domma-cms 0.43.1 → 0.45.0

package/server/middleware/auth.js

@@ -63,7 +63,7 @@ export function requireRole(allowedRoles) {
 
 /**
  * Return a preHandler that checks the current user's role has access to a resource.
- * Reads from the roles cache at request time — reflects live role changes.
+ * Reads from the roles cache at request time - reflects live role changes.
  *
  * @param {string}  resource - Resource key (e.g. 'pages', 'users')
  * @param {string} [action]  - Optional action (read | create | update | delete)
@@ -80,7 +80,7 @@ export function requirePermission(resource, action) {
         }
 
         // Check ANY of the user's effective roles (primary + additional) against
-        // the resource's permission list — union semantics so a user with both
+        // the resource's permission list - union semantics so a user with both
         // candidate and recruiter roles can do either role's actions.
         const allowed = getPermissionsFor(resource, action);
         const roles   = getEffectiveRoles(request.user);
@@ -103,7 +103,7 @@ export function requirePermission(resource, action) {
 export {getPermissionsForRole};
 
 /**
- * Shorthand preHandler — admin-tier role (level ≤ 1) or above.
+ * Shorthand preHandler - admin-tier role (level ≤ 1) or above.
  * Matches the base role hierarchy documented in roles.js:
  *   super-admin (0), admin (1), user (2).
  * Both super-admin and admin pass; regular users and anything below do not.
@@ -116,7 +116,7 @@ export async function requireAdmin(request, reply) {
     if (!request.user) {
         return reply.code(401).send({ statusCode: 401, error: 'Unauthorised', message: 'Authentication required' });
     }
-    // Use effective level — a user with "additionalRoles: ['admin']" can do admin work
+    // Use effective level - a user with "additionalRoles: ['admin']" can do admin work
     // even if their primary role is something lower-privilege.
     if (getEffectiveLevel(request.user) > 1) {
         return reply.code(403).send({ statusCode: 403, error: 'Forbidden', message: 'Admin access required' });
@@ -127,7 +127,7 @@ export async function requireAdmin(request, reply) {
  * Determine whether an actor can manage a target user.
  * Managers cannot create, edit, or delete users with a lower level number (higher privilege).
  *
- * Accepts either user objects (preferred — uses effective level across all roles)
+ * Accepts either user objects (preferred - uses effective level across all roles)
  * or bare role-name strings (legacy compat). Strings are looked up via
  * `getRoleLevel`; objects via `getEffectiveLevel` so multi-role actors and
  * targets are compared by their HIGHEST-privilege role.
@@ -148,19 +148,19 @@ export function canManageUser(actor, target) {
  *
  * Visibility may be either:
  *   - A single string ('public', 'private', or a role name)
- *   - An array of role names — granted if ANY entry passes the per-role check
+ *   - An array of role names - granted if ANY entry passes the per-role check
  *
  * Per-role semantics are unchanged: each role check passes if the visitor's
  * role level is at or above the required role (lower or equal level number).
  * 'private' resolves to super-admin only (Infinity → level 0).
  *
  * The "any of" semantics for arrays means siblings at different tiers of the
- * hierarchy are all granted access — e.g. `visibility: [candidate, employer]`
+ * hierarchy are all granted access - e.g. `visibility: [candidate, employer]`
  * lets both roles in, plus anyone more privileged than either (typically
  * admins inherit access automatically via the level comparison).
  *
  * @param {string|null}      userRole   - The visitor's role, or null if unauthenticated
- * @param {string|string[]}  visibility - Required visibility — single value or array
+ * @param {string|string[]}  visibility - Required visibility - single value or array
  * @returns {boolean} true if access is granted
  */
 export function checkVisibility(userRoleOrObj, visibility) {
@@ -168,7 +168,7 @@ export function checkVisibility(userRoleOrObj, visibility) {
 
     // Accept either a bare role name (legacy) or a user object with multi-role
     // support. When given an object we walk every effective role and grant
-    // access if ANY satisfies — same union semantics as permissions.
+    // access if ANY satisfies - same union semantics as permissions.
     const roles = typeof userRoleOrObj === 'string'
         ? (userRoleOrObj ? [userRoleOrObj] : [])
         : getEffectiveRoles(userRoleOrObj);
@@ -186,7 +186,7 @@ export function checkVisibility(userRoleOrObj, visibility) {
 }
 
 /**
- * Internal helper — single-role visibility check.
+ * Internal helper - single-role visibility check.
  * Returns true if the user role is at or above the required role's level.
  *
  * @param {string} userRole   - Must not be null
@@ -201,7 +201,7 @@ function checkSingleVisibility(userRole, visibility) {
 }
 
 /**
- * Fastify preHandler factory — gates a route by visibility level.
+ * Fastify preHandler factory - gates a route by visibility level.
  * Works identically to the content-page visibility system; accepts the same
  * single-string or array-of-roles syntax as checkVisibility().
  *

package/server/middleware/managerAuth.js

@@ -1,11 +1,11 @@
 /**
- * Manager auth middleware — shared-secret guard for inbound requests from domma-cms-manager.
+ * Manager auth middleware - shared-secret guard for inbound requests from domma-cms-manager.
  * Completely separate from JWT authenticate. Do NOT mix these two auth surfaces.
  */
 import { timingSafeEqual, createHmac } from 'crypto';
 
 /**
- * Fastify preHandler — validates the X-Manager-Token or Authorization: Bearer header
+ * Fastify preHandler - validates the X-Manager-Token or Authorization: Bearer header
  * against the MANAGER_SECRET environment variable using timing-safe comparison.
  *
  * @param {import('fastify').FastifyRequest} request
@@ -26,7 +26,7 @@ export function requireManager(request, reply, done) {
         return reply.code(401).send({ error: 'Manager token required.' });
     }
 
-    // Compare HMAC digests — always 32 bytes regardless of input length, preventing timing oracle
+    // Compare HMAC digests - always 32 bytes regardless of input length, preventing timing oracle
     const digest = (s) => createHmac('sha256', 'domma-cms').update(s).digest();
     if (!timingSafeEqual(digest(token), digest(secret))) {
         return reply.code(403).send({ error: 'Invalid manager token.' });

package/server/routes/api/actions.js

@@ -1,5 +1,5 @@
 /**
- * Actions API (Pro — requires MongoDB)
+ * Actions API (Pro - requires MongoDB)
  *
  * Admin endpoints (authenticated + actions permission):
  * GET    /actions                        - List all action configs
@@ -43,7 +43,7 @@ export async function actionsRoutes(fastify) {
         try {
             const {canSeeArtefact} = await import('../../services/projects.js');
             const all = await listActions();
-            // listActions returns full records with meta inline — filter directly
+            // listActions returns full records with meta inline - filter directly
             return all.filter(a => canSeeArtefact(request.user, a));
         } catch (err) {
             return reply.status(503).send({ error: err.message });
@@ -188,7 +188,7 @@ export async function actionsRoutes(fastify) {
 
         const user          = request.user;
         const allowedRoles  = action.access?.roles || ['admin', 'super-admin'];
-        // Use effective level — a candidate-with-also-admin can run admin-tier actions.
+        // Use effective level - a candidate-with-also-admin can run admin-tier actions.
         const userLevel     = getEffectiveLevel(user);
         const minAllowed    = Math.min(...allowedRoles.map(r => getRoleLevel(r)));
 
@@ -217,7 +217,7 @@ export async function actionsRoutes(fastify) {
      * shortcode to render only the buttons that will actually succeed.
      *
      * Auth: optional. Anonymous calls return actions accessible to anonymous
-     * users (rare — most transitions require a role). With a JWT we narrow
+     * users (rare - most transitions require a role). With a JWT we narrow
      * to what the signed-in user can do.
      *
      * Response: { transitions: [{slug, title, trigger, transition}, ...] }

package/server/routes/api/api-endpoints.js

@@ -1,11 +1,11 @@
 /**
  * API Endpoints API (admin management of custom endpoint definitions)
  *
- * GET    /api/api-endpoints      — list definitions visible to the caller
- * GET    /api/api-endpoints/:id  — single definition (the builder editor)
- * POST   /api/api-endpoints      — create (400 validation, 409 duplicate path shape)
- * PUT    /api/api-endpoints/:id  — update (project binding immutable)
- * DELETE /api/api-endpoints/:id  — delete
+ * GET    /api/api-endpoints      - list definitions visible to the caller
+ * GET    /api/api-endpoints/:id  - single definition (the builder editor)
+ * POST   /api/api-endpoints      - create (400 validation, 409 duplicate path shape)
+ * PUT    /api/api-endpoints/:id  - update (project binding immutable)
+ * DELETE /api/api-endpoints/:id  - delete
  *
  * Endpoints are project-scoped artefacts: non-super-admin users with a
  * `projects: []` access scope only see/manage definitions in their projects.
@@ -28,7 +28,7 @@ import {getCollection} from '../../services/collections.js';
 /**
  * Scoped users must not expose data they cannot see: the collection an
  * endpoint queries is itself an artefact subject to project access scope.
- * Returns true when the user may use the collection (or it doesn't exist —
+ * Returns true when the user may use the collection (or it doesn't exist -
  * the service's validation produces the clearer 400 for that case).
  *
  * @param {object} user
@@ -96,7 +96,7 @@ export async function apiEndpointsRoutes(fastify, opts = {}) {
         if (!canSeeArtefact(request.user, {meta: {project: existing.project}})) {
             return reply.status(403).send({error: 'Access denied for this project'});
         }
-        // The project binding is the endpoint's URL namespace — immutable.
+        // The project binding is the endpoint's URL namespace - immutable.
         const {project: _ignored, ...patch} = request.body || {};
         if (!await canUseCollection(request.user, patch.collection ?? existing.collection)) {
             return reply.status(403).send({error: 'Access denied for this collection'});

package/server/routes/api/api-tokens.js

@@ -1,10 +1,10 @@
 /**
  * API Tokens API
  *
- * GET    /api/api-tokens      — list tokens visible to the caller (sanitised; never the hash)
- * POST   /api/api-tokens      — create; response carries the plaintext ONCE
- * PUT    /api/api-tokens/:id  — rename, enable/disable, edit scopes/expiry
- * DELETE /api/api-tokens/:id  — revoke (immediate)
+ * GET    /api/api-tokens      - list tokens visible to the caller (sanitised; never the hash)
+ * POST   /api/api-tokens      - create; response carries the plaintext ONCE
+ * PUT    /api/api-tokens/:id  - rename, enable/disable, edit scopes/expiry
+ * DELETE /api/api-tokens/:id  - revoke (immediate)
  *
  * Tokens are project-scoped artefacts: non-super-admin users with a
  * `projects: []` access scope only see/manage tokens in their projects.
@@ -51,7 +51,7 @@ export async function apiTokensRoutes(fastify, opts = {}) {
         try {
             const creator = request.user?.name || request.user?.email || null;
             const {entry, plaintext} = await createToken({name, project, scopes, expiresAt, createdBy: creator});
-            // The plaintext appears here and nowhere else — only the hash is stored.
+            // The plaintext appears here and nowhere else - only the hash is stored.
             return reply.status(201).send({token: entry, plaintext});
         } catch (err) {
             return reply.status(400).send({error: err.message});

package/server/routes/api/auth.js

@@ -5,7 +5,7 @@
  * POST /api/auth/login         - { email, password } → { token, refreshToken, user }
  * GET  /api/auth/me            - return current user from token
  * POST /api/auth/refresh       - { refreshToken } → { token }
- * POST /api/auth/logout        - { refreshToken } → { ok: true } — blacklists the refresh token
+ * POST /api/auth/logout        - { refreshToken } → { ok: true } - blacklists the refresh token
  */
 import crypto from 'node:crypto';
 import {config, getConfig} from '../../config.js';
@@ -58,7 +58,7 @@ export async function authRoutes(fastify) {
         return { needsSetup: count === 0 };
     });
 
-    // POST /api/auth/setup — create the very first admin (only allowed when no users exist)
+    // POST /api/auth/setup - create the very first admin (only allowed when no users exist)
     fastify.post('/auth/setup', async (request, reply) => {
         if (setupInProgress) {
             return reply.status(409).send({error: 'Setup already in progress'});
@@ -114,13 +114,13 @@ export async function authRoutes(fastify) {
         return { token, refreshToken, user: safeUser };
     });
 
-    // GET /api/auth/permissions — returns the raw permissions array for the authenticated user's role
+    // GET /api/auth/permissions - returns the raw permissions array for the authenticated user's role
     fastify.get('/auth/permissions', {preHandler: [authenticate]}, async (request) => {
         const permissions = getPermissionsForRole(request.user.role);
         return {permissions};
     });
 
-    // GET /api/auth/permissions-registry — returns the full permissions registry
+    // GET /api/auth/permissions-registry - returns the full permissions registry
     fastify.get('/auth/permissions-registry', {preHandler: [authenticate]}, async () => {
         return {groups: GROUP_ORDER, resources: REGISTRY};
     });
@@ -133,7 +133,7 @@ export async function authRoutes(fastify) {
         return {...user, profile: profileEntry?.data || {}};
     });
 
-    // PUT /api/auth/me — self-service update (name, email, password, profile)
+    // PUT /api/auth/me - self-service update (name, email, password, profile)
     fastify.put('/auth/me', {preHandler: [authenticate]}, async (request, reply) => {
         const id = request.user.id;
         const {name, email, password, profile} = request.body || {};
@@ -157,10 +157,10 @@ export async function authRoutes(fastify) {
         return {...user, profile: profileEntry?.data || {}};
     });
 
-    // POST /api/auth/forgot-password — send a password reset email (no auth)
+    // POST /api/auth/forgot-password - send a password reset email (no auth)
     fastify.post('/auth/forgot-password', { config: { rateLimit: { max: 3, timeWindow: '1 hour' } } }, async (request) => {
         const {email} = request.body || {};
-        if (!email) return {ok: true}; // always ok — prevents enumeration
+        if (!email) return {ok: true}; // always ok - prevents enumeration
 
         try {
             const user = await getUserByEmail(email);
@@ -195,7 +195,7 @@ export async function authRoutes(fastify) {
 <body style="font-family:sans-serif;max-width:560px;margin:0 auto;padding:24px;">
     <h2 style="color:#333;">Password Reset</h2>
     <p>Hi ${user.name},</p>
-    <p>We received a request to reset your password. Click the link below — it expires in 1 hour.</p>
+    <p>We received a request to reset your password. Click the link below - it expires in 1 hour.</p>
     <p style="margin:24px 0;">
         <a href="${resetUrl}" style="background:#5b8cff;color:#fff;padding:12px 24px;border-radius:6px;text-decoration:none;display:inline-block;">Reset Password</a>
     </p>
@@ -212,7 +212,7 @@ export async function authRoutes(fastify) {
         return {ok: true};
     });
 
-    // POST /api/auth/reset-password — consume token and set new password (no auth)
+    // POST /api/auth/reset-password - consume token and set new password (no auth)
     fastify.post('/auth/reset-password', { config: { rateLimit: { max: 5, timeWindow: '1 minute' } } }, async (request, reply) => {
         const {token, password} = request.body || {};
         if (!token || !password) {
@@ -237,7 +237,7 @@ export async function authRoutes(fastify) {
         return {ok: true};
     });
 
-  // POST /api/auth/logout — blacklists the refresh token (fire-and-forget safe: no auth required)
+  // POST /api/auth/logout - blacklists the refresh token (fire-and-forget safe: no auth required)
   fastify.post('/auth/logout', async (request) => {
     const {refreshToken} = request.body || {};
     if (refreshToken) blacklistedRefreshTokens.add(refreshToken);

package/server/routes/api/blocks.js

@@ -73,7 +73,7 @@ export async function blocksRoutes(fastify) {
         }
     });
 
-    // Import a bundle — creates or updates a block from a .dmblock.json payload.
+    // Import a bundle - creates or updates a block from a .dmblock.json payload.
     // Pass { overwrite: true } to replace an existing block by the same name;
     // without it, a collision returns 409 so the caller can confirm.
     fastify.post('/blocks/import', canUpdate, async (request, reply) => {
@@ -90,7 +90,7 @@ export async function blocksRoutes(fastify) {
             return reply.status(400).send({error: 'Bundle is missing html content'});
         }
 
-        // Collision check — only when the caller hasn't explicitly opted in to overwrite.
+        // Collision check - only when the caller hasn't explicitly opted in to overwrite.
         if (!overwrite) {
             try {
                 await getBlock(name);
@@ -98,7 +98,7 @@ export async function blocksRoutes(fastify) {
             } catch (err) {
                 if (err.code === 'INVALID_NAME') return reply.status(400).send({error: err.message});
                 if (err.code !== 'ENOENT') throw err;
-                // ENOENT — no collision, proceed
+                // ENOENT - no collision, proceed
             }
         }
 

package/server/routes/api/collections.js

@@ -31,7 +31,7 @@
  * DELETE /v1/:slug/:id      ≡ DELETE /collections/:slug/public/:id
  *
  * Access modes per verb (`schema.api.<verb>.access`): 'public', a role name
- * (JWT + role level), or 'token' (project-scoped API token — see
+ * (JWT + role level), or 'token' (project-scoped API token - see
  * services/apiTokens.js). A token is ONLY accepted when the mode is 'token';
  * it is never a substitute for a role, and a JWT is never accepted in token
  * mode. `schema.api.read.fields` optionally whitelists which data fields the
@@ -116,7 +116,7 @@ function redactTokenHash(entry) {
 /**
  * Apply the read-field allowlist (`schema.api.read.fields`) to a public read
  * payload. Absent or empty allowlist = all fields. Handles both list payloads
- * ({entries: [...]}) and single entries. Only entry.data is filtered —
+ * ({entries: [...]}) and single entries. Only entry.data is filtered -
  * `_refs` from resolveRefs is not (refs of stripped fields may still appear;
  * documented v1 behaviour).
  *
@@ -147,10 +147,10 @@ export function applyReadFieldAllowlist(schema, payload) {
  */
 export async function checkPublicAccess(schema, operation, request, reply) {
     // Hard kill-switch: if the artefact's project is disabled, the whole
-    // external surface is off — 404 (no oracle). This covers /api/v1
+    // external surface is off - 404 (no oracle). This covers /api/v1
     // collections, the synthesized-schema custom endpoints (/api/x/*, whose
     // meta.project is the endpoint's project), and any token bound to the
-    // project — all funnel through here.
+    // project - all funnel through here.
     if (!(await isProjectEnabled(resolveArtefactProject(schema)))) {
         return reply.status(404).send({ error: 'Not found' });
     }
@@ -162,7 +162,7 @@ export async function checkPublicAccess(schema, operation, request, reply) {
 
     if (access.access === 'public') return; // No auth needed
 
-    // Token mode — project-scoped API token, strict: a token is the ONLY
+    // Token mode - project-scoped API token, strict: a token is the ONLY
     // accepted credential here (a JWT never satisfies token mode, and a
     // token never satisfies a role mode).
     if (access.access === 'token') {
@@ -184,7 +184,7 @@ export async function checkPublicAccess(schema, operation, request, reply) {
         return;
     }
 
-    // Auth required — try to verify JWT
+    // Auth required - try to verify JWT
     try {
         await request.jwtVerify();
     } catch {
@@ -193,7 +193,7 @@ export async function checkPublicAccess(schema, operation, request, reply) {
 
     const user = request.user;
     const requiredLevel = roleLevel(access.access);
-    // Effective level — multi-role users get the lowest (most privileged) level
+    // Effective level - multi-role users get the lowest (most privileged) level
     // across their primary + additional roles for this access decision.
     const userLevel     = getEffectiveLevel(user);
 
@@ -307,9 +307,9 @@ export async function collectionsRoutes(fastify) {
      * GET /api/collections/:slug/entries
      *
      * Query parameters:
-     *   page, limit, sort, order   — pagination/sort (limit=0 means "no limit")
-     *   search                     — free-text substring across all field values
-     *   filter[<field>_<op>]=val   — structured filter; see filterEngine.js
+     *   page, limit, sort, order   - pagination/sort (limit=0 means "no limit")
+     *   search                     - free-text substring across all field values
+     *   filter[<field>_<op>]=val   - structured filter; see filterEngine.js
      *
      * Example:
      *   /api/collections/jobs/entries?filter[location]=London&filter[salary_gte]=50000
@@ -388,7 +388,7 @@ export async function collectionsRoutes(fastify) {
         }
     });
 
-    // Clear all entries — DELETE /collections/:slug/entries (no :id)
+    // Clear all entries - DELETE /collections/:slug/entries (no :id)
     fastify.delete('/collections/:slug/entries', canDelete, async (request, reply) => {
         try {
             await clearEntries(request.params.slug);
@@ -493,11 +493,11 @@ export async function collectionsRoutes(fastify) {
     /*
      * GET /api/collections/:slug/public
      *
-     * Public read endpoint — gated by `api.read` in the collection schema.
+     * Public read endpoint - gated by `api.read` in the collection schema.
      * Supports the same pagination/sort/search/filter as the admin endpoint
      * (see GET /collections/:slug/entries above), plus:
      *
-     *   scope=mine   — restrict results to entries created by the current
+     *   scope=mine   - restrict results to entries created by the current
      *                  user (`meta.createdBy === user.id`). Requires a valid
      *                  JWT; returns 401 if unauthenticated. Used by the
      *                  `[collection scope="mine"]` shortcode for per-user
@@ -566,11 +566,11 @@ export async function collectionsRoutes(fastify) {
      * resolved here and the rendered HTML fragment swapped in client-side.
      *
      * Body: { attrs: <base64 JSON of the original shortcode attributes> }
-     * Auth: JWT required — `createdBy = <user.id>` is injected server-side
+     * Auth: JWT required - `createdBy = <user.id>` is injected server-side
      *       (the client cannot tamper with which user's data they see).
      * Returns: { html: '<div class="dm-collection-…">…</div>' }
      *
-     * Security: results are always scoped to `createdBy = <user.id>` —
+     * Security: results are always scoped to `createdBy = <user.id>` -
      * a caller can only ever render their own entries, regardless of the
      * collection's `api.read` setting. This matches the security model
      * of GET /:slug/public?scope=mine.
@@ -586,11 +586,11 @@ export async function collectionsRoutes(fastify) {
          *
          * Body: {
          *   attrs: <base64 JSON of the shortcode attributes>,
-         *   page:  <number, optional — applied via attrs.limit + slicing>
+         *   page:  <number, optional - applied via attrs.limit + slicing>
          * }
          *
          * Auth: gated by the target collection's `api.read` setting via
-         *       checkPublicAccess(). No user identity is injected — this
+         *       checkPublicAccess(). No user identity is injected - this
          *       endpoint is for general fragment rendering, not per-user
          *       scoping (that's render-scope's job).
          *
@@ -712,7 +712,7 @@ export async function collectionsRoutes(fastify) {
     fastify.delete('/collections/:slug/public/:id', publicDeleteEntry);
 
     // -------------------------------------------------------------------------
-    // External versioned API — stable alias of the public endpoints above.
+    // External versioned API - stable alias of the public endpoints above.
     // Documented surface for external consumers (docs/api-reference.md).
     // -------------------------------------------------------------------------
 

package/server/routes/api/dashboard.js

@@ -98,7 +98,7 @@ function buildTopPages(daily, days = 7) {
         .slice(0, 5);
 }
 
-// ── Journeys / spikes — ported verbatim from plugins/analytics so the core
+// ── Journeys / spikes - ported verbatim from plugins/analytics so the core
 //    dashboard can compute them off disk without the plugin's encapsulated
 //    `fastify.analytics` decorator (which it cannot see). Keep in sync with
 //    plugins/analytics/plugin.js.
@@ -181,7 +181,7 @@ function detectSpikes(daily, now = new Date()) {
 }
 
 /**
- * Recent activity feed — combines page version events with recent collection
+ * Recent activity feed - combines page version events with recent collection
  * entries (form submissions). Returns at most 10 items, newest first.
  *
  * @returns {Promise<Array<object>>}
@@ -189,7 +189,7 @@ function detectSpikes(daily, now = new Date()) {
 async function buildActivity() {
     const items = [];
 
-    // Versions — read each page's _meta.json via the service so the schema
+    // Versions - read each page's _meta.json via the service so the schema
     // stays in one place. listVersions returns newest-first.
     const versionsDir = path.join(ROOT, 'content', 'versions');
     try {
@@ -211,7 +211,7 @@ async function buildActivity() {
         }
     } catch { /* no versions dir */ }
 
-    // Collection entries — each slug has a single data.json with an array of
+    // Collection entries - each slug has a single data.json with an array of
     // entries. Take the newest ENTRIES_PER_COLLECTION by meta.createdAt.
     const collectionsDir = path.join(ROOT, 'content', 'collections');
     try {
@@ -277,7 +277,7 @@ export async function dashboardRoutes(fastify, opts = {}) {
         const analytics = fastify.analytics;
         // The analytics plugin decorates `analytics` inside its own prefixed,
         // encapsulated scope, so `fastify.analytics` is undefined here in the
-        // core dashboard route — traffic/topPages always read 0 even though hits
+        // core dashboard route - traffic/topPages always read 0 even though hits
         // are recorded. Read the plugin's daily counters straight off disk (same
         // pattern as buildActivity reading versions/collections below).
         const daily = (await safe('analytics.daily', async () => {

package/server/routes/api/effects.js

@@ -1,7 +1,7 @@
 /**
  * Effects API Routes
- * GET  /api/effects/settings  — public (read by public site IIFE)
- * PUT  /api/effects/settings  — admin-only (save user overrides)
+ * GET  /api/effects/settings  - public (read by public site IIFE)
+ * PUT  /api/effects/settings  - admin-only (save user overrides)
  */
 import {authenticate, requireAdmin} from '../../middleware/auth.js';
 import {getConfig, saveConfig} from '../../config.js';

package/server/routes/api/endpoints-public.js

@@ -1,5 +1,5 @@
 /**
- * Custom API Endpoints — public surface
+ * Custom API Endpoints - public surface
  *
  * One catch-all serves every user-defined endpoint:
  *   GET /api/x/<project><path>     e.g. /api/x/world-cup/fixtures-day/2026-06-11
@@ -7,7 +7,7 @@
  * Definitions live in the `api-endpoints` preset collection and are matched
  * at request time by services/apiEndpoints.js. Auth (public / token / role),
  * project binding, token scopes, and the read field allowlist all reuse the
- * public collections machinery via a synthesized schema — one battle-tested
+ * public collections machinery via a synthesized schema - one battle-tested
  * code path for every external read.
  *
  * Unknown project, unknown path, and disabled endpoints all 404 identically
@@ -17,7 +17,7 @@ import {EndpointParamError, executeEndpoint, matchEndpoint} from '../../services
 import {applyReadFieldAllowlist, checkPublicAccess} from './collections.js';
 import * as cache from '../../services/cache/index.js';
 
-/** Cached sentinel for single-mode misses — a miss is a cacheable answer. */
+/** Cached sentinel for single-mode misses - a miss is a cacheable answer. */
 const NOT_FOUND = {__endpointNotFound: true};
 
 /**
@@ -44,7 +44,7 @@ export async function endpointsPublicRoutes(fastify) {
 
         const {def, params} = match;
 
-        // Synthesized schema — checkPublicAccess reads exactly api.read,
+        // Synthesized schema - checkPublicAccess reads exactly api.read,
         // slug (token scopes), and meta.project (token project binding).
         const synth = {
             slug: def.collection,
@@ -63,7 +63,7 @@ export async function endpointsPublicRoutes(fastify) {
         };
 
         try {
-            // Only public responses are cacheable — token/role responses are
+            // Only public responses are cacheable - token/role responses are
             // caller-dependent. Both tags are invalidated by the service layer
             // on every write path: entry mutations bust collection:<slug>, and
             // definition edits (entries in api-endpoints) bust