domma-cms 0.44.0 → 0.45.0

package/server/routes/api/navigation.js

@@ -1,42 +1,42 @@
-/**
- * Navigation API
- * GET /api/navigation    - get navigation config
- * PUT /api/navigation    - save navigation config
- */
-import {getConfig, saveConfig} from '../../config.js';
-import {authenticate, requirePermission} from '../../middleware/auth.js';
-import * as cache from '../../services/cache/index.js';
-
-export async function navigationRoutes(fastify) {
-    const canRead = {preHandler: [authenticate, requirePermission('navigation', 'read')]};
-    const canUpdate = {preHandler: [authenticate, requirePermission('navigation', 'update')]};
-
-    fastify.get('/navigation', canRead, async () => {
-        return getConfig('navigation');
-    });
-
-    fastify.put('/navigation', canUpdate, async (request, reply) => {
-        const data = request.body;
-        if (!data || typeof data !== 'object') {
-            return reply.status(400).send({ error: 'Invalid navigation data' });
-        }
-        if (!Array.isArray(data.items) && !Array.isArray(data)) {
-            return reply.status(400).send({ error: 'Navigation must be an array of items' });
-        }
-        // Normalise child key: Domma navbar expects `items`, not `children`
-        if (Array.isArray(data.items)) {
-            data.items = data.items.map(item => {
-                const children = item.items || item.children;
-                if (children?.length) {
-                    const { children: _c, ...rest } = item;
-                    return { ...rest, items: children };
-                }
-                const { children: _c, ...rest } = item;
-                return rest;
-            });
-        }
-        saveConfig('navigation', data);
-        await cache.invalidateTags(['nav']);
-        return { success: true };
-    });
-}
+/**
+ * Navigation API
+ * GET /api/navigation    - get navigation config
+ * PUT /api/navigation    - save navigation config
+ */
+import {getConfig, saveConfig} from '../../config.js';
+import {authenticate, requirePermission} from '../../middleware/auth.js';
+import * as cache from '../../services/cache/index.js';
+
+export async function navigationRoutes(fastify) {
+    const canRead = {preHandler: [authenticate, requirePermission('navigation', 'read')]};
+    const canUpdate = {preHandler: [authenticate, requirePermission('navigation', 'update')]};
+
+    fastify.get('/navigation', canRead, async () => {
+        return getConfig('navigation');
+    });
+
+    fastify.put('/navigation', canUpdate, async (request, reply) => {
+        const data = request.body;
+        if (!data || typeof data !== 'object') {
+            return reply.status(400).send({ error: 'Invalid navigation data' });
+        }
+        if (!Array.isArray(data.items) && !Array.isArray(data)) {
+            return reply.status(400).send({ error: 'Navigation must be an array of items' });
+        }
+        // Normalise child key: Domma navbar expects `items`, not `children`
+        if (Array.isArray(data.items)) {
+            data.items = data.items.map(item => {
+                const children = item.items || item.children;
+                if (children?.length) {
+                    const { children: _c, ...rest } = item;
+                    return { ...rest, items: children };
+                }
+                const { children: _c, ...rest } = item;
+                return rest;
+            });
+        }
+        saveConfig('navigation', data);
+        await cache.invalidateTags(['nav']);
+        return { success: true };
+    });
+}

package/server/routes/api/notifications.js

@@ -83,7 +83,7 @@ export async function notificationsRoutes(fastify) {
             }));
     });
 
-    // --- Unread count (lightweight — for bell badge) ---
+    // --- Unread count (lightweight - for bell badge) ---
     fastify.get('/system/notifications/unread-count', canRead, async (request) => {
         const userId = request.user.id;
         const now = new Date().toISOString();
@@ -110,7 +110,7 @@ export async function notificationsRoutes(fastify) {
         if (!entry) return reply.code(404).send({ error: 'Notification not found.' });
 
         const readBy = Array.isArray(entry.data.readBy) ? entry.data.readBy : [];
-        if (readBy.includes(userId)) return { ok: true }; // already read — idempotent
+        if (readBy.includes(userId)) return { ok: true }; // already read - idempotent
 
         const updated = await adapter.update(SLUG, id, {
             ...entry.data,

package/server/routes/api/pages.js

@@ -26,7 +26,7 @@ export async function pagesRoutes(fastify) {
     return {html};
   });
 
-    // Aggregate unique tags from all pages — must be registered before the wildcard /pages/* route
+    // Aggregate unique tags from all pages - must be registered before the wildcard /pages/* route
     fastify.get('/pages/tags', canRead, async (request, reply) => {
         const pages = await listPages();
         const tagSet = new Set();
@@ -72,8 +72,20 @@ export async function pagesRoutes(fastify) {
         const { urlPath, frontmatter, body } = request.body;
         if (!urlPath) return reply.status(400).send({ error: 'urlPath is required' });
 
+        // Name the project in the conflict. A page filed under a project the
+        // admin isn't currently browsing is absent from the filtered list, so
+        // a bare "already exists" reads as a phantom.
         const existing = await getPage(urlPath);
-        if (existing) return reply.status(409).send({ error: 'Page already exists at that path' });
+        if (existing) {
+            const {getProjectForPage} = await import('../../services/projects.js');
+            const project = await getProjectForPage(urlPath, existing.project);
+            return reply.status(409).send({
+                error: `A page already exists at ${urlPath}`
+                    + (project ? ` (project: ${project})` : ''),
+                urlPath,
+                project: project || null
+            });
+        }
 
         const page = await createPage(urlPath, frontmatter || {}, body || '');
         return reply.status(201).send(page);

package/server/routes/api/plugin-marketplace.js

@@ -1,8 +1,8 @@
 /**
  * Plugin Marketplace API
- * GET    /api/plugins/marketplace         — fetch catalogue from manager (requires MANAGER_URL)
- * POST   /api/plugins/marketplace/install — download + install a plugin bundle
- * DELETE /api/plugins/marketplace/:slug   — uninstall an installed plugin
+ * GET    /api/plugins/marketplace         - fetch catalogue from manager (requires MANAGER_URL)
+ * POST   /api/plugins/marketplace/install - download + install a plugin bundle
+ * DELETE /api/plugins/marketplace/:slug   - uninstall an installed plugin
  *
  * All routes require authentication + admin role.
  */

package/server/routes/api/plugins.js

@@ -24,7 +24,7 @@ import {getConfig} from '../../config.js';
  * True when something will bring the process back after a clean exit.
  *
  * Two supervisors matter in practice: pm2 (sets `pm_id` / `PM2_HOME`) and the
- * fleet manager, which forks each site with an IPC channel — hence
+ * fleet manager, which forks each site with an IPC channel - hence
  * `process.send`. A bare `node server/server.js` has neither, and exiting there
  * would leave the site down for good, so restarts are refused.
  *
@@ -35,7 +35,7 @@ export function hasSupervisor() {
 }
 
 // One pending restart at a time. An admin flipping four plugins in a row should
-// cost one restart, not four — each toggle pushes the timer out instead of
+// cost one restart, not four - each toggle pushes the timer out instead of
 // stacking exits.
 let _restartTimer = null;
 
@@ -43,7 +43,7 @@ let _restartTimer = null;
  * Exit cleanly so the supervisor restarts us on the new plugin set. Debounced,
  * and long enough after the reply for it to reach the browser.
  *
- * The timer is unref'd so it can never be the thing keeping the process alive —
+ * The timer is unref'd so it can never be the thing keeping the process alive -
  * in production the listening socket does that.
  *
  * @param {Function} exit      How to exit; injectable so tests don't take the runner down
@@ -98,7 +98,7 @@ export async function pluginsRoutes(fastify, opts = {}) {
 
     // Scaffold a new plugin from plugins/_template. The plugin is created
     // pre-enabled so it goes live on the next server restart (its routes and
-    // admin views only register at boot — same restart rule as enable/disable).
+    // admin views only register at boot - same restart rule as enable/disable).
     fastify.post('/plugins/scaffold', canCreate, async (request, reply) => {
         const {slug, displayName, description, author, icon} = request.body || {};
         try {
@@ -134,7 +134,7 @@ export async function pluginsRoutes(fastify, opts = {}) {
 
         // A plugin's routes, hooks and admin views only register at boot, so a
         // toggle does nothing until the process restarts. Do it for the admin
-        // rather than leaving a "restart to apply" note they have to action —
+        // rather than leaving a "restart to apply" note they have to action -
         // but only where a supervisor will bring the process back, and only
         // when the enabled flag actually changed (a settings-only save must not
         // bounce the site).
@@ -154,7 +154,7 @@ export async function pluginsRoutes(fastify, opts = {}) {
         return getAdminPluginConfig();
     });
 
-    // ── In-admin code editor (plugins.develop — code execution grade) ──────
+    // ── In-admin code editor (plugins.develop - code execution grade) ──────
 
     const mapErr = (reply, err) => reply.status(err.statusCode || 500).send({ error: err.message });
 

package/server/routes/api/projects.js

@@ -1,13 +1,13 @@
 /**
  * Projects API
  *
- * GET    /api/projects                       — list visible projects
- * GET    /api/projects/:slug                 — full project
- * POST   /api/projects                       — create
- * PUT    /api/projects/:slug                 — edit (slug immutable)
- * DELETE /api/projects/:slug                 — delete (403 for core; 409 if any artefacts tagged)
- * GET    /api/projects/:slug/artefacts       — grouped artefacts
- * POST   /api/projects/:slug/untag-all       — escape hatch before delete (403 for core)
+ * GET    /api/projects                       - list visible projects
+ * GET    /api/projects/:slug                 - full project
+ * POST   /api/projects                       - create
+ * PUT    /api/projects/:slug                 - edit (slug immutable)
+ * DELETE /api/projects/:slug                 - delete (403 for core; 409 if any artefacts tagged)
+ * GET    /api/projects/:slug/artefacts       - grouped artefacts
+ * POST   /api/projects/:slug/untag-all       - escape hatch before delete (403 for core)
  *
  * Auth middlewares are accepted as DI options so tests can supply no-ops.
  */
@@ -88,7 +88,7 @@ export async function projectsRoutes(fastify, opts = {}) {
         const total = Object.values(grouped).reduce((sum, arr) => sum + arr.length, 0);
         if (total > 0) {
             return reply.status(409).send({
-                error: `Cannot delete — ${total} artefacts still tagged with this project`,
+                error: `Cannot delete - ${total} artefacts still tagged with this project`,
                 artefacts: Object.fromEntries(Object.entries(grouped).map(([k, v]) => [k, v.length]))
             });
         }
@@ -107,7 +107,7 @@ export async function projectsRoutes(fastify, opts = {}) {
 
     fastify.post('/projects/:slug/untag-all', canDelete, async (request, reply) => {
         if (request.params.slug === CORE_PROJECT_SLUG) {
-            return reply.status(403).send({error: 'Cannot untag the core project — artefacts would immediately resolve back to it'});
+            return reply.status(403).send({error: 'Cannot untag the core project - artefacts would immediately resolve back to it'});
         }
         const target = await getProject(request.params.slug);
         if (target?.protected === true) {

package/server/routes/api/scaffold.js

@@ -1,15 +1,15 @@
 /**
- * Scaffold API — list bundled recipes and apply one to create a working CRUD
+ * Scaffold API - list bundled recipes and apply one to create a working CRUD
  * system (Collection + Form + Actions) in a single call.
  *
- * Admin-only — these endpoints can create resources, so they require the same
+ * Admin-only - these endpoints can create resources, so they require the same
  * permission tier as collection/form management. The `apply` endpoint is
  * non-atomic across recipe pieces but returns a clear summary of what was
  * created vs. skipped so the caller can clean up if needed.
  *
  * Endpoints:
- *   GET  /api/scaffold/recipes          — list bundled recipes (name, description, options)
- *   POST /api/scaffold/apply            — apply one recipe with caller-provided option overrides
+ *   GET  /api/scaffold/recipes          - list bundled recipes (name, description, options)
+ *   POST /api/scaffold/apply            - apply one recipe with caller-provided option overrides
  */
 import {applyRecipe, getRecipe, listRecipes} from '../../services/scaffolder.js';
 import {authenticate, requirePermission} from '../../middleware/auth.js';
@@ -17,7 +17,7 @@ import {authenticate, requirePermission} from '../../middleware/auth.js';
 export async function scaffoldRoutes(fastify) {
     // Scaffolding creates collections + forms + actions, so we require both
     // collections.create and forms.create permissions. The cheap check is to
-    // gate on collections.create — anyone with that should already be a
+    // gate on collections.create - anyone with that should already be a
     // privileged role; we add forms.create on top as a belt-and-braces.
     const canScaffold = {preHandler: [authenticate, requirePermission('collections', 'create')]};
 
@@ -38,7 +38,7 @@ export async function scaffoldRoutes(fastify) {
     /*
      * GET /api/scaffold/recipes/:slug
      *
-     * Returns the full recipe document — useful for a preview view that wants
+     * Returns the full recipe document - useful for a preview view that wants
      * to show the user exactly what will be created before they click Apply.
      */
     fastify.get('/scaffold/recipes/:slug', canScaffold, async (request, reply) => {
@@ -61,7 +61,7 @@ export async function scaffoldRoutes(fastify) {
      *   { created: {collection, form, actions: [...]}, skipped: [...], warnings: [...], snippet: string|null }
      *
      * The `snippet` is a Markdown fragment the caller can insert at the
-     * cursor position in the page editor — typically the [form] + [collection]
+     * cursor position in the page editor - typically the [form] + [collection]
      * combination needed to see the new system on a page immediately.
      */
     fastify.post('/scaffold/apply', canScaffold, async (request, reply) => {

package/server/routes/api/settings.js

@@ -41,7 +41,7 @@ export async function settingsRoutes(fastify) {
             'smtp', 'footer', 'analytics', 'social', 'locale',
             'layoutOptions', 'seo', 'backToTop', 'cookieConsent', 'breadcrumbs', 'autoTheme',
             'adminBrand',
-            // Keys that legitimately live in site.json (written elsewhere — e.g.
+            // Keys that legitimately live in site.json (written elsewhere - e.g.
             // `brand` by the menus migration) and are echoed back by GET /settings.
             // They must be accepted here or any client that round-trips the GET
             // payload into a save gets a 400 for keys it never touched.
@@ -80,7 +80,7 @@ export async function settingsRoutes(fastify) {
             return reply.status(400).send({ error: 'SMTP is not configured. Save your SMTP settings first.' });
         }
 
-        // Shared transport factory — carries the self-signed-cert TLS relaxation.
+        // Shared transport factory - carries the self-signed-cert TLS relaxation.
         // Do NOT build a raw nodemailer transport here; that regresses on engine sync.
         const transporter = await createTransport(smtp);
 
@@ -93,7 +93,7 @@ export async function settingsRoutes(fastify) {
             await transporter.sendMail({
                 from:    smtp.fromName ? `"${smtp.fromName}" <${smtp.fromAddress}>` : smtp.fromAddress,
                 to,
-                subject: 'Domma CMS — Test Email',
+                subject: 'Domma CMS - Test Email',
                 text:    'This is a test email sent from Domma CMS to verify your SMTP configuration.',
                 html:    '<p>This is a test email sent from <strong>Domma CMS</strong> to verify your SMTP configuration.</p>'
             });
@@ -103,7 +103,7 @@ export async function settingsRoutes(fastify) {
         }
     });
 
-    // GET /api/settings/db-status — returns whether MongoDB connections are configured
+    // GET /api/settings/db-status - returns whether MongoDB connections are configured
     fastify.get('/settings/db-status', canRead, async () => {
         try {
             const raw = await fs.readFile(CONNECTIONS_FILE, 'utf8');
@@ -117,7 +117,7 @@ export async function settingsRoutes(fastify) {
         }
     });
 
-    // GET /api/settings/custom-css — return current CSS as JSON
+    // GET /api/settings/custom-css - return current CSS as JSON
     fastify.get('/settings/custom-css', canUpdate, async () => {
         try {
             const css = await fs.readFile(CUSTOM_CSS_FILE, 'utf8');
@@ -127,7 +127,7 @@ export async function settingsRoutes(fastify) {
         }
     });
 
-    // PUT /api/settings/custom-css — save CSS to content/custom.css
+    // PUT /api/settings/custom-css - save CSS to content/custom.css
     fastify.put('/settings/custom-css', canUpdate, async (request, reply) => {
         const { css } = request.body || {};
         if (typeof css !== 'string') {

package/server/routes/api/sidebar.js

@@ -1,7 +1,7 @@
 /**
  * Admin sidebar API
  *
- * GET /api/sidebar/registered-items — plugin-registered sidebar items
+ * GET /api/sidebar/registered-items - plugin-registered sidebar items
  *
  * Auth middlewares are accepted as DI options so tests can supply no-ops.
  */

package/server/routes/api/users.js

@@ -2,9 +2,9 @@
  * Users API
  * GET    /api/users      - list all users (admin, manager)
  * GET    /api/users/:id  - single user (admin, manager, or self)
- * POST   /api/users      - create user (admin, manager — manager cannot create admin)
- * PUT    /api/users/:id  - update user (admin, manager — manager cannot edit admin)
- * DELETE /api/users/:id  - delete user (admin, manager — manager cannot delete admin, no self-delete)
+ * POST   /api/users      - create user (admin, manager - manager cannot create admin)
+ * PUT    /api/users/:id  - update user (admin, manager - manager cannot edit admin)
+ * DELETE /api/users/:id  - delete user (admin, manager - manager cannot delete admin, no self-delete)
  */
 import {authenticate, canManageUser, requirePermission} from '../../middleware/auth.js';
 import {getPermissionsFor} from '../../services/roles.js';
@@ -64,7 +64,7 @@ export async function usersRoutes(fastify) {
         if (!canManageUser(request.user, targetRole)) {
             return reply.code(403).send({ error: 'You cannot create a user with that role' });
         }
-        // Additional-roles privilege guard — actor must be able to manage EVERY role
+        // Additional-roles privilege guard - actor must be able to manage EVERY role
         // they're trying to assign, not just the primary.
         const requestedAdditional = Array.isArray(request.body?.additionalRoles) ? request.body.additionalRoles : [];
         for (const r of requestedAdditional) {
@@ -89,7 +89,7 @@ export async function usersRoutes(fastify) {
         const target = await getUserById(id);
         if (!target) return reply.status(404).send({ error: 'User not found' });
 
-        // Self-edit is always allowed — the hierarchy guard only applies to
+        // Self-edit is always allowed - the hierarchy guard only applies to
         // OTHER users, otherwise nobody can edit a peer-level account (or
         // even their own, since canManageUser is a strict level comparison).
         // Role-escalation guards below still apply to self-edits.

package/server/routes/api/versions.js

@@ -83,7 +83,7 @@ export async function versionsRoutes(fastify) {
         }
     });
 
-    // Prune versions — keep the most recent N (policy decided in pruneVersions)
+    // Prune versions - keep the most recent N (policy decided in pruneVersions)
     fastify.post('/versions/prune/*', canDelete, async (request, reply) => {
         const urlPath = '/' + request.params['*'];
         const keep = Number.parseInt(request.body?.keep, 10);

package/server/routes/api/views.js

@@ -32,7 +32,7 @@ export async function viewsRoutes(fastify) {
         try {
             const {canSeeArtefact} = await import('../../services/projects.js');
             const all = await listViews();
-            // listViews returns full records with meta inline — filter directly
+            // listViews returns full records with meta inline - filter directly
             return all.filter(v => canSeeArtefact(request.user, v));
         } catch (err) {
             return reply.status(503).send({ error: err.message });

package/server/routes/docs-public.js

@@ -1,5 +1,5 @@
 /**
- * Domma Docs — public surface
+ * Domma Docs - public surface
  *
  * Serves the handbook at request time from the admin doc templates:
  *   GET /domma-docs              → home landing
@@ -11,7 +11,7 @@
  *
  * This dedicated /domma-docs(/*) prefix out-prioritises public.js's `/*`
  * catch-all (Fastify ranks static segments above wildcards), exactly as
- * routes/api/endpoints-public.js `/x/*` coexists with it — so no per-path
+ * routes/api/endpoints-public.js `/x/*` coexists with it - so no per-path
  * special-casing is needed in public.js. Registered at app root (not behind a
  * prefixed plugin) so the specificity ranking shares one router scope.
  */
@@ -38,6 +38,6 @@ export async function docsPublicRoutes(fastify) {
         return reply.type('text/html').send(html);
     };
 
-    fastify.get('/domma-docs', handle);    // exact — params['*'] === '' (home landing)
+    fastify.get('/domma-docs', handle);    // exact - params['*'] === '' (home landing)
     fastify.get('/domma-docs/*', handle);  // sections + leaves
 }

package/server/routes/public.js

@@ -18,7 +18,7 @@ import * as cache from '../services/cache/index.js';
  *
  * Honours `site.baseUrl` as an explicit override (useful when the CMS sits
  * behind infrastructure that doesn't forward Host correctly). Otherwise
- * builds it from `request.protocol` + `request.host` — both of which Fastify
+ * builds it from `request.protocol` + `request.host` - both of which Fastify
  * resolves from `X-Forwarded-*` headers when `trustProxy` is on. `request.host`
  * includes the port for non-default ports (e.g. `localhost:4096` in dev) and
  * omits it for the standard 80/443.
@@ -58,7 +58,7 @@ export async function publicRoutes(fastify) {
     // Health check
     fastify.get('/api/health', async () => ({ status: 'ok' }));
 
-    // SEO: sitemap.xml — cached per origin (so a single CMS responding on
+    // SEO: sitemap.xml - cached per origin (so a single CMS responding on
     // multiple domains gets the right absolute URLs); invalidated by page
     // CRUD via the 'sitemap' tag.
     fastify.get('/sitemap.xml', async (request, reply) => {
@@ -71,7 +71,7 @@ export async function publicRoutes(fastify) {
         return reply.type('application/xml').send(xml);
     });
 
-    // SEO: robots.txt — cheap to build, no cache wrap needed.
+    // SEO: robots.txt - cheap to build, no cache wrap needed.
     fastify.get('/robots.txt', async (request, reply) => {
         return reply.type('text/plain').send(buildRobotsTxt(getBaseUrl(request)));
     });
@@ -87,7 +87,7 @@ export async function publicRoutes(fastify) {
 
         const urlPath = '/' + (rawPath || '');
 
-        // First-pass page lookup — used only for the visibility decision
+        // First-pass page lookup - used only for the visibility decision
         // (metadata-only is sufficient). We re-fetch below with `user` once
         // it is resolved so the body's [menu] shortcode renders against the
         // correct role.
@@ -110,28 +110,28 @@ export async function publicRoutes(fastify) {
         }
 
         // Hard kill-switch: a disabled project takes its pages off the public
-        // site entirely — 404 (no oracle), regardless of page visibility.
+        // site entirely - 404 (no oracle), regardless of page visibility.
         const pageProject = await getProjectForPage(page.urlPath || urlPath, page.project);
         if (!(await isProjectEnabled(pageProject))) {
             reply.status(404);
             return reply.type('text/html').send(await render404(urlPath));
         }
 
-        // Enforce page visibility — role only resolved for gated pages,
+        // Enforce page visibility - role only resolved for gated pages,
         // so public pages share a single cache entry keyed `roleanon`.
         //
         // `visibility` may be a string ('public' | 'private' | role name) or
-        // an array of role names — see checkVisibility() for full semantics.
+        // an array of role names - see checkVisibility() for full semantics.
         // Effectively-public values (missing, 'public', or an array containing
         // 'public') skip JWT verification entirely so anonymous traffic hits
         // the shared cache without auth cost.
-        // For per-role cache keying we use the primary role only — multi-role
+        // For per-role cache keying we use the primary role only - multi-role
         // users still see correctly-gated content (checkVisibility consults
         // additionalRoles too) but the cache key stays bounded to one entry
         // per primary role rather than 2^N per role combination. The fallback
         // is correctness: any user whose access depends on an additional role
         // is granted, but their served HTML is the variant cached for their
-        // primary role's tier — fine for the public-site use case.
+        // primary role's tier - fine for the public-site use case.
         let userRole = null;
         let userObj  = null;
         const vis      = page.visibility;
@@ -146,7 +146,7 @@ export async function publicRoutes(fastify) {
                     userRole = decoded.role;
                     userObj  = { role: decoded.role, additionalRoles: decoded.additionalRoles || [] };
                 }
-            } catch { /* no token — treat as unauthenticated */ }
+            } catch { /* no token - treat as unauthenticated */ }
 
             if (!checkVisibility(userObj, vis)) {
                 reply.status(403);
@@ -155,12 +155,12 @@ export async function publicRoutes(fastify) {
         }
 
         const baseUrl = getBaseUrl(request);
-        // mtime in the key: any change to the backing file — editor save,
-        // script, git pull — yields a fresh entry even if no invalidation
+        // mtime in the key: any change to the backing file - editor save,
+        // script, git pull - yields a fresh entry even if no invalidation
         // hook fired. Stale-mtime entries age out via TTL/LRU.
         const pageMtime = await getPageMtime(page.urlPath || urlPath);
         const cacheKey = `page:${urlPath}:m${pageMtime}:role${userRole ?? 'anon'}:o${baseUrl}`;
-        const cacheTags = [`page:${urlPath}`, ...(page.tags || []), 'nav', 'site'];
+        const cacheTags = [`page:${urlPath}`, ...(page.cacheTags || []), 'nav', 'site'];
         const html = await cache.wrap(
             cacheKey,
             async () => {
@@ -179,7 +179,7 @@ export async function publicRoutes(fastify) {
 }
 
 /**
- * Render a 404 response — tries content/pages/404.md first, falls back to
+ * Render a 404 response - tries content/pages/404.md first, falls back to
  * a minimal inline page so the site theme is applied when possible.
  */
 export async function render404(urlPath) {