domma-cms 0.43.1 → 0.45.0

package/server/services/scaffolder.js

@@ -1,5 +1,5 @@
 /**
- * Scaffolder — one-shot creator for a working CRUD system from a recipe.
+ * Scaffolder - one-shot creator for a working CRUD system from a recipe.
  *
  * A "recipe" is a JSON file under `server/services/recipes/` that describes:
  *   - one Collection (schema + initial api access rules)
@@ -14,7 +14,7 @@
  * and template variable.
  *
  * Atomicity: pre-flight check refuses to start if ANY target slug already
- * exists — keeps the user out of a partial-create state. If pre-flight passes
+ * exists - keeps the user out of a partial-create state. If pre-flight passes
  * we apply collection → form → actions in order. Action creation requires
  * MongoDB (Pro feature); when not configured we still complete the
  * collection + form and report actions as skipped with a warning.
@@ -64,7 +64,7 @@ export async function listRecipes() {
                 options:     r.options || []
             });
         } catch {
-            /* skip malformed recipe — don't break the listing */
+            /* skip malformed recipe - don't break the listing */
         }
     }
     return recipes;
@@ -101,7 +101,7 @@ function substituteTokens(value, tokens) {
     if (typeof value === 'string') {
         return value.replace(/\{\{\s*([A-Za-z0-9_]+)\s*\}\}/g, (_m, key) => {
             // Leave action template variables (entry.*, user.*, now, env.*) untouched
-            // — those are resolved at action execution time, not at scaffold time.
+            // - those are resolved at action execution time, not at scaffold time.
             if (key.includes('.') || key === 'now') return _m;
             if (key === 'entry' || key === 'user' || key === 'env') return _m;
             return tokens[key] != null ? String(tokens[key]) : _m;
@@ -117,18 +117,18 @@ function substituteTokens(value, tokens) {
 }
 
 /**
- * Resolve effective options for a recipe — recipe defaults merged with caller
+ * Resolve effective options for a recipe - recipe defaults merged with caller
  * overrides, with non-empty user values winning. Returns a plain `{ name: value }`
  * map suitable to pass to `substituteTokens`.
  *
  * **Default-chaining**: an option's `default` may template-reference earlier
- * options via `{{otherOption}}`. This is the "namespacing" affordance — set
+ * options via `{{otherOption}}`. This is the "namespacing" affordance - set
  * one `namespace` option and let `collectionSlug`, `formSlug`, `actionPrefix`
  * default to `{{namespace}}`, `{{namespace}}-form`, `{{namespace}}` etc. The
  * recipe author chooses which options participate; users can still override
  * any individual option to break the chain.
  *
- * Resolution is left-to-right over the options array — so the option being
+ * Resolution is left-to-right over the options array - so the option being
  * referenced MUST appear earlier in the array than the option that references
  * it. (If forward references become a recurring need we can topologically
  * sort, but the explicit-order rule keeps recipe files readable.)
@@ -160,7 +160,7 @@ function resolveOptions(recipe, userOverrides = {}) {
  * Check whether anything the recipe wants to create already exists. Returns a
  * list of human-readable conflict descriptions; empty array means clear.
  *
- * Action conflict checks are skipped silently when MongoDB isn't configured —
+ * Action conflict checks are skipped silently when MongoDB isn't configured -
  * the apply phase will degrade those into warnings rather than blocking.
  *
  * @param {object} resolvedRecipe
@@ -188,12 +188,12 @@ async function preflight(resolvedRecipe) {
             const existing = await getAction(action.slug);
             if (existing) conflicts.push(`Action "${action.slug}" already exists`);
         } catch {
-            // Mongo unavailable — treat as not-conflicting; the apply step
+            // Mongo unavailable - treat as not-conflicting; the apply step
             // will report actions as skipped instead.
         }
     }
 
-    // Roles + users are NOT treated as pre-flight conflicts — they're a
+    // Roles + users are NOT treated as pre-flight conflicts - they're a
     // looser kind of resource that frequently already exists (re-running a
     // recipe, admin-created role, etc.) and where overwriting would lose
     // data the user cares about (existing role's permissions tweaks, user's
@@ -247,7 +247,7 @@ export async function applyRecipe(recipeSlug, opts = {}) {
         }
     }
 
-    // Project — auto-create if the recipe declares one and it doesn't exist.
+    // Project - auto-create if the recipe declares one and it doesn't exist.
     // Uses the recipe's `namespace` token as the project slug, so a single user
     // choice ties together every artefact's `meta.project` tag below.
     let projectSlug = null;
@@ -273,7 +273,7 @@ export async function applyRecipe(recipeSlug, opts = {}) {
 
     const conflicts = await preflight(resolved);
     if (conflicts.length) {
-        const err = new Error(`Cannot apply recipe — conflicts:\n  - ${conflicts.join('\n  - ')}`);
+        const err = new Error(`Cannot apply recipe - conflicts:\n  - ${conflicts.join('\n  - ')}`);
         err.statusCode = 409;
         err.conflicts  = conflicts;
         throw err;
@@ -283,16 +283,16 @@ export async function applyRecipe(recipeSlug, opts = {}) {
     const skipped  = [];
     const warnings = [];
 
-    // 0. Roles — create FIRST so subsequent actions can reference them by name.
+    // 0. Roles - create FIRST so subsequent actions can reference them by name.
     // If a role with the same name already exists (re-run, admin-created),
-    // we skip silently rather than failing — the role's existence is what
+    // we skip silently rather than failing - the role's existence is what
     // matters for the actions that reference it, not who created it.
     const existingRoles = getRoleMap();
     for (const role of (resolved.roles || [])) {
         if (!role.name) continue;
         if (existingRoles.has(role.name)) {
             skipped.push(`role:${role.name}`);
-            warnings.push(`Role "${role.name}" already exists — using existing definition (recipe-defined permissions not applied)`);
+            warnings.push(`Role "${role.name}" already exists - using existing definition (recipe-defined permissions not applied)`);
             continue;
         }
         try {
@@ -310,7 +310,7 @@ export async function applyRecipe(recipeSlug, opts = {}) {
         }
     }
 
-    // 0b. Menus — write each declared menu and, if requested, map it to a slot.
+    // 0b. Menus - write each declared menu and, if requested, map it to a slot.
     for (const menu of (resolved.menus || [])) {
         if (!menu.slug) continue;
         try {
@@ -331,7 +331,7 @@ export async function applyRecipe(recipeSlug, opts = {}) {
                 let touched = false;
                 for (const slot of menu.locations) {
                     if (map[slot] && map[slot] !== menu.slug && !menu.force) {
-                        warnings.push(`Slot "${slot}" already mapped to "${map[slot]}" — left unchanged (set force:true to overwrite)`);
+                        warnings.push(`Slot "${slot}" already mapped to "${map[slot]}" - left unchanged (set force:true to overwrite)`);
                         continue;
                     }
                     map[slot] = menu.slug;
@@ -358,11 +358,11 @@ export async function applyRecipe(recipeSlug, opts = {}) {
             api:         resolved.collection.api,
             // rowAccess is a top-level schema field; createCollection accepts arbitrary keys via spread,
             // but to be explicit we set it on the schema after create. Simpler: write it via the schema
-            // file directly — createCollection already writes the schema, so we re-read + patch + write.
+            // file directly - createCollection already writes the schema, so we re-read + patch + write.
             ...(projectSlug && {meta: {project: projectSlug}})
         });
 
-        // Patch in rowAccess (if any) — collections.createCollection doesn't take it directly
+        // Patch in rowAccess (if any) - collections.createCollection doesn't take it directly
         if (resolved.collection.rowAccess) {
             const {getCollection: get, updateCollection} = await import('./collections.js');
             const cur = await get(tokens.collectionSlug);
@@ -386,7 +386,7 @@ export async function applyRecipe(recipeSlug, opts = {}) {
         created.form = tokens.formSlug;
     }
 
-    // 2b. Users — recipe-defined seed accounts. Password is mandatory (the
+    // 2b. Users - recipe-defined seed accounts. Password is mandatory (the
     // scaffolder won't invent one); if omitted, the user is reported as
     // skipped so the admin knows to create them manually. Auto-creating
     // accounts with a default password would be a meaningful security trap.
@@ -398,14 +398,14 @@ export async function applyRecipe(recipeSlug, opts = {}) {
             const existing = await getUserByEmail(u.email);
             if (existing) {
                 skipped.push(`user:${u.email}`);
-                warnings.push(`User "${u.email}" already exists — left unchanged`);
+                warnings.push(`User "${u.email}" already exists - left unchanged`);
                 continue;
             }
         } catch { /* no-op */ }
 
         if (!u.password) {
             skipped.push(`user:${u.email}`);
-            warnings.push(`User "${u.email}" skipped — no password set in recipe. Create the account manually under Users → New.`);
+            warnings.push(`User "${u.email}" skipped - no password set in recipe. Create the account manually under Users → New.`);
             continue;
         }
         try {
@@ -423,7 +423,7 @@ export async function applyRecipe(recipeSlug, opts = {}) {
         }
     }
 
-    // 3. Actions — best-effort; skip with warning when Mongo isn't available
+    // 3. Actions - best-effort; skip with warning when Mongo isn't available
     for (const action of (resolved.actions || [])) {
         if (!action.slug) continue;
         try {
@@ -441,7 +441,7 @@ export async function applyRecipe(recipeSlug, opts = {}) {
             created.actions.push(a.slug);
         } catch (err) {
             const reason = err.message.includes('MongoDB') || err.message.includes('Mongo')
-                ? `MongoDB not configured — action "${action.slug}" skipped (Pro feature)`
+                ? `MongoDB not configured - action "${action.slug}" skipped (Pro feature)`
                 : `Action "${action.slug}" failed: ${err.message}`;
             skipped.push(action.slug);
             warnings.push(reason);
@@ -449,17 +449,17 @@ export async function applyRecipe(recipeSlug, opts = {}) {
     }
 
     // Wire the form's actionSlug to the first created action if the recipe
-    // wanted it — convenient for "submit this form, fire that action" patterns.
+    // wanted it - convenient for "submit this form, fire that action" patterns.
     if (created.form && created.actions.length && resolved.form?.settings?.actionSlug === '') {
         try {
             const formDef = await readForm(created.form);
             formDef.settings = formDef.settings || {};
             formDef.settings.actionSlug = created.actions[0];
             await writeForm(created.form, formDef);
-        } catch { /* non-fatal — admin can wire it manually */ }
+        } catch { /* non-fatal - admin can wire it manually */ }
     }
 
-    // API tokens — generated at apply time; the plaintext rides ONCE in
+    // API tokens - generated at apply time; the plaintext rides ONCE in
     // `created.apiTokens[].token` (only a hash is stored). Idempotent:
     // re-applying never re-issues an existing name+project token, so the
     // credential the user already deployed survives recipe re-runs.
@@ -471,7 +471,7 @@ export async function applyRecipe(recipeSlug, opts = {}) {
             if (!t.name) continue;
             if (await findTokenByName(t.name, tokenProject)) {
                 skipped.push(`apiToken:${t.name}`);
-                warnings.push(`API token "${t.name}" already exists for project "${tokenProject}" — left unchanged (token value NOT re-issued)`);
+                warnings.push(`API token "${t.name}" already exists for project "${tokenProject}" - left unchanged (token value NOT re-issued)`);
                 continue;
             }
             try {
@@ -489,7 +489,7 @@ export async function applyRecipe(recipeSlug, opts = {}) {
         }
     }
 
-    // Custom API endpoints — declared as definition objects (path, collection,
+    // Custom API endpoints - declared as definition objects (path, collection,
     // filter, ...). Idempotent: an existing (project, path-shape) match is
     // skipped so re-applying a recipe never clobbers a tuned definition.
     const endpointDecls = resolved.apiEndpoints ? [].concat(resolved.apiEndpoints) : [];
@@ -500,7 +500,7 @@ export async function applyRecipe(recipeSlug, opts = {}) {
             if (!ep.path) continue;
             if (await findEndpointByPath(epProject, ep.path)) {
                 skipped.push(`apiEndpoint:${ep.path}`);
-                warnings.push(`API endpoint "${ep.path}" already exists for project "${epProject}" — left unchanged`);
+                warnings.push(`API endpoint "${ep.path}" already exists for project "${epProject}" - left unchanged`);
                 continue;
             }
             try {

package/server/services/sidebar-migration.js

@@ -1,7 +1,7 @@
 /**
  * Admin sidebar auto-migration.
  *
- * Runs once on server boot. Idempotent — guarded by the existence of
+ * Runs once on server boot. Idempotent - guarded by the existence of
  * config/menus/admin-sidebar.json. Seeds the admin sidebar menu with the
  * standard tree (Overview, Projects, Content, Data, System, Documentation)
  * and patches config/menu-locations.json to map the `admin-sidebar` slot.
@@ -148,7 +148,7 @@ async function readJson(p) {
 
 async function writeJson(p, data) {
     await fs.writeFile(p, JSON.stringify(data, null, 2) + '\n', 'utf8');
-    // Menu files written outside the menus service — drop its cached index so
+    // Menu files written outside the menus service - drop its cached index so
     // binding resolution sees the seeded sidebar menu.
     invalidateMenuIndex();
 }
@@ -180,7 +180,7 @@ export async function runMigration(opts = {}) {
 
     let locations = {};
     if (await exists(locPath)) {
-        try { locations = await readJson(locPath); } catch { /* malformed — start fresh */ }
+        try { locations = await readJson(locPath); } catch { /* malformed - start fresh */ }
     }
     locations['admin-sidebar'] = 'admin-sidebar';
     await writeJson(locPath, locations);
@@ -193,8 +193,8 @@ export async function runMigration(opts = {}) {
  * Append-if-absent: ensure a single item exists in the persisted admin
  * sidebar menu. Lets updates surface new admin pages on EXISTING installs
  * (the seed above only reaches fresh ones) without clobbering admin edits:
- * if any node in the tree already has the item's url — even moved, renamed,
- * or hidden — this is a no-op.
+ * if any node in the tree already has the item's url - even moved, renamed,
+ * or hidden - this is a no-op.
  *
  * Returns `{ensured: boolean, reason?: string}`.
  *
@@ -237,13 +237,13 @@ export async function ensureSidebarItem({groupText, item}, opts = {}) {
  * per-topic submenus. Idempotent and non-clobbering:
  *
  *  - If the persisted menu has no "Documentation" group, do nothing (the admin
- *    may have removed it deliberately — don't resurrect it).
- *  - Convert each flat leaf — "Usage" (`#/documentation`), "Tutorials"
- *    (`#/tutorials`) and "API Reference" (`#/api-reference`) — into its
+ *    may have removed it deliberately - don't resurrect it).
+ *  - Convert each flat leaf - "Usage" (`#/documentation`), "Tutorials"
+ *    (`#/tutorials`) and "API Reference" (`#/api-reference`) - into its
  *    submenu, replacing the node in place so its position is preserved. A leaf
  *    that the admin already turned into a parent, or whose new pages already
  *    appear anywhere in the group, is left untouched.
- *  - Add the Components submenu only if `#/docs/components` isn't present yet —
+ *  - Add the Components submenu only if `#/docs/components` isn't present yet -
  *    inserted before "API Reference" when that node exists.
  *
  * Returns `{updated: boolean, reason?: string}`.
@@ -290,7 +290,7 @@ export async function ensureDocumentationSubmenus(opts = {}) {
         changed = true;
     }
 
-    // Components submenu — add if absent, before API Reference.
+    // Components submenu - add if absent, before API Reference.
     if (!hasUrl(docGroup.items, '#/docs/components')) {
         const apiIdx = findByText('API Reference');
         const node = DOC_COMPONENTS_SUBMENU();

package/server/services/sitemap.js

@@ -1,7 +1,7 @@
 /**
  * Sitemap Service
  * Builds sitemap.xml from the page list. Filter logic lives in
- * shouldIncludeInSitemap() — see the TODO below.
+ * shouldIncludeInSitemap() - see the TODO below.
  *
  * Cache: callers should wrap generate() with the 'sitemap' tag so it
  * invalidates whenever a page is created, updated, renamed, or deleted.

package/server/services/userProfiles.js

@@ -1,6 +1,6 @@
 /**
  * User Profiles Service
- * Preset Collection — stores extended profile data for each user,
+ * Preset Collection - stores extended profile data for each user,
  * keyed by user UUID. Seeded on startup; entries auto-managed on user lifecycle.
  */
 import fs from 'fs/promises';
@@ -70,7 +70,7 @@ async function writeData(entries) {
 export async function seed() {
     await fs.mkdir(DIR, {recursive: true});
 
-    // Only write schema if absent — admin edits to fields must be preserved across restarts
+    // Only write schema if absent - admin edits to fields must be preserved across restarts
     try {
         await fs.access(SCHEMA_PATH);
     } catch {
@@ -164,7 +164,7 @@ export async function deleteProfile(userId) {
 
 /**
  * Return a Map of userId → profile data object.
- * Reads data.json once — use this for list endpoints to avoid N+1 reads.
+ * Reads data.json once - use this for list endpoints to avoid N+1 reads.
  *
  * @returns {Promise<Map<string, object>>}
  */
@@ -178,7 +178,7 @@ export async function listProfiles() {
 }
 
 /**
- * Migration helper — ensure every existing user has a profile entry.
+ * Migration helper - ensure every existing user has a profile entry.
  * Called once on startup after seed().
  *
  * @returns {Promise<void>}

package/server/services/userRoles.js

@@ -1,21 +1,21 @@
 /**
- * User Roles — multi-role support helpers.
+ * User Roles - multi-role support helpers.
  *
  * A user has ONE primary role (`user.role`) and an optional array of
  * additional roles (`user.additionalRoles`). Permission, visibility, and
  * row-access checks consult ALL of them and grant access if any one role
- * satisfies — "any path wins" semantics that matches how most apps actually
+ * satisfies - "any path wins" semantics that matches how most apps actually
  * model multi-membership (you can be both a candidate AND a recruiter).
  *
  * Hierarchical-level comparisons (`canManageUser`, `requireAdmin`, the
  * level-clamp in `checkSingleVisibility`) use `getEffectiveLevel` which
- * returns the LOWEST level number across all the user's roles — i.e. the
+ * returns the LOWEST level number across all the user's roles - i.e. the
  * highest privilege the user has access to. This is what makes "additional
  * admin" meaningfully grant admin-tier access without rewriting the level
  * arithmetic everywhere.
  *
  * Backward compatibility: users with no `additionalRoles` field behave
- * exactly as before — `getEffectiveRoles` returns `[user.role]`, `getEffectiveLevel`
+ * exactly as before - `getEffectiveRoles` returns `[user.role]`, `getEffectiveLevel`
  * returns `getRoleLevel(user.role)`. Existing callers that read `user.role`
  * directly continue to work; the new helpers are opt-in for callers that
  * want the union semantics.
@@ -40,7 +40,7 @@ export function getEffectiveRoles(user) {
 }
 
 /**
- * Return the effective role level for a user — the LOWEST level number
+ * Return the effective role level for a user - the LOWEST level number
  * across all roles. Lower number = higher privilege, so the user's most
  * privileged role wins all hierarchical checks.
  *
@@ -57,7 +57,7 @@ export function getEffectiveLevel(user) {
 
 /**
  * Check whether a user holds a specific role (primary or additional).
- * Exact-name match — does NOT walk the hierarchy. For hierarchical "user
+ * Exact-name match - does NOT walk the hierarchy. For hierarchical "user
  * is at least this level" checks use `getEffectiveLevel` against the target
  * role's level instead.
  *
@@ -72,7 +72,7 @@ export function userHasRole(user, role) {
 
 /**
  * Check whether a user holds ANY of the given roles. Convenience helper
- * for "anyone in this set can do X" patterns — equivalent to OR-ing
+ * for "anyone in this set can do X" patterns - equivalent to OR-ing
  * `userHasRole` over the list.
  *
  * @param {object|null} user

package/server/services/users.js

@@ -1,6 +1,6 @@
 /**
  * User Storage Service
- * File-based CRUD — one JSON file per user in content/users/{id}.json.
+ * File-based CRUD - one JSON file per user in content/users/{id}.json.
  * Mirrors the page-per-file pattern from the content service.
  */
 import fs from 'fs/promises';
@@ -96,7 +96,7 @@ export async function getUserById(id) {
 }
 
 /**
- * Get a user by email address — includes password hash (needed for login).
+ * Get a user by email address - includes password hash (needed for login).
  *
  * @param {string} email
  * @returns {Promise<object|null>}
@@ -135,7 +135,7 @@ export async function createUser({ name, email, password, role = 'user', additio
         name: name.trim(),
         password: hash,
         role,
-        // Additional roles beyond the primary — permission/visibility checks
+        // Additional roles beyond the primary - permission/visibility checks
         // grant access if ANY role satisfies. The primary `role` is what
         // appears in UI badges and is used for hierarchical level comparisons
         // when a single value is needed.
@@ -180,7 +180,7 @@ export async function updateUser(id, updates) {
 
     await writeUserFile(updated);
 
-    // Invalidate per-user cache when the project access-scope changes — downstream
+    // Invalidate per-user cache when the project access-scope changes - downstream
     // request handlers cache scope-filtered responses keyed by `user:<id>`.
     if (updates.projects !== undefined) {
         const before = JSON.stringify(user.projects || []);
@@ -208,7 +208,7 @@ export async function deleteUser(id) {
     try {
         await deleteProfile(id);
     } catch {
-        // Profile deletion is best-effort — never block user deletion
+        // Profile deletion is best-effort - never block user deletion
     }
 }
 

package/server/services/versions.js

@@ -33,7 +33,7 @@ function versionsDirForPath(urlPath) {
 }
 
 /**
- * Validate a version filename — must not contain path separators and must end in .md.
+ * Validate a version filename - must not contain path separators and must end in .md.
  *
  * @param {string} filename
  * @throws {Error}
@@ -120,7 +120,7 @@ export async function createVersion(urlPath, {author = 'system', type = 'auto',
     try {
         content = await fs.readFile(livePath, 'utf8');
     } catch {
-        return null; // Page doesn't exist yet — nothing to snapshot
+        return null; // Page doesn't exist yet - nothing to snapshot
     }
 
     const dir = versionsDirForPath(urlPath);
@@ -182,7 +182,7 @@ export async function pruneVersions(urlPath, {keep = 5} = {}) {
     const dir = versionsDirForPath(urlPath);
     const meta = await readMeta(dir);
 
-    // Newest first — index 0 is the most recent snapshot
+    // Newest first - index 0 is the most recent snapshot
     const sorted = [...meta].sort((a, b) => b.createdAt.localeCompare(a.createdAt));
 
     // Manually-named snapshots are always preserved (deliberate restore points).

package/server/services/viewPipeline.js

@@ -3,7 +3,7 @@
  *
  * Executes the Views feature's allowed aggregation-stage subset in plain
  * JavaScript so views work on file-backed collections (no MongoDB needed).
- * MongoDB-backed sources keep using native aggregation in views.js — this
+ * MongoDB-backed sources keep using native aggregation in views.js - this
  * module exists so the SAME view definition produces the same results on
  * either storage adapter. Documents are the raw entry shape ({id, data,
  * meta}) and field paths are dot-paths ('data.price', 'meta.createdAt').
@@ -14,7 +14,7 @@
  *    that visibly "should" match. (Same trade filterEngine makes.)
  *  - $sort places missing/null values LAST regardless of direction (Mongo
  *    treats missing as lowest).
- *  - $addFields supports literals and '$path' references only — operator
+ *  - $addFields supports literals and '$path' references only - operator
  *    expressions throw a clear error rather than mis-evaluating.
  *
  * Pure module: no imports from other services. $lookup resolves foreign
@@ -103,7 +103,7 @@ function deletePath(target, path) {
     if (typeof node === 'object' && node !== null) delete node[parts[parts.length - 1]];
 }
 
-/** Number('') is 0 — treat empty strings as non-numeric like filterEngine. */
+/** Number('') is 0 - treat empty strings as non-numeric like filterEngine. */
 function maybeNumber(value) {
     if (typeof value === 'number') return value;
     if (typeof value === 'string' && value.trim() !== '' && Number.isFinite(Number(value))) {
@@ -342,7 +342,7 @@ function evalProject(docs, config) {
 
     return docs.map((doc) => {
         const out = {};
-        // id carried unless explicitly excluded ({..., id: 0} — mongo's _id exception)
+        // id carried unless explicitly excluded ({..., id: 0} - mongo's _id exception)
         const idExcluded = entries.some(([k, v]) => (k === 'id' || k === '_id') && (v === 0 || v === false));
         if (!idExcluded && doc.id !== undefined) out.id = doc.id;
         for (const [path, spec] of inclusions) {
@@ -522,7 +522,7 @@ async function evalLookup(docs, config, resolveCollection, lookupCache) {
         throw new ViewPipelineError('$lookup requires a collection resolver', '$lookup');
     }
 
-    // Mongo-authored views reference `cms_<slug>` collection names — accept both.
+    // Mongo-authored views reference `cms_<slug>` collection names - accept both.
     const slug = String(from).replace(/^cms_/, '');
     if (!lookupCache.has(slug)) {
         lookupCache.set(slug, await resolveCollection(slug));
@@ -548,7 +548,7 @@ async function evalLookup(docs, config, resolveCollection, lookupCache) {
 
 /**
  * Execute a pipeline (mongo-form stage objects) over an array of documents.
- * Returns the FULL result set — the caller paginates.
+ * Returns the FULL result set - the caller paginates.
  *
  * @param {object[]} docs
  * @param {object[]} stages - [{$match: {...}}, {$sort: {...}}, ...]

package/server/services/views.js

@@ -10,12 +10,12 @@
  *  - everything else → the built-in JS pipeline evaluator (viewPipeline.js)
  *    over the collection adapter's documents
  *
- * The same view definition therefore works on both storage adapters —
+ * The same view definition therefore works on both storage adapters -
  * field paths are raw-document dot-paths ('data.price', 'meta.createdAt')
  * in both cases.
  *
  * Older installs that stored view configs in the MongoDB `cms__views`
- * collection are migrated to files automatically (one-time, read-only —
+ * collection are migrated to files automatically (one-time, read-only -
  * the Mongo collection is never modified).
  *
  * Allowed aggregation stage types:
@@ -40,10 +40,10 @@ export const VIEWS_DIR = path.join(ROOT, 'content', 'views');
 /** Legacy MongoDB collection where pre-0.34 view configs were stored. */
 const LEGACY_VIEWS_COLLECTION = 'cms__views';
 
-/** Prefix applied to CMS data collections — mirrors MongoAdapter.PREFIX. */
+/** Prefix applied to CMS data collections - mirrors MongoAdapter.PREFIX. */
 const COLLECTION_PREFIX = 'cms_';
 
-/** Filename/lookup guard — view slugs are slugified, so keep this strict. */
+/** Filename/lookup guard - view slugs are slugified, so keep this strict. */
 const SLUG_RE = /^[a-z0-9-]+$/;
 
 const ALLOWED_STAGES = new Set([
@@ -103,7 +103,7 @@ function buildPipelineStages(stages) {
 // ---------------------------------------------------------------------------
 
 /**
- * Ensure the views directory exists. Lazy — engine updates never touch
+ * Ensure the views directory exists. Lazy - engine updates never touch
  * content/, so the dir is created on first write.
  *
  * @returns {Promise<void>}
@@ -113,7 +113,7 @@ export async function ensureViewsDir() {
 }
 
 /**
- * Read a single view config by slug (no migration hook — internal/raw).
+ * Read a single view config by slug (no migration hook - internal/raw).
  *
  * @param {string} slug
  * @returns {Promise<object>}
@@ -164,14 +164,14 @@ export async function migrateFromMongo({ getDbImpl } = {}) {
     try {
         const entries = await fs.readdir(VIEWS_DIR);
         if (entries.some(e => e.endsWith('.json'))) return;
-    } catch { /* dir absent — proceed */ }
+    } catch { /* dir absent - proceed */ }
 
     let db;
     try {
         const getDb = getDbImpl ?? (await import('./connectionManager.js')).getDb;
         db = getDb('default');
     } catch {
-        return; // file-mode install — nothing to migrate
+        return; // file-mode install - nothing to migrate
     }
 
     let docs;
@@ -238,7 +238,7 @@ export async function listViews() {
 export async function getView(slug) {
     await ensureMigrated();
 
-    // Strict slug guard — this is hit with raw URL params (public route) and
+    // Strict slug guard - this is hit with raw URL params (public route) and
     // the slug becomes a filename.
     if (typeof slug !== 'string' || !SLUG_RE.test(slug)) return null;
 
@@ -414,7 +414,7 @@ async function executeMongoView(view, { page, limit, user }) {
 
 /**
  * Execute a view against any other source via the JS pipeline evaluator.
- * The full collection and full pipeline output are materialised in memory —
+ * The full collection and full pipeline output are materialised in memory -
  * same trade the FileAdapter already makes for whole collections.
  */
 async function executeFileView(view, { page, limit, user }) {
@@ -456,7 +456,7 @@ export async function executeView(slug, {page = 1, limit = 25, user = null} = {}
     validateStages(view.pipeline?.stages || []);
 
     // Dispatch on the SOURCE collection's storage adapter. A mongodb-declared
-    // schema whose connection is unavailable falls back to the JS evaluator —
+    // schema whose connection is unavailable falls back to the JS evaluator -
     // matching adapterRegistry's own file fallback.
     let useMongo = false;
     try {

package/server/templates/page.html

@@ -18,7 +18,7 @@
 
     <!-- Site CSS -->
     <link rel="stylesheet" href="/public/css/site.css">
-    <link rel="stylesheet" href="/public/css/forms.css?v=20260817-multi-chooser">
+    <link rel="stylesheet" href="/public/css/forms.css?v=20260821-wizard-steps">
 
   <!-- Font overrides -->
   {{fontStyleTag}}
@@ -26,7 +26,7 @@
     <!-- Plugin head injection -->
     {{headInject}}
 
-  <!-- Late head injection — custom CSS always loads last so it can override everything -->
+  <!-- Late head injection - custom CSS always loads last so it can override everything -->
   {{headInjectLate}}
 </head>
 <body class="dm-cloaked dm-theme-{{theme}} {{layoutBodyClass}}" data-layout="{{layout}}">
@@ -116,7 +116,7 @@
     </script>
 
     <!-- Site initialisation -->
-    <script src="/public/js/site.js?v=20260817-menu-bindings" type="module"></script>
+    <script src="/public/js/site.js?v=20260821-wizard-steps" type="module"></script>
     <script src="/public/js/collection-context.js?v=20260819-export" type="module"></script>
 
     <!-- Interactive Collection Browser (used by [collection] shortcodes with
@@ -124,8 +124,8 @@
     <script src="/public/js/collection-browser.js?v=20260523-browser"></script>
 
     <!-- Core Forms (logic engine must load before renderer) -->
-    <script src="/public/js/form-logic-engine.js?v=20260817-transition-speed"></script>
-    <script src="/public/js/forms.js?v=20260817-multi-chooser" type="module"></script>
+    <script src="/public/js/form-logic-engine.js?v=20260821-wizard-steps"></script>
+    <script src="/public/js/forms.js?v=20260821-wizard-steps" type="module"></script>
 
     <!-- Core effects runtime -->
     <script src="/public/js/effects.js"></script>