domma-cms 0.44.0 → 0.45.1

package/server/services/menuRender.js

@@ -4,15 +4,15 @@
  * One builder, three callers: the `[menu]` shortcode, the overlay menus the
  * renderer injects into the page shell, and anything a plugin wants to render
  * itself. Keeping it here means a menu looks the same however it reaches the
- * page — the shortcode and an overlay binding of the same menu produce byte-
+ * page - the shortcode and an overlay binding of the same menu produce byte-
  * identical markup.
  *
  * Item filtering (visibility, `hidden`), depth capping and badge-count
- * resolution happen before this — callers hand in the items they want drawn.
+ * resolution happen before this - callers hand in the items they want drawn.
  */
 import {colourToCss, floatToCss} from './menus.js';
 
-/** Attribute-safe escaping — mirrors escapeAttr in markdown.js. */
+/** Attribute-safe escaping - mirrors escapeAttr in markdown.js. */
 function esc(str) {
     return String(str ?? '')
         .replace(/&/g, '&')
@@ -43,7 +43,7 @@ export function renderMenuItemsAsUl(items) {
         const colourCss = it.colour ? colourToCss(it.colour) : '';
         const styleAttr = colourCss ? ` style="color:${colourCss}"` : '';
 
-        // Badge — static text, or a count stamped on by resolveMenuDecorations.
+        // Badge - static text, or a count stamped on by resolveMenuDecorations.
         let badge = '';
         if (it.badge && it.badge.text != null && it.badge.text !== '') {
             const bg = it.badge.variant ? colourToCss(it.badge.variant) : '';
@@ -60,7 +60,7 @@ export function renderMenuItemsAsUl(items) {
  * Build the full `<nav>` for a menu.
  *
  * @param {object} menu            The menu record (slug, orientation, position, float)
- * @param {Array}  items           Items to draw — already filtered/capped/decorated
+ * @param {Array}  items           Items to draw - already filtered/capped/decorated
  * @param {object} [opts]
  * @param {string} [opts.orientation] Override the menu's own orientation for this placement
  * @param {string} [opts.variant]     Adds `dm-menu--variant-<x>`

package/server/services/menus-migration.js

@@ -1,7 +1,7 @@
 /**
  * Menus auto-migration.
  *
- * Runs once on server boot. Idempotent — guarded by the existence of
+ * Runs once on server boot. Idempotent - guarded by the existence of
  * config/menu-locations.json. Converts:
  *   - config/navigation.json → config/menus/main.json + locations.navbar
  *     (brand moves into site.json.brand)
@@ -28,7 +28,7 @@ async function readJson(p) {
 
 async function writeJson(p, data) {
     await fs.writeFile(p, JSON.stringify(data, null, 2) + '\n', 'utf8');
-    // Menu files written outside the menus service — drop its cached index so
+    // Menu files written outside the menus service - drop its cached index so
     // binding resolution sees the migrated menus.
     invalidateMenuIndex();
 }
@@ -104,7 +104,7 @@ export async function runMigration(opts = {}) {
         }
     }
 
-    // 4. Write the locations map (even if empty — its existence is the migration guard)
+    // 4. Write the locations map (even if empty - its existence is the migration guard)
     await writeJson(path.join(configDir, 'menu-locations.json'), locations);
 
     return {migrated: true};

package/server/services/menus.js

@@ -18,13 +18,13 @@ import * as cache from './cache/index.js';
 /**
  * Bust the response-cache tags that menu changes affect. Public pages are
  * cached with the `nav` and `site` tags (see routes/public.js), so any menu
- * mutation — content, behaviour/style overrides, or slot mapping — must clear
+ * mutation - content, behaviour/style overrides, or slot mapping - must clear
  * them or the navbar/footer/[menu] output stays stale until TTL or restart.
  * No-op when the cache is disabled (e.g. dev / boot-time seeding).
  */
 async function invalidateNavCache() {
     try { await cache.invalidateTags(['nav', 'site']); }
-    catch { /* cache not ready (boot) — safe to ignore */ }
+    catch { /* cache not ready (boot) - safe to ignore */ }
 }
 
 const __filename = fileURLToPath(import.meta.url);
@@ -52,7 +52,7 @@ export function validateSlug(slug) {
 }
 
 // ---------------------------------------------------------------------------
-// Decoration colour convention — preset key → theme CSS var, or #rrggbb hex.
+// Decoration colour convention - preset key → theme CSS var, or #rrggbb hex.
 // A "colour value" is one of these preset keys or a 6-digit hex.
 // Keep PRESET_COLOUR_VARS in sync with the copy in public/js/menu-decor.mjs.
 // ---------------------------------------------------------------------------
@@ -82,7 +82,7 @@ export function colourToCss(value) {
 }
 
 // ---------------------------------------------------------------------------
-// Floating menus — a menu with position "floating" detaches from the document
+// Floating menus - a menu with position "floating" detaches from the document
 // flow and pins itself to a viewport corner or edge, the same way the
 // breadcrumb trail does. The anchor/offset shape deliberately mirrors
 // site.json's `breadcrumbs` config so the two read alike in the admin.
@@ -112,7 +112,7 @@ function floatNumber(value, fallback, min, max) {
 }
 
 /**
- * Surface declarations for a floating panel — corner rounding, drop shadow and
+ * Surface declarations for a floating panel - corner rounding, drop shadow and
  * accent colour. Everything is optional: an omitted field falls through to the
  * `.dm-menu-floating` defaults in site.css rather than being frozen inline.
  *
@@ -135,7 +135,7 @@ function floatSurfaceCss(f) {
         decls.push(`--dm-menu-accent:${css}`, `border-color:${css}`);
     }
     if (f.opacity != null && f.opacity !== '') {
-        // Panel translucency, not item translucency — the backdrop filter in
+        // Panel translucency, not item translucency - the backdrop filter in
         // site.css keeps the text readable over busy page content.
         decls.push(`--dm-menu-panel-opacity:${floatNumber(f.opacity, 100, 20, 100) / 100}`);
     }
@@ -176,7 +176,7 @@ export function floatToCss(menu) {
         decls.push(`width:${floatNumber(f.width, 260, 120, 600)}px`);
     }
 
-    // A pinned panel must never grow past the viewport — it scrolls instead.
+    // A pinned panel must never grow past the viewport - it scrolls instead.
     decls.push(`max-height:calc(100vh - ${(anchor === 'L' || anchor === 'R') ? 32 : y * 2}px)`);
 
     decls.push(...floatSurfaceCss(f));
@@ -185,19 +185,19 @@ export function floatToCss(menu) {
 }
 
 // ---------------------------------------------------------------------------
-// Orientation — how the menu flows where it renders. `horizontal` is the
+// Orientation - how the menu flows where it renders. `horizontal` is the
 // historic behaviour and stays the default for every menu without the field.
 // `vertical` stacks the items into a column: a side rail for the navbar slot,
 // a stacked list for `[menu]` and floating panels.
 //
-// `side` only means anything for a vertical menu in the navbar slot — it picks
+// `side` only means anything for a vertical menu in the navbar slot - it picks
 // the viewport edge the rail docks to.
 // ---------------------------------------------------------------------------
 export const ORIENTATIONS = new Set(['horizontal', 'vertical']);
 export const SIDES        = new Set(['left', 'right']);
 
 // ---------------------------------------------------------------------------
-// Bindings — a menu can claim a slot for a subset of the site instead of being
+// Bindings - a menu can claim a slot for a subset of the site instead of being
 // mapped to it globally in menu-locations.json. `binding.slot` names the slot
 // it takes over; `binding.projects` and `binding.pages` say where.
 //
@@ -300,12 +300,12 @@ async function writeMenuFile(menu) {
     await ensureMenusDir();
     await fs.writeFile(menuPath(menu.slug), JSON.stringify(menu, null, 2) + '\n', 'utf8');
     invalidateMenuIndex();
-    // Menu content / behaviour / style changed — drop the cached public pages.
+    // Menu content / behaviour / style changed - drop the cached public pages.
     await invalidateNavCache();
 }
 
 /**
- * List all menus. Returns metadata only (no items) — use getMenu(slug) for
+ * List all menus. Returns metadata only (no items) - use getMenu(slug) for
  * the full payload. Sorted alphabetically by slug.
  *
  * @returns {Promise<Array<{slug:string,name:string,description:string,itemsCount:number,meta:object}>>}
@@ -368,7 +368,7 @@ export async function createMenu(input) {
         throw new Error(`Menu "${input.slug}" already exists`);
     }
     // Normalise the binding first so validation judges what will actually be
-    // written — surrounding whitespace and duplicates are tidied, not rejected.
+    // written - surrounding whitespace and duplicates are tidied, not rejected.
     const binding = normaliseBinding(input.binding);
     const errors = validateMenu({...input, binding});
     if (errors.length) {
@@ -444,7 +444,7 @@ export async function updateMenu(slug, input) {
 
 /**
  * Delete a menu file. Returns true if removed, false if it didn't exist.
- * Callers must check the locations map first — service does not.
+ * Callers must check the locations map first - service does not.
  *
  * @param   {string} slug
  * @returns {Promise<boolean>}
@@ -531,30 +531,30 @@ export function validateMenu(menu) {
     const errors = [];
     if (!menu || typeof menu !== 'object') return ['Menu must be an object'];
     if (!validateSlug(menu.slug)) {
-        errors.push(`Invalid slug "${menu.slug}" — lowercase alphanumeric + hyphen only`);
+        errors.push(`Invalid slug "${menu.slug}" - lowercase alphanumeric + hyphen only`);
     }
     if (!menu.name || typeof menu.name !== 'string') {
         errors.push('name is required');
     }
     if (menu.position != null && !POSITIONS.has(menu.position)) {
-        errors.push(`Invalid position "${menu.position}" — expected one of: ${[...POSITIONS].join(', ')}`);
+        errors.push(`Invalid position "${menu.position}" - expected one of: ${[...POSITIONS].join(', ')}`);
     }
     if (menu.orientation != null && !ORIENTATIONS.has(menu.orientation)) {
-        errors.push(`Invalid orientation "${menu.orientation}" — expected one of: ${[...ORIENTATIONS].join(', ')}`);
+        errors.push(`Invalid orientation "${menu.orientation}" - expected one of: ${[...ORIENTATIONS].join(', ')}`);
     }
     if (menu.side != null && !SIDES.has(menu.side)) {
-        errors.push(`Invalid side "${menu.side}" — expected one of: ${[...SIDES].join(', ')}`);
+        errors.push(`Invalid side "${menu.side}" - expected one of: ${[...SIDES].join(', ')}`);
     }
     if (menu.binding != null) {
         if (typeof menu.binding !== 'object' || Array.isArray(menu.binding)) {
             errors.push('binding must be an object');
         } else {
             const {slot, projects, pages} = menu.binding;
-            // A binding with no slot is inert rather than invalid — the admin
-            // sends an empty block when the feature is switched off — but a
+            // A binding with no slot is inert rather than invalid - the admin
+            // sends an empty block when the feature is switched off - but a
             // slot that IS present has to be a usable slot name.
             if (slot != null && slot !== '' && !validateSlug(slot)) {
-                errors.push(`binding.slot "${slot}" — lowercase alphanumeric + hyphen only`);
+                errors.push(`binding.slot "${slot}" - lowercase alphanumeric + hyphen only`);
             }
             for (const [key, list] of [['projects', projects], ['pages', pages]]) {
                 if (list == null) continue;
@@ -597,7 +597,7 @@ export function validateMenu(menu) {
         errors.push('items must be an array');
     } else {
         walkItems(menu.items, (item, path) => {
-            // Separator items are purely visual dividers — no text/url required.
+            // Separator items are purely visual dividers - no text/url required.
             // Renderers translate them into <hr> / structural breaks.
             if (item && item.type === 'separator') return;
 
@@ -605,7 +605,7 @@ export function validateMenu(menu) {
                 errors.push(`Item ${path}: text is required`);
             }
             // url is only required for LEAF items (no children). Folder items
-            // — those with their own `items` array — are pure groupings and
+            // - those with their own `items` array - are pure groupings and
             // don't need a navigation target. The admin sidebar uses this
             // shape extensively (Content / Data / System headings etc.).
             const hasChildren = Array.isArray(item.items) && item.items.length > 0;
@@ -671,7 +671,7 @@ function walkItems(items, fn, parentPath = '') {
 }
 
 // ---------------------------------------------------------------------------
-// Locations registry — module-level Map, seeded by core, extended by plugins
+// Locations registry - module-level Map, seeded by core, extended by plugins
 // ---------------------------------------------------------------------------
 
 const _locationRegistry = new Map(); // slot -> { label, description, maxDepth, source }
@@ -687,7 +687,7 @@ const _locationRegistry = new Map(); // slot -> { label, description, maxDepth,
 export function registerLocation(slot, def) {
     if (!validateSlug(slot)) throw new Error(`Invalid slot name: ${slot}`);
     if (_locationRegistry.has(slot)) {
-        console.warn(`[menus] Slot "${slot}" re-registered — last write wins`);
+        console.warn(`[menus] Slot "${slot}" re-registered - last write wins`);
     }
     _locationRegistry.set(slot, {
         label:       def?.label       || slot,
@@ -704,7 +704,7 @@ export function getLocationRegistry() {
     return [..._locationRegistry.entries()].map(([slot, def]) => ({slot, ...def}));
 }
 
-// Core slots — registered at module load. Plugins register theirs from
+// Core slots - registered at module load. Plugins register theirs from
 // their plugin.js setup function via the registerMenuLocation hook (Task 7).
 registerLocation('navbar',         {label: 'Navbar',         description: 'Site navbar', source: 'core'});
 registerLocation('footer-primary', {label: 'Footer primary', description: 'Primary footer column', source: 'core', maxDepth: 1});
@@ -713,7 +713,7 @@ registerLocation('admin-sidebar',  {label: 'Admin sidebar',  description: 'The l
 // The overlay slot is the "anywhere" placement: menus bound to it render on
 // matching pages positioned by their own `float` config, with no navbar, no
 // footer and no shortcode involved. Unlike the other slots it is not
-// one-menu-wins — a page can carry several overlays at once.
+// one-menu-wins - a page can carry several overlays at once.
 registerLocation('overlay',        {label: 'Page overlay',   description: 'Floating menus placed on matching pages by their binding', source: 'core', maxDepth: null});
 
 // ---------------------------------------------------------------------------
@@ -768,8 +768,8 @@ export async function setLocations(map) {
 
 /**
  * Every menu on disk, cached in memory. Bound-menu resolution has to consider
- * all of them on each render, and the alternative — re-reading the directory
- * three times per uncached page — is wasteful for a set of files that only
+ * all of them on each render, and the alternative - re-reading the directory
+ * three times per uncached page - is wasteful for a set of files that only
  * changes when an admin saves a menu.
  *
  * Every write path in this module invalidates the cache; anything writing menu
@@ -777,7 +777,7 @@ export async function setLocations(map) {
  */
 let _menuIndex = null;
 
-/** Drop the cached menu index — call after writing menu files out-of-band. */
+/** Drop the cached menu index - call after writing menu files out-of-band. */
 export function invalidateMenuIndex() {
     _menuIndex = null;
 }
@@ -880,7 +880,7 @@ export async function resolveBoundMenu(slot, ctx = {}) {
  *
  * A menu bound to the current page or project (see `resolveBoundMenu`) takes
  * the slot over; otherwise the `menu-locations.json` mapping applies. Callers
- * that know the page they are rendering should pass `ctx` — without it only the
+ * that know the page they are rendering should pass `ctx` - without it only the
  * global mapping is considered, which is the pre-binding behaviour.
  *
  * Note: `user` may be null (anonymous). `user.role` and

package/server/services/permissionRegistry.js

@@ -242,7 +242,7 @@ const _pluginContributed = [];
 
 /**
  * Register a resource contributed by a plugin.
- * Idempotent — if the key already exists in the effective registry it is skipped.
+ * Idempotent - if the key already exists in the effective registry it is skipped.
  *
  * @param {{key:string,label:string,description?:string,icon?:string,group?:string,actions?:{key:string,label:string,description?:string}[]}} resource
  * @param {string} plugin - Plugin name that owns this resource

package/server/services/pluginFiles.js

@@ -2,7 +2,7 @@
  * Plugin Files Service
  * Read/write access to a plugin's source files for the in-admin code editor.
  *
- * Every operation is confined to plugins/<name>/ — names must be discovered
+ * Every operation is confined to plugins/<name>/ - names must be discovered
  * plugin directories (underscore-prefixed dirs like _template/_lib are never
  * valid names), paths are normalised and containment-checked after symlink
  * resolution, and only known text extensions are editable.
@@ -20,7 +20,7 @@ const NAME_PATTERN = /^[a-z][a-z0-9-]{1,39}$/;
 // Editable/viewable file types. Everything else is invisible to the editor.
 const TEXT_EXTENSIONS = new Set(['.js', '.json', '.md', '.html', '.css', '.txt', '.svg']);
 
-// Never deletable — removing any of these breaks discovery of the plugin.
+// Never deletable - removing any of these breaks discovery of the plugin.
 const REQUIRED_FILES = new Set(['plugin.json', 'plugin.js', 'config.js']);
 
 // Directories skipped when listing.
@@ -86,7 +86,7 @@ async function resolveFilePath(pluginDir, relPath) {
         }
     } catch (err) {
         if (err.statusCode) throw err;
-        // ENOENT — new file, fine
+        // ENOENT - new file, fine
     }
 
     return abs;
@@ -184,7 +184,7 @@ export async function writePluginFile(name, relPath, content) {
     await fs.writeFile(abs, content, 'utf8');
 
     const rel = path.relative(pluginDir, abs).split(path.sep).join('/');
-    // admin/** is fetched by the SPA at runtime — a tab refresh picks it up.
+    // admin/** is fetched by the SPA at runtime - a tab refresh picks it up.
     // Everything else (plugin.js, config.js, plugin.json, public/ snippets)
     // is read or imported server-side and needs a restart.
     const restartRequired = !rel.startsWith('admin/');
@@ -204,7 +204,7 @@ export async function deletePluginFile(name, relPath) {
     const rel = path.relative(pluginDir, abs).split(path.sep).join('/');
 
     if (REQUIRED_FILES.has(rel)) {
-        throw fail(400, `${rel} is required — deleting it would break the plugin.`);
+        throw fail(400, `${rel} is required - deleting it would break the plugin.`);
     }
 
     try {

package/server/services/pluginInstaller.js

@@ -27,7 +27,7 @@ const CONFIG_PATH = path.join(ROOT, 'config', 'plugins.json');
 const AUDIT_LOG   = path.join(ROOT, 'content', 'instances_log.json');
 
 // ---------------------------------------------------------------------------
-// Trusted public keys — rotate by adding new keyId + bumping CMS version
+// Trusted public keys - rotate by adding new keyId + bumping CMS version
 // Private key counterpart: domma-cms-manager/config/keys/plugin-signing-2026.pem
 // ---------------------------------------------------------------------------
 
@@ -109,12 +109,12 @@ async function extractTar(tarBuffer, slug, destDir) {
         zeroBlockCount = 0;
         offset += 512;
 
-        // Filename: bytes 0–99, null-terminated
+        // Filename: bytes 0-99, null-terminated
         const nameEnd = header.indexOf(0, 0);
         const name = header.slice(0, nameEnd === -1 ? 100 : Math.min(nameEnd, 100)).toString('utf8');
         if (!name) break;
 
-        // File size: bytes 124–135, octal ASCII
+        // File size: bytes 124-135, octal ASCII
         const sizeStr = header.slice(124, 136).toString('utf8').replace(/\0/g, '').trim();
         const size = parseInt(sizeStr, 8) || 0;
 
@@ -177,36 +177,36 @@ export async function installPlugin(slug, { tarball, signature, publicKeyId }) {
         throw new Error(`Invalid plugin slug: ${slug}`);
     }
 
-    // Step 1 — Verify signature
+    // Step 1 - Verify signature
     const pubKeyPem = TRUSTED_KEYS[publicKeyId];
     if (!pubKeyPem) {
         throw new Error(`Unknown public key: ${publicKeyId}`);
     }
 
     if (pubKeyPem.includes('PLACEHOLDER')) {
-        throw new Error(`pluginInstaller: TRUSTED_KEYS['${publicKeyId}'] is a placeholder — not usable for verification`);
+        throw new Error(`pluginInstaller: TRUSTED_KEYS['${publicKeyId}'] is a placeholder - not usable for verification`);
     }
 
     const signatureBuffer = Buffer.from(signature, 'base64');
     const valid = crypto.verify('sha256', tarball, pubKeyPem, signatureBuffer);
     if (!valid) {
-        throw new Error('Plugin signature invalid — refusing to install');
+        throw new Error('Plugin signature invalid - refusing to install');
     }
 
-    // Step 2 — Reject if already installed
+    // Step 2 - Reject if already installed
     const destDir = path.join(PLUGINS_DIR, slug);
     let alreadyExists = false;
     try {
         await fs.access(destDir);
         alreadyExists = true;
     } catch {
-        // Not present — proceed
+        // Not present - proceed
     }
     if (alreadyExists) {
         throw new Error(`Plugin already installed: ${slug}`);
     }
 
-    // Step 3 — Decompress + extract
+    // Step 3 - Decompress + extract
     await fs.mkdir(destDir, { recursive: true });
     try {
         const tarBuffer = zlib.gunzipSync(tarball);
@@ -217,7 +217,7 @@ export async function installPlugin(slug, { tarball, signature, publicKeyId }) {
         throw err;
     }
 
-    // Step 4 — Validate manifest
+    // Step 4 - Validate manifest
     const manifests = await discoverPlugins();
     const manifest = manifests.find(m => m.name === slug);
     if (!manifest) {
@@ -225,14 +225,14 @@ export async function installPlugin(slug, { tarball, signature, publicKeyId }) {
         throw new Error(`Plugin manifest validation failed after extraction: ${slug}`);
     }
 
-    // Step 5 — Update config/plugins.json
+    // Step 5 - Update config/plugins.json
     const cfg = await readPluginsConfig();
     if (!cfg[slug]) {
         cfg[slug] = { enabled: false, settings: {} };
         await writePluginsConfig(cfg);
     }
 
-    // Step 6 — Run onEnable lifecycle hook (warn on failure, do not throw)
+    // Step 6 - Run onEnable lifecycle hook (warn on failure, do not throw)
     try {
         const pluginJsPath = path.join(destDir, 'plugin.js');
         const mod = await import(pluginJsPath);
@@ -243,7 +243,7 @@ export async function installPlugin(slug, { tarball, signature, publicKeyId }) {
         console.warn(`[pluginInstaller] onEnable hook for "${slug}" failed: ${err.message}`);
     }
 
-    // Step 7 — Audit log
+    // Step 7 - Audit log
     await writeAuditLog({
         action: 'install',
         slug,
@@ -271,7 +271,7 @@ export async function uninstallPlugin(slug) {
 
     const destDir = path.join(PLUGINS_DIR, slug);
 
-    // Step 1 — Run onDisable lifecycle hook (warn on failure, do not throw)
+    // Step 1 - Run onDisable lifecycle hook (warn on failure, do not throw)
     try {
         const pluginJsPath = path.join(destDir, 'plugin.js');
         const mod = await import(pluginJsPath);
@@ -282,17 +282,17 @@ export async function uninstallPlugin(slug) {
         console.warn(`[pluginInstaller] onDisable hook for "${slug}" failed: ${err.message}`);
     }
 
-    // Step 2 — Remove plugin directory
+    // Step 2 - Remove plugin directory
     await fs.rm(destDir, { recursive: true, force: true });
 
-    // Step 3 — Remove from config/plugins.json
+    // Step 3 - Remove from config/plugins.json
     const cfg = await readPluginsConfig();
     if (slug in cfg) {
         delete cfg[slug];
         await writePluginsConfig(cfg);
     }
 
-    // Step 4 — Audit log
+    // Step 4 - Audit log
     await writeAuditLog({
         action: 'uninstall',
         slug,

package/server/services/pluginScaffold.js

@@ -84,7 +84,7 @@ export async function scaffoldPlugin(input) {
         throw fail(409, `A plugin named "${slug}" already exists.`);
     } catch (err) {
         if (err.statusCode) throw err;
-        // ENOENT — target is free
+        // ENOENT - target is free
     }
 
     const replacements = [

package/server/services/plugins.js

@@ -3,12 +3,12 @@
  * Discovers, loads, and manages CMS plugins.
  *
  * Plugin structure:
- *   plugins/{name}/plugin.json   — manifest (required)
- *   plugins/{name}/plugin.js     — Fastify plugin, default export (required)
- *   plugins/{name}/config.js     — default settings, default export (required)
- *   plugins/{name}/admin/        — optional admin views/templates
- *   plugins/{name}/public/       — optional injection HTML snippets
- *   plugins/{name}/data/         — optional plugin-specific data store
+ *   plugins/{name}/plugin.json   - manifest (required)
+ *   plugins/{name}/plugin.js     - Fastify plugin, default export (required)
+ *   plugins/{name}/config.js     - default settings, default export (required)
+ *   plugins/{name}/admin/        - optional admin views/templates
+ *   plugins/{name}/public/       - optional injection HTML snippets
+ *   plugins/{name}/data/         - optional plugin-specific data store
  */
 import fs from 'fs/promises';
 import path from 'path';
@@ -61,7 +61,7 @@ export function getPluginLoadFailures() {
 const _loadedPlugins = {};
 
 /**
- * Core plugins — always loaded regardless of plugins.json enabled state.
+ * Core plugins - always loaded regardless of plugins.json enabled state.
  * These are considered first-class CMS features, not optional add-ons.
  */
 const CORE_PLUGINS = new Set(['analytics']);
@@ -101,7 +101,7 @@ export async function discoverPlugins() {
         for (const field of REQUIRED_MANIFEST_FIELDS) {
             if (!manifest[field]) {
                 const reason = `missing required field "${field}" in plugin.json`;
-                console.warn(`Plugin "${dir}": ${reason} — skipping`);
+                console.warn(`Plugin "${dir}": ${reason} - skipping`);
                 recordPluginLoadFailure(dir, reason);
                 valid = false;
                 break;
@@ -117,7 +117,7 @@ export async function discoverPlugins() {
             await fs.access(pluginJsPath);
         } catch {
             const reason = 'missing required file plugin.js';
-            console.warn(`Plugin "${dir}": ${reason} — skipping`);
+            console.warn(`Plugin "${dir}": ${reason} - skipping`);
             recordPluginLoadFailure(dir, reason);
             continue;
         }
@@ -126,7 +126,7 @@ export async function discoverPlugins() {
             await fs.access(configJsPath);
         } catch {
             const reason = 'missing required file config.js';
-            console.warn(`Plugin "${dir}": ${reason} — skipping`);
+            console.warn(`Plugin "${dir}": ${reason} - skipping`);
             recordPluginLoadFailure(dir, reason);
             continue;
         }
@@ -153,7 +153,7 @@ async function loadConfigDefaults(name) {
     const {default: exported} = await import(configJsPath);
     defaults = exported || {};
   } catch (err) {
-    const reason = `failed to load config.js — ${err.message}`;
+    const reason = `failed to load config.js - ${err.message}`;
     console.warn(`Plugin "${name}": ${reason}`);
     recordPluginLoadFailure(name, reason);
   }
@@ -233,7 +233,7 @@ export async function registerPlugins(fastify) {
                 }
             }
 
-            // Ensure plugin collections exist (idempotent — skips if already present)
+            // Ensure plugin collections exist (idempotent - skips if already present)
             await setupPlugin(manifest.name, {collections: {getCollection, createCollection}})
                 .catch(err => fastify.log.warn(`[plugins] Collection setup for "${manifest.name}" failed: ${err.message}`));
 
@@ -244,7 +244,7 @@ export async function registerPlugins(fastify) {
                 await fs.access(publicEntryPath);
                 _loadedPlugins[manifest.name].publicEntry = publicEntryPath;
             } catch {
-                // no public entry — that's fine
+                // no public entry - that's fine
             }
         } catch (err) {
             const reason = `server failed to load: ${err.message}`;
@@ -306,7 +306,7 @@ export async function getInjectionSnippets() {
         if (!manifest.inject[key]) continue;
         const filePath = path.resolve(PLUGINS_DIR, manifest.name, manifest.inject[key]);
         if (!filePath.startsWith(pluginRoot + path.sep)) {
-          console.warn(`Plugin "${manifest.name}": inject.${key} path escapes plugin directory — skipping`);
+          console.warn(`Plugin "${manifest.name}": inject.${key} path escapes plugin directory - skipping`);
           continue;
         }
             try {
@@ -314,7 +314,7 @@ export async function getInjectionSnippets() {
               if (target === 'head') head += content + '\n';
               if (target === 'headLate') headLate += content + '\n';
               if (target === 'bodyEnd') bodyEnd += content + '\n';
-            } catch { /* snippet not found — skip */
+            } catch { /* snippet not found - skip */
             }
         }
     }
@@ -431,7 +431,7 @@ export async function setupPlugin(pluginName, services) {
         }
     }
 
-    // Roles — read plugins/<name>/roles/*.json, register resources + persist roles
+    // Roles - read plugins/<name>/roles/*.json, register resources + persist roles
     if (services.roles) {
         const rolesDir = path.join(pluginDir, 'roles');
         let roleFiles;
@@ -511,7 +511,7 @@ export async function teardownPlugin(pluginName, services, fastify) {
         }
     }
 
-    // Roles — remove plugin-contributed roles and unregister their resources
+    // Roles - remove plugin-contributed roles and unregister their resources
     if (services.roles) {
         try {
             await services.roles.removeRolesByPlugin(pluginName);

package/server/services/presetCollections.js

@@ -1,7 +1,7 @@
 /**
  * Preset Collections
  * Built-in collections whose schemas are defined in code and overwritten on boot.
- * Data files are never touched — only schema.json is reset each startup.
+ * Data files are never touched - only schema.json is reset each startup.
  */
 import fs from 'fs/promises';
 import path from 'path';
@@ -10,7 +10,7 @@ import {config} from '../config.js';
 const COLLECTIONS_DIR = path.resolve(config.content.collectionsDir);
 
 // contacts, enquiries, feedback, notes, categories, posts, comments, to-do
-// have been removed — they belong to plugins and are seeded on plugin enable.
+// have been removed - they belong to plugins and are seeded on plugin enable.
 
 const PRESETS = [
     {