type:"error"})}}),r.on("click",".btn-bundle-plugin",async function(){const e=$(this),a=e.data("name"),s=e.data("bundled")!==1&&e.data("bundled")!=="1";e.prop("disabled",!0).text(s?"Bundling\u2026":"Unbundling\u2026");try{await i.plugins.update(a,{bundled:s}),E.toast(`Plugin ${s?"marked as bundled":"unbundled"}.`,{type:"success"});const o=await i.plugins.list();y(l,o)}catch(o){E.toast(`Failed: ${o.message}`,{type:"error"}),e.prop("disabled",!1)}}),r.on("click",".btn-toggle-plugin",async function(){const e=$(this),a=e.data("name"),s=e.data("enabled")!==1&&e.data("enabled")!=="1";e.prop("disabled",!0).text(s?"Enabling\u2026":"Disabling\u2026");try{await i.plugins.update(a,{enabled:s}),E.toast(`Plugin ${s?"enabled":"disabled"}. Restart the server to apply changes.`,{type:"success"});const o=await i.plugins.list();y(l,o)}catch(o){E.toast(`Failed: ${o.message}`,{type:"error"}),e.prop("disabled",!1)}})}function n(l){return String(l).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}
+                <label class="form-label">${r(t.label)}</label>
+                <input class="form-control" type="text" name="${r(t.key)}" value="${r(String(o))}">
+            </div>`}).join("")}</form>`;if(!await E.confirm(l,{title:`${r(a.displayName)} Settings`,confirmText:"Save",cancelText:"Cancel",html:!0}))return;const i=document.getElementById("plugin-settings-form");if(!i)return;const m={};a.settingsSchema.forEach(t=>{const o=i.elements[t.key];o&&(m[t.key]=t.type==="number"?Number(o.value):o.value)});try{await g.plugins.update(e,{settings:m}),a.settings={...a.settings,...m},E.toast("Settings saved.",{type:"success"})}catch(t){E.toast(`Failed to save: ${t.message}`,{type:"error"})}}),c.on("click",".btn-bundle-plugin",async function(){const e=$(this),a=e.data("name"),n=e.data("bundled")!==1&&e.data("bundled")!=="1";e.prop("disabled",!0).text(n?"Bundling\u2026":"Unbundling\u2026");try{await g.plugins.update(a,{bundled:n}),E.toast(`Plugin ${n?"marked as bundled":"unbundled"}.`,{type:"success"});const l=await g.plugins.list();f(s,l)}catch(l){E.toast(`Failed: ${l.message}`,{type:"error"}),e.prop("disabled",!1)}}),c.on("click",".btn-toggle-plugin",async function(){const e=$(this),a=e.data("name"),n=e.data("enabled")!==1&&e.data("enabled")!=="1";e.prop("disabled",!0).text(n?"Enabling\u2026":"Disabling\u2026");try{await g.plugins.update(a,{enabled:n}),E.toast(`Plugin ${n?"enabled":"disabled"}. Restart the server to apply changes.`,{type:"success"});const l=await g.plugins.list();f(s,l)}catch(l){E.toast(`Failed: ${l.message}`,{type:"error"}),e.prop("disabled",!1)}})}function r(s){return String(s).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "0.36.14",
+  "version": "0.36.16",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/server/routes/api/plugins.js

@@ -1,8 +1,9 @@
 /**
  * Plugins API
- * GET /api/plugins              - list all discovered plugins + state (admin only)
- * PUT /api/plugins/:name        - enable/disable, update settings (admin only)
- * GET /api/plugins/admin-config - sidebar/routes/views for enabled plugins (authenticated)
+ * GET  /api/plugins              - list all discovered plugins + state (admin only)
+ * POST /api/plugins/scaffold     - create a new plugin from plugins/_template (admin only)
+ * PUT  /api/plugins/:name        - enable/disable, update settings (admin only)
+ * GET  /api/plugins/admin-config - sidebar/routes/views for enabled plugins (authenticated)
  */
 import {authenticate, requirePermission} from '../../middleware/auth.js';
 import {
@@ -12,9 +13,11 @@ import {
     runLifecycleHook,
     savePluginState
 } from '../../services/plugins.js';
+import {scaffoldPlugin} from '../../services/pluginScaffold.js';
 
 export async function pluginsRoutes(fastify) {
     const canRead   = { preHandler: [authenticate, requirePermission('plugins', 'read')]   };
+    const canCreate = { preHandler: [authenticate, requirePermission('plugins', 'create')] };
     const canUpdate = { preHandler: [authenticate, requirePermission('plugins', 'update')] };
 
     // List all plugins with their current state
@@ -36,6 +39,20 @@ export async function pluginsRoutes(fastify) {
         }));
     });
 
+    // Scaffold a new plugin from plugins/_template. The plugin is created
+    // pre-enabled so it goes live on the next server restart (its routes and
+    // admin views only register at boot — same restart rule as enable/disable).
+    fastify.post('/plugins/scaffold', canCreate, async (request, reply) => {
+        const {slug, displayName, description, author, icon} = request.body || {};
+        try {
+            const result = await scaffoldPlugin({slug, displayName, description, author, icon});
+            savePluginState(result.name, { enabled: true });
+            return { success: true, name: result.name, files: result.files, restartRequired: true };
+        } catch (err) {
+            return reply.status(err.statusCode || 500).send({ error: err.message });
+        }
+    });
+
     // Enable/disable or update settings for a plugin
     fastify.put('/plugins/:name', canUpdate, async (request, reply) => {
         const { name } = request.params;

package/server/services/pluginScaffold.js

@@ -0,0 +1,136 @@
+/**
+ * Plugin Scaffold Service
+ * Instantiates plugins/_template into a new plugin directory, replacing the
+ * PLUGIN_* token placeholders in every text file.
+ *
+ * Tokens replaced: PLUGIN_SLUG, PLUGIN_DISPLAY_NAME, PLUGIN_DESCRIPTION,
+ * PLUGIN_AUTHOR, PLUGIN_DATE.
+ *
+ * Thrown errors carry a `statusCode` (400 invalid input, 409 already exists,
+ * 500 template missing) so the route layer can map them directly.
+ */
+import fs from 'fs/promises';
+import path from 'path';
+
+const PLUGINS_DIR = path.resolve('plugins');
+const TEMPLATE_DIR = path.join(PLUGINS_DIR, '_template');
+
+const SLUG_PATTERN = /^[a-z][a-z0-9-]{1,39}$/;
+const ICON_PATTERN = /^[a-z][a-z0-9-]{0,39}$/;
+
+// Free-text values land inside JSON strings, JS block comments, and HTML
+// text nodes in the template, so any character that could escape one of
+// those contexts is refused rather than escaped per-file.
+const UNSAFE_TEXT = /[<>"\\]|\*\//;
+
+// Extensions that get token replacement; anything else is copied verbatim.
+const TEXT_EXTENSIONS = new Set(['.js', '.json', '.md', '.html', '.css', '.txt']);
+
+function fail(statusCode, message) {
+    const err = new Error(message);
+    err.statusCode = statusCode;
+    return err;
+}
+
+/**
+ * Validate scaffold input. Returns the normalised values or throws a 400.
+ *
+ * @param {object} input
+ * @returns {{slug: string, displayName: string, description: string, author: string, icon: string}}
+ */
+export function validateScaffoldInput(input = {}) {
+    const slug = String(input.slug || '').trim();
+    const displayName = String(input.displayName || '').trim();
+    const description = String(input.description || '').trim();
+    const author = String(input.author || '').trim();
+    const icon = String(input.icon || 'box').trim();
+
+    if (!SLUG_PATTERN.test(slug)) {
+        throw fail(400, 'Slug must be 2-40 characters: lowercase letters, digits and hyphens, starting with a letter.');
+    }
+    if (!displayName) throw fail(400, 'Display name is required.');
+    if (displayName.length > 60) throw fail(400, 'Display name must be 60 characters or fewer.');
+    if (description.length > 300) throw fail(400, 'Description must be 300 characters or fewer.');
+    if (author.length > 80) throw fail(400, 'Author must be 80 characters or fewer.');
+    if (!ICON_PATTERN.test(icon)) throw fail(400, 'Icon must be a lowercase icon name (letters, digits, hyphens).');
+
+    for (const [label, value] of [['Display name', displayName], ['Description', description], ['Author', author]]) {
+        if (UNSAFE_TEXT.test(value)) {
+            throw fail(400, `${label} may not contain <, >, ", backslash or */.`);
+        }
+    }
+
+    return { slug, displayName, description, author, icon };
+}
+
+/**
+ * Copy plugins/_template to plugins/<slug>, replacing PLUGIN_* tokens.
+ *
+ * @param {object} input - { slug, displayName, description?, author?, icon? }
+ * @returns {Promise<{name: string, files: string[]}>} Created plugin name and relative file list
+ */
+export async function scaffoldPlugin(input) {
+    const { slug, displayName, description, author, icon } = validateScaffoldInput(input);
+
+    try {
+        await fs.access(TEMPLATE_DIR);
+    } catch {
+        throw fail(500, 'Plugin template (plugins/_template) is missing.');
+    }
+
+    const targetDir = path.join(PLUGINS_DIR, slug);
+    try {
+        await fs.access(targetDir);
+        throw fail(409, `A plugin named "${slug}" already exists.`);
+    } catch (err) {
+        if (err.statusCode) throw err;
+        // ENOENT — target is free
+    }
+
+    const replacements = [
+        ['PLUGIN_SLUG', slug],
+        ['PLUGIN_DISPLAY_NAME', displayName],
+        ['PLUGIN_DESCRIPTION', description || `${displayName} plugin.`],
+        ['PLUGIN_AUTHOR', author],
+        ['PLUGIN_DATE', new Date().toISOString().slice(0, 10)],
+    ];
+
+    const files = [];
+
+    async function copyDir(srcDir, destDir) {
+        await fs.mkdir(destDir, { recursive: true });
+        const entries = await fs.readdir(srcDir, { withFileTypes: true });
+        for (const entry of entries) {
+            const src = path.join(srcDir, entry.name);
+            const dest = path.join(destDir, entry.name);
+            if (entry.isDirectory()) {
+                await copyDir(src, dest);
+            } else if (entry.isFile()) {
+                if (TEXT_EXTENSIONS.has(path.extname(entry.name).toLowerCase())) {
+                    let content = await fs.readFile(src, 'utf8');
+                    for (const [token, value] of replacements) {
+                        content = content.split(token).join(value);
+                    }
+                    await fs.writeFile(dest, content, 'utf8');
+                } else {
+                    await fs.copyFile(src, dest);
+                }
+                files.push(path.relative(targetDir, dest));
+            }
+        }
+    }
+
+    await copyDir(TEMPLATE_DIR, targetDir);
+
+    // The template hard-codes "box" as the icon; set the requested one via
+    // a proper JSON parse rather than string replacement.
+    if (icon !== 'box') {
+        const manifestPath = path.join(targetDir, 'plugin.json');
+        const manifest = JSON.parse(await fs.readFile(manifestPath, 'utf8'));
+        manifest.icon = icon;
+        for (const item of manifest.admin?.sidebar || []) item.icon = icon;
+        await fs.writeFile(manifestPath, JSON.stringify(manifest, null, 2) + '\n', 'utf8');
+    }
+
+    return { name: slug, files };
+}