domma-cms 0.44.0 → 0.45.1

package/scripts/build.js

@@ -1,5 +1,5 @@
 /**
- * Build script — creates a publishable staging copy in _publish/
+ * Build script - creates a publishable staging copy in _publish/
  * Browser-facing JS/CSS is minified; server-side code is copied as-is.
  * Run: node scripts/build.js
  */
@@ -29,7 +29,7 @@ const COPY_AS_IS = [
 ];
 
 // Glob patterns for browser-facing assets to minify. NOTE: both .js AND .mjs
-// must be listed — the browser ESM modules served raw (e.g. public/js/*.mjs)
+// must be listed - the browser ESM modules served raw (e.g. public/js/*.mjs)
 // use the .mjs extension, and omitting it silently drops those files from the
 // published package (this is the bug that shipped 0.22.1 without menu-decor.mjs).
 const MINIFY_PATTERNS = [
@@ -177,7 +177,7 @@ async function stampPluginVersions() {
  * `/dist/domma/domma.min.js` is served straight from `node_modules/domma-js` (server.js), so a
  * `npm install domma-js@next` silently upgrades one half of the admin and leaves the other on
  * whatever version was last copied across. The tools bundle's own banner says
- * `Requires: domma.min.js` — it is built against a specific core and is not version-independent.
+ * `Requires: domma.min.js` - it is built against a specific core and is not version-independent.
  *
  * That skew is invisible: both files load, no import dangles, nothing throws. It surfaces later as
  * a Theme Roller or Page Roller that misbehaves against a core it was not built for. This is the
@@ -203,14 +203,14 @@ function verifyDommaToolsVersion(toolsRelPaths) {
             // admin/index.html loads both unconditionally, so an absent file is a dead <script>/<link>
             // in the published admin. The copy step already tolerates absence; flag it rather than
             // silently agreeing.
-            problems.push(`${rel} is missing — the published admin will reference a file that isn't there`);
+            problems.push(`${rel} is missing - the published admin will reference a file that isn't there`);
             continue;
         }
         // The banner is in the first few lines; no need to read a 230 KB bundle in full.
         const head = readFileSync(src, 'utf8').slice(0, 512);
         const match = head.match(BANNER);
         if (!match) {
-            problems.push(`${rel} carries no recognisable Domma Tools banner — cannot confirm its version`);
+            problems.push(`${rel} carries no recognisable Domma Tools banner - cannot confirm its version`);
             found.push({rel, version: null});
             continue;
         }
@@ -238,7 +238,7 @@ async function build() {
     }
   }
 
-  // Strip prepublishOnly from _publish/package.json — the guard is for the
+  // Strip prepublishOnly from _publish/package.json - the guard is for the
   // source tree only; running npm publish inside _publish/ must succeed.
   const pkgPath = join(OUT, 'package.json');
   const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
@@ -247,7 +247,7 @@ async function build() {
 
   // Scrub this machine's local config out of the staged copy. config/site.json
   // is a working file on a development install, so it carries whatever SMTP
-  // host and site URL were last set here — published releases up to 0.43.1 put
+  // host and site URL were last set here - published releases up to 0.43.1 put
   // a LAN address on the public registry and handed every manual installer a
   // mail host that does not exist for them. Same reasoning as the analytics
   // counters in .npmignore: runtime state must not ride along in the tarball.
@@ -265,7 +265,7 @@ async function build() {
   }
 
   // .bak files are migration leftovers from whichever machine built the
-  // release — never something an installer should receive.
+  // release - never something an installer should receive.
   for (const rel of ['config/navigation.json.bak', 'config/connections.json.bak']) {
     const bak = join(OUT, rel);
     if (existsSync(bak)) rmSync(bak, {force: true});
@@ -293,14 +293,14 @@ async function build() {
     'admin/dist/domma/domma-tools.min.js',
   ];
 
-  // Version-skew gate — see verifyDommaToolsVersion() for why this cannot be left to npm.
+  // Version-skew gate - see verifyDommaToolsVersion() for why this cannot be left to npm.
   const toolsCheck = verifyDommaToolsVersion(dommaTools);
   if (toolsCheck.ok) {
-    console.log(`Domma Tools v${toolsCheck.installed} — matches installed domma-js`);
+    console.log(`Domma Tools v${toolsCheck.installed} - matches installed domma-js`);
   } else {
     for (const problem of toolsCheck.problems) console.error(`  ${problem}`);
     throw new Error(
-      `Domma Tools is out of step with domma-js v${toolsCheck.installed} — copy `
+      `Domma Tools is out of step with domma-js v${toolsCheck.installed} - copy `
       + `domma-tools.min.js and domma-tools.css from that version's build into admin/dist/domma/, `
       + `then rebuild`,
     );
@@ -338,16 +338,16 @@ async function build() {
 
   await stampPluginVersions();
 
-  console.log(`Built into _publish/ — JS: ${jsCount} minified, CSS: ${cssCount} minified, ${totalCopied} entries copied`);
+  console.log(`Built into _publish/ - JS: ${jsCount} minified, CSS: ${cssCount} minified, ${totalCopied} entries copied`);
 
-  // Integrity gate — fail the build (and therefore `make pack` / `make
+  // Integrity gate - fail the build (and therefore `make pack` / `make
   // release-npm`) if the staged set ships any ESM import pointing at a file
   // that isn't there. This is what stops a "shipped code that imports a missing
   // file" release (the 0.22.1 menu-decor.mjs incident) from ever publishing.
   const integrity = await verifyAssetImports({projectRoot: OUT});
   console.log(formatReport(integrity, '_publish/'));
   if (!integrity.ok) {
-    throw new Error(`asset integrity check failed — ${integrity.missing.length} dangling import(s); refusing to package a broken release`);
+    throw new Error(`asset integrity check failed - ${integrity.missing.length} dangling import(s); refusing to package a broken release`);
   }
 }
 

package/scripts/create-plugin.js

@@ -69,12 +69,12 @@ const templateDir = join(ROOT, 'plugins', '_template');
 const targetDir   = join(ROOT, 'plugins', slug);
 
 if (!existsSync(templateDir)) {
-    console.error(`Template not found at plugins/_template/ — cannot scaffold.`);
+    console.error(`Template not found at plugins/_template/ - cannot scaffold.`);
     process.exit(1);
 }
 
 if (existsSync(targetDir)) {
-    console.error(`plugins/${slug}/ already exists — choose a different name.`);
+    console.error(`plugins/${slug}/ already exists - choose a different name.`);
     process.exit(1);
 }
 

package/scripts/fresh.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * Domma CMS — Fresh Install
+ * Domma CMS - Fresh Install
  * Chains: reset → setup
  * Gives you a clean CMS install ready to use.
  * Run: npm run fresh
@@ -24,7 +24,7 @@ function run(script) {
 
 console.log('');
 console.log('  ╔══════════════════════════════════════╗');
-console.log('  ║   Domma CMS — Fresh Install          ║');
+console.log('  ║   Domma CMS - Fresh Install          ║');
 console.log('  ║   reset → setup                      ║');
 console.log('  ╚══════════════════════════════════════╝');
 console.log('');

package/scripts/gen-instance-secret.js

@@ -36,7 +36,7 @@ async function writeEnv(env) {
 
 const env = await readEnv();
 if (env.INSTANCE_SECRET && env.INSTANCE_SECRET.length >= 32) {
-    console.log('  ✓ INSTANCE_SECRET already set — skipping.');
+    console.log('  ✓ INSTANCE_SECRET already set - skipping.');
     process.exit(0);
 }
 

package/scripts/pro.js

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 /**
- * Domma CMS — Pro Mode Toggle
+ * Domma CMS - Pro Mode Toggle
  *
  * Enables or disables MongoDB storage adapter (Pro feature).
  *
  * Usage:
- *   npm run pro enable    — copy connections.json.example, prompt for URI/DB, install mongodb
- *   npm run pro disable   — back up connections.json, optionally uninstall mongodb
- *   npm run pro status    — report current mode and connection summary
+ *   npm run pro enable    - copy connections.json.example, prompt for URI/DB, install mongodb
+ *   npm run pro disable   - back up connections.json, optionally uninstall mongodb
+ *   npm run pro status    - report current mode and connection summary
  */
 import {createInterface} from 'node:readline/promises';
 import {copyFile, readFile, rename, writeFile} from 'node:fs/promises';
@@ -75,7 +75,7 @@ async function cmdStatus() {
   }
 
   console.log('  Mode    : Pro (MongoDB)');
-  console.log(`  mongodb : ${mongoInstalled ? 'installed ✓' : 'NOT installed — run: npm install mongodb'}`);
+  console.log(`  mongodb : ${mongoInstalled ? 'installed ✓' : 'NOT installed - run: npm install mongodb'}`);
 
   try {
     const raw = await readFile(CONNECTIONS_FILE, 'utf8');
@@ -95,7 +95,7 @@ async function cmdStatus() {
       }
     }
   } catch (err) {
-    console.log(`  Warning : Could not parse connections.json — ${err.message}`);
+    console.log(`  Warning : Could not parse connections.json - ${err.message}`);
   }
 
   console.log('');
@@ -105,7 +105,7 @@ async function cmdEnable() {
   section('Enable Pro Mode');
 
   if (existsSync(CONNECTIONS_FILE)) {
-    console.log('  ✓ config/connections.json already exists — Pro mode is already enabled.');
+    console.log('  ✓ config/connections.json already exists - Pro mode is already enabled.');
     console.log('  Run "npm run pro status" to review the current configuration.\n');
     return;
   }
@@ -140,7 +140,7 @@ async function cmdEnable() {
   await writeFile(CONNECTIONS_FILE, JSON.stringify(cfg, null, 4) + '\n', 'utf8');
 
   console.log('\n  ✓ config/connections.json updated with your connection details.');
-  console.log('    (This file is gitignored — credentials stay local.)\n');
+  console.log('    (This file is gitignored - credentials stay local.)\n');
 
   // Install mongodb package
   console.log('  Installing mongodb package…');
@@ -168,13 +168,13 @@ async function cmdDisable() {
   section('Disable Pro Mode');
 
   if (!existsSync(CONNECTIONS_FILE)) {
-    console.log('  Already in file-based mode — nothing to disable.\n');
+    console.log('  Already in file-based mode - nothing to disable.\n');
     return;
   }
 
   // Back up connections.json
   if (existsSync(CONNECTIONS_BAK)) {
-    console.log('  Note: connections.json.bak already exists — it will be overwritten.');
+    console.log('  Note: connections.json.bak already exists - it will be overwritten.');
   }
 
   await rename(CONNECTIONS_FILE, CONNECTIONS_BAK);
@@ -195,7 +195,7 @@ async function cmdDisable() {
       console.log('\n  Warning: npm uninstall mongodb failed. Remove it manually if needed.');
     }
   } else {
-    console.log('  Skipping uninstall — mongodb package remains (unused).');
+    console.log('  Skipping uninstall - mongodb package remains (unused).');
   }
 
   console.log('');
@@ -209,7 +209,7 @@ async function cmdDisable() {
 function printUsage() {
   console.log('');
   console.log('  ┌─────────────────────────────────────┐');
-  console.log('  │   Domma CMS — Pro Mode Toggle       │');
+  console.log('  │   Domma CMS - Pro Mode Toggle       │');
   console.log('  └─────────────────────────────────────┘');
   console.log('');
   console.log('  Usage: npm run pro <command>');

package/scripts/reset.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * Domma CMS — Factory Reset
+ * Domma CMS - Factory Reset
  * Wipes all content, users, and resets config to defaults.
  * Run: npm run reset
  */
@@ -74,7 +74,7 @@ async function resetEnv() {
 
 console.log('');
 console.log('  ┌──────────────────────────────────┐');
-console.log('  │   Domma CMS — Factory Reset      │');
+console.log('  │   Domma CMS - Factory Reset      │');
 console.log('  └──────────────────────────────────┘');
 console.log('');
 console.log('  This will permanently delete:');

package/scripts/setup.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 /**
- * Domma CMS — Interactive Setup Wizard
+ * Domma CMS - Interactive Setup Wizard
  *
  * Run once after cloning: npm run setup
- * Operates directly on files — does NOT import the Fastify server.
+ * Operates directly on files - does NOT import the Fastify server.
  *
  * Steps:
  *   1. Generate JWT_SECRET (skips if already set)
@@ -134,7 +134,7 @@ console.log('  │   Domma CMS Setup Wizard   │');
 console.log('  └────────────────────────────┘');
 
 // ---------------------------------------------------------------------------
-// Step 1 — JWT Secret
+// Step 1 - JWT Secret
 // ---------------------------------------------------------------------------
 section('1. JWT Secret');
 
@@ -145,7 +145,7 @@ const isPlaceholder  = !existingSecret
     || existingSecret.length < 32;
 
 if (!isPlaceholder) {
-    console.log('  ✓ JWT_SECRET already configured — skipping.');
+    console.log('  ✓ JWT_SECRET already configured - skipping.');
 } else {
     const secret = randomBytes(48).toString('hex');
     env.JWT_SECRET = secret;
@@ -155,18 +155,18 @@ if (!isPlaceholder) {
 }
 
 // ---------------------------------------------------------------------------
-// Step 2 — Instance Secret
+// Step 2 - Instance Secret
 // ---------------------------------------------------------------------------
 section('2. Instance Secret');
 
-// Distinct name from step 1's existingSecret — both are module-scope consts,
+// Distinct name from step 1's existingSecret - both are module-scope consts,
 // so reusing the identifier made the whole file a SyntaxError and setup could
 // not run at all.
 const existingInstanceSecret = env.INSTANCE_SECRET ?? '';
 const isInstanceSecretSet = existingInstanceSecret && existingInstanceSecret.length >= 32;
 
 if (isInstanceSecretSet) {
-    console.log('  ✓ INSTANCE_SECRET already configured — skipping.');
+    console.log('  ✓ INSTANCE_SECRET already configured - skipping.');
 } else {
     const secret = randomBytes(32).toString('hex');
     env.INSTANCE_SECRET = secret;
@@ -175,13 +175,13 @@ if (isInstanceSecretSet) {
 }
 
 // ---------------------------------------------------------------------------
-// Step 3 — Admin Account
+// Step 3 - Admin Account
 // ---------------------------------------------------------------------------
 section('3. Admin Account');
 
 const userCount = await countUsers();
 if (userCount > 0) {
-    console.log(`  ✓ ${userCount} user(s) already exist — skipping admin creation.`);
+    console.log(`  ✓ ${userCount} user(s) already exist - skipping admin creation.`);
 } else {
     console.log('  No users found. Create the first admin account.\n');
 
@@ -228,7 +228,7 @@ if (userCount > 0) {
 }
 
 // ---------------------------------------------------------------------------
-// Step 4 — Site Identity
+// Step 4 - Site Identity
 // ---------------------------------------------------------------------------
 section('4. Site Identity');
 
@@ -256,7 +256,7 @@ section('4. Site Identity');
 }
 
 // ---------------------------------------------------------------------------
-// Step 5 — Theme
+// Step 5 - Theme
 // ---------------------------------------------------------------------------
 section('5. Theme');
 
@@ -268,7 +268,7 @@ THEMES.forEach((t, i) => {
 
 {
     const rl = createInterface({ input: process.stdin, output: process.stdout });
-    const choice = (await rl.question(`\n  Choice (1–${THEMES.length}, Enter = charcoal-dark): `)).trim();
+    const choice = (await rl.question(`\n  Choice (1-${THEMES.length}, Enter = charcoal-dark): `)).trim();
     rl.close();
 
     const idx   = parseInt(choice, 10) - 1;
@@ -282,7 +282,7 @@ THEMES.forEach((t, i) => {
 }
 
 // ---------------------------------------------------------------------------
-// Step 6 — Port
+// Step 6 - Port
 // ---------------------------------------------------------------------------
 section('6. Server Port');
 
@@ -305,7 +305,7 @@ section('6. Server Port');
 // Git hooks
 // ---------------------------------------------------------------------------
 // The hooks in .githooks/ are committed, but git will not run them until this
-// clone points at that directory — core.hooksPath is local config, so it cannot
+// clone points at that directory - core.hooksPath is local config, so it cannot
 // travel with the repository. Every clone that misses this step silently loses
 // both hooks: the commit-msg trailer strip and the pre-commit minified-source
 // guard. Enable it here so a fresh clone is protected by default.
@@ -315,7 +315,7 @@ try {
     execSync('git config core.hooksPath .githooks', {stdio: 'ignore'});
     console.log('  ✓ Git hooks enabled (core.hooksPath = .githooks)');
 } catch {
-    // Not a git checkout — an npm install of the published package, most
+    // Not a git checkout - an npm install of the published package, most
     // likely. Nothing to enable, and nothing worth warning about.
 }
 

package/scripts/users.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * Domma CMS — User Management CLI
+ * Domma CMS - User Management CLI
  *
  * Run from the project root:
  *   npm run users -- <command> [args] [options]
@@ -105,7 +105,7 @@ async function cmdList() {
         name:     u.name,
         role:     u.role,
         active:   u.isActive ? 'yes' : 'no',
-        last:     u.lastLogin ? u.lastLogin.slice(0, 16).replace('T', ' ') : '—'
+        last:     u.lastLogin ? u.lastLogin.slice(0, 16).replace('T', ' ') : '-'
     }));
     printTable(['email', 'name', 'role', 'active', 'last'], rows);
 }
@@ -203,7 +203,7 @@ async function resolvePassword({confirm: requireConfirm = false} = {}) {
     if (flags.has('generate')) {
         const pw = generatePassword(20);
         console.log(`\n  Generated password: ${pw}`);
-        console.log('  (this is the only time it will be shown — copy it now)\n');
+        console.log('  (this is the only time it will be shown - copy it now)\n');
         return pw;
     }
 
@@ -221,7 +221,7 @@ function generatePassword(bytes) {
 }
 
 /**
- * Prompt with masked echo — reads raw TTY input so keystrokes don't appear on screen.
+ * Prompt with masked echo - reads raw TTY input so keystrokes don't appear on screen.
  * Falls back to a plain (visible) readline when stdin isn't a TTY (e.g. piped input).
  *
  * @param {string} prompt
@@ -286,7 +286,7 @@ function printTable(headers, rows) {
 
 function printHelp() {
     console.log(`
-  Domma CMS — User Management CLI
+  Domma CMS - User Management CLI
 
   Usage:
     npm run users -- <command> [args] [options]

package/scripts/verify-assets.mjs

@@ -1,5 +1,5 @@
 /**
- * Asset Import Verifier — build/publish gate
+ * Asset Import Verifier - build/publish gate
  *
  * Statically resolves every local ESM import under the browser-facing code
  * (admin/ + public/) against the files that actually exist, and fails if any
@@ -11,7 +11,7 @@
  * import natively (no bundler). If a release ships consumer code that imports a
  * new module but forgets to include the module file (as 0.22.1 did with
  * /public/js/menu-decor.mjs), every page 404s on the import and the whole site
- * breaks — with no signal but a browser console error, and it cascades to every
+ * breaks - with no signal but a browser console error, and it cascades to every
  * downstream project that copies these dirs on update. A bundler would catch
  * this at build time; because we don't bundle, this gate stands in for that.
  *
@@ -21,8 +21,8 @@
  * Exits 1 (with a report) on any dangling import, 0 otherwise. Wired into
  * scripts/build.js so `make pack` / `make release-npm` cannot ship a broken set.
  *
- * Scope (deliberately conservative — zero false positives is the whole point):
- * only STATIC, LOCAL specifiers with an explicit extension are checked — the
+ * Scope (deliberately conservative - zero false positives is the whole point):
+ * only STATIC, LOCAL specifiers with an explicit extension are checked - the
  * only kind this codebase emits. Bare (npm) specifiers, URLs, dynamic/template
  * specifiers, commented-out imports, and extension-less paths are all ignored.
  */
@@ -160,12 +160,12 @@ export async function verifyAssetImports({ projectRoot, roots = ['admin', 'publi
 
 export function formatReport(result, label) {
     if (result.ok) {
-        return `[verify-assets] OK — ${result.scanned} files scanned, all local imports resolve (${label}).`;
+        return `[verify-assets] OK - ${result.scanned} files scanned, all local imports resolve (${label}).`;
     }
     const lines = [
         '',
         '  ╔════════════════════════════════════════════════════════════════╗',
-        '  ║  ASSET INTEGRITY FAILURE — dangling front-end imports detected  ║',
+        '  ║  ASSET INTEGRITY FAILURE - dangling front-end imports detected  ║',
         '  ╚════════════════════════════════════════════════════════════════╝',
         `  Context: ${label}`,
         `  ${result.missing.length} import(s) reference files that do not exist:`,

package/server/config.js

@@ -43,7 +43,7 @@ export function saveConfig(name, data) {
 }
 
 /**
- * Structural config — loaded once at startup.
+ * Structural config - loaded once at startup.
  * Do not use for admin-editable settings (site, navigation, presets, plugins).
  */
 const serverConfig = loadJson('server');