domma-cms 0.55.1 → 0.66.0

package/server/services/pluginFiles.js

@@ -7,8 +7,16 @@
  * valid names), paths are normalised and containment-checked after symlink
  * resolution, and only known text extensions are editable.
  *
- * Thrown errors carry `statusCode` (400 invalid, 404 missing, 413 too large)
- * for direct mapping in the route layer.
+ * A plugin marked `"closedSource": true` in its manifest is refused - licensed
+ * code is distributed to a site so it can RUN there, not so it can be read out
+ * of it, and the editor was handing over the server source in full. The one
+ * exception is a SUPER-ADMIN (role level 0), which on the fleet exists only on
+ * the manager: the people who publish the paid plugins are the people who need
+ * to read and edit them. Customer sites are all level 1, so nothing changes
+ * there - see the `allowLicensed` argument, set from the request's user.
+ *
+ * Thrown errors carry `statusCode` (400 invalid, 403 licensed, 404 missing,
+ * 413 too large) for direct mapping in the route layer.
  */
 import fs from 'fs/promises';
 import path from 'path';
@@ -40,7 +48,7 @@ function fail(statusCode, message) {
  * @param {string} name
  * @returns {Promise<string>} Absolute plugin directory
  */
-async function resolvePluginDir(name) {
+async function resolvePluginDir(name, allowLicensed = false) {
     if (!NAME_PATTERN.test(String(name || ''))) throw fail(400, 'Invalid plugin name.');
     const dir = path.join(PLUGINS_DIR, name);
     try {
@@ -49,9 +57,42 @@ async function resolvePluginDir(name) {
     } catch {
         throw fail(404, `Plugin "${name}" not found.`);
     }
+
+    // Every operation in this module goes through here, which is why the check
+    // lives here and not in four places that could drift apart.
+    if (!allowLicensed && await isClosedSource(dir)) {
+        throw fail(403, `"${name}" is a licensed plugin. Its source is not editable here.`);
+    }
     return dir;
 }
 
+/**
+ * Is this plugin's source off limits to the code editor?
+ *
+ * A licensed plugin is distributed to a site so it can RUN there, not so it
+ * can be read and copied - and the editor made it readable AND writable to
+ * anyone holding `plugins.develop`, which on a customer's own site is the
+ * customer. Writable is the worse half: the licence check is in that file.
+ *
+ * Declared by the plugin itself (`"closedSource": true` in plugin.json) so the
+ * flag travels with it wherever it is distributed, rather than depending on a
+ * list somewhere that a new paid plugin would have to be remembered into.
+ *
+ * A manifest that cannot be read is treated as closed. This gate failing open
+ * would publish the very thing it exists to protect.
+ *
+ * @param   {string} dir - absolute plugin directory
+ * @returns {Promise<boolean>}
+ */
+async function isClosedSource(dir) {
+    try {
+        const manifest = JSON.parse(await fs.readFile(path.join(dir, 'plugin.json'), 'utf8'));
+        return manifest.closedSource === true;
+    } catch {
+        return true;
+    }
+}
+
 /**
  * Resolve a relative file path inside the plugin dir, or throw.
  * Rejects absolute paths, traversal, hidden segments and unknown extensions.
@@ -98,8 +139,8 @@ async function resolveFilePath(pluginDir, relPath) {
  * @param {string} name
  * @returns {Promise<Array<{path: string, size: number, modified: string}>>}
  */
-export async function listPluginFiles(name) {
-    const pluginDir = await resolvePluginDir(name);
+export async function listPluginFiles(name, {allowLicensed = false} = {}) {
+    const pluginDir = await resolvePluginDir(name, allowLicensed);
     const files = [];
 
     async function walk(dir) {
@@ -132,8 +173,8 @@ export async function listPluginFiles(name) {
  * @param {string} relPath
  * @returns {Promise<{path: string, content: string}>}
  */
-export async function readPluginFile(name, relPath) {
-    const pluginDir = await resolvePluginDir(name);
+export async function readPluginFile(name, relPath, {allowLicensed = false} = {}) {
+    const pluginDir = await resolvePluginDir(name, allowLicensed);
     const abs = await resolveFilePath(pluginDir, relPath);
 
     let stat;
@@ -158,8 +199,8 @@ export async function readPluginFile(name, relPath) {
  * @param {string} content
  * @returns {Promise<{path: string, restartRequired: boolean}>}
  */
-export async function writePluginFile(name, relPath, content) {
-    const pluginDir = await resolvePluginDir(name);
+export async function writePluginFile(name, relPath, content, {allowLicensed = false} = {}) {
+    const pluginDir = await resolvePluginDir(name, allowLicensed);
     const abs = await resolveFilePath(pluginDir, relPath);
 
     if (typeof content !== 'string') throw fail(400, 'Content must be a string.');
@@ -198,8 +239,8 @@ export async function writePluginFile(name, relPath, content) {
  * @param {string} relPath
  * @returns {Promise<{path: string}>}
  */
-export async function deletePluginFile(name, relPath) {
-    const pluginDir = await resolvePluginDir(name);
+export async function deletePluginFile(name, relPath, {allowLicensed = false} = {}) {
+    const pluginDir = await resolvePluginDir(name, allowLicensed);
     const abs = await resolveFilePath(pluginDir, relPath);
     const rel = path.relative(pluginDir, abs).split(path.sep).join('/');
 

package/server/services/plugins.js

@@ -62,10 +62,24 @@ const _loadedPlugins = {};
 
 /**
  * Core plugins - always loaded regardless of plugins.json enabled state.
- * These are considered first-class CMS features, not optional add-ons.
+ * These are considered first-class CMS features, not optional add-ons: they
+ * ship with the CMS, cannot be switched off, and their sidebar entries file
+ * under Tools rather than Plugins.
+ *
+ * Being in here is the whole mechanism. `enabled` in plugins.json is ignored
+ * for these, so a site that had one switched off still gets it on the next
+ * start - which is the point of promoting one.
+ *
+ * It is also a waiting room rather than a destination: site-search sat here
+ * until search was moved into the CMS proper (server/services/search.js), and
+ * a feature nobody may switch off has no business being discovered, listed and
+ * toggled as though it were an add-on.
  */
 const CORE_PLUGINS = new Set(['analytics']);
 
+/** Is this plugin a built-in feature rather than an optional add-on? */
+export function isCorePlugin(name) { return CORE_PLUGINS.has(name); }
+
 /**
  * Scan the plugins/ directory and return all valid manifests.
  * Validates mandatory fields and required files (plugin.js, config.js).
@@ -187,6 +201,94 @@ export function savePluginState(name, state) {
     saveConfig('plugins', states);
 }
 
+/**
+ * Work out which plugins are pushed aside by others that are loading.
+ *
+ * A plugin declares `"supersedes": ["other-plugin"]` in its manifest when it
+ * replaces another outright - the Pro edition of something that also ships
+ * free, for instance. The superseded plugin then registers nothing at all: no
+ * routes, no sidebar item, no collections, so the admin shows one of the pair
+ * rather than two that do the same job.
+ *
+ * The claim lives on the REPLACEMENT, never on the plugin being replaced, so
+ * a bundled plugin needs no knowledge of the paid one that may one day
+ * displace it.
+ *
+ * ## This is computed every boot and never written to config/plugins.json
+ *
+ * Persisting it would be a trap. Licences are withdrawn by disabling a plugin
+ * and leaving its files in place, so if superseding had written the free
+ * plugin off as disabled, a customer whose licence lapsed would lose the
+ * replacement AND the thing it replaced, ending up worse off than someone who
+ * never paid. Deriving it at load time means the superseded plugin simply
+ * comes back on the next restart.
+ *
+ * @param   {object[]} manifests - every discovered manifest
+ * @param   {Set<string>} activeNames - names that would otherwise load
+ * @param   {{isCore?: (name: string) => boolean, warn?: (message: string) => void}} [options]
+ * @returns {Map<string, string>} superseded plugin name → the plugin displacing it
+ */
+export function resolveSupersessions(manifests, activeNames, options = {}) {
+    const {isCore = () => false, warn = () => {}} = options;
+    const byName = new Map(manifests.map(m => [m.name, m]));
+
+    // Collect the claims worth honouring, dropping the nonsensical ones loudly
+    // rather than silently - a manifest that claims the wrong thing is a
+    // packaging mistake, and a silent no-op makes it very hard to find.
+    const claims = new Map();
+    for (const manifest of manifests) {
+        if (!activeNames.has(manifest.name)) continue;
+        const targets = Array.isArray(manifest.supersedes) ? manifest.supersedes : [];
+        const kept = [];
+
+        for (const target of targets) {
+            if (target === manifest.name) {
+                warn(`"${manifest.name}" lists itself in supersedes - ignored.`);
+                continue;
+            }
+            if (!byName.has(target) || !activeNames.has(target)) continue;
+            if (isCore(target)) {
+                warn(`"${manifest.name}" cannot supersede core plugin "${target}" - ignored.`);
+                continue;
+            }
+            const rival = byName.get(target);
+            if (Array.isArray(rival.supersedes) && rival.supersedes.includes(manifest.name)) {
+                warn(`"${manifest.name}" and "${target}" each claim to supersede the other - neither is applied.`);
+                continue;
+            }
+            kept.push(target);
+        }
+
+        if (kept.length) claims.set(manifest.name, kept);
+    }
+
+    if (!claims.size) return new Map();
+
+    // A superseded plugin's own claims must stop counting, or A>B>C would
+    // leave C displaced by a B that is not itself loading. Recompute from
+    // scratch each pass until the answer stops changing.
+    let superseded = new Map();
+    for (let pass = 0; pass <= manifests.length; pass++) {
+        const next = new Map();
+        for (const [claimant, targets] of claims) {
+            if (superseded.has(claimant)) continue;
+            for (const target of targets) {
+                if (!next.has(target)) next.set(target, claimant);
+            }
+        }
+
+        const settled = next.size === superseded.size
+            && [...next].every(([name, by]) => superseded.get(name) === by);
+        superseded = next;
+        if (settled) return superseded;
+    }
+
+    // Only reachable via a supersede cycle longer than a mutual pair. Refusing
+    // to apply any of it keeps the outcome deterministic and visible.
+    warn('supersedes declarations form a cycle - none are applied.');
+    return new Map();
+}
+
 /**
  * Register server-side Fastify plugins for all enabled plugins.
  * Always loads plugin.js as the entry point.
@@ -198,11 +300,33 @@ export async function registerPlugins(fastify) {
     const manifests = await discoverPlugins();
     const states = getPluginStates();
 
+    // Which plugins would load on their own account, before anything displaces
+    // one another.
+    const activeNames = new Set(
+        manifests
+            .filter(m => states[m.name]?.enabled || CORE_PLUGINS.has(m.name))
+            .map(m => m.name)
+    );
+    const superseded = resolveSupersessions(manifests, activeNames, {
+        isCore: name => CORE_PLUGINS.has(name),
+        warn: message => fastify.log.warn(`[plugins] ${message}`)
+    });
+
     const loaded = [];
     for (const manifest of manifests) {
         const state = states[manifest.name] || {};
         if (!state.enabled && !CORE_PLUGINS.has(manifest.name)) continue;
 
+        const displacedBy = superseded.get(manifest.name);
+        if (displacedBy) {
+            // Recorded rather than merely skipped: the admin Plugins screen
+            // needs to say WHY this one is inactive, or the first thing anyone
+            // does is toggle it back on and watch nothing happen.
+            _loadedPlugins[manifest.name] = {enabled: false, publicEntry: null, supersededBy: displacedBy};
+            fastify.log.info(`[plugins] "${manifest.name}" superseded by "${displacedBy}" - not loaded.`);
+            continue;
+        }
+
         const entryPath = path.join(PLUGINS_DIR, manifest.name, 'plugin.js');
         try {
             const { default: plugin } = await import(entryPath);
@@ -613,6 +737,70 @@ export async function runLifecycleHook(name, hook, fastify) {
  *
  * @returns {Promise<{ sidebar: object[], routes: object[], views: object, css: object[] }>}
  */
+/**
+ * The newest mtime anywhere under a directory of browser code.
+ *
+ * Browser code that is imported rather than routed has no version of its own
+ * - it is fetched under whatever token the importing entry carried. Folding
+ * the newest mtime of the whole tree into that token is what makes a change
+ * to an imported file actually reach a browser. It applies to the shared
+ * plugins/_lib/admin as much as to a plugin's own admin/lib, and missing
+ * either presents the same way: a fix that is on disk and not in the tab.
+ *
+ * @param   {string} root absolute path; a missing directory is not an error
+ * @returns {Promise<number>} epoch milliseconds, or 0 if there is nothing there
+ */
+async function newestAdminMtime(root) {
+    let newest = 0;
+
+    /**
+     * @param   {string} dir
+     * @returns {Promise<void>}
+     */
+    async function walk(dir) {
+        let entries;
+        try {
+            entries = await fs.readdir(dir, {withFileTypes: true});
+        } catch {
+            return;
+        }
+        for (const entry of entries) {
+            const full = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                await walk(full);
+            } else {
+                try {
+                    newest = Math.max(newest, Math.floor((await fs.stat(full)).mtimeMs));
+                } catch { /* unreadable - ignore */ }
+            }
+        }
+    }
+
+    await walk(root);
+    return newest;
+}
+
+/**
+ * The licence line shown on a plugin's admin banner.
+ *
+ * A manifest may state it outright; otherwise it is derived, because every
+ * plugin needs a truthful answer here and almost none of them will ever carry
+ * the field. Closed source means it was bought, and the paid plugins are the
+ * ones already marked that way for the source-code guard - so the flag that
+ * protects the source also names the licence, rather than a second list
+ * someone has to remember to add to.
+ *
+ * @param   {object} manifest
+ * @returns {string}
+ */
+export function pluginLicence(manifest) {
+    const stated = manifest.licence || manifest.license;
+    if (typeof stated === 'string' && stated.trim()) return stated.trim();
+    if (CORE_PLUGINS.has(manifest.name)) return 'Built in';
+    if (manifest.closedSource) return 'Commercial licence';
+    return 'Included with Domma CMS';
+}
+
 export async function getAdminPluginConfig() {
     const manifests = await discoverPlugins();
     const states = getPluginStates();
@@ -621,6 +809,10 @@ export async function getAdminPluginConfig() {
     const routes = [];
     const views = {};
     const css = [];
+    // Per-view plugin identity, so the admin can put the same banner above
+    // every plugin screen without each plugin having to render one (and each
+    // rendering it differently, which is what it did before).
+    const meta = {};
 
     for (const manifest of manifests) {
         const state = states[manifest.name] || {};
@@ -629,27 +821,58 @@ export async function getAdminPluginConfig() {
         if (manifest.admin.sidebar) sidebar.push(...manifest.admin.sidebar);
         if (manifest.admin.routes) routes.push(...manifest.admin.routes);
 
-        // Auto-stamp view entries with mtime-based version (replaces manual ?v=N)
+        // Auto-stamp view entries with an mtime-based version.
+        //
+        // The stamp is the NEWEST mtime of the entry, the plugin's own admin
+        // tree and the shared admin library - not the entry alone. A view is
+        // usually a thin wrapper that rarely changes, while the code it
+        // imports changes constantly, so stamping only the entry left the
+        // browser fetching the same URL and serving the previous build of
+        // everything behind it. That presents as a feature that worked
+        // yesterday and does not today, on one machine.
+        const sharedStamp = Math.max(
+            await newestAdminMtime(path.join(PLUGINS_DIR, '_lib', 'admin')),
+            await newestAdminMtime(path.join(PLUGINS_DIR, manifest.name, 'admin'))
+        );
         for (const [viewName, viewDef] of Object.entries(manifest.admin.views || {})) {
             const entryBase = viewDef.entry.split('?')[0];
             let stamped = viewDef.entry;
             try {
                 const filePath = path.join(PLUGINS_DIR, entryBase);
                 const s = await fs.stat(filePath);
-                stamped = `${entryBase}?v=${Math.floor(s.mtimeMs)}`;
+                stamped = `${entryBase}?v=${Math.max(Math.floor(s.mtimeMs), sharedStamp)}`;
             } catch { /* keep original entry as-is */ }
             views[viewName] = { ...viewDef, entry: stamped };
+            meta[viewName] = {
+                plugin:      manifest.name,
+                displayName: manifest.displayName || manifest.name,
+                version:     manifest.version || '1.0.0',
+                date:        manifest.date || '',
+                author:      manifest.author || '',
+                icon:        manifest.icon || 'package',
+                core:        CORE_PLUGINS.has(manifest.name),
+                licence:     pluginLicence(manifest)
+            };
         }
 
-        // Collect admin CSS links declared in plugin.json admin.css[]
+        // Collect admin CSS links declared in plugin.json admin.css[], stamped
+        // with the file's mtime for the same reason view entries are: a browser
+        // keys its cache on the full URL, so an unstamped stylesheet keeps
+        // serving the old rules after an update and the plugin looks broken in
+        // a way that only a hard refresh explains.
         for (let i = 0; i < (manifest.admin.css || []).length; i++) {
             const cssPath = manifest.admin.css[i];
+            let href = `/plugins/${manifest.name}/${cssPath}`;
+            try {
+                const stat = await fs.stat(path.join(PLUGINS_DIR, manifest.name, cssPath));
+                href += `?v=${Math.max(Math.floor(stat.mtimeMs), sharedStamp)}`;
+            } catch { /* unreadable - link it unstamped rather than not at all */ }
             css.push({
                 id: `plugin-${manifest.name}-css${i > 0 ? `-${i}` : ''}`,
-                href: `/plugins/${manifest.name}/${cssPath}`
+                href
             });
         }
     }
 
-    return { sidebar, routes, views, css };
+    return { sidebar, routes, views, css, meta };
 }

package/server/services/renderer.js

@@ -11,6 +11,9 @@ import {applyTransforms} from './hooks.js';
 import {resolveLocation, resolveMenuDecorations, resolveOverlaysForPage} from './menus.js';
 import {buildMenuNav} from './menuRender.js';
 import {getProjectForPage} from './projects.js';
+import {resolveContextMenusForPage} from './contextMenus.js';
+import {buildOverrideStyleTag, loadThemeConfig} from './themeSettings.js';
+import {getSearchSettings} from './search.js';
 
 const VALID_LAYOUT_WIDTHS = new Set(['narrow', 'normal', 'wide', 'full']);
 const CUSTOM_CSS_PATH = new URL('../../content/custom.css', import.meta.url).pathname;
@@ -34,6 +37,43 @@ async function getTemplate() {
 }
 let _templateCache = null;
 
+/*
+ * Asset version for the public search UI. Bumped by hand when search.js or
+ * search.css changes - the updater replaces public/ wholesale, and a browser
+ * holding the previous file otherwise keeps it.
+ */
+const SEARCH_ASSET_V = '20260920-search';
+
+/**
+ * The public search UI: stylesheet, settings, script.
+ *
+ * Settings travel INSIDE the page rather than being fetched, so the trigger is
+ * there on first paint instead of a round trip later. Every key is public by
+ * design (see SEARCH_DEFAULTS); nothing sensitive belongs in that object.
+ *
+ * Both render paths need this, and wiring one and not the other is the standing
+ * trap in this file - the same one buildThemeView() carries.
+ *
+ * @returns {{headTag: string, bodyTag: string}} Empty strings when search is off
+ */
+function buildSearchAssets() {
+    let settings;
+    try {
+        settings = getSearchSettings();
+    } catch {
+        // A malformed config/search.json is not worth a blank page.
+        return {headTag: '', bodyTag: ''};
+    }
+    if (settings.enabled === false) return {headTag: '', bodyTag: ''};
+
+    const json = JSON.stringify(settings).replace(/<\/script>/gi, '<\\/script>');
+    return {
+        headTag: `<link rel="stylesheet" href="/public/css/search.css?v=${SEARCH_ASSET_V}">`,
+        bodyTag: `<script>window.__CMS_SEARCH__ = ${json};</script>\n`
+            + `<script src="/public/js/search.js?v=${SEARCH_ASSET_V}"></script>`
+    };
+}
+
 /**
  * Strip hidden items from the navigation config before public injection.
  * Returns a shallow clone - never mutates the cached config object.
@@ -191,10 +231,9 @@ export async function renderPage(page, opts = {}) {
 
     const breadcrumbsHtml = buildBreadcrumbsHtml(page, site);
 
-    const {fontLink, fontOverride} = buildFontVars(site.fontFamily, site.fontSize);
-    const fontStyleTag = fontOverride
-      ? `<style>${fontOverride}</style>`
-      : '';
+    const themeView = await buildThemeView(page);
+    const searchAssets = buildSearchAssets();
+    const {fontLink, fontStyleTag, autoTheme, activeTheme, dommaTheme, customThemeClass} = themeView;
 
     const {navbarFontLink, navbarStyleTag} = buildNavbarStyleTag(navigation);
 
@@ -202,16 +241,6 @@ export async function renderPage(page, opts = {}) {
         ? `<style>${customCss.replace(/<\/style>/gi, '<\\/style>')}</style>`
         : '';
 
-    const autoTheme = (!page.theme && site.autoTheme?.enabled) ? site.autoTheme : null;
-    const activeTheme = page.theme
-        || (autoTheme ? autoTheme.dayTheme : site.theme)
-        || 'charcoal-dark';
-    // When a custom theme is active, Domma's theme engine must receive the base
-    // built-in theme (which it recognises). The custom override class is added
-    // separately after Domma's init so _applyTheme() cannot strip it.
-    const dommaTheme = site.baseTheme || activeTheme;
-    const customThemeClass = site.baseTheme ? `dm-theme-${activeTheme}` : '';
-
     // Compose window.__CMS_FOOTER__ from the menus mapped to footer-primary / footer-legal.
     const footer = {
         primary:   footerPrimaryDecorated,
@@ -229,6 +258,26 @@ export async function renderPage(page, opts = {}) {
     // counts for something nobody has published.
     const noTrack = !!opts.preview || opts.noTrack === true;
 
+    /*
+     * Authored context menus. Resolved server-side so a visitor only receives
+     * the menus that apply to this page - a menu bound to /shop/* is not in the
+     * source of /about. Domma does the rest in the browser: which menu answers
+     * a given right-click is decided by walking outward from the click, not here.
+     */
+    let ctxMenus = [];
+    try {
+        ctxMenus = await resolveContextMenusForPage(menuCtx);
+    } catch (err) {
+        // A malformed menu file must not take the page down with it.
+        console.warn(`[context-menus] Resolution skipped: ${err.message}`);
+    }
+    const ctxMenusScript = ctxMenus.length
+        ? `window.__CMS_CTXMENUS__ = ${JSON.stringify(ctxMenus).replace(/<\/script>/gi, '<\\/script>')};`
+        : '';
+    const ctxMenusModule = ctxMenus.length
+        ? '<script src="/public/js/context-menus.js?v=20260918-ctx" type="module"></script>'
+        : '';
+
     const vars = {
         previewFlagScript: noTrack ? '<script>window.__CMS_PREVIEW__ = true;</script>' : '',
         seoTitle,
@@ -252,6 +301,8 @@ export async function renderPage(page, opts = {}) {
         showSidebar: preset.sidebar === true || page.sidebar === true,
         navJson: JSON.stringify(filterHiddenNavItems(navigation)).replace(/<\/script>/gi, '<\\/script>'),
         footerScript: footerJson ? `window.__CMS_FOOTER__ = ${footerJson};` : '',
+        ctxMenusScript: ctxMenusScript,
+        ctxMenusModule: ctxMenusModule,
         siteJson: JSON.stringify(Object.assign(
             {
                 title: site.title,
@@ -268,7 +319,11 @@ export async function renderPage(page, opts = {}) {
             autoTheme ? {autoTheme} : {}
         )).replace(/<\/script>/gi, '<\\/script>'),
         headInject: [injection.head, navbarFontLink].filter(Boolean).join('\n'),
-        headInjectLate: [injection.headLate, customCssTag, navbarStyleTag].filter(Boolean).join('\n'),
+        // Theme overrides land BEFORE content/custom.css: the overrides are
+        // generated, custom.css is hand-written, and the hand-written one stays
+        // the last word.
+        headInjectLate: [injection.headLate, searchAssets.headTag, themeView.overrideStyleTag, customCssTag, navbarStyleTag]
+            .filter(Boolean).join('\n'),
         bodyEndInject: [
             // Draft banner - first, so it is the topmost fixed element and a
             // floating overlay menu cannot bury the only affordance telling
@@ -279,6 +334,7 @@ export async function renderPage(page, opts = {}) {
             // content flow.
             overlayMenus,
             injection.bodyEnd,
+            searchAssets.bodyTag,
             site.backToTop?.enabled    ? '<script src="/public/js/btt.js"></script>'             : '',
             site.cookieConsent?.enabled ? '<script src="/public/js/cookie-consent.js"></script>' : '',
             (page.usedComponents || [])
@@ -641,6 +697,46 @@ function fontFamilyValue(family) {
     return `'${safe}', ${generic}`;
 }
 
+/**
+ * The theme facts one render needs.
+ *
+ * config/theme.json is authoritative. The matching site.json keys still exist
+ * as a one-way mirror for plugins and the fleet manager, so reading them here
+ * would make the mirror load-bearing and give the CMS two sources of truth.
+ *
+ * @param {object} page - Page record; `page.theme` still wins over everything.
+ * @returns {Promise<object>} Template vars plus the compiled override stylesheet.
+ */
+async function buildThemeView(page = {}) {
+    const cfg = await loadThemeConfig();
+
+    // A page pinned to a theme opts out of the automatic pair - otherwise the
+    // pin would silently expire at the day/night boundary.
+    const autoTheme = (!page.theme && cfg.autoTheme?.enabled) ? cfg.autoTheme : null;
+    const activeTheme = page.theme
+        || (autoTheme ? autoTheme.dayTheme : cfg.theme)
+        || 'charcoal-dark';
+
+    // A custom (Theme Roller) theme is not a theme Domma's engine knows, so it
+    // receives the built-in base and the custom class rides along separately,
+    // added after init so _applyTheme() cannot strip it.
+    const dommaTheme = cfg.baseTheme || activeTheme;
+    const customThemeClass = cfg.baseTheme ? `dm-theme-${activeTheme}` : '';
+
+    const {fontLink, fontOverride} = buildFontVars(cfg.font?.family, cfg.font?.size);
+
+    return {
+        cfg,
+        autoTheme,
+        activeTheme,
+        dommaTheme,
+        customThemeClass,
+        fontLink,
+        fontStyleTag: fontOverride ? `<style>${fontOverride}</style>` : '',
+        overrideStyleTag: buildOverrideStyleTag(cfg)
+    };
+}
+
 function buildFontVars(fontFamily, fontSize) {
     const PRECONNECT = '<link rel="preconnect" href="https://fonts.googleapis.com">\n    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>';
     const family = fontFamily || 'Roboto';
@@ -753,18 +849,17 @@ export async function renderBlogPage(templatePath, data = {}, seoMeta = {}) {
     };
     const seoTags = buildSeoTags({page: syntheticPage, site, baseUrl, seoTitle, seoDescription, ogImage});
 
-    const {fontLink, fontOverride} = buildFontVars(site.fontFamily, site.fontSize);
-    const fontStyleTag = fontOverride ? `<style>${fontOverride}</style>` : '';
+    // Both render paths resolve the theme the same way. Wiring one and not the
+    // other is the standing trap in this file.
+    const themeView = await buildThemeView({});
+    const searchAssets = buildSearchAssets();
+    const {fontLink, fontStyleTag, activeTheme, dommaTheme, customThemeClass} = themeView;
     const {navbarFontLink, navbarStyleTag} = buildNavbarStyleTag(navigation);
 
     const customCssTag = customCss.trim()
         ? `<style>${customCss.replace(/<\/style>/gi, '<\\/style>')}</style>`
         : '';
 
-    const activeTheme = site.theme || 'charcoal-dark';
-    const dommaTheme = site.baseTheme || activeTheme;
-    const customThemeClass = site.baseTheme ? `dm-theme-${activeTheme}` : '';
-
     // Compose window.__CMS_FOOTER__ from the menus mapped to footer-primary / footer-legal.
     const footer = {
         primary:   footerPrimaryDecorated,
@@ -776,6 +871,26 @@ export async function renderBlogPage(templatePath, data = {}, seoMeta = {}) {
     };
     const footerJson = JSON.stringify(footer).replace(/<\/script>/gi, '<\\/script>');
 
+    /*
+     * Authored context menus. Resolved server-side so a visitor only receives
+     * the menus that apply to this page - a menu bound to /shop/* is not in the
+     * source of /about. Domma does the rest in the browser: which menu answers
+     * a given right-click is decided by walking outward from the click, not here.
+     */
+    let ctxMenus = [];
+    try {
+        ctxMenus = await resolveContextMenusForPage({urlPath: seoMeta.urlPath || '/'});
+    } catch (err) {
+        // A malformed menu file must not take the page down with it.
+        console.warn(`[context-menus] Resolution skipped: ${err.message}`);
+    }
+    const ctxMenusScript = ctxMenus.length
+        ? `window.__CMS_CTXMENUS__ = ${JSON.stringify(ctxMenus).replace(/<\/script>/gi, '<\\/script>')};`
+        : '';
+    const ctxMenusModule = ctxMenus.length
+        ? '<script src="/public/js/context-menus.js?v=20260918-ctx" type="module"></script>'
+        : '';
+
     const vars = {
         seoTitle,
         seoDescription,
@@ -799,6 +914,8 @@ export async function renderBlogPage(templatePath, data = {}, seoMeta = {}) {
         showSidebar: false,
         navJson: JSON.stringify(filterHiddenNavItems(navigation)).replace(/<\/script>/gi, '<\\/script>'),
         footerScript: footerJson ? `window.__CMS_FOOTER__ = ${footerJson};` : '',
+        ctxMenusScript: ctxMenusScript,
+        ctxMenusModule: ctxMenusModule,
         siteJson: JSON.stringify({
             title: site.title,
             footer: site.footer
@@ -810,10 +927,15 @@ export async function renderBlogPage(templatePath, data = {}, seoMeta = {}) {
             social: site.social || null
         }).replace(/<\/script>/gi, '<\\/script>'),
         headInject: [injection.head, navbarFontLink].filter(Boolean).join('\n'),
-        headInjectLate: [injection.headLate, customCssTag, navbarStyleTag].filter(Boolean).join('\n'),
+        // Theme overrides land BEFORE content/custom.css: the overrides are
+        // generated, custom.css is hand-written, and the hand-written one stays
+        // the last word.
+        headInjectLate: [injection.headLate, searchAssets.headTag, themeView.overrideStyleTag, customCssTag, navbarStyleTag]
+            .filter(Boolean).join('\n'),
         bodyEndInject: [
             overlayMenus,
             injection.bodyEnd,
+            searchAssets.bodyTag,
             (seoMeta.usedComponents || [])
                 .map(n => `<script type="module" src="/api/components/${n}.js"></script>`)
                 .join('\n')