domma-cms 0.44.0 → 0.45.1

package/server/server.js

@@ -38,7 +38,7 @@ const DOMMA_DIST = path.join(dommaPackageDir, 'public', 'dist');
 
 const { server: serverConfig, auth: authConfig } = config;
 
-// Validate JWT_SECRET before starting — prevents silent auth failures
+// Validate JWT_SECRET before starting - prevents silent auth failures
 const JWT_SECRET = process.env.JWT_SECRET;
 if (!JWT_SECRET || JWT_SECRET === 'CHANGE_ME' || JWT_SECRET.length < 32) {
     console.error('');
@@ -49,7 +49,7 @@ if (!JWT_SECRET || JWT_SECRET === 'CHANGE_ME' || JWT_SECRET.length < 32) {
     process.exit(1);
 }
 
-// MANAGER_SECRET is optional — only needed when domma-cms-manager pushes notifications.
+// MANAGER_SECRET is optional - only needed when domma-cms-manager pushes notifications.
 // Warn if set but insecure; silently accept if absent (manager push is disabled).
 const MANAGER_SECRET = process.env.MANAGER_SECRET;
 if (MANAGER_SECRET && MANAGER_SECRET.length < 32) {
@@ -92,7 +92,7 @@ await app.register(helmet, {
         }
     },
     crossOriginEmbedderPolicy: false, // allow embedding images/resources
-    hsts: false, // disable HSTS — server runs HTTP only; HSTS would force browser to https
+    hsts: false, // disable HSTS - server runs HTTP only; HSTS would force browser to https
 });
 
 await app.register(jwt, { secret: process.env.JWT_SECRET });
@@ -102,7 +102,7 @@ await app.register(rateLimit, {
     global: true, // apply default limit to all routes; stricter per-route limits override this
     max: 500,
     timeWindow: '1 minute',
-    // Loopback is always exempt — local admin use should never be rate-limited.
+    // Loopback is always exempt - local admin use should never be rate-limited.
     // When behind a reverse proxy (TRUST_PROXY), the proxy's loopback is also exempt.
     allowList: ['127.0.0.1', '::1', '::ffff:127.0.0.1'],
 });
@@ -133,11 +133,11 @@ await app.register(staticPlugin, {
     decorateReply: false
 });
 
-// Serve admin panel assets — no-store on JS/CSS so ESM module URLs are never
+// Serve admin panel assets - no-store on JS/CSS so ESM module URLs are never
 // cached. `no-cache` revalidates but browsers may keep the parsed ESM module
 // keyed by URL across reloads, which means a hard refresh can still load the
 // stale code path. `no-store` skips the cache entirely. Other admin assets
-// (images, html) keep no-cache. Local-only impact — admin is not public.
+// (images, html) keep no-cache. Local-only impact - admin is not public.
 await app.register(staticPlugin, {
     root: path.join(ROOT, 'admin'),
     prefix: '/admin/',
@@ -162,7 +162,7 @@ await fs.mkdir(pluginsDir,     { recursive: true });
 await fs.mkdir(blocksDir, {recursive: true});
 
 // ---------------------------------------------------------------------------
-// Pro feature — optional MongoDB connections
+// Pro feature - optional MongoDB connections
 // ---------------------------------------------------------------------------
 
 try {
@@ -173,11 +173,11 @@ try {
         app.addHook('onClose', shutdown);
     }
 } catch {
-    // No connections.json or empty — pure file-based mode (free version).
+    // No connections.json or empty - pure file-based mode (free version).
 }
 
 // ---------------------------------------------------------------------------
-// Roles — seed preset collection + load into cache
+// Roles - seed preset collection + load into cache
 // ---------------------------------------------------------------------------
 
 await seedRoles();
@@ -186,13 +186,13 @@ await seedUserProfiles();
 await ensureAllProfiles();
 await seedPresetCollections();
 await seedCoreProject();
-await seedDocsProject();  // built-in Domma Docs project — seeded disabled by default
+await seedDocsProject();  // built-in Domma Docs project - seeded disabled by default
 await seedDefaultBlocks();
 await seedDefaultComponents();
 await refreshComponentTagAllowlist();
 
 // ---------------------------------------------------------------------------
-// Menus — one-shot migration from legacy navigation.json + site footer links
+// Menus - one-shot migration from legacy navigation.json + site footer links
 // ---------------------------------------------------------------------------
 
 try {
@@ -229,7 +229,7 @@ console.log(`[cache] driver=${cache.isEnabled() ? config.cache.driver : 'disable
 // stale pages. No-op on a cold memory cache; matters for the Redis driver.
 await cache.invalidateTags(['docs']);
 
-// Serve uploaded media files — nosniff prevents browsers rendering spoofed content types
+// Serve uploaded media files - nosniff prevents browsers rendering spoofed content types
 await app.register(staticPlugin, {
     root: mediaDir,
     prefix: '/media/',
@@ -239,7 +239,7 @@ await app.register(staticPlugin, {
     }
 });
 
-// Serve plugin admin/ and public/ subdirs only — block plugin.js, config.js, data/, etc.
+// Serve plugin admin/ and public/ subdirs only - block plugin.js, config.js, data/, etc.
 await app.register(async function pluginStaticScope(instance) {
   instance.addHook('onRequest', (request, reply, done) => {
     const relative = request.url.replace(/^\/plugins\//, '').split('?')[0];
@@ -265,7 +265,7 @@ await app.register(async function pluginStaticScope(instance) {
 });
 
 // ---------------------------------------------------------------------------
-// Global error handler — prevents stack trace leaks in production
+// Global error handler - prevents stack trace leaks in production
 // ---------------------------------------------------------------------------
 
 app.setErrorHandler((error, request, reply) => {
@@ -278,6 +278,24 @@ app.setErrorHandler((error, request, reply) => {
     return reply.code(statusCode).send({ error: message });
 });
 
+// ---------------------------------------------------------------------------
+// Admin API responses are never cacheable
+// ---------------------------------------------------------------------------
+// The admin SPA must always see the live state of the site - a stale list is
+// indistinguishable from a missing artefact, and the user is left arguing with
+// their own CMS. Everything under /api is no-store EXCEPT the two externally
+// consumable surfaces, which have their own caching contracts:
+//   /api/v1/*  - collection access by API token
+//   /api/x/*   - API Builder endpoints
+app.addHook('onSend', async (request, reply) => {
+    const url = request.raw.url || '';
+    if (!url.startsWith('/api/')) return;
+    if (url.startsWith('/api/v1/') || url.startsWith('/api/x/')) return;
+    reply.header('Cache-Control', 'no-store, must-revalidate');
+    reply.header('Pragma', 'no-cache');
+    reply.header('Expires', '0');
+});
+
 // ---------------------------------------------------------------------------
 // Auth API Routes (no authentication required on these endpoints themselves)
 // ---------------------------------------------------------------------------
@@ -374,10 +392,10 @@ for (const [name, plugin] of Object.entries(getLoadedPlugins())) {
 }
 
 // ---------------------------------------------------------------------------
-// Public Site (catch-all — must be last)
+// Public Site (catch-all - must be last)
 // ---------------------------------------------------------------------------
 
-// Domma Docs (request-time handbook) — dedicated /domma-docs(/*) prefix that
+// Domma Docs (request-time handbook) - dedicated /domma-docs(/*) prefix that
 // out-prioritises the catch-all; must be registered before it.
 const { docsPublicRoutes } = await import('./routes/docs-public.js');
 await app.register(docsPublicRoutes);

package/server/services/actions.js

@@ -1,17 +1,17 @@
 /**
- * Actions Service (Pro — requires MongoDB)
+ * Actions Service (Pro - requires MongoDB)
  *
  * Action configs are stored in MongoDB `cms__actions` on the 'default' connection.
  * Executing an action runs a sequence of steps against a target collection entry.
  *
  * Supported step types:
- *   updateField         — overwrite one field on the source entry
- *   deleteEntry         — remove the source entry
- *   moveToCollection    — copy source entry into target collection AND delete source
- *   createInCollection  — create a new entry in another collection; source untouched
+ *   updateField         - overwrite one field on the source entry
+ *   deleteEntry         - remove the source entry
+ *   moveToCollection    - copy source entry into target collection AND delete source
+ *   createInCollection  - create a new entry in another collection; source untouched
  *                         (used for apply/follow/bookmark/upvote-style relations)
- *   webhook             — POST/PUT/GET to an external URL with interpolated body
- *   email               — send a transactional email via configured SMTP
+ *   webhook             - POST/PUT/GET to an external URL with interpolated body
+ *   email               - send a transactional email via configured SMTP
  *
  * Template interpolation in step configs:
  *   {{entry.id}}         → source entry id
@@ -23,7 +23,7 @@
  *   {{user.role}}        → executing user's role
  *   {{env.CMS_PUBLIC_*}} → environment variables with CMS_PUBLIC_ prefix only
  *
- * Note: execution is not transactional — partial results are returned on failure
+ * Note: execution is not transactional - partial results are returned on failure
  * with a `stepsCompleted` count.
  */
 import {v4 as uuidv4} from 'uuid';
@@ -151,16 +151,16 @@ async function executeStep(step, collection, entry, context) {
         }
 
         /*
-         * createInCollection — append an entry to another collection without
+         * createInCollection - append an entry to another collection without
          * touching the source. Designed for relational patterns like:
          *   - Apply for job  → create entry in `applications` { jobId, candidateId, status }
          *   - Bookmark page  → create entry in `bookmarks`    { pageId, userId }
          *   - Upvote item    → create entry in `votes`        { itemId, userId, value: 1 }
          *
          * Config:
-         *   targetCollection {string} required — slug of the collection to append to
-         *   data             {object} required — field map; values are template-interpolated
-         *   createdBy        {string} optional — '{{user.id}}' is the conventional value;
+         *   targetCollection {string} required - slug of the collection to append to
+         *   data             {object} required - field map; values are template-interpolated
+         *   createdBy        {string} optional - '{{user.id}}' is the conventional value;
          *                                       enables row-level "mine" filtering downstream
          *
          * Returns: { created: <new entry id>, in: <targetCollection> }
@@ -303,7 +303,7 @@ export async function createAction(data, userId = null) {
             confirmMessage: trigger?.confirmMessage || null
         },
         steps,
-        // State-machine transition — when set, the action is gated by the
+        // State-machine transition - when set, the action is gated by the
         // entry's current value of `field` matching one of the `from` values,
         // and is advertised as an "available transition" for that state.
         // Optional `to` is informational only (steps still do the actual write).
@@ -399,12 +399,12 @@ export async function listActionsForCollection(collectionSlug) {
  *   3. action.access.roles allows the user (compared by role level so
  *      higher-privileged roles inherit access automatically)
  *
- * Returns a stripped projection — slug, title, trigger config, transition —
+ * Returns a stripped projection - slug, title, trigger config, transition -
  * so the client can render buttons without leaking step internals.
  *
  * @param {string} collectionSlug
  * @param {object} entry          - The entry being inspected (needed for field-value match)
- * @param {object} [user]         - { role } — anonymous if missing
+ * @param {object} [user]         - { role } - anonymous if missing
  * @returns {Promise<object[]>}
  */
 export async function listTransitionsForEntry(collectionSlug, entry, user = null) {
@@ -414,7 +414,7 @@ export async function listTransitionsForEntry(collectionSlug, entry, user = null
     const { getRoleLevel } = await import('./roles.js');
     const { getEffectiveLevel } = await import('./userRoles.js');
     // Use effective level so multi-role users see transitions any of their
-    // roles permit — e.g. a user who's primarily a candidate but also an
+    // roles permit - e.g. a user who's primarily a candidate but also an
     // admin sees BOTH the candidate-only "withdraw" AND the admin-only
     // "approve" transitions on the same entry.
     const userLevel = getEffectiveLevel(user);
@@ -446,7 +446,7 @@ export async function listTransitionsForEntry(collectionSlug, entry, user = null
 
 /**
  * Execute an action against a specific collection entry.
- * Steps run sequentially — not transactional.
+ * Steps run sequentially - not transactional.
  * Returns partial results with stepsCompleted count on failure.
  *
  * @param {string} slug             - Action slug
@@ -469,7 +469,7 @@ export async function executeAction(slug, entryId, { user = null } = {}) {
         throw err;
     }
 
-    // State-machine guard — an action with a transition config only runs when
+    // State-machine guard - an action with a transition config only runs when
     // the entry's current value of `field` is in `from`. Stops illegal moves
     // like "withdraw" on an already-rejected application; the API returns 409
     // so the client can present a meaningful "no longer available" message
@@ -480,7 +480,7 @@ export async function executeAction(slug, entryId, { user = null } = {}) {
         const currentValue = entry.data?.[t.field];
         const allowed      = Array.isArray(t.from) ? t.from : (t.from ? [t.from] : []);
         if (allowed.length && !allowed.includes(currentValue)) {
-            const err = new Error(`Cannot apply "${action.title}" — current ${t.field} is "${currentValue ?? '(none)'}", allowed: ${allowed.join(', ')}`);
+            const err = new Error(`Cannot apply "${action.title}" - current ${t.field} is "${currentValue ?? '(none)'}", allowed: ${allowed.join(', ')}`);
             err.statusCode = 409;
             throw err;
         }

package/server/services/adapters/FileAdapter.js

@@ -1,5 +1,5 @@
 /**
- * FileAdapter — file-based storage adapter for Collection entries.
+ * FileAdapter - file-based storage adapter for Collection entries.
  *
  * Stores entries in `data.json` inside the collection directory.
  * This is the default adapter for all collections and the only adapter
@@ -56,7 +56,7 @@ export class FileAdapter {
      *
      * `search` is a simple substring match across all field values (legacy
      * behaviour, kept for the admin search box). `filter` is the structured
-     * DSL — see `filterEngine.js` for operator syntax. Both may be combined;
+     * DSL - see `filterEngine.js` for operator syntax. Both may be combined;
      * search runs first, then filter.
      *
      * @param {string} slug

package/server/services/adapters/MongoAdapter.js

@@ -1,10 +1,10 @@
 /**
- * MongoAdapter — MongoDB storage adapter for Collection entries. (Pro feature)
+ * MongoAdapter - MongoDB storage adapter for Collection entries. (Pro feature)
  *
  * Each CMS collection maps to a MongoDB collection prefixed with `cms_`
  * (e.g. slug "contacts" → MongoDB collection "cms_contacts").
  *
- * Entry format is preserved: { id, data, meta } — identical to FileAdapter output.
+ * Entry format is preserved: { id, data, meta } - identical to FileAdapter output.
  * MongoDB's _id field is stripped from all returned documents.
  *
  * Adapter interface:
@@ -66,7 +66,7 @@ export class MongoAdapter {
      * and structured filtering.
      *
      * `filter` is translated to native MongoDB query operators via
-     * `filterEngine.toMongoQuery()` and pushed down to the database — page
+     * `filterEngine.toMongoQuery()` and pushed down to the database - page
      * authors writing `[collection where_salary_gte="50000"]` get index-aware
      * queries automatically. When `search` is present, all documents are
      * fetched and filtered in memory (same behaviour as FileAdapter, kept
@@ -200,7 +200,7 @@ export class MongoAdapter {
 
     /**
      * Drop the backing MongoDB collection entirely (documents, indexes and
-     * the namespace). Used when the CMS collection itself is deleted —
+     * the namespace). Used when the CMS collection itself is deleted -
      * clear() only removes documents and would leave `cms_<slug>` behind.
      *
      * Deliberately bypasses _col(): that helper ensures the unique index,
@@ -213,7 +213,7 @@ export class MongoAdapter {
         try {
             await this._db.collection(`${PREFIX}${slug}`).drop();
         } catch (err) {
-            // Already absent — nothing to drop.
+            // Already absent - nothing to drop.
             if (err.codeName !== 'NamespaceNotFound') throw err;
         }
         this._ensured.delete(slug);

package/server/services/apiEndpoints.js

@@ -5,12 +5,12 @@
  *
  * Definitions are DATA, never code: entries in the file-based `api-endpoints`
  * preset collection. A definition binds a URL path (with `:param` segments)
- * to a collection query — fixed filters whose values may carry
+ * to a collection query - fixed filters whose values may carry
  * `{{params.<name>}}` / `{{query.<name>}}` placeholders, sort/limit, a read
  * field allowlist, and an auth mode (public / token / role) that reuses the
  * exact machinery of the public collections API.
  *
- * Substituted values only ever feed the filterEngine — there is no eval and
+ * Substituted values only ever feed the filterEngine - there is no eval and
  * no way for a definition to execute code.
  */
 import {createEntry, deleteEntry, getCollection, getEntry, listEntries, updateEntry} from './collections.js';
@@ -42,7 +42,7 @@ function invalidateRegistry() {
     registry = null;
 }
 
-// Generic admin collection endpoints emit these for ALL collections — the
+// Generic admin collection endpoints emit these for ALL collections - the
 // service's own mutations invalidate directly, this catches edits made
 // through the admin entries grid.
 for (const ev of ['collection:entryCreated', 'collection:entryUpdated', 'collection:entryDeleted']) {
@@ -79,7 +79,7 @@ function sanitise(entry) {
 }
 
 /**
- * Normalise a path to its shape for duplicate detection — every `:param`
+ * Normalise a path to its shape for duplicate detection - every `:param`
  * segment collapses to `:` so `/a/:x` and `/a/:y` are the same shape.
  *
  * @param {string} path
@@ -113,12 +113,12 @@ async function validateDefinition(data, {excludeId} = {}) {
     if (schema.systemManaged || schema.preset) {
         throw new Error(`Collection "${data.collection}" is system-managed and cannot be exposed`);
     }
-    // An endpoint may only expose collections from its own project or core —
+    // An endpoint may only expose collections from its own project or core -
     // the URL namespace must match where the data lives, and scoped users
     // must not be able to publish another project's data through their own.
     const collectionProject = resolveArtefactProject(schema);
     if (collectionProject !== data.project && collectionProject !== CORE_PROJECT_SLUG) {
-        throw new Error(`Collection "${data.collection}" belongs to project "${collectionProject}" — an endpoint may only expose collections from its own project or core`);
+        throw new Error(`Collection "${data.collection}" belongs to project "${collectionProject}" - an endpoint may only expose collections from its own project or core`);
     }
 
     if (typeof data.path !== 'string' || !data.path.startsWith('/')) {
@@ -131,13 +131,13 @@ async function validateDefinition(data, {excludeId} = {}) {
         if (PARAM_SEGMENT_RE.test(seg)) {
             paramNames.add(seg.slice(1));
         } else if (!STATIC_SEGMENT_RE.test(seg)) {
-            throw new Error(`Invalid path segment "${seg}" — use lowercase letters, numbers, hyphens, or :param`);
+            throw new Error(`Invalid path segment "${seg}" - use lowercase letters, numbers, hyphens, or :param`);
         }
     }
 
     const auth = data.auth || 'public';
     if (auth !== 'public' && auth !== 'token' && !getRoleMap().has(auth)) {
-        throw new Error(`Unknown auth mode "${auth}" — use public, token, or a role name`);
+        throw new Error(`Unknown auth mode "${auth}" - use public, token, or a role name`);
     }
 
     if (data.mode != null && !MODES.includes(data.mode)) throw new Error('mode must be "list" or "single"');
@@ -170,7 +170,7 @@ async function validateDefinition(data, {excludeId} = {}) {
         }
     }
 
-    // Duplicate shape per project — `/a/:x` and `/a/:y` collide.
+    // Duplicate shape per project - `/a/:x` and `/a/:y` collide.
     const shape = pathShape(data.path);
     const {entries} = await listEntries(API_ENDPOINTS_COLLECTION_SLUG, {limit: 0});
     const clash = entries.find(e =>
@@ -216,7 +216,7 @@ export async function createEndpoint(input) {
 
 /**
  * Update an endpoint. The project binding is immutable (it is the endpoint's
- * URL namespace) — create a new endpoint to move one.
+ * URL namespace) - create a new endpoint to move one.
  *
  * @param {string} id
  * @param {object} patch
@@ -387,14 +387,14 @@ function substituteFilter(filterTemplate, params, query) {
 }
 
 /**
- * Query keys that control the query envelope, not a field to filter on — they
+ * Query keys that control the query envelope, not a field to filter on - they
  * must never be interpreted as ad-hoc filters (otherwise `?limit=5` would
  * filter a field called "limit").
  */
 const RESERVED_QUERY_KEYS = new Set(['page', 'limit', 'sort', 'order', 'search']);
 
 /**
- * The fields an endpoint is allowed to expose — and therefore the only fields
+ * The fields an endpoint is allowed to expose - and therefore the only fields
  * an ad-hoc query filter may touch. A read-field allowlist, when set, is the
  * boundary; otherwise every declared collection field (plus the always-safe
  * `id` / `createdBy` pseudo-fields) is fair game. Restricting ad-hoc filters
@@ -415,7 +415,7 @@ async function exposedFieldSet(def) {
  * Collect ad-hoc filters from the request query, layered UNDER the definition's
  * declared filters: reserved envelope keys are skipped, values must target an
  * exposed field, and a field already constrained by a declared filter is left
- * to the declaration (the curated filter always wins — a caller cannot loosen
+ * to the declaration (the curated filter always wins - a caller cannot loosen
  * or override it).
  *
  * @param {Record<string, unknown>} query
@@ -442,7 +442,7 @@ function collectAdHocFilter(query, exposed, declaredFields) {
  *
  * The final filter is the definition's declared filters (fixed literals,
  * {{params.x}}, {{query.x}}) with ad-hoc query-string filters layered beneath
- * them — declared always wins on any overlap.
+ * them - declared always wins on any overlap.
  *
  * @param {object} def
  * @param {Record<string, string>} params - Decoded path params
@@ -458,7 +458,7 @@ export async function executeEndpoint(def, params, query) {
     const adhoc = collectAdHocFilter(q, exposed, declaredFields);
     const filter = {...adhoc, ...declared}; // declared wins on any key collision
 
-    // Envelope controls — the reserved query keys tune pagination and sort
+    // Envelope controls - the reserved query keys tune pagination and sort
     // rather than filter (list mode only). The definition's own limit is the
     // ceiling: a caller may page/shrink within it but never pull more than the
     // endpoint intends; sort is restricted to exposed fields.

package/server/services/apiTokens.js

@@ -3,7 +3,7 @@
  * Project-scoped machine credentials for the external collections API.
  *
  * Tokens are entries in the file-based `api-tokens` preset collection.
- * Only a SHA-256 hash is stored — the plaintext (`dcms_<64 hex>`) is returned
+ * Only a SHA-256 hash is stored - the plaintext (`dcms_<64 hex>`) is returned
  * exactly once, from createToken(). A token is accepted only on collection
  * verbs configured with `api.<verb>.access === 'token'`, and only for
  * collections whose resolved project matches the token's `project` binding.
@@ -26,7 +26,7 @@ let tokenCache = null;
  * Serialises this service's fire-and-forget writes (the throttled lastUsedAt
  * update) against its mutations. FileAdapter does unlocked read-modify-write,
  * so an in-flight lastUsedAt update that read the data file BEFORE a revoke
- * wrote it would write the revoked token straight back — resurrection.
+ * wrote it would write the revoked token straight back - resurrection.
  * Mutations await the chain; lastUsedAt updates append to it.
  */
 let writeChain = Promise.resolve();
@@ -35,7 +35,7 @@ function invalidateCache() {
     tokenCache = null;
 }
 
-// Generic admin collection endpoints emit these for ALL collections — the
+// Generic admin collection endpoints emit these for ALL collections - the
 // service's own mutations invalidate directly, this catches edits made
 // through the admin entries grid.
 for (const ev of ['collection:entryCreated', 'collection:entryUpdated', 'collection:entryDeleted']) {
@@ -162,7 +162,7 @@ export async function findTokenByName(name, project) {
 /**
  * Validate a presented plaintext token.
  * Returns the sanitised entry when the token exists, is enabled, and has not
- * expired — otherwise null. Updates lastUsedAt at most once per minute
+ * expired - otherwise null. Updates lastUsedAt at most once per minute
  * (fire-and-forget; the cached copy is patched in place to avoid thrash).
  *
  * @param {string} plaintext
@@ -184,7 +184,7 @@ export async function validateToken(plaintext) {
 
     const lastUsed = entry.data.lastUsedAt ? Date.parse(entry.data.lastUsedAt) : 0;
     if (Date.now() - lastUsed > LAST_USED_THROTTLE_MS) {
-        // updateEntry replaces data wholesale — pass the full object.
+        // updateEntry replaces data wholesale - pass the full object.
         const data = {...entry.data, lastUsedAt: new Date().toISOString()};
         entry.data = data; // keep the cached copy current without invalidating
         // Fire-and-forget, but chained so revoke/update can await it.
@@ -222,7 +222,7 @@ export async function getTokenSanitised(id) {
 
 /**
  * Update mutable token fields. The project binding, hash, and hint are fixed
- * for the token's lifetime — revoke and re-issue to rebind.
+ * for the token's lifetime - revoke and re-issue to rebind.
  *
  * @param {string} id
  * @param {{name?: string, enabled?: boolean, scopes?: object[], expiresAt?: string|null}} patch
@@ -264,7 +264,7 @@ export async function updateToken(id, patch = {}) {
  * @returns {Promise<boolean>}
  */
 export async function revokeToken(id) {
-    await writeChain; // drain any in-flight lastUsedAt write — revoke must be final
+    await writeChain; // drain any in-flight lastUsedAt write - revoke must be final
     const entry = await getEntry(API_TOKENS_COLLECTION_SLUG, id);
     if (!entry) return false;
     await deleteEntry(API_TOKENS_COLLECTION_SLUG, id);

package/server/services/blocks.js

@@ -1,7 +1,7 @@
 /**
  * Blocks Service
  * CRUD operations and seeding for reusable HTML block templates in content/blocks/.
- * Never overwrites existing files during seeding — user customisations are preserved.
+ * Never overwrites existing files during seeding - user customisations are preserved.
  */
 import fs from 'fs/promises';
 import path from 'path';
@@ -21,7 +21,7 @@ async function seedBlock(name, content) {
     const filePath = path.join(BLOCKS_DIR, `${name}.html`);
     try {
         await fs.access(filePath);
-        // File exists — leave it alone
+        // File exists - leave it alone
     } catch {
         await fs.writeFile(filePath, content.trim() + '\n', 'utf8');
     }
@@ -34,7 +34,7 @@ async function seedBlock(name, content) {
 const BLOCKS = {
 
     /**
-     * contact-info — standalone contact details panel for landing pages.
+     * contact-info - standalone contact details panel for landing pages.
      * Fields: heading, intro, phone, phoneHref, email, address, hours,
      *         facebook, facebookLabel, instagram, instagramLabel,
      *         website, websiteLabel, footnote
@@ -99,7 +99,7 @@ const BLOCKS = {
 `,
 
     /**
-     * contact-card — for the Contacts form
+     * contact-card - for the Contacts form
      * Fields: full_name, phone_number, email_address
      */
     'contact-card': `
@@ -120,7 +120,7 @@ const BLOCKS = {
 `,
 
     /**
-     * enquiry-card — for the Enquiries form
+     * enquiry-card - for the Enquiries form
      * Fields: full_name, email, phone, subject, message
      */
     'enquiry-card': `
@@ -143,7 +143,7 @@ const BLOCKS = {
 `,
 
     /**
-     * feedback-card — for the Feedback form
+     * feedback-card - for the Feedback form
      * Fields: name, email, rating, category, subject, message, recommend
      */
     'feedback-card': `
@@ -159,7 +159,7 @@ const BLOCKS = {
   <div class="card-body">
     <p style="margin:0 0 1rem;line-height:1.65;">{{message}}</p>
     <div style="display:flex;justify-content:space-between;align-items:center;flex-wrap:wrap;gap:.5rem;font-size:.8rem;color:var(--dm-text-muted,#888);">
-      <span>{{name}} &mdash; {{email}}</span>
+      <span>{{name}} - {{email}}</span>
       <span>Would recommend: <strong>{{recommend}}</strong></span>
     </div>
   </div>
@@ -167,7 +167,7 @@ const BLOCKS = {
 `,
 
     /**
-     * note-card — for the Notes form
+     * note-card - for the Notes form
      * Fields: title, content, category, tags
      */
     'note-card': `
@@ -187,7 +187,7 @@ const BLOCKS = {
 `,
 
     /**
-     * todo-item — for the To-Do form
+     * todo-item - for the To-Do form
      * Fields: title, description, status, priority, due_date, assigned_to
      */
     'todo-item': `
@@ -238,7 +238,7 @@ function blockMetaPath(name) {
     return path.join(BLOCKS_DIR, `${name}.meta.json`);
 }
 
-/** Per-block CSS size cap — matches the 100 KB site-wide cap, scaled down. */
+/** Per-block CSS size cap - matches the 100 KB site-wide cap, scaled down. */
 const MAX_CSS_SIZE = 50 * 1024;
 
 // ---------------------------------------------------------------------------
@@ -300,7 +300,7 @@ export async function getBlock(name) {
         let css = '';
         try {
             css = await fs.readFile(blockCssPath(name), 'utf8');
-        } catch { /* no CSS file — treat as empty */
+        } catch { /* no CSS file - treat as empty */
         }
         return {name, content, css, bundled, ...(meta && {meta})};
     } catch (err) {
@@ -334,7 +334,7 @@ export async function saveBlock(name, content, {bundled, css, meta} = {}) {
     await fs.mkdir(BLOCKS_DIR, {recursive: true});
     await fs.writeFile(blockFilePath(name), content, 'utf8');
     const metaPath = blockMetaPath(name);
-    // Merge sidecar meta — bundled flag plus any caller-supplied fields (eg meta.project).
+    // Merge sidecar meta - bundled flag plus any caller-supplied fields (eg meta.project).
     const sidecar = {
         ...(meta && typeof meta === 'object' ? meta : {}),
         ...(bundled ? {bundled: true} : {})
@@ -345,7 +345,7 @@ export async function saveBlock(name, content, {bundled, css, meta} = {}) {
         await fs.unlink(metaPath).catch(() => {
         });
     }
-    // CSS is optional — only touch the file when the caller passed the field explicitly.
+    // CSS is optional - only touch the file when the caller passed the field explicitly.
     if (typeof css === 'string') {
         if (css.trim().length > 0) {
             await fs.writeFile(blockCssPath(name), css, 'utf8');

package/server/services/cache/drivers/MemoryDriver.js

@@ -3,7 +3,7 @@ import {LRU} from '../lru.js';
 /**
  * In-memory cache driver with TTL and tag invalidation.
  *
- * Each entry is stored as {value, expiresAt, tags}. TTL is lazy — entries
+ * Each entry is stored as {value, expiresAt, tags}. TTL is lazy - entries
  * past their expiresAt are returned as undefined on the next get and dropped.
  *
  * Tag index: a Map<tag, Set<key>>. set() with {tags} adds the key to each
@@ -79,14 +79,14 @@ export class MemoryDriver {
         this._tagIndex.clear();
     }
 
-    /** Current entry count (sync — for the dashboard widget). */
+    /** Current entry count (sync - for the dashboard widget). */
     size() {
         return this._lru.size;
     }
 
     /**
      * Snapshot the currently cached entries as `{key, tags, expiresAt}`.
-     * No values — they can be megabytes of HTML. Uses `entries()` (non-mutating)
+     * No values - they can be megabytes of HTML. Uses `entries()` (non-mutating)
      * so the LRU order is preserved through the iteration.
      */
     listEntries() {

package/server/services/cache/drivers/NoneDriver.js

@@ -1,5 +1,5 @@
 /**
- * Null driver — used when the cache is disabled.
+ * Null driver - used when the cache is disabled.
  * Every read misses; every write is dropped on the floor.
  */
 export class NoneDriver {