domma-cms 0.43.1 → 0.45.0

package/server/routes/api/forms.js

@@ -4,18 +4,18 @@
  * Submissions are stored exclusively in Collections (no dual-storage).
  *
  * Endpoints (prefix: /api):
- *   GET    /forms                          — admin: list all forms
- *   POST   /forms                          — admin: create new form
- *   GET    /forms/:slug                    — admin: get form definition
- *   GET    /forms/:slug/public             — public: get form (no actions block)
- *   PUT    /forms/:slug                    — admin: update form definition
- *   DELETE /forms/:slug                    — admin: delete form
- *   GET    /forms/:slug/submissions        — admin: list submissions from collection
- *   GET    /forms/:slug/submissions/export — admin: CSV export from collection
- *   DELETE /forms/:slug/submissions        — admin: clear all submissions
- *   DELETE /forms/:slug/submissions/:id    — admin: delete one submission
- *   POST   /forms/submit/:slug             — public: accept submission
- *   POST   /forms/test-email               — admin: send test email
+ *   GET    /forms                          - admin: list all forms
+ *   POST   /forms                          - admin: create new form
+ *   GET    /forms/:slug                    - admin: get form definition
+ *   GET    /forms/:slug/public             - public: get form (no actions block)
+ *   PUT    /forms/:slug                    - admin: update form definition
+ *   DELETE /forms/:slug                    - admin: delete form
+ *   GET    /forms/:slug/submissions        - admin: list submissions from collection
+ *   GET    /forms/:slug/submissions/export - admin: CSV export from collection
+ *   DELETE /forms/:slug/submissions        - admin: clear all submissions
+ *   DELETE /forms/:slug/submissions/:id    - admin: delete one submission
+ *   POST   /forms/submit/:slug             - public: accept submission
+ *   POST   /forms/test-email               - admin: send test email
  */
 import {createRequire} from 'module';
 import {fileURLToPath} from 'url';
@@ -40,7 +40,7 @@ import {v4 as uuidv4} from 'uuid';
 /**
  * Detect form↔collection mismatches at save time so admins know BEFORE
  * users hit silent rejection. Returns an array of human-readable warning
- * strings — empty when the form lines up cleanly with its target collection.
+ * strings - empty when the form lines up cleanly with its target collection.
  *
  * Checks performed:
  *   - Target collection exists (otherwise every submission goes nowhere)
@@ -63,7 +63,7 @@ async function detectFormCollectionMismatch(form) {
         return warnings;
     }
     if (!collection) {
-        warnings.push(`Target collection "${targetSlug}" does not exist — submissions will fail. Either create the collection or change the form's target.`);
+        warnings.push(`Target collection "${targetSlug}" does not exist - submissions will fail. Either create the collection or change the form's target.`);
         return warnings;
     }
 
@@ -145,7 +145,7 @@ function validateUpload(fieldCfg, part, size) {
  * `content/media/`, and replaced by a `{ url, name, size, mime }` reference.
  *
  * Throws on validation failure (caller handles HTTP 400). Files are streamed
- * into memory up to fastify-multipart's configured limit — fine for the
+ * into memory up to fastify-multipart's configured limit - fine for the
  * resume-pdf / portrait-photo scale; large uploads should still use the admin
  * media flow.
  *
@@ -163,7 +163,7 @@ async function parseMultipartForm(request, form) {
         if (part.type === 'file') {
             const fieldCfg = fileFields.get(part.fieldname);
             if (!fieldCfg) {
-                // Unknown file field — drain and skip rather than 400, so a
+                // Unknown file field - drain and skip rather than 400, so a
                 // form that gains a file input later doesn't reject older
                 // submissions in-flight from a stale page.
                 for await (const _ of part.file) { /* drain */ }
@@ -174,7 +174,7 @@ async function parseMultipartForm(request, form) {
             const buffer = Buffer.concat(chunks);
             const err    = validateUpload(fieldCfg, part, buffer.length);
             if (err) throw new Error(err);
-            if (buffer.length === 0) continue;     // empty file input — skip
+            if (buffer.length === 0) continue;     // empty file input - skip
             const saved = await saveMedia(safeFilename(part.filename), buffer);
             out[part.fieldname] = {
                 url:  saved.url,
@@ -183,7 +183,7 @@ async function parseMultipartForm(request, form) {
                 mime: part.mimetype
             };
         } else {
-            // Text field — last value wins on duplicates (browser-standard).
+            // Text field - last value wins on duplicates (browser-standard).
             out[part.fieldname] = part.value;
         }
     }
@@ -237,7 +237,7 @@ export async function formsRoutes(fastify) {
     const canDelete = { preHandler: [authenticate, requirePermission('collections', 'delete')] };
 
     // -----------------------------------------------------------------------
-    // GET /forms — list all form definitions with submission counts
+    // GET /forms - list all form definitions with submission counts
     // -----------------------------------------------------------------------
     fastify.get('/forms', canRead, async (request) => {
         const {canSeeArtefact} = await import('../../services/projects.js');
@@ -245,7 +245,7 @@ export async function formsRoutes(fastify) {
         const result = await Promise.all(forms.map(async form => {
             let submissionCount = 0;
             try {
-                // listEntries returns { entries, total, page, limit } — total is the
+                // listEntries returns { entries, total, page, limit } - total is the
                 // unpaginated count which is what we want for the badge here.
                 const r = await listEntries(form.slug, { limit: 0 });
                 submissionCount = r.total ?? (r.entries || []).length;
@@ -263,7 +263,7 @@ export async function formsRoutes(fastify) {
     });
 
     // -----------------------------------------------------------------------
-    // POST /forms — create new form
+    // POST /forms - create new form
     // -----------------------------------------------------------------------
     fastify.post('/forms', canCreate, async (request, reply) => {
         const { title, slug: rawSlug } = request.body || {};
@@ -280,7 +280,7 @@ export async function formsRoutes(fastify) {
             await readForm(slug);
             return reply.status(409).send({ error: `A form with slug "${slug}" already exists.` });
         } catch {
-            // Does not exist — good
+            // Does not exist - good
         }
 
         const now  = new Date().toISOString();
@@ -333,7 +333,7 @@ export async function formsRoutes(fastify) {
     });
 
     // -----------------------------------------------------------------------
-    // GET /forms/:slug — get single form (admin, includes actions)
+    // GET /forms/:slug - get single form (admin, includes actions)
     // -----------------------------------------------------------------------
     fastify.get('/forms/:slug', canRead, async (request, reply) => {
         let form;
@@ -350,7 +350,7 @@ export async function formsRoutes(fastify) {
     });
 
     // -----------------------------------------------------------------------
-    // GET /forms/:slug/public — get form for public rendering (no actions)
+    // GET /forms/:slug/public - get form for public rendering (no actions)
     // -----------------------------------------------------------------------
     fastify.get('/forms/:slug/public', async (request, reply) => {
         try {
@@ -363,7 +363,7 @@ export async function formsRoutes(fastify) {
     });
 
     // -----------------------------------------------------------------------
-    // PUT /forms/:slug — update form definition
+    // PUT /forms/:slug - update form definition
     // -----------------------------------------------------------------------
     fastify.put('/forms/:slug', canUpdate, async (request, reply) => {
         const { slug } = request.params;
@@ -386,14 +386,14 @@ export async function formsRoutes(fastify) {
 
         // Non-blocking warnings: check the form's fields against its target
         // collection's required fields. Missing-required-on-form would cause
-        // every submission to fail server-side validation — admin gets a
+        // every submission to fail server-side validation - admin gets a
         // heads-up here so they can fix it BEFORE users hit silent rejection.
         const warnings = await detectFormCollectionMismatch(updated);
         return warnings.length ? { ...updated, warnings } : updated;
     });
 
     // -----------------------------------------------------------------------
-    // DELETE /forms/:slug — delete form
+    // DELETE /forms/:slug - delete form
     // -----------------------------------------------------------------------
     fastify.delete('/forms/:slug', canDelete, async (request, reply) => {
         const { slug } = request.params;
@@ -406,7 +406,7 @@ export async function formsRoutes(fastify) {
     });
 
     // -----------------------------------------------------------------------
-    // GET /forms/:slug/submissions — list submissions from collection
+    // GET /forms/:slug/submissions - list submissions from collection
     // -----------------------------------------------------------------------
     fastify.get('/forms/:slug/submissions', canRead, async (request, reply) => {
         const { slug } = request.params;
@@ -420,19 +420,19 @@ export async function formsRoutes(fastify) {
         const targetSlug = (collectionAction?.enabled && collectionAction.slug) ? collectionAction.slug : slug;
 
         // A form whose backing collection has not been provisioned yet simply
-        // has no submissions — return an empty list rather than a 404 so the
+        // has no submissions - return an empty list rather than a 404 so the
         // admin view loads cleanly instead of erroring.
         const collection = await getCollection(targetSlug);
         if (!collection) return [];
 
-        // listEntries returns { entries, total, page, limit } — unwrap to the
+        // listEntries returns { entries, total, page, limit } - unwrap to the
         // array. Newest-first is the conventional display order.
         const { entries } = await listEntries(targetSlug, { limit: 0 });
         return [...entries].reverse();
     });
 
     // -----------------------------------------------------------------------
-    // GET /forms/:slug/submissions/export — CSV download from collection
+    // GET /forms/:slug/submissions/export - CSV download from collection
     // -----------------------------------------------------------------------
     fastify.get('/forms/:slug/submissions/export', canRead, async (request, reply) => {
         const { slug } = request.params;
@@ -456,7 +456,7 @@ export async function formsRoutes(fastify) {
     });
 
     // -----------------------------------------------------------------------
-    // GET /forms/:slug/submissions/export/json — JSON export from collection
+    // GET /forms/:slug/submissions/export/json - JSON export from collection
     // -----------------------------------------------------------------------
     fastify.get('/forms/:slug/submissions/export/json', canRead, async (request, reply) => {
         const { slug } = request.params;
@@ -479,7 +479,7 @@ export async function formsRoutes(fastify) {
     });
 
     // -----------------------------------------------------------------------
-    // DELETE /forms/:slug/submissions — clear all submissions
+    // DELETE /forms/:slug/submissions - clear all submissions
     // -----------------------------------------------------------------------
     fastify.delete('/forms/:slug/submissions', canDelete, async (request, reply) => {
         const { slug } = request.params;
@@ -492,7 +492,7 @@ export async function formsRoutes(fastify) {
     });
 
     // -----------------------------------------------------------------------
-    // DELETE /forms/:slug/submissions/:id — delete one submission
+    // DELETE /forms/:slug/submissions/:id - delete one submission
     // -----------------------------------------------------------------------
     fastify.delete('/forms/:slug/submissions/:id', canDelete, async (request, reply) => {
         const { slug, id } = request.params;
@@ -505,12 +505,12 @@ export async function formsRoutes(fastify) {
     });
 
     /*
-     * POST /forms/submit/:slug — public form submission.
+     * POST /forms/submit/:slug - public form submission.
      *
      * Authentication is OPTIONAL: when a valid JWT is present the submitter
      * is captured as the entry's `createdBy` and passed into any triggered
      * action's template context (as `{{user.id}}`, `{{user.email}}`, etc.).
-     * Anonymous submissions still work — `createdBy` is null and actions
+     * Anonymous submissions still work - `createdBy` is null and actions
      * receive an empty user. This is what makes the apply/bookmark patterns
      * work without forcing every form to be auth-only:
      *
@@ -527,7 +527,7 @@ export async function formsRoutes(fastify) {
             return reply.status(404).send({ error: 'Form not found.' });
         }
 
-        // Multipart parsing — when the request is multipart (file uploads),
+        // Multipart parsing - when the request is multipart (file uploads),
         // we walk parts ourselves: text fields go into `body`, file parts are
         // validated against the form's field config and saved to /content/media,
         // then their { url, name, size, mime } reference object lands in `body`
@@ -542,7 +542,7 @@ export async function formsRoutes(fastify) {
         }
         const settings = form.settings || {};
 
-        // Best-effort auth — never reject, just enrich.
+        // Best-effort auth - never reject, just enrich.
         let submittingUser = null;
         try {
             const decoded = await request.jwtVerify();
@@ -556,12 +556,12 @@ export async function formsRoutes(fastify) {
             }
         } catch { /* anonymous submission */ }
 
-        // Honeypot check — silently accept if filled (bot detected)
+        // Honeypot check - silently accept if filled (bot detected)
         if (settings.honeypot && body._hp) {
             return { ok: true, message: settings.successMessage, redirect: settings.successRedirect || null };
         }
 
-        // Timing check — silently accept if submitted too fast (< 2 s, likely a bot)
+        // Timing check - silently accept if submitted too fast (< 2 s, likely a bot)
         if (settings.honeypot && body._t) {
             const elapsed = Date.now() - Number(body._t);
             if (!Number.isNaN(elapsed) && elapsed < 2000) {
@@ -614,7 +614,7 @@ export async function formsRoutes(fastify) {
             return reply.status(429).send({ error: 'Too many submissions. Please try again later.' });
         }
 
-        // Build submission data — only include visible fields
+        // Build submission data - only include visible fields
         const data = {};
         for (const field of form.fields || []) {
             if (field.type === 'page-break' || field.type === 'spacer') continue;
@@ -630,9 +630,9 @@ export async function formsRoutes(fastify) {
         // CRITICAL: collection write failure is the difference between "your
         // submission was saved" and "your submission disappeared into thin air".
         // We MUST surface the error to the user rather than logging a warning
-        // and returning success — anything else is a silent-data-loss bug.
+        // and returning success - anything else is a silent-data-loss bug.
         // (Email / webhook / action failures downstream are still treated as
-        // non-fatal — they fire AFTER the entry is persisted, so even a partial
+        // non-fatal - they fire AFTER the entry is persisted, so even a partial
         // delivery has the original submission safely stored.)
         const collectionAction = form.actions?.collection;
         const targetSlug = (collectionAction?.enabled && collectionAction.slug) ? collectionAction.slug : slug;
@@ -653,12 +653,12 @@ export async function formsRoutes(fastify) {
                     createdBy: submittingUser?.id || null
                 });
             } else {
-                // Could not resolve or provision a target — e.g. collection
+                // Could not resolve or provision a target - e.g. collection
                 // storage is explicitly disabled with no slug. Fail loudly
                 // rather than silently lose submissions.
                 fastify.log.warn(`[forms] Submission for "${slug}" had no target collection "${targetSlug}"`);
                 return reply.status(500).send({
-                    error: `Submission not saved — target collection "${targetSlug}" does not exist. Please contact the site administrator.`
+                    error: `Submission not saved - target collection "${targetSlug}" does not exist. Please contact the site administrator.`
                 });
             }
         } catch (err) {
@@ -706,7 +706,7 @@ export async function formsRoutes(fastify) {
             }
         }
 
-        // CMS Action trigger — forwards the authenticated submitter so
+        // CMS Action trigger - forwards the authenticated submitter so
         // action steps can interpolate {{user.id}}, {{user.email}}, etc.
         // (Anonymous submissions still trigger the action with user={}.)
         const actionSlug = form.settings?.actionSlug;
@@ -735,7 +735,7 @@ export async function formsRoutes(fastify) {
     });
 
     // -----------------------------------------------------------------------
-    // POST /forms/test-email — send a test email
+    // POST /forms/test-email - send a test email
     // -----------------------------------------------------------------------
     fastify.post('/forms/test-email', { preHandler: [authenticate, requireAdmin] }, async (request, reply) => {
         const smtp = getConfig('site').smtp || {};

package/server/routes/api/menu-locations.js

@@ -1,9 +1,9 @@
 /**
  * Menu locations API
  *
- * GET /api/menu-locations           — current slot → menu-slug map
- * PUT /api/menu-locations           — replace the map (validates against registry + menus)
- * GET /api/menu-locations/registry  — list registered slots (core + plugin-contributed)
+ * GET /api/menu-locations           - current slot → menu-slug map
+ * PUT /api/menu-locations           - replace the map (validates against registry + menus)
+ * GET /api/menu-locations/registry  - list registered slots (core + plugin-contributed)
  *
  * Auth middlewares are accepted as options so tests can supply no-ops without
  * needing to register `@fastify/jwt` + seed the roles cache. In production the

package/server/routes/api/menus.js

@@ -1,12 +1,12 @@
 /**
  * Menus API
  *
- * GET    /api/menus                  — list (metadata only)
- * GET    /api/menus/:slug            — full menu
- * POST   /api/menus                  — create
- * PUT    /api/menus/:slug            — replace
- * DELETE /api/menus/:slug            — delete (409 if mapped to a slot)
- * POST   /api/menus/:slug/duplicate  — copy as <slug>-copy
+ * GET    /api/menus                  - list (metadata only)
+ * GET    /api/menus/:slug            - full menu
+ * POST   /api/menus                  - create
+ * PUT    /api/menus/:slug            - replace
+ * DELETE /api/menus/:slug            - delete (409 if mapped to a slot)
+ * POST   /api/menus/:slug/duplicate  - copy as <slug>-copy
  *
  * Auth middlewares are accepted as options so tests can supply no-ops without
  * needing to register `@fastify/jwt` + seed the roles cache. In production the
@@ -93,7 +93,7 @@ export async function menusRoutes(fastify, opts = {}) {
         const slot = Object.entries(map).find(([, slug]) => slug === request.params.slug)?.[0];
         if (slot) {
             return reply.status(409).send({
-                error: `Cannot delete — menu is mapped to slot "${slot}". Unmap it first.`
+                error: `Cannot delete - menu is mapped to slot "${slot}". Unmap it first.`
             });
         }
         const ok = await deleteMenu(request.params.slug);

package/server/routes/api/notifications.js

@@ -83,7 +83,7 @@ export async function notificationsRoutes(fastify) {
             }));
     });
 
-    // --- Unread count (lightweight — for bell badge) ---
+    // --- Unread count (lightweight - for bell badge) ---
     fastify.get('/system/notifications/unread-count', canRead, async (request) => {
         const userId = request.user.id;
         const now = new Date().toISOString();
@@ -110,7 +110,7 @@ export async function notificationsRoutes(fastify) {
         if (!entry) return reply.code(404).send({ error: 'Notification not found.' });
 
         const readBy = Array.isArray(entry.data.readBy) ? entry.data.readBy : [];
-        if (readBy.includes(userId)) return { ok: true }; // already read — idempotent
+        if (readBy.includes(userId)) return { ok: true }; // already read - idempotent
 
         const updated = await adapter.update(SLUG, id, {
             ...entry.data,

package/server/routes/api/pages.js

@@ -26,7 +26,7 @@ export async function pagesRoutes(fastify) {
     return {html};
   });
 
-    // Aggregate unique tags from all pages — must be registered before the wildcard /pages/* route
+    // Aggregate unique tags from all pages - must be registered before the wildcard /pages/* route
     fastify.get('/pages/tags', canRead, async (request, reply) => {
         const pages = await listPages();
         const tagSet = new Set();
@@ -72,8 +72,20 @@ export async function pagesRoutes(fastify) {
         const { urlPath, frontmatter, body } = request.body;
         if (!urlPath) return reply.status(400).send({ error: 'urlPath is required' });
 
+        // Name the project in the conflict. A page filed under a project the
+        // admin isn't currently browsing is absent from the filtered list, so
+        // a bare "already exists" reads as a phantom.
         const existing = await getPage(urlPath);
-        if (existing) return reply.status(409).send({ error: 'Page already exists at that path' });
+        if (existing) {
+            const {getProjectForPage} = await import('../../services/projects.js');
+            const project = await getProjectForPage(urlPath, existing.project);
+            return reply.status(409).send({
+                error: `A page already exists at ${urlPath}`
+                    + (project ? ` (project: ${project})` : ''),
+                urlPath,
+                project: project || null
+            });
+        }
 
         const page = await createPage(urlPath, frontmatter || {}, body || '');
         return reply.status(201).send(page);

package/server/routes/api/plugin-marketplace.js

@@ -1,8 +1,8 @@
 /**
  * Plugin Marketplace API
- * GET    /api/plugins/marketplace         — fetch catalogue from manager (requires MANAGER_URL)
- * POST   /api/plugins/marketplace/install — download + install a plugin bundle
- * DELETE /api/plugins/marketplace/:slug   — uninstall an installed plugin
+ * GET    /api/plugins/marketplace         - fetch catalogue from manager (requires MANAGER_URL)
+ * POST   /api/plugins/marketplace/install - download + install a plugin bundle
+ * DELETE /api/plugins/marketplace/:slug   - uninstall an installed plugin
  *
  * All routes require authentication + admin role.
  */

package/server/routes/api/plugins.js

@@ -24,7 +24,7 @@ import {getConfig} from '../../config.js';
  * True when something will bring the process back after a clean exit.
  *
  * Two supervisors matter in practice: pm2 (sets `pm_id` / `PM2_HOME`) and the
- * fleet manager, which forks each site with an IPC channel — hence
+ * fleet manager, which forks each site with an IPC channel - hence
  * `process.send`. A bare `node server/server.js` has neither, and exiting there
  * would leave the site down for good, so restarts are refused.
  *
@@ -35,7 +35,7 @@ export function hasSupervisor() {
 }
 
 // One pending restart at a time. An admin flipping four plugins in a row should
-// cost one restart, not four — each toggle pushes the timer out instead of
+// cost one restart, not four - each toggle pushes the timer out instead of
 // stacking exits.
 let _restartTimer = null;
 
@@ -43,7 +43,7 @@ let _restartTimer = null;
  * Exit cleanly so the supervisor restarts us on the new plugin set. Debounced,
  * and long enough after the reply for it to reach the browser.
  *
- * The timer is unref'd so it can never be the thing keeping the process alive —
+ * The timer is unref'd so it can never be the thing keeping the process alive -
  * in production the listening socket does that.
  *
  * @param {Function} exit      How to exit; injectable so tests don't take the runner down
@@ -98,7 +98,7 @@ export async function pluginsRoutes(fastify, opts = {}) {
 
     // Scaffold a new plugin from plugins/_template. The plugin is created
     // pre-enabled so it goes live on the next server restart (its routes and
-    // admin views only register at boot — same restart rule as enable/disable).
+    // admin views only register at boot - same restart rule as enable/disable).
     fastify.post('/plugins/scaffold', canCreate, async (request, reply) => {
         const {slug, displayName, description, author, icon} = request.body || {};
         try {
@@ -134,7 +134,7 @@ export async function pluginsRoutes(fastify, opts = {}) {
 
         // A plugin's routes, hooks and admin views only register at boot, so a
         // toggle does nothing until the process restarts. Do it for the admin
-        // rather than leaving a "restart to apply" note they have to action —
+        // rather than leaving a "restart to apply" note they have to action -
         // but only where a supervisor will bring the process back, and only
         // when the enabled flag actually changed (a settings-only save must not
         // bounce the site).
@@ -154,7 +154,7 @@ export async function pluginsRoutes(fastify, opts = {}) {
         return getAdminPluginConfig();
     });
 
-    // ── In-admin code editor (plugins.develop — code execution grade) ──────
+    // ── In-admin code editor (plugins.develop - code execution grade) ──────
 
     const mapErr = (reply, err) => reply.status(err.statusCode || 500).send({ error: err.message });
 

package/server/routes/api/projects.js

@@ -1,13 +1,13 @@
 /**
  * Projects API
  *
- * GET    /api/projects                       — list visible projects
- * GET    /api/projects/:slug                 — full project
- * POST   /api/projects                       — create
- * PUT    /api/projects/:slug                 — edit (slug immutable)
- * DELETE /api/projects/:slug                 — delete (403 for core; 409 if any artefacts tagged)
- * GET    /api/projects/:slug/artefacts       — grouped artefacts
- * POST   /api/projects/:slug/untag-all       — escape hatch before delete (403 for core)
+ * GET    /api/projects                       - list visible projects
+ * GET    /api/projects/:slug                 - full project
+ * POST   /api/projects                       - create
+ * PUT    /api/projects/:slug                 - edit (slug immutable)
+ * DELETE /api/projects/:slug                 - delete (403 for core; 409 if any artefacts tagged)
+ * GET    /api/projects/:slug/artefacts       - grouped artefacts
+ * POST   /api/projects/:slug/untag-all       - escape hatch before delete (403 for core)
  *
  * Auth middlewares are accepted as DI options so tests can supply no-ops.
  */
@@ -88,7 +88,7 @@ export async function projectsRoutes(fastify, opts = {}) {
         const total = Object.values(grouped).reduce((sum, arr) => sum + arr.length, 0);
         if (total > 0) {
             return reply.status(409).send({
-                error: `Cannot delete — ${total} artefacts still tagged with this project`,
+                error: `Cannot delete - ${total} artefacts still tagged with this project`,
                 artefacts: Object.fromEntries(Object.entries(grouped).map(([k, v]) => [k, v.length]))
             });
         }
@@ -107,7 +107,7 @@ export async function projectsRoutes(fastify, opts = {}) {
 
     fastify.post('/projects/:slug/untag-all', canDelete, async (request, reply) => {
         if (request.params.slug === CORE_PROJECT_SLUG) {
-            return reply.status(403).send({error: 'Cannot untag the core project — artefacts would immediately resolve back to it'});
+            return reply.status(403).send({error: 'Cannot untag the core project - artefacts would immediately resolve back to it'});
         }
         const target = await getProject(request.params.slug);
         if (target?.protected === true) {

package/server/routes/api/scaffold.js

@@ -1,15 +1,15 @@
 /**
- * Scaffold API — list bundled recipes and apply one to create a working CRUD
+ * Scaffold API - list bundled recipes and apply one to create a working CRUD
  * system (Collection + Form + Actions) in a single call.
  *
- * Admin-only — these endpoints can create resources, so they require the same
+ * Admin-only - these endpoints can create resources, so they require the same
  * permission tier as collection/form management. The `apply` endpoint is
  * non-atomic across recipe pieces but returns a clear summary of what was
  * created vs. skipped so the caller can clean up if needed.
  *
  * Endpoints:
- *   GET  /api/scaffold/recipes          — list bundled recipes (name, description, options)
- *   POST /api/scaffold/apply            — apply one recipe with caller-provided option overrides
+ *   GET  /api/scaffold/recipes          - list bundled recipes (name, description, options)
+ *   POST /api/scaffold/apply            - apply one recipe with caller-provided option overrides
  */
 import {applyRecipe, getRecipe, listRecipes} from '../../services/scaffolder.js';
 import {authenticate, requirePermission} from '../../middleware/auth.js';
@@ -17,7 +17,7 @@ import {authenticate, requirePermission} from '../../middleware/auth.js';
 export async function scaffoldRoutes(fastify) {
     // Scaffolding creates collections + forms + actions, so we require both
     // collections.create and forms.create permissions. The cheap check is to
-    // gate on collections.create — anyone with that should already be a
+    // gate on collections.create - anyone with that should already be a
     // privileged role; we add forms.create on top as a belt-and-braces.
     const canScaffold = {preHandler: [authenticate, requirePermission('collections', 'create')]};
 
@@ -38,7 +38,7 @@ export async function scaffoldRoutes(fastify) {
     /*
      * GET /api/scaffold/recipes/:slug
      *
-     * Returns the full recipe document — useful for a preview view that wants
+     * Returns the full recipe document - useful for a preview view that wants
      * to show the user exactly what will be created before they click Apply.
      */
     fastify.get('/scaffold/recipes/:slug', canScaffold, async (request, reply) => {
@@ -61,7 +61,7 @@ export async function scaffoldRoutes(fastify) {
      *   { created: {collection, form, actions: [...]}, skipped: [...], warnings: [...], snippet: string|null }
      *
      * The `snippet` is a Markdown fragment the caller can insert at the
-     * cursor position in the page editor — typically the [form] + [collection]
+     * cursor position in the page editor - typically the [form] + [collection]
      * combination needed to see the new system on a page immediately.
      */
     fastify.post('/scaffold/apply', canScaffold, async (request, reply) => {

package/server/routes/api/settings.js

@@ -41,7 +41,7 @@ export async function settingsRoutes(fastify) {
             'smtp', 'footer', 'analytics', 'social', 'locale',
             'layoutOptions', 'seo', 'backToTop', 'cookieConsent', 'breadcrumbs', 'autoTheme',
             'adminBrand',
-            // Keys that legitimately live in site.json (written elsewhere — e.g.
+            // Keys that legitimately live in site.json (written elsewhere - e.g.
             // `brand` by the menus migration) and are echoed back by GET /settings.
             // They must be accepted here or any client that round-trips the GET
             // payload into a save gets a 400 for keys it never touched.
@@ -80,7 +80,7 @@ export async function settingsRoutes(fastify) {
             return reply.status(400).send({ error: 'SMTP is not configured. Save your SMTP settings first.' });
         }
 
-        // Shared transport factory — carries the self-signed-cert TLS relaxation.
+        // Shared transport factory - carries the self-signed-cert TLS relaxation.
         // Do NOT build a raw nodemailer transport here; that regresses on engine sync.
         const transporter = await createTransport(smtp);
 
@@ -93,7 +93,7 @@ export async function settingsRoutes(fastify) {
             await transporter.sendMail({
                 from:    smtp.fromName ? `"${smtp.fromName}" <${smtp.fromAddress}>` : smtp.fromAddress,
                 to,
-                subject: 'Domma CMS — Test Email',
+                subject: 'Domma CMS - Test Email',
                 text:    'This is a test email sent from Domma CMS to verify your SMTP configuration.',
                 html:    '<p>This is a test email sent from <strong>Domma CMS</strong> to verify your SMTP configuration.</p>'
             });
@@ -103,7 +103,7 @@ export async function settingsRoutes(fastify) {
         }
     });
 
-    // GET /api/settings/db-status — returns whether MongoDB connections are configured
+    // GET /api/settings/db-status - returns whether MongoDB connections are configured
     fastify.get('/settings/db-status', canRead, async () => {
         try {
             const raw = await fs.readFile(CONNECTIONS_FILE, 'utf8');
@@ -117,7 +117,7 @@ export async function settingsRoutes(fastify) {
         }
     });
 
-    // GET /api/settings/custom-css — return current CSS as JSON
+    // GET /api/settings/custom-css - return current CSS as JSON
     fastify.get('/settings/custom-css', canUpdate, async () => {
         try {
             const css = await fs.readFile(CUSTOM_CSS_FILE, 'utf8');
@@ -127,7 +127,7 @@ export async function settingsRoutes(fastify) {
         }
     });
 
-    // PUT /api/settings/custom-css — save CSS to content/custom.css
+    // PUT /api/settings/custom-css - save CSS to content/custom.css
     fastify.put('/settings/custom-css', canUpdate, async (request, reply) => {
         const { css } = request.body || {};
         if (typeof css !== 'string') {

package/server/routes/api/sidebar.js

@@ -1,7 +1,7 @@
 /**
  * Admin sidebar API
  *
- * GET /api/sidebar/registered-items — plugin-registered sidebar items
+ * GET /api/sidebar/registered-items - plugin-registered sidebar items
  *
  * Auth middlewares are accepted as DI options so tests can supply no-ops.
  */