domma-cms 0.44.0 → 0.45.1

package/server/routes/api/collections.js

@@ -31,7 +31,7 @@
  * DELETE /v1/:slug/:id      ≡ DELETE /collections/:slug/public/:id
  *
  * Access modes per verb (`schema.api.<verb>.access`): 'public', a role name
- * (JWT + role level), or 'token' (project-scoped API token — see
+ * (JWT + role level), or 'token' (project-scoped API token - see
  * services/apiTokens.js). A token is ONLY accepted when the mode is 'token';
  * it is never a substitute for a role, and a JWT is never accepted in token
  * mode. `schema.api.read.fields` optionally whitelists which data fields the
@@ -116,7 +116,7 @@ function redactTokenHash(entry) {
 /**
  * Apply the read-field allowlist (`schema.api.read.fields`) to a public read
  * payload. Absent or empty allowlist = all fields. Handles both list payloads
- * ({entries: [...]}) and single entries. Only entry.data is filtered —
+ * ({entries: [...]}) and single entries. Only entry.data is filtered -
  * `_refs` from resolveRefs is not (refs of stripped fields may still appear;
  * documented v1 behaviour).
  *
@@ -147,10 +147,10 @@ export function applyReadFieldAllowlist(schema, payload) {
  */
 export async function checkPublicAccess(schema, operation, request, reply) {
     // Hard kill-switch: if the artefact's project is disabled, the whole
-    // external surface is off — 404 (no oracle). This covers /api/v1
+    // external surface is off - 404 (no oracle). This covers /api/v1
     // collections, the synthesized-schema custom endpoints (/api/x/*, whose
     // meta.project is the endpoint's project), and any token bound to the
-    // project — all funnel through here.
+    // project - all funnel through here.
     if (!(await isProjectEnabled(resolveArtefactProject(schema)))) {
         return reply.status(404).send({ error: 'Not found' });
     }
@@ -162,7 +162,7 @@ export async function checkPublicAccess(schema, operation, request, reply) {
 
     if (access.access === 'public') return; // No auth needed
 
-    // Token mode — project-scoped API token, strict: a token is the ONLY
+    // Token mode - project-scoped API token, strict: a token is the ONLY
     // accepted credential here (a JWT never satisfies token mode, and a
     // token never satisfies a role mode).
     if (access.access === 'token') {
@@ -184,7 +184,7 @@ export async function checkPublicAccess(schema, operation, request, reply) {
         return;
     }
 
-    // Auth required — try to verify JWT
+    // Auth required - try to verify JWT
     try {
         await request.jwtVerify();
     } catch {
@@ -193,7 +193,7 @@ export async function checkPublicAccess(schema, operation, request, reply) {
 
     const user = request.user;
     const requiredLevel = roleLevel(access.access);
-    // Effective level — multi-role users get the lowest (most privileged) level
+    // Effective level - multi-role users get the lowest (most privileged) level
     // across their primary + additional roles for this access decision.
     const userLevel     = getEffectiveLevel(user);
 
@@ -307,9 +307,9 @@ export async function collectionsRoutes(fastify) {
      * GET /api/collections/:slug/entries
      *
      * Query parameters:
-     *   page, limit, sort, order   — pagination/sort (limit=0 means "no limit")
-     *   search                     — free-text substring across all field values
-     *   filter[<field>_<op>]=val   — structured filter; see filterEngine.js
+     *   page, limit, sort, order   - pagination/sort (limit=0 means "no limit")
+     *   search                     - free-text substring across all field values
+     *   filter[<field>_<op>]=val   - structured filter; see filterEngine.js
      *
      * Example:
      *   /api/collections/jobs/entries?filter[location]=London&filter[salary_gte]=50000
@@ -388,7 +388,7 @@ export async function collectionsRoutes(fastify) {
         }
     });
 
-    // Clear all entries — DELETE /collections/:slug/entries (no :id)
+    // Clear all entries - DELETE /collections/:slug/entries (no :id)
     fastify.delete('/collections/:slug/entries', canDelete, async (request, reply) => {
         try {
             await clearEntries(request.params.slug);
@@ -493,11 +493,11 @@ export async function collectionsRoutes(fastify) {
     /*
      * GET /api/collections/:slug/public
      *
-     * Public read endpoint — gated by `api.read` in the collection schema.
+     * Public read endpoint - gated by `api.read` in the collection schema.
      * Supports the same pagination/sort/search/filter as the admin endpoint
      * (see GET /collections/:slug/entries above), plus:
      *
-     *   scope=mine   — restrict results to entries created by the current
+     *   scope=mine   - restrict results to entries created by the current
      *                  user (`meta.createdBy === user.id`). Requires a valid
      *                  JWT; returns 401 if unauthenticated. Used by the
      *                  `[collection scope="mine"]` shortcode for per-user
@@ -566,11 +566,11 @@ export async function collectionsRoutes(fastify) {
      * resolved here and the rendered HTML fragment swapped in client-side.
      *
      * Body: { attrs: <base64 JSON of the original shortcode attributes> }
-     * Auth: JWT required — `createdBy = <user.id>` is injected server-side
+     * Auth: JWT required - `createdBy = <user.id>` is injected server-side
      *       (the client cannot tamper with which user's data they see).
      * Returns: { html: '<div class="dm-collection-…">…</div>' }
      *
-     * Security: results are always scoped to `createdBy = <user.id>` —
+     * Security: results are always scoped to `createdBy = <user.id>` -
      * a caller can only ever render their own entries, regardless of the
      * collection's `api.read` setting. This matches the security model
      * of GET /:slug/public?scope=mine.
@@ -586,11 +586,11 @@ export async function collectionsRoutes(fastify) {
          *
          * Body: {
          *   attrs: <base64 JSON of the shortcode attributes>,
-         *   page:  <number, optional — applied via attrs.limit + slicing>
+         *   page:  <number, optional - applied via attrs.limit + slicing>
          * }
          *
          * Auth: gated by the target collection's `api.read` setting via
-         *       checkPublicAccess(). No user identity is injected — this
+         *       checkPublicAccess(). No user identity is injected - this
          *       endpoint is for general fragment rendering, not per-user
          *       scoping (that's render-scope's job).
          *
@@ -712,7 +712,7 @@ export async function collectionsRoutes(fastify) {
     fastify.delete('/collections/:slug/public/:id', publicDeleteEntry);
 
     // -------------------------------------------------------------------------
-    // External versioned API — stable alias of the public endpoints above.
+    // External versioned API - stable alias of the public endpoints above.
     // Documented surface for external consumers (docs/api-reference.md).
     // -------------------------------------------------------------------------
 

package/server/routes/api/dashboard.js

@@ -98,7 +98,7 @@ function buildTopPages(daily, days = 7) {
         .slice(0, 5);
 }
 
-// ── Journeys / spikes — ported verbatim from plugins/analytics so the core
+// ── Journeys / spikes - ported verbatim from plugins/analytics so the core
 //    dashboard can compute them off disk without the plugin's encapsulated
 //    `fastify.analytics` decorator (which it cannot see). Keep in sync with
 //    plugins/analytics/plugin.js.
@@ -181,7 +181,7 @@ function detectSpikes(daily, now = new Date()) {
 }
 
 /**
- * Recent activity feed — combines page version events with recent collection
+ * Recent activity feed - combines page version events with recent collection
  * entries (form submissions). Returns at most 10 items, newest first.
  *
  * @returns {Promise<Array<object>>}
@@ -189,7 +189,7 @@ function detectSpikes(daily, now = new Date()) {
 async function buildActivity() {
     const items = [];
 
-    // Versions — read each page's _meta.json via the service so the schema
+    // Versions - read each page's _meta.json via the service so the schema
     // stays in one place. listVersions returns newest-first.
     const versionsDir = path.join(ROOT, 'content', 'versions');
     try {
@@ -211,7 +211,7 @@ async function buildActivity() {
         }
     } catch { /* no versions dir */ }
 
-    // Collection entries — each slug has a single data.json with an array of
+    // Collection entries - each slug has a single data.json with an array of
     // entries. Take the newest ENTRIES_PER_COLLECTION by meta.createdAt.
     const collectionsDir = path.join(ROOT, 'content', 'collections');
     try {
@@ -277,7 +277,7 @@ export async function dashboardRoutes(fastify, opts = {}) {
         const analytics = fastify.analytics;
         // The analytics plugin decorates `analytics` inside its own prefixed,
         // encapsulated scope, so `fastify.analytics` is undefined here in the
-        // core dashboard route — traffic/topPages always read 0 even though hits
+        // core dashboard route - traffic/topPages always read 0 even though hits
         // are recorded. Read the plugin's daily counters straight off disk (same
         // pattern as buildActivity reading versions/collections below).
         const daily = (await safe('analytics.daily', async () => {

package/server/routes/api/effects.js

@@ -1,7 +1,7 @@
 /**
  * Effects API Routes
- * GET  /api/effects/settings  — public (read by public site IIFE)
- * PUT  /api/effects/settings  — admin-only (save user overrides)
+ * GET  /api/effects/settings  - public (read by public site IIFE)
+ * PUT  /api/effects/settings  - admin-only (save user overrides)
  */
 import {authenticate, requireAdmin} from '../../middleware/auth.js';
 import {getConfig, saveConfig} from '../../config.js';

package/server/routes/api/endpoints-public.js

@@ -1,5 +1,5 @@
 /**
- * Custom API Endpoints — public surface
+ * Custom API Endpoints - public surface
  *
  * One catch-all serves every user-defined endpoint:
  *   GET /api/x/<project><path>     e.g. /api/x/world-cup/fixtures-day/2026-06-11
@@ -7,7 +7,7 @@
  * Definitions live in the `api-endpoints` preset collection and are matched
  * at request time by services/apiEndpoints.js. Auth (public / token / role),
  * project binding, token scopes, and the read field allowlist all reuse the
- * public collections machinery via a synthesized schema — one battle-tested
+ * public collections machinery via a synthesized schema - one battle-tested
  * code path for every external read.
  *
  * Unknown project, unknown path, and disabled endpoints all 404 identically
@@ -17,7 +17,7 @@ import {EndpointParamError, executeEndpoint, matchEndpoint} from '../../services
 import {applyReadFieldAllowlist, checkPublicAccess} from './collections.js';
 import * as cache from '../../services/cache/index.js';
 
-/** Cached sentinel for single-mode misses — a miss is a cacheable answer. */
+/** Cached sentinel for single-mode misses - a miss is a cacheable answer. */
 const NOT_FOUND = {__endpointNotFound: true};
 
 /**
@@ -44,7 +44,7 @@ export async function endpointsPublicRoutes(fastify) {
 
         const {def, params} = match;
 
-        // Synthesized schema — checkPublicAccess reads exactly api.read,
+        // Synthesized schema - checkPublicAccess reads exactly api.read,
         // slug (token scopes), and meta.project (token project binding).
         const synth = {
             slug: def.collection,
@@ -63,7 +63,7 @@ export async function endpointsPublicRoutes(fastify) {
         };
 
         try {
-            // Only public responses are cacheable — token/role responses are
+            // Only public responses are cacheable - token/role responses are
             // caller-dependent. Both tags are invalidated by the service layer
             // on every write path: entry mutations bust collection:<slug>, and
             // definition edits (entries in api-endpoints) bust

package/server/routes/api/forms.js

@@ -4,18 +4,18 @@
  * Submissions are stored exclusively in Collections (no dual-storage).
  *
  * Endpoints (prefix: /api):
- *   GET    /forms                          — admin: list all forms
- *   POST   /forms                          — admin: create new form
- *   GET    /forms/:slug                    — admin: get form definition
- *   GET    /forms/:slug/public             — public: get form (no actions block)
- *   PUT    /forms/:slug                    — admin: update form definition
- *   DELETE /forms/:slug                    — admin: delete form
- *   GET    /forms/:slug/submissions        — admin: list submissions from collection
- *   GET    /forms/:slug/submissions/export — admin: CSV export from collection
- *   DELETE /forms/:slug/submissions        — admin: clear all submissions
- *   DELETE /forms/:slug/submissions/:id    — admin: delete one submission
- *   POST   /forms/submit/:slug             — public: accept submission
- *   POST   /forms/test-email               — admin: send test email
+ *   GET    /forms                          - admin: list all forms
+ *   POST   /forms                          - admin: create new form
+ *   GET    /forms/:slug                    - admin: get form definition
+ *   GET    /forms/:slug/public             - public: get form (no actions block)
+ *   PUT    /forms/:slug                    - admin: update form definition
+ *   DELETE /forms/:slug                    - admin: delete form
+ *   GET    /forms/:slug/submissions        - admin: list submissions from collection
+ *   GET    /forms/:slug/submissions/export - admin: CSV export from collection
+ *   DELETE /forms/:slug/submissions        - admin: clear all submissions
+ *   DELETE /forms/:slug/submissions/:id    - admin: delete one submission
+ *   POST   /forms/submit/:slug             - public: accept submission
+ *   POST   /forms/test-email               - admin: send test email
  */
 import {createRequire} from 'module';
 import {fileURLToPath} from 'url';
@@ -40,7 +40,7 @@ import {v4 as uuidv4} from 'uuid';
 /**
  * Detect form↔collection mismatches at save time so admins know BEFORE
  * users hit silent rejection. Returns an array of human-readable warning
- * strings — empty when the form lines up cleanly with its target collection.
+ * strings - empty when the form lines up cleanly with its target collection.
  *
  * Checks performed:
  *   - Target collection exists (otherwise every submission goes nowhere)
@@ -63,7 +63,7 @@ async function detectFormCollectionMismatch(form) {
         return warnings;
     }
     if (!collection) {
-        warnings.push(`Target collection "${targetSlug}" does not exist — submissions will fail. Either create the collection or change the form's target.`);
+        warnings.push(`Target collection "${targetSlug}" does not exist - submissions will fail. Either create the collection or change the form's target.`);
         return warnings;
     }
 
@@ -145,7 +145,7 @@ function validateUpload(fieldCfg, part, size) {
  * `content/media/`, and replaced by a `{ url, name, size, mime }` reference.
  *
  * Throws on validation failure (caller handles HTTP 400). Files are streamed
- * into memory up to fastify-multipart's configured limit — fine for the
+ * into memory up to fastify-multipart's configured limit - fine for the
  * resume-pdf / portrait-photo scale; large uploads should still use the admin
  * media flow.
  *
@@ -163,7 +163,7 @@ async function parseMultipartForm(request, form) {
         if (part.type === 'file') {
             const fieldCfg = fileFields.get(part.fieldname);
             if (!fieldCfg) {
-                // Unknown file field — drain and skip rather than 400, so a
+                // Unknown file field - drain and skip rather than 400, so a
                 // form that gains a file input later doesn't reject older
                 // submissions in-flight from a stale page.
                 for await (const _ of part.file) { /* drain */ }
@@ -174,7 +174,7 @@ async function parseMultipartForm(request, form) {
             const buffer = Buffer.concat(chunks);
             const err    = validateUpload(fieldCfg, part, buffer.length);
             if (err) throw new Error(err);
-            if (buffer.length === 0) continue;     // empty file input — skip
+            if (buffer.length === 0) continue;     // empty file input - skip
             const saved = await saveMedia(safeFilename(part.filename), buffer);
             out[part.fieldname] = {
                 url:  saved.url,
@@ -183,7 +183,7 @@ async function parseMultipartForm(request, form) {
                 mime: part.mimetype
             };
         } else {
-            // Text field — last value wins on duplicates (browser-standard).
+            // Text field - last value wins on duplicates (browser-standard).
             out[part.fieldname] = part.value;
         }
     }
@@ -237,7 +237,7 @@ export async function formsRoutes(fastify) {
     const canDelete = { preHandler: [authenticate, requirePermission('collections', 'delete')] };
 
     // -----------------------------------------------------------------------
-    // GET /forms — list all form definitions with submission counts
+    // GET /forms - list all form definitions with submission counts
     // -----------------------------------------------------------------------
     fastify.get('/forms', canRead, async (request) => {
         const {canSeeArtefact} = await import('../../services/projects.js');
@@ -245,7 +245,7 @@ export async function formsRoutes(fastify) {
         const result = await Promise.all(forms.map(async form => {
             let submissionCount = 0;
             try {
-                // listEntries returns { entries, total, page, limit } — total is the
+                // listEntries returns { entries, total, page, limit } - total is the
                 // unpaginated count which is what we want for the badge here.
                 const r = await listEntries(form.slug, { limit: 0 });
                 submissionCount = r.total ?? (r.entries || []).length;
@@ -263,7 +263,7 @@ export async function formsRoutes(fastify) {
     });
 
     // -----------------------------------------------------------------------
-    // POST /forms — create new form
+    // POST /forms - create new form
     // -----------------------------------------------------------------------
     fastify.post('/forms', canCreate, async (request, reply) => {
         const { title, slug: rawSlug } = request.body || {};
@@ -280,7 +280,7 @@ export async function formsRoutes(fastify) {
             await readForm(slug);
             return reply.status(409).send({ error: `A form with slug "${slug}" already exists.` });
         } catch {
-            // Does not exist — good
+            // Does not exist - good
         }
 
         const now  = new Date().toISOString();
@@ -333,7 +333,7 @@ export async function formsRoutes(fastify) {
     });
 
     // -----------------------------------------------------------------------
-    // GET /forms/:slug — get single form (admin, includes actions)
+    // GET /forms/:slug - get single form (admin, includes actions)
     // -----------------------------------------------------------------------
     fastify.get('/forms/:slug', canRead, async (request, reply) => {
         let form;
@@ -350,7 +350,7 @@ export async function formsRoutes(fastify) {
     });
 
     // -----------------------------------------------------------------------
-    // GET /forms/:slug/public — get form for public rendering (no actions)
+    // GET /forms/:slug/public - get form for public rendering (no actions)
     // -----------------------------------------------------------------------
     fastify.get('/forms/:slug/public', async (request, reply) => {
         try {
@@ -363,7 +363,7 @@ export async function formsRoutes(fastify) {
     });
 
     // -----------------------------------------------------------------------
-    // PUT /forms/:slug — update form definition
+    // PUT /forms/:slug - update form definition
     // -----------------------------------------------------------------------
     fastify.put('/forms/:slug', canUpdate, async (request, reply) => {
         const { slug } = request.params;
@@ -386,14 +386,14 @@ export async function formsRoutes(fastify) {
 
         // Non-blocking warnings: check the form's fields against its target
         // collection's required fields. Missing-required-on-form would cause
-        // every submission to fail server-side validation — admin gets a
+        // every submission to fail server-side validation - admin gets a
         // heads-up here so they can fix it BEFORE users hit silent rejection.
         const warnings = await detectFormCollectionMismatch(updated);
         return warnings.length ? { ...updated, warnings } : updated;
     });
 
     // -----------------------------------------------------------------------
-    // DELETE /forms/:slug — delete form
+    // DELETE /forms/:slug - delete form
     // -----------------------------------------------------------------------
     fastify.delete('/forms/:slug', canDelete, async (request, reply) => {
         const { slug } = request.params;
@@ -406,7 +406,7 @@ export async function formsRoutes(fastify) {
     });
 
     // -----------------------------------------------------------------------
-    // GET /forms/:slug/submissions — list submissions from collection
+    // GET /forms/:slug/submissions - list submissions from collection
     // -----------------------------------------------------------------------
     fastify.get('/forms/:slug/submissions', canRead, async (request, reply) => {
         const { slug } = request.params;
@@ -420,19 +420,19 @@ export async function formsRoutes(fastify) {
         const targetSlug = (collectionAction?.enabled && collectionAction.slug) ? collectionAction.slug : slug;
 
         // A form whose backing collection has not been provisioned yet simply
-        // has no submissions — return an empty list rather than a 404 so the
+        // has no submissions - return an empty list rather than a 404 so the
         // admin view loads cleanly instead of erroring.
         const collection = await getCollection(targetSlug);
         if (!collection) return [];
 
-        // listEntries returns { entries, total, page, limit } — unwrap to the
+        // listEntries returns { entries, total, page, limit } - unwrap to the
         // array. Newest-first is the conventional display order.
         const { entries } = await listEntries(targetSlug, { limit: 0 });
         return [...entries].reverse();
     });
 
     // -----------------------------------------------------------------------
-    // GET /forms/:slug/submissions/export — CSV download from collection
+    // GET /forms/:slug/submissions/export - CSV download from collection
     // -----------------------------------------------------------------------
     fastify.get('/forms/:slug/submissions/export', canRead, async (request, reply) => {
         const { slug } = request.params;
@@ -456,7 +456,7 @@ export async function formsRoutes(fastify) {
     });
 
     // -----------------------------------------------------------------------
-    // GET /forms/:slug/submissions/export/json — JSON export from collection
+    // GET /forms/:slug/submissions/export/json - JSON export from collection
     // -----------------------------------------------------------------------
     fastify.get('/forms/:slug/submissions/export/json', canRead, async (request, reply) => {
         const { slug } = request.params;
@@ -479,7 +479,7 @@ export async function formsRoutes(fastify) {
     });
 
     // -----------------------------------------------------------------------
-    // DELETE /forms/:slug/submissions — clear all submissions
+    // DELETE /forms/:slug/submissions - clear all submissions
     // -----------------------------------------------------------------------
     fastify.delete('/forms/:slug/submissions', canDelete, async (request, reply) => {
         const { slug } = request.params;
@@ -492,7 +492,7 @@ export async function formsRoutes(fastify) {
     });
 
     // -----------------------------------------------------------------------
-    // DELETE /forms/:slug/submissions/:id — delete one submission
+    // DELETE /forms/:slug/submissions/:id - delete one submission
     // -----------------------------------------------------------------------
     fastify.delete('/forms/:slug/submissions/:id', canDelete, async (request, reply) => {
         const { slug, id } = request.params;
@@ -505,12 +505,12 @@ export async function formsRoutes(fastify) {
     });
 
     /*
-     * POST /forms/submit/:slug — public form submission.
+     * POST /forms/submit/:slug - public form submission.
      *
      * Authentication is OPTIONAL: when a valid JWT is present the submitter
      * is captured as the entry's `createdBy` and passed into any triggered
      * action's template context (as `{{user.id}}`, `{{user.email}}`, etc.).
-     * Anonymous submissions still work — `createdBy` is null and actions
+     * Anonymous submissions still work - `createdBy` is null and actions
      * receive an empty user. This is what makes the apply/bookmark patterns
      * work without forcing every form to be auth-only:
      *
@@ -527,7 +527,7 @@ export async function formsRoutes(fastify) {
             return reply.status(404).send({ error: 'Form not found.' });
         }
 
-        // Multipart parsing — when the request is multipart (file uploads),
+        // Multipart parsing - when the request is multipart (file uploads),
         // we walk parts ourselves: text fields go into `body`, file parts are
         // validated against the form's field config and saved to /content/media,
         // then their { url, name, size, mime } reference object lands in `body`
@@ -542,7 +542,7 @@ export async function formsRoutes(fastify) {
         }
         const settings = form.settings || {};
 
-        // Best-effort auth — never reject, just enrich.
+        // Best-effort auth - never reject, just enrich.
         let submittingUser = null;
         try {
             const decoded = await request.jwtVerify();
@@ -556,12 +556,12 @@ export async function formsRoutes(fastify) {
             }
         } catch { /* anonymous submission */ }
 
-        // Honeypot check — silently accept if filled (bot detected)
+        // Honeypot check - silently accept if filled (bot detected)
         if (settings.honeypot && body._hp) {
             return { ok: true, message: settings.successMessage, redirect: settings.successRedirect || null };
         }
 
-        // Timing check — silently accept if submitted too fast (< 2 s, likely a bot)
+        // Timing check - silently accept if submitted too fast (< 2 s, likely a bot)
         if (settings.honeypot && body._t) {
             const elapsed = Date.now() - Number(body._t);
             if (!Number.isNaN(elapsed) && elapsed < 2000) {
@@ -614,7 +614,7 @@ export async function formsRoutes(fastify) {
             return reply.status(429).send({ error: 'Too many submissions. Please try again later.' });
         }
 
-        // Build submission data — only include visible fields
+        // Build submission data - only include visible fields
         const data = {};
         for (const field of form.fields || []) {
             if (field.type === 'page-break' || field.type === 'spacer') continue;
@@ -630,9 +630,9 @@ export async function formsRoutes(fastify) {
         // CRITICAL: collection write failure is the difference between "your
         // submission was saved" and "your submission disappeared into thin air".
         // We MUST surface the error to the user rather than logging a warning
-        // and returning success — anything else is a silent-data-loss bug.
+        // and returning success - anything else is a silent-data-loss bug.
         // (Email / webhook / action failures downstream are still treated as
-        // non-fatal — they fire AFTER the entry is persisted, so even a partial
+        // non-fatal - they fire AFTER the entry is persisted, so even a partial
         // delivery has the original submission safely stored.)
         const collectionAction = form.actions?.collection;
         const targetSlug = (collectionAction?.enabled && collectionAction.slug) ? collectionAction.slug : slug;
@@ -653,12 +653,12 @@ export async function formsRoutes(fastify) {
                     createdBy: submittingUser?.id || null
                 });
             } else {
-                // Could not resolve or provision a target — e.g. collection
+                // Could not resolve or provision a target - e.g. collection
                 // storage is explicitly disabled with no slug. Fail loudly
                 // rather than silently lose submissions.
                 fastify.log.warn(`[forms] Submission for "${slug}" had no target collection "${targetSlug}"`);
                 return reply.status(500).send({
-                    error: `Submission not saved — target collection "${targetSlug}" does not exist. Please contact the site administrator.`
+                    error: `Submission not saved - target collection "${targetSlug}" does not exist. Please contact the site administrator.`
                 });
             }
         } catch (err) {
@@ -706,7 +706,7 @@ export async function formsRoutes(fastify) {
             }
         }
 
-        // CMS Action trigger — forwards the authenticated submitter so
+        // CMS Action trigger - forwards the authenticated submitter so
         // action steps can interpolate {{user.id}}, {{user.email}}, etc.
         // (Anonymous submissions still trigger the action with user={}.)
         const actionSlug = form.settings?.actionSlug;
@@ -735,7 +735,7 @@ export async function formsRoutes(fastify) {
     });
 
     // -----------------------------------------------------------------------
-    // POST /forms/test-email — send a test email
+    // POST /forms/test-email - send a test email
     // -----------------------------------------------------------------------
     fastify.post('/forms/test-email', { preHandler: [authenticate, requireAdmin] }, async (request, reply) => {
         const smtp = getConfig('site').smtp || {};

package/server/routes/api/menu-locations.js

@@ -1,9 +1,9 @@
 /**
  * Menu locations API
  *
- * GET /api/menu-locations           — current slot → menu-slug map
- * PUT /api/menu-locations           — replace the map (validates against registry + menus)
- * GET /api/menu-locations/registry  — list registered slots (core + plugin-contributed)
+ * GET /api/menu-locations           - current slot → menu-slug map
+ * PUT /api/menu-locations           - replace the map (validates against registry + menus)
+ * GET /api/menu-locations/registry  - list registered slots (core + plugin-contributed)
  *
  * Auth middlewares are accepted as options so tests can supply no-ops without
  * needing to register `@fastify/jwt` + seed the roles cache. In production the

package/server/routes/api/menus.js

@@ -1,12 +1,12 @@
 /**
  * Menus API
  *
- * GET    /api/menus                  — list (metadata only)
- * GET    /api/menus/:slug            — full menu
- * POST   /api/menus                  — create
- * PUT    /api/menus/:slug            — replace
- * DELETE /api/menus/:slug            — delete (409 if mapped to a slot)
- * POST   /api/menus/:slug/duplicate  — copy as <slug>-copy
+ * GET    /api/menus                  - list (metadata only)
+ * GET    /api/menus/:slug            - full menu
+ * POST   /api/menus                  - create
+ * PUT    /api/menus/:slug            - replace
+ * DELETE /api/menus/:slug            - delete (409 if mapped to a slot)
+ * POST   /api/menus/:slug/duplicate  - copy as <slug>-copy
  *
  * Auth middlewares are accepted as options so tests can supply no-ops without
  * needing to register `@fastify/jwt` + seed the roles cache. In production the
@@ -93,7 +93,7 @@ export async function menusRoutes(fastify, opts = {}) {
         const slot = Object.entries(map).find(([, slug]) => slug === request.params.slug)?.[0];
         if (slot) {
             return reply.status(409).send({
-                error: `Cannot delete — menu is mapped to slot "${slot}". Unmap it first.`
+                error: `Cannot delete - menu is mapped to slot "${slot}". Unmap it first.`
             });
         }
         const ok = await deleteMenu(request.params.slug);