domma-cms 0.66.0 → 0.69.4

package/plugins/blog/public/samples/rosewood.svg

@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1600 900" width="1600" height="900">
+<defs><linearGradient id="g" x1="0" y1="0" x2="1" y2="1"><stop offset="0" stop-color="#831843"/><stop offset="1" stop-color="#ec4899"/></linearGradient>
+<filter id="blur"><feGaussianBlur stdDeviation="40"/></filter></defs>
+<rect width="1600" height="900" fill="url(#g)"/>
+<g filter="url(#blur)"><circle cx="1309" cy="431" r="339" fill="#fecdd3" opacity="0.1"/><circle cx="750" cy="714" r="357" fill="#fecdd3" opacity="0.18"/><circle cx="1245" cy="680" r="207" fill="#ffffff" opacity="0.18"/><circle cx="546" cy="727" r="288" fill="#ffffff" opacity="0.18"/><circle cx="1564" cy="596" r="325" fill="#ec4899" opacity="0.14"/><circle cx="172" cy="540" r="370" fill="#ffffff" opacity="0.14"/><circle cx="1078" cy="252" r="125" fill="#ffffff" opacity="0.22"/></g>
+<path d="M0 520 C400 400 1200 640 1600 520" stroke="#fff" stroke-opacity=".12" stroke-width="2" fill="none"/><path d="M0 580 C400 460 1200 700 1600 580" stroke="#fff" stroke-opacity=".12" stroke-width="2" fill="none"/><path d="M0 640 C400 520 1200 760 1600 640" stroke="#fff" stroke-opacity=".12" stroke-width="2" fill="none"/><path d="M0 700 C400 580 1200 820 1600 700" stroke="#fff" stroke-opacity=".12" stroke-width="2" fill="none"/><path d="M0 760 C400 640 1200 880 1600 760" stroke="#fff" stroke-opacity=".12" stroke-width="2" fill="none"/><path d="M0 820 C400 700 1200 940 1600 820" stroke="#fff" stroke-opacity=".12" stroke-width="2" fill="none"/><path d="M0 880 C400 760 1200 1000 1600 880" stroke="#fff" stroke-opacity=".12" stroke-width="2" fill="none"/>
+</svg>

package/plugins/blog/templates/index.html

@@ -1,9 +1,10 @@
-<main class="container" style="padding: 2rem 0;">
-  <h1 class="mb-4">{{archiveTitle}}</h1>
-  <div id="blog-posts-list">
-    {{posts}}
-  </div>
-  <div id="blog-pagination" class="mt-4">
-    {{pagination}}
-  </div>
+<link rel="stylesheet" href="/plugins/blog/public/blog.css?v={{assetV}}">
+<main class="container blog-page" id="dm-blog">
+  <header class="blog-archive-head">
+    <h1>{{archiveTitle}}</h1>
+    {{archiveIntro}}
+  </header>
+  {{archive}}
+  {{pagination}}
 </main>
+<script type="module" src="/plugins/blog/public/blog.js?v={{assetV}}"></script>

package/plugins/blog/templates/post.html

@@ -1,18 +1,5 @@
-<main class="container" style="padding: 2rem 0;">
-  <article class="blog-post">
-    <header class="mb-4">
-      <h1>{{title}}</h1>
-      <p class="text-muted">by {{authorName}} &bull; <time>{{publishedAt}}</time></p>
-      <div class="mb-2">{{categories}}{{tags}}</div>
-    </header>
-    {{featuredImage}}
-    <div class="post-content mb-5">
-      {{content}}
-    </div>
-  </article>
-
-  <section id="comments" class="mt-5">
-    {{comments}}
-    {{commentForm}}
-  </section>
+<link rel="stylesheet" href="/plugins/blog/public/blog.css?v={{assetV}}">
+<main class="container blog-page" id="dm-blog">
+  {{post}}
 </main>
+<script type="module" src="/plugins/blog/public/blog.js?v={{assetV}}"></script>

package/plugins/blog/tests/layouts.test.js

@@ -0,0 +1,97 @@
+/**
+ * Blog layouts - the pure half of rendering through blocks (lib/layouts.js).
+ *
+ * Post fields reach these functions from authors, and the listing's metadata
+ * reaches every visitor's browser, so the escaping and the whitelists are
+ * pinned here rather than trusted.
+ */
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {
+    buildToc, cardMeta, cardVars, interpolate, listDisplays, pickDisplay, pickDisplaySettings,
+    pickPostLayout, postLayouts, relatedPosts, safeImageUrl
+} from '../lib/layouts.js';
+
+test('interpolate: escaped by default, raw on request, dates formatted, comments dropped', () => {
+    const tpl = '<!-- header: {{title}} --><h1>{{title}}</h1>{{{html}}}<time>{{when:D MMM YYYY}}</time>{{missing}}';
+    assert.equal(
+        interpolate(tpl, {title: '<script>x</script>', html: '<b>ok</b>', when: '2026-09-23T10:00:00Z'}),
+        '<h1>&lt;script&gt;x&lt;/script&gt;</h1><b>ok</b><time>23 Sep 2026</time>'
+    );
+    assert.equal(interpolate('{{when:YYYY}}', {when: 'not a date'}), 'not a date', 'a non-date prints as itself');
+});
+
+test('the layouts on offer: shipped ones first, then any blog-post-* / blog-card-* block', () => {
+    const names = ['blog-post-long-read', 'blog-card-poster', 'blog-card', 'cta-banner', 'blog-post-classic', 'blog-post-Bad'];
+    assert.deepEqual(postLayouts(names).map(l => l.id),
+        ['blog-post-classic', 'blog-post-feature', 'blog-post-minimal', 'blog-post-sidebar', 'blog-post-long-read']);
+    assert.equal(postLayouts(names).at(-1).label, 'Long read');
+    const displays = listDisplays(names);
+    assert.deepEqual(displays.map(d => d.id), ['cards', 'list', 'magazine', 'compact', 'blog-card-poster']);
+    assert.equal(displays.at(-1).block, 'blog-card-poster');
+});
+
+test('a post uses its own layout, else the site default, else Classic', () => {
+    const layouts = postLayouts([]);
+    assert.equal(pickPostLayout({template: 'blog-post-feature'}, {postLayout: 'blog-post-minimal'}, layouts), 'blog-post-feature');
+    assert.equal(pickPostLayout({template: 'blog-post-gone'}, {postLayout: 'blog-post-minimal'}, layouts), 'blog-post-minimal');
+    assert.equal(pickPostLayout({}, {postLayout: 'blog-post-gone'}, layouts), 'blog-post-classic');
+    const displays = listDisplays([]);
+    assert.equal(pickDisplay('list', {listDisplay: 'compact'}, displays).id, 'list');
+    assert.equal(pickDisplay('nope', {listDisplay: 'compact'}, displays).id, 'compact');
+    assert.equal(pickDisplay('', {}, displays).id, 'cards');
+});
+
+test('display settings are whitelisted, and only the keys sent come back', () => {
+    assert.deepEqual(pickDisplaySettings({postLayout: 'blog-post-x', listDisplay: 'List!', relatedCount: '99', interactive: 0, other: 1}),
+        {postLayout: 'blog-post-x', relatedCount: 6, interactive: false});
+    assert.deepEqual(pickDisplaySettings({postLayout: '../etc'}), {});
+    assert.deepEqual(pickDisplaySettings({}), {});
+});
+
+test('contents: headings get unique ids; one heading is not worth a list', () => {
+    const {html, toc, count} = buildToc('<h2>Intro</h2><p>x</p><h3 id="kept">Detail</h3><h2>Intro</h2>');
+    assert.equal(count, 3);
+    assert.match(html, /<h2 id="intro">Intro<\/h2>/);
+    assert.match(html, /<h2 id="intro-2">Intro<\/h2>/);
+    assert.match(html, /<h3 id="kept">/);
+    assert.match(toc, /href="#intro-2"/);
+    assert.equal(buildToc('<h2>Only</h2>').toc, '');
+});
+
+test('image addresses are only ever plain URLs - nothing that escapes url() or src=""', () => {
+    assert.equal(safeImageUrl('/media/a.jpg'), '/media/a.jpg');
+    assert.equal(safeImageUrl('https://x.test/a.png'), 'https://x.test/a.png');
+    for (const bad of ["javascript:alert(1)", "/a.jpg') ; background:red", '/a".jpg', 'a.jpg', '']) {
+        assert.equal(safeImageUrl(bad), '', bad);
+    }
+});
+
+test('a card: markup only where the plugin built it; the browser gets plain values', () => {
+    const post = {id: 'p1', slug: 'hi there', title: 'A <b>', excerpt: 'e', categories: ['c1', 'gone'], tags: ['x"y'],
+        authorId: 'u1', content: 'word '.repeat(450), featuredImage: 'javascript:1', publishedAt: '2026-01-02T00:00:00Z'};
+    const catMap = {c1: {name: 'News <i>', slug: 'news'}};
+    const v = cardVars(post, {base: '/blog', catMap, authorName: 'Ann'});
+    assert.equal(v.url, '/blog/hi%20there');
+    assert.equal(v.image, '', 'an unsafe image is dropped, not escaped into place');
+    assert.equal(v.imageClass, 'no-image');
+    assert.equal(v.readingTime, '2 min read');
+    assert.match(v.categories, /News &lt;i&gt;/);
+    assert.match(v.tags, /data-blog-tag="x&quot;y"/);
+    const m = cardMeta(post, {catMap, authorName: 'Ann'});
+    assert.deepEqual(m.cats, [{slug: 'news', name: 'News <i>'}], 'plain text: the browser sets it as text');
+    assert.equal(m.minutes, 2);
+});
+
+test('related posts: shared categories outweigh shared tags; newer breaks a tie', () => {
+    const me = {id: 'me', categories: ['a'], tags: ['t']};
+    const all = [
+        me,
+        {id: 'tag-only', tags: ['t'], publishedAt: '2026-05-01'},
+        {id: 'cat-old', categories: ['a'], publishedAt: '2026-01-01'},
+        {id: 'cat-new', categories: ['a'], publishedAt: '2026-03-01'},
+        {id: 'none', publishedAt: '2026-06-01'}
+    ];
+    assert.deepEqual(relatedPosts(me, all, 3).map(p => p.id), ['cat-new', 'cat-old', 'tag-only']);
+    assert.deepEqual(relatedPosts(me, all, 0), []);
+});

package/plugins/blog/tests/public.test.js

@@ -0,0 +1,71 @@
+/**
+ * Blog - the routes readers and authors actually hit.
+ *
+ * The public pages are driven through @fastify/compress with a browser's
+ * Accept-Encoding, because that is where they broke: the handlers sent the
+ * page without returning the reply, and under compression every browser got a
+ * 200 with an EMPTY body. Plain requests (curl, tests without compression)
+ * still got the page, which is how it went unnoticed.
+ *
+ * Nothing here writes to the host CMS: the public plugin only reads, and the
+ * post rules are tested on the pure function that applies them.
+ */
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import zlib from 'zlib';
+import Fastify from 'fastify';
+import compress from '@fastify/compress';
+import blogPublicPlugin from '../plugin.public.js';
+import {postFields} from '../plugin.js';
+
+async function buildPublic() {
+    const app = Fastify();
+    await app.register(compress, {global: true, threshold: 1024, encodings: ['br', 'gzip', 'deflate']});
+    await app.register(blogPublicPlugin, {settings: {basePath: '/blog'}, config: {}});
+    return app;
+}
+
+test('the blog index reaches a browser whole, under every encoding', async () => {
+    const app = await buildPublic();
+    const decoders = {gzip: zlib.gunzipSync, br: zlib.brotliDecompressSync, deflate: zlib.inflateSync};
+    for (const enc of ['gzip, deflate, br', 'gzip', 'br', 'identity']) {
+        const res = await app.inject({method: 'GET', url: '/blog', headers: {'accept-encoding': enc}});
+        assert.equal(res.statusCode, 200, enc);
+        const used = res.headers['content-encoding'];
+        const body = (used ? decoders[used](res.rawPayload) : res.rawPayload).toString('utf8');
+        assert.ok(body.length > 1000, `${enc}: a page, not an empty body (${body.length} bytes)`);
+        assert.match(body, /data-blog-archive/, enc);
+        assert.match(body, /\/plugins\/blog\/public\/blog\.js/, `${enc}: the listing script is on the page`);
+    }
+    const feed = await app.inject({method: 'GET', url: '/blog/feed.xml', headers: {'accept-encoding': 'gzip'}});
+    const xml = feed.headers['content-encoding'] === 'gzip' ? zlib.gunzipSync(feed.rawPayload) : feed.rawPayload;
+    assert.match(xml.toString('utf8'), /<rss version="2.0">/);
+    await app.close();
+});
+
+test('a display can be asked for, and an unknown one falls back', async () => {
+    const app = await buildPublic();
+    const list = await app.inject({method: 'GET', url: '/blog?display=compact'});
+    assert.match(list.body, /data-display="compact"/);
+    const odd = await app.inject({method: 'GET', url: '/blog?display=%3Cscript%3E'});
+    assert.doesNotMatch(odd.body, /data-display="<script>/);
+    assert.match(odd.body, /data-display="cards"/);
+    await app.close();
+});
+
+test('an author cannot publish by writing the status - that is what the publish route is for', () => {
+    const author = {id: 'a', role: 'blog-author'};
+    const editor = {id: 'e', role: 'blog-editor'};
+    assert.equal(postFields({status: 'published'}, author).status, undefined);
+    assert.equal(postFields({status: 'scheduled'}, author).status, undefined);
+    assert.equal(postFields({status: 'draft'}, author).status, 'draft', 'anyone may move their post back to draft');
+    assert.equal(postFields({status: 'published'}, editor).status, 'published');
+    assert.equal(postFields({status: 'bogus'}, editor).status, undefined);
+});
+
+test('a post keeps only the fields it has - no authorship, no sample flag, a valid layout', () => {
+    const out = postFields({title: ' T ', authorId: 'someone-else', sample: true, template: 'blog-post-feature', tags: [' a ', '', 'b']}, {role: 'admin'});
+    assert.deepEqual(out, {title: 'T', template: 'blog-post-feature', tags: ['a', 'b']});
+    assert.equal(postFields({template: '../../etc/passwd'}, {role: 'admin'}).template, '');
+    assert.equal(postFields({template: ''}, {role: 'admin'}).template, '', 'empty is "use the site default"');
+});

package/plugins/free-tier.lock.json

@@ -0,0 +1,74 @@
+{
+  "note": "Written by `make sync-free-tier` in dcms-marketplace. Do not edit these plugins here - edit them there and sync.",
+  "source": "dcms-marketplace@6f9dbf3",
+  "plugins": {
+    "blog": {
+      "version": "1.4.4",
+      "files": {
+        "CLAUDE.md": "69087729ee22dddef5868e14fd6dd4570bb5387917020de873948785e6919756",
+        "admin/css/index.css": "2f39febfe02491f6db0e32b766723c3a2950a6a1139a108b2ec756d395472f30",
+        "admin/templates/blog.html": "a6054c1febe764bb1edf5c9e466d44a9080d9c83ba5486437b7a8244acf5ba54",
+        "admin/templates/categories.html": "ab7d6fc2fedd48876c585bc216a1532b3bdd78c946dee976c1171bfe4664feb6",
+        "admin/templates/comments.html": "095ff03bd5e1ed9ac75edf1ceb9fbe7b2907a1e35b261672da51e00742c2814a",
+        "admin/templates/post-editor.html": "c5292ecac2bfe4994ac62b4bf67631b7959dfa068cc3c1332d2268d870d0b467",
+        "admin/templates/settings.html": "e0730cd57435e592034328a699198d5e1326084767156bfc2289852f5f1a45af",
+        "admin/views/blog.js": "52bf73bfbc2d8736c1217d89dec1e69649f4b2f5334b7da1abf33bb1981dc921",
+        "admin/views/categories.js": "dade241e8d70d101366c5c8e9eed721f7b39ffda65025a272ae5679660f0f50c",
+        "admin/views/comments.js": "f5055e7b8e0c3fd8f71b2a8aeeb47c68fab5ff7d24ffb5d9e052eedfc1da1df2",
+        "admin/views/kit.js": "c7b475fe5920b6429a03976a1463a218751e0ed2e42135920e4c3b1ebf47e79f",
+        "admin/views/post-editor.js": "97ea927c539419940fccf4a78fc3098e00beca3454a56ef432fa94b7f3cacb81",
+        "admin/views/settings-cog.js": "307efc93835863dd8511f8fb17a224cf45a77532c90b854a86d2cd1d4e5f9f18",
+        "admin/views/settings.js": "2b7f775e37e034dee4ae3dfadea5e446c2e526bed8a066ef3ca2e777146ada23",
+        "blocks/blog-card-compact.css": "eb8e8ae9a6461c362bc021ea0396c6b4481047b6b36a50eeb59e47375e49be75",
+        "blocks/blog-card-compact.html": "7e1e31923808e6108d57d34309d3442b5d93b4aa4396f0e471e870249934ab8f",
+        "blocks/blog-card-row.css": "f5f0249c51a40cc71ff8d054bfa887353badc79730b0f323c76ac32f7d893b44",
+        "blocks/blog-card-row.html": "eb28d26c86c4cefcf553273e6547885b0dc03fbb6e2543e9c1aa4b132db6216a",
+        "blocks/blog-card.css": "d480a80a7378bd55659e9549bb30d8c106bdae1a9cd450a8c0114bfaefa94cd2",
+        "blocks/blog-card.html": "cf676e8e9f676ea8b49637cb54a7d6fcd6f3395af8f4a8833a65ba78b35efc76",
+        "blocks/blog-post-classic.css": "9acac617847b5a10dabd5efccb601572e2751f792c4038475325f11e24142584",
+        "blocks/blog-post-classic.html": "1fab77c7aeb67fe72b73c4db42ff4c3a66466c041104639f4898c390c665fc38",
+        "blocks/blog-post-feature.css": "7d8a242b627f3826df21d5470e643b386967122ea3585e69f96cce9ffc2452e9",
+        "blocks/blog-post-feature.html": "c0408538cc269e4f2873f9c9c44a000347e4d5cafe3ecb024f62112ea711a9ab",
+        "blocks/blog-post-minimal.css": "2323b84a7d0a99e1c85c30faa18bb2ee16763ff08cfe87f181ffadf8cff84dd0",
+        "blocks/blog-post-minimal.html": "3a04925980018a13038ebf4bcfecc4f69284c1bac087631ddc0f66e0e95e07fe",
+        "blocks/blog-post-sidebar.css": "3c66109fa48ca448605eb5acd0c998f43649fb3747813b4a811992ec89886007",
+        "blocks/blog-post-sidebar.html": "d510a9e272e9415941064b4567def47a179b88825e29c6dd340540870ab04a61",
+        "collections/categories/schema.json": "0728e522ed8e3c623fd45e137cd03e0960aa5158e70613ec8628c8b3928e0929",
+        "collections/comments/schema.json": "29cbd289cbfcfc4158c9357a218db4ce06eddc3370bfbf9afb7d7f52065a849e",
+        "collections/posts/schema.json": "19a5a770d3eefea73f4117454bd1312a7a7e3d727cfcdfde141139fbc81cabd7",
+        "config.js": "ee67396262762f5c31269d258affd75f7392a3e364f72f7792c2f1cdafd94bba",
+        "lib/layouts.js": "e55dfd79227a36e190d648dcbd3c31de538dafed9b5ca68844c98ef79b6c2509",
+        "lib/page.js": "1fb9a01c3080e8ecf65c19b1273b23d550a131fe30079a493a9f5b1c90b720ae",
+        "lib/render.js": "0e97c6a950bc962c8d8ea4b2f21d06cb73fbcdc738d8942d6935d01309a29b1d",
+        "lib/samples.js": "e8cdb77ce22e43937707f6854d3a5cb722437dc584e22ac7b24480bef686cf85",
+        "plugin.js": "32e223ff46bfc72a4db6904425ef9488538a901d73c67be41a0fc0cc037e457b",
+        "plugin.json": "16104f855c0afa2912d5a96465d6388e4090d56fabbf566401942d8160ea2d1b",
+        "plugin.public.js": "053bbc0322ba205640fdbb834340883d0698600e7a637c8165ecac9d49c8d040",
+        "public/blog.css": "fd733e6b624190da1e70dc1b6613e2376efd7f7570a28fab311d81006d03d960",
+        "public/blog.js": "d01c72a9834dcc7c5241923371f2b164ac30d20ac9f1a5c5dc5b71fa3cb09f08",
+        "public/samples/aurora.svg": "feb29e2b46465913fc29de9eda221b00b1541f1fa3ea7120f0c1d1cd11a9a4f6",
+        "public/samples/dusk.svg": "92469dcfe2e78ed9bfa6ddeb9f9c4726ec64e04c6e9b40260523a825b582b580",
+        "public/samples/ember.svg": "754cb6e1cc2d26274f24bf86baa7658a402448944dcfb10709c658abad9b29d0",
+        "public/samples/harbour.svg": "a5f09eafa1406da3c2d017e9bee308a98543df15090ed27227cbbf8341aec460",
+        "public/samples/meadow.svg": "90efae21e209b7d48901eed457f47d0a347c58a6b6e1ea81ba98c131c4c559cb",
+        "public/samples/rosewood.svg": "0f963fe5633585786271255b7c9df36be67748ae751f9cf7b0bbda6f5b93449d",
+        "roles/blog-author.json": "ccdd4d99296c157ddc839af22ef6e79c47c381dd9d937069f7090a4fb76bb41d",
+        "roles/blog-editor.json": "bea0b673cf9e3da04c5882d51dd33bdcaf035b047c1cfe87624a9f16e6514ffc",
+        "templates/index.html": "3c2cf8a4ffde8599d451f6d00b736aeba42fd073b726ada3b0ffe4d56e1ef0f4",
+        "templates/post.html": "28e9f06071115ecc4fbba007b35782732bf12ef72528525893d424e3c4f0313f",
+        "tests/layouts.test.js": "70e0e462985d14618838c3897ffff7c453b711b64c6fc9277023268b0755377c",
+        "tests/public.test.js": "ef04ba271d03cee86adac332c6834bb51102b20d892d5f84d30eb04507605de5"
+      }
+    },
+    "mail-reader": {
+      "version": "1.0.0",
+      "files": {
+        "CLAUDE.md": "a8dd2cb285e1d24b2f072aa11a644e1c8c1be89013da6f6cc46d9820fe24ccd5",
+        "admin/views/mail.js": "c5c6483f9618c75cac8f4be32d3aea99511db76d4b9d38b8ef43bdc1d35db3c5",
+        "config.js": "6e65803ad822a9acda40c203631b8eb32a87cf9d9e5f1c7cb59d01aa406075c6",
+        "plugin.js": "79b17346ed0192b092040460cc8d762d5207ee6e4af7bfc2d1cf654a51e2fa81",
+        "plugin.json": "5f5b98757514aa70d7c7a2be5a1fbfdde8ef21a2ccc7586b3b5aea9b44fbe5e6"
+      }
+    }
+  }
+}

package/plugins/mail-reader/CLAUDE.md

@@ -0,0 +1,78 @@
+# mail-reader — AI Assistant Guide
+
+## Purpose
+
+Read-only IMAP mailbox reader. Connects to a **standard IMAP server** and displays mail. It
+deliberately cannot write: no mark-as-read, no flagging, no move, no delete, no send.
+
+Full mail (sending, flags, drafts, search, sync) is **`email-pro`** — a separate Pro-tier plugin
+that requires MongoDB. Nothing here should grow toward it by accident — phase 1 keeps **no message store at
+all**, which is what makes the Pro sync layer a clean addition rather than a migration.
+
+## Files
+
+- `plugin.json`, `config.js`, `plugin.js` — manifest, defaults, routes
+- `admin/views/mail.js`, `admin/templates/mail.html`, `admin/css/mail.css`
+
+The IMAP core — crypto, account store, connection pool, renderer — is **not here**. It lives in
+`plugins/_lib/mail/`, shared with `email-pro`, with its state at `plugins/_lib/data/`. See
+`plugins/_lib/mail/CLAUDE.md` before changing anything about credentials or connections.
+
+## Routes
+
+All under `/api/plugins/mail-reader`, all requiring authentication.
+
+| Method | Path | Purpose |
+|---|---|---|
+| GET | `/accounts` | Every mailbox this user owns. Never returns passwords, only `hasPassword`. |
+| POST | `/accounts` | Add a mailbox. |
+| PUT | `/accounts/:id` | Update one. A blank password means "keep the stored one". |
+| DELETE | `/accounts/:id` | Forget a mailbox and its password. |
+| POST | `/accounts/test` | Try details without saving. With `id` and a blank password, uses the stored one. |
+| GET | `/folders` | Folder list, `\Noselect` filtered out. `?account=` |
+| GET | `/messages` | One page of envelopes, newest first. `?account=&folder=&page=&limit=` |
+| GET | `/messages/:uid` | One message, rendered. `?account=&folder=&images=load` |
+| GET | `/messages/:uid/attachments/:index` | Streams one part as a download. `?account=&folder=` |
+
+A user may hold several mailboxes. Omitting `?account=` selects their first one, so the reader can
+open on something rather than asking which before it has shown anything.
+
+## Gotchas
+
+- **Read-only is enforced, not merely omitted.** Mailboxes open `{readOnly: true}` and ImapFlow
+  fetches with `BODY.PEEK[]`. Drop either and the server sets `\Seen` as a side effect of *reading*
+  a message — the user's phone then shows mail they never opened. There is no route that writes;
+  keep it that way until mark-as-read is a deliberate, visible action.
+- **No permission resource, on purpose.** Access control is ownership: every route resolves the
+  account from `request.user`, and no route takes someone else's id. Registering a `mail-reader` resource
+  would 403 every user *including super-admin* (no bypass since 0.22) from the moment the plugin was
+  enabled, because a new resource belongs to no role and nothing back-fills it.
+- **Credentials are not a collection.** `schema.plugin` is a badge, not a visibility gate — a
+  plugin-owned collection still appears in admin Collections with a working Entries link, is
+  reachable via `/api/v1`, and can be pointed at a shared Mongo. Hence `data/accounts.json`, 0600,
+  gitignored, and excluded from the npm `files` list.
+- **Key resolution is a chain**, not a single source: `MAIL_SECRET` → `INSTANCE_SECRET` →
+  generated `data/.mailkey`. `INSTANCE_SECRET` only exists on sites that ran setup or registered
+  with the manager, so relying on it alone breaks every older site. The sealing source is recorded
+  in each token so a key change fails with a sentence, not a bare auth error.
+- **Never derive from `JWT_SECRET`.** Rotating it logs everyone out, which is recoverable; silently
+  bricking every stored mailbox password at the same time is not.
+- **`transformTags` runs BEFORE attribute filtering** in sanitize-html. `target` and `rel` must be
+  on `allowedAttributes.a` or the values the transform just set are stripped straight back off, and
+  links inside the sandboxed iframe silently do nothing. This has already been fixed once.
+- **Remote images are blocked by default** and the per-message override is never persisted — it
+  lives in a `Set` in the view. Loading a remote image reports the open back to the sender; that
+  decision should be per message, not a preference someone forgets they set.
+- **The iframe sandbox has neither `allow-scripts` nor `allow-same-origin`.** That pair is the whole
+  defence. `allow-popups` is there only so links can open in a new tab.
+- **Attachment downloads go through `fetch` + blob**, not a plain `<a href>` — the route needs the
+  bearer token, which a link cannot carry.
+- **Single-process only.** The connection pool is module state, like the messages plugin's SSE
+  registry. Multiple workers would each open their own connections and hit per-user server limits.
+
+## Testing
+
+`services/secretbox.js` and `services/render.js` are pure and unit-tested. Connection behaviour
+should be checked against a **real IMAP server** — `mail.dommajs.org` answers on 993 (TLS) and 143
+(STARTTLS). A wrong-credentials attempt is enough to verify TLS, auth-failure mapping and that the
+pool leaves nothing open; it does not verify folder listing or rendering, which need a real mailbox.

package/plugins/mail-reader/plugin.json

@@ -2,6 +2,7 @@
   "name": "mail-reader",
   "displayName": "Mail Reader",
   "version": "1.0.0",
+  "tier": "free",
   "description": "Read-only IMAP mailbox reader. Connects to a standard IMAP server and reads mail without ever writing to it.",
   "author": "Darryl Waterhouse",
   "date": "2026-09-19",
@@ -25,7 +26,7 @@
     ],
     "views": {
       "plugin-mail-reader": {
-        "entry": "mail-reader/admin/views/mail.js?v=c5c6483f",
+        "entry": "mail-reader/admin/views/mail.js?v=1",
         "exportName": "mailView"
       }
     }

package/public/css/theme-switcher.css

@@ -0,0 +1 @@
+.dm-theme-switcher{position:fixed;z-index:9998}.dm-ts-trigger{width:48px;height:48px;border-radius:50%;border:2px solid rgba(255,255,255,.25);cursor:pointer;padding:0;transition:transform .18s ease,box-shadow .18s ease;box-shadow:0 3px 12px #0006,0 0 0 1px #ffffff14}.dm-ts-trigger:hover{transform:scale(1.14);box-shadow:0 6px 20px #00000080,0 0 0 1px #ffffff26}.dm-ts-options{position:absolute;display:grid;grid-template-columns:repeat(2,28px);gap:8px;padding:10px;background:var(--dm-surface, #1e2030);border:1px solid var(--dm-border, rgba(255, 255, 255, .12));border-radius:14px;box-shadow:0 10px 28px #00000073;opacity:0;visibility:hidden;transform:scale(.92) translateY(6px);transform-origin:bottom right;transition:opacity .18s ease,transform .18s ease,visibility .18s;pointer-events:none;bottom:56px;right:0;max-height:60vh;overflow-y:auto}.dm-theme-switcher.dm-ts-left .dm-ts-options{right:auto;left:0;transform-origin:bottom left}.dm-theme-switcher.dm-ts-top .dm-ts-options{bottom:auto;top:56px;transform:scale(.92) translateY(-6px);transform-origin:top right}.dm-theme-switcher.dm-ts-top.dm-ts-left .dm-ts-options{transform-origin:top left}.dm-theme-switcher:hover .dm-ts-options,.dm-theme-switcher:focus-within .dm-ts-options{opacity:1;visibility:visible;transform:scale(1) translateY(0);pointer-events:all}.dm-theme-switcher.dm-ts-top:hover .dm-ts-options,.dm-theme-switcher.dm-ts-top:focus-within .dm-ts-options{transform:scale(1) translateY(0)}.dm-ts-dot{width:28px;height:28px;border-radius:50%;border:2px solid transparent;cursor:pointer;padding:0;position:relative;transition:transform .15s ease,border-color .15s ease,box-shadow .15s ease;box-shadow:0 1px 4px #00000059;outline:none}.dm-ts-dot:hover{transform:scale(1.22)}.dm-ts-dot.active{border-color:#fff;box-shadow:0 0 0 2px #ffffff80,0 2px 8px #0006}.dm-ts-dot:after,.dm-ts-trigger:after{content:attr(data-tooltip);position:absolute;top:50%;transform:translateY(-50%);background:#0a0c14eb;color:#fff;padding:4px 9px;border-radius:5px;font-size:.7rem;font-family:system-ui,sans-serif;white-space:nowrap;opacity:0;pointer-events:none;transition:opacity .15s ease;z-index:1}.dm-theme-switcher:not(.dm-ts-left) .dm-ts-dot:after,.dm-theme-switcher:not(.dm-ts-left) .dm-ts-trigger:after{right:calc(100% + 7px);left:auto}.dm-theme-switcher.dm-ts-left .dm-ts-dot:after,.dm-theme-switcher.dm-ts-left .dm-ts-trigger:after{left:calc(100% + 7px);right:auto}.dm-ts-dot:hover:after,.dm-ts-trigger:hover:after{opacity:1}@media(prefers-reduced-motion:reduce){.dm-ts-trigger,.dm-ts-dot,.dm-ts-options{transition:none}}

package/public/js/analytics.js

@@ -0,0 +1 @@
+(function(){if(typeof fetch=="function"&&!window.__CMS_PREVIEW__){var s=navigator.doNotTrack==="1"||window.doNotTrack==="1"||navigator.msDoNotTrack==="1";if(!s){var r=window.location.pathname,t="";try{t=sessionStorage.getItem("dm_sid")||"",t||(t=crypto&&crypto.randomUUID?crypto.randomUUID():Date.now().toString(36)+Math.random().toString(36).slice(2,10),sessionStorage.setItem("dm_sid",t))}catch{}try{var n="dm_analytics_seen",a=sessionStorage.getItem(n),o=a?a.split("|"):[];if(o.indexOf(r)!==-1)return;o.push(r),sessionStorage.setItem(n,o.join("|"))}catch{}var i="";try{if(document.referrer){var e=new URL(document.referrer);i=e.origin===window.location.origin?e.pathname:e.origin+e.pathname}}catch{}fetch("/api/analytics/hit",{method:"POST",headers:{"Content-Type":"application/json"},keepalive:!0,body:JSON.stringify({url:r,sid:t,ref:i})}).catch(function(){})}}})();

package/public/js/theme-switcher.js

@@ -0,0 +1 @@
+(function(){"use strict";var a=window.__CMS_THEME_SWITCHER__;if(!a||!Array.isArray(a.themes)||!a.themes.length)return;var r=a.position||"right-center",d=r==="left-center"||r==="bottom-left"||r==="top-left",m=r==="bottom-left"||r==="bottom-right",u=r==="top-left"||r==="top-right",l=a.offsetX!=null?a.offsetX:32,c=a.offsetY!=null?a.offsetY:32,n=document.createElement("div");n.className="dm-theme-switcher"+(d?" dm-ts-left":"")+(u?" dm-ts-top":""),n.id="dm-theme-switcher",n.setAttribute("role","navigation"),n.setAttribute("aria-label","Theme switcher");var o=document.createElement("button");o.className="dm-ts-trigger",o.setAttribute("data-tooltip","Switch theme"),o.setAttribute("aria-haspopup","true"),o.setAttribute("aria-expanded","false");var f=360/a.themes.length;o.style.background="conic-gradient("+a.themes.map(function(e,t){return(e.from||"#888")+" "+(t*f).toFixed(2)+"deg "+((t+1)*f).toFixed(2)+"deg"}).join(", ")+")";var s=document.createElement("div");s.className="dm-ts-options",s.setAttribute("role","menu");var p=a.themes.map(function(e){var t=document.createElement("button");return t.className="dm-ts-dot",t.dataset.theme=e.id,t.setAttribute("data-tooltip",e.label),t.setAttribute("aria-label",e.label),t.setAttribute("role","menuitem"),t.style.background="linear-gradient(135deg, "+(e.from||"#888")+", "+(e.to||e.from||"#888")+")",s.appendChild(t),t});n.appendChild(o),n.appendChild(s),Object.assign(n.style,{right:d?"auto":l+"px",left:d?l+"px":"auto",top:u?c+"px":m?"auto":"50vh",bottom:m?c+"px":"auto",transform:u||m?"none":"translateY(-50%)"});function h(){document.body.appendChild(n)}document.readyState==="loading"?document.addEventListener("DOMContentLoaded",h):h();function g(e,t){typeof Domma<"u"&&Domma.theme?e(Domma.theme):t>0&&setTimeout(function(){g(e,t-1)},100)}g(function(e){function t(){var i=e.get();p.forEach(function(b){b.classList.toggle("active",b.dataset.theme===i)})}p.forEach(function(i){i.addEventListener("click",function(){e.set(i.dataset.theme),t()})}),e.onChange(t),t(),o.addEventListener("click",function(){var i=o.getAttribute("aria-expanded")==="true";o.setAttribute("aria-expanded",String(!i))})},30)})();

package/scripts/build.js

@@ -80,8 +80,30 @@ const PLUGIN_AS_IS_PATTERNS = [
   'plugins/**/lib/**/*.js',
   'plugins/**/*.json',
   'plugins/**/*.html',
+  // A plugin's own BLOCKS: blog ships its post layouts and listing cards as
+  // blocks/<name>.html + .css. The .html rode along with the line above and
+  // the .css did not, so a published blog laid its posts out with no styling.
+  // As-is, not minified: block CSS is nested under [data-block] at render.
+  'plugins/*/blocks/**/*.css',
+  // Images a plugin serves from public/ (blog's sample-post covers).
+  'plugins/*/public/**/*.svg',
 ];
 
+/**
+ * The free plugins (Blog, Mail Reader) are written in dcms-marketplace and
+ * copied here by its `make sync-free-tier`, which records every file's hash in
+ * plugins/free-tier.lock.json. The engine ships them EXACTLY as locked - no
+ * minifying, no ?v= stamping, nothing added or left out - so a site the engine
+ * updates runs the same bytes the catalogue ships, and Marketplace Sync sees
+ * the same plugin, not a "modified" one. tests/plugins/free-tier-lock.test.js
+ * keeps the copies here honest.
+ */
+const FREE_TIER_LOCK = join(ROOT, 'plugins', 'free-tier.lock.json');
+const FREE_TIER = existsSync(FREE_TIER_LOCK)
+  ? JSON.parse(readFileSync(FREE_TIER_LOCK, 'utf8')).plugins ?? {}
+  : {};
+const isFreeTier = (rel) => Object.keys(FREE_TIER).some(slug => rel.startsWith(`plugins/${slug}/`));
+
 // HTML templates in admin (copied as-is)
 const ADMIN_HTML_PATTERNS = [
   'admin/**/*.html',
@@ -177,6 +199,8 @@ async function stampPluginVersions() {
         const outPath = join(OUT, rel);
         if (!existsSync(outPath)) continue;
 
+        if (isFreeTier(rel)) continue;   // shipped exactly as synced - see FREE_TIER
+
         let manifest;
         try { manifest = JSON.parse(readFileSync(outPath, 'utf8')); } catch { continue; }
         if (!manifest.admin?.views) continue;
@@ -306,13 +330,27 @@ async function build() {
   // the build artifact has no business containing them in the first place.
   const PLUGIN_RUNTIME_DATA = /^plugins\/[^/]+\/data\//;
   const pluginAsIs = (await collectFiles('{' + PLUGIN_AS_IS_PATTERNS.join(',') + '}'))
-    .filter(rel => !PLUGIN_RUNTIME_DATA.test(rel));
+    .filter(rel => !PLUGIN_RUNTIME_DATA.test(rel) && !isFreeTier(rel));
   for (const rel of pluginAsIs) {
     const outPath = join(OUT, rel);
     mkdirSync(dirname(outPath), {recursive: true});
     cpSync(join(ROOT, rel), outPath);
   }
 
+  // The free plugins: every locked file, byte for byte, and nothing else.
+  let freeTierCount = 0;
+  for (const [slug, entry] of Object.entries(FREE_TIER)) {
+    for (const file of Object.keys(entry.files ?? {})) {
+      const rel = `plugins/${slug}/${file}`;
+      const src = join(ROOT, rel);
+      if (!existsSync(src)) throw new Error(`${rel} is in the free-tier lock but not on disk - run make sync-free-tier in dcms-marketplace`);
+      const outPath = join(OUT, rel);
+      mkdirSync(dirname(outPath), {recursive: true});
+      cpSync(src, outPath);
+      freeTierCount++;
+    }
+  }
+
   // Copy admin HTML templates verbatim
   const adminHtml = await collectFiles(ADMIN_HTML_PATTERNS[0]);
   for (const rel of adminHtml) {
@@ -360,6 +398,7 @@ async function build() {
     const files = await collectFiles(pattern);
     for (const rel of files) {
       if (pluginAsIsSet.has(rel)) continue; // skip plugin server-side JS
+      if (isFreeTier(rel)) continue;        // shipped exactly as synced
       const loader = rel.endsWith('.css') ? 'css' : 'js';
       await minifyFile(rel, loader);
       if (loader === 'js') jsCount++;
@@ -368,7 +407,7 @@ async function build() {
   }
 
   const totalCopied = COPY_AS_IS.filter(i => existsSync(join(ROOT, i))).length
-    + pluginAsIs.length + adminHtml.length;
+    + pluginAsIs.length + adminHtml.length + freeTierCount;
 
   await stampPluginVersions();
 

package/scripts/run-tests.mjs

@@ -0,0 +1,94 @@
+#!/usr/bin/env node
+/**
+ * Run the test suite in a throwaway copy of this checkout.
+ *
+ * Plenty of tests exercise the real services, and those resolve their data
+ * from the tree they live in (content/, config/, plugins/<slug>/data/). Run
+ * in place, the suite rewrote tracked files every time - config/plugins.json,
+ * and seed data such as the "Family" contacts group - which then sat in
+ * `git status` waiting to be committed by mistake.
+ *
+ * So the working tree (edits included, .git and node_modules left out) is
+ * copied to a temp directory, node_modules is linked in, and the suite runs
+ * there. Whatever a test writes lands in the copy, which is deleted after.
+ *
+ *   npm test                                  # the whole suite
+ *   npm test -- tests/services/foo.test.js    # named files (paths as from the repo root)
+ *   npm test -- --test-name-pattern='client copy' tests/services/foo.test.js
+ *                                             # node --test flags pass through - name the FILE
+ *                                             # too: a pattern alone over the whole suite hangs
+ *                                             # on files whose before() hooks start servers
+ *   KEEP_TEST_COPY=1 npm test                 # keep the copy, to look at what a test wrote
+ *
+ * @module scripts/run-tests
+ */
+import {spawn} from 'node:child_process';
+import {cpSync, existsSync, mkdtempSync, readdirSync, rmSync, statSync, symlinkSync} from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+/** Never copied: history, dependencies (linked instead) and build output. */
+const SKIP = new Set(['.git', 'node_modules', '_publish', 'test-site', '.domma-backups']);
+
+// Copies a crashed or SIGKILLed run could not delete, once they are clearly
+// not in use by a run happening now.
+const STALE_MS = 6 * 60 * 60 * 1000;
+for (const name of readdirSync(os.tmpdir())) {
+    if (!name.startsWith('domma-cms-tests-')) continue;
+    const dir = path.join(os.tmpdir(), name);
+    try {
+        if (Date.now() - statSync(dir).mtimeMs > STALE_MS) rmSync(dir, {recursive: true, force: true});
+    } catch { /* someone else's, or gone */ }
+}
+
+const copy = mkdtempSync(path.join(os.tmpdir(), 'domma-cms-tests-'));
+const cleanup = () => {
+    if (process.env.KEEP_TEST_COPY) {
+        console.log(`\nTest copy kept at ${copy}`);
+        return;
+    }
+    rmSync(copy, {recursive: true, force: true});
+};
+
+try {
+    cpSync(ROOT, copy, {
+        recursive: true,
+        // Links are copied as links, so nothing in the copy points back into
+        // this checkout except node_modules, below, on purpose.
+        verbatimSymlinks: true,
+        filter: (src) => {
+            const rel = path.relative(ROOT, src);
+            return !rel || !SKIP.has(rel.split(path.sep)[0]);
+        }
+    });
+    if (existsSync(path.join(ROOT, 'node_modules'))) {
+        symlinkSync(path.join(ROOT, 'node_modules'), path.join(copy, 'node_modules'), 'dir');
+    }
+} catch (err) {
+    console.error(`Could not prepare the test copy: ${err.message}`);
+    cleanup();
+    process.exit(1);
+}
+
+// Flags (e.g. --test-name-pattern=...) pass through; with no FILES named, run the whole suite.
+const given = process.argv.slice(2);
+const files = given.filter(a => !a.startsWith('-'));
+const args = ['--test', '--test-concurrency=1', ...given, ...(files.length ? [] : ['tests/**/*.test.js'])];
+// DOMMA_REPO_ROOT: where the real checkout is, for the few tests that compare
+// against a sibling repo (../dcms-marketplace) the temp copy has no neighbour for.
+const child = spawn(process.execPath, args, {cwd: copy, stdio: 'inherit', env: {...process.env, DOMMA_REPO_ROOT: ROOT}});
+
+// Ctrl+C, or a kill: stop the suite, then still delete the copy.
+for (const sig of ['SIGINT', 'SIGTERM', 'SIGHUP']) {
+    process.on(sig, () => {
+        child.kill(sig);
+        setTimeout(() => child.kill('SIGKILL'), 5000).unref();
+    });
+}
+child.on('exit', (code, signal) => {
+    cleanup();
+    process.exit(code ?? (signal ? 1 : 0));
+});