domma-cms 0.66.0 → 0.69.4

package/server/routes/api/plugin-marketplace.js

@@ -1,32 +1,57 @@
 /**
- * Plugin Marketplace API
- * GET    /api/plugins/marketplace         - fetch catalogue from manager (requires MANAGER_URL)
- * POST   /api/plugins/marketplace/install - download + install a plugin bundle
- * DELETE /api/plugins/marketplace/:slug   - uninstall an installed plugin
+ * Plugin Marketplace API - the managed (fleet) path.
+ *
+ * GET    /api/plugins/marketplace          - the catalogue as this site sees it
+ * POST   /api/plugins/marketplace/install  - fetch a bundle and install it
+ * DELETE /api/plugins/marketplace/:slug    - uninstall
+ *
+ * This is delivery path A: a site the manager forked, buying from the fleet's
+ * own catalogue over loopback. The standalone path - buy, download one file,
+ * Install from File - goes through `POST /plugins/install-upload` instead and
+ * shares nothing with this but the installer.
+ *
+ * An unmanaged site has no MANAGER_URL, every route here answers "not
+ * available", and the screen says so in terms that fit that customer.
  *
  * All routes require authentication + admin role.
  */
 import {authenticate, requireAdmin} from '../../middleware/auth.js';
-import {fetchCatalogue, fetchPluginBundle} from '../../services/managerClient.js';
-import {installPlugin, uninstallPlugin} from '../../services/pluginInstaller.js';
+import {fetchCatalogue, fetchPluginBundle, isManaged, siteSlug} from '../../services/managerClient.js';
+import {compareVersions, installPlugin, uninstallPlugin} from '../../services/pluginInstaller.js';
+import {discoverPlugins} from '../../services/plugins.js';
 
 export async function pluginMarketplaceRoutes(fastify) {
     const adminOnly = { preHandler: [authenticate, requireAdmin] };
 
     // GET /plugins/marketplace
     fastify.get('/plugins/marketplace', adminOnly, async (_request, reply) => {
-        if (!process.env.MANAGER_URL) {
-            return reply.send({ available: false, catalogue: [] });
-        }
+        if (!isManaged()) return reply.send({ available: false, catalogue: [] });
+
+        const catalogue = await fetchCatalogue();
 
-        const licenceToken = process.env.LICENCE_TOKEN;
-        const catalogue = await fetchCatalogue(licenceToken);
-        return reply.send({ available: true, catalogue });
+        // What is on THIS disk is a local fact - the manager's ledger knows
+        // what a site is licensed for, never what it actually has. Joined here
+        // so the card can offer Update rather than an Install that would come
+        // back 409.
+        const installed = new Map((await discoverPlugins()).map(m => [m.name, m.version]));
+        return reply.send({
+            available: true,
+            site: siteSlug(),
+            catalogue: catalogue.map(entry => {
+                const have = installed.get(entry.slug);
+                return {
+                    ...entry,
+                    installed: have !== undefined,
+                    installedVersion: have ?? null,
+                    updatable: have !== undefined && compareVersions(entry.version, have) > 0
+                };
+            })
+        });
     });
 
     // POST /plugins/marketplace/install
     fastify.post('/plugins/marketplace/install', adminOnly, async (request, reply) => {
-        const { slug, version } = request.body || {};
+        const { slug, version, update } = request.body || {};
 
         if (!slug || !/^[a-z0-9][a-z0-9-_]{0,63}$/.test(slug)) {
             return reply.code(400).send({ error: 'Invalid plugin slug.' });
@@ -34,25 +59,55 @@ export async function pluginMarketplaceRoutes(fastify) {
         if (!version || !/^\d+\.\d+\.\d+$/.test(version)) {
             return reply.code(400).send({ error: 'Invalid version format. Expected semver (e.g. 1.0.0).' });
         }
+        if (!isManaged()) {
+            return reply.code(503).send({ error: 'This site is not managed - install from a file instead.' });
+        }
 
-        const licenceToken = process.env.LICENCE_TOKEN;
-        const bundle = await fetchPluginBundle(slug, version, licenceToken);
-
+        let bundle;
+        try {
+            bundle = await fetchPluginBundle(slug, version);
+        } catch (err) {
+            // A refusal from the manager is the answer, not a failure: "this
+            // site has no licence for invoice" is what the admin needs to read.
+            return reply.code(403).send({ error: err.message });
+        }
         if (!bundle) {
-            return reply.code(503).send({ error: 'Manager unavailable' });
+            return reply.code(503).send({ error: 'The manager is not reachable right now.' });
         }
 
         try {
-            await installPlugin(slug, bundle);
+            const result = await installPlugin(slug, {
+                tarball: bundle.tarball,
+                signature: bundle.signature,
+                publicKeyId: bundle.publicKeyId,
+                // Minted for this site by the manager. Without it a paid plugin
+                // installs and then refuses to load, which reads as a broken
+                // install rather than a licensing answer.
+                entitlement: bundle.entitlement,
+                // Same plugin already here means update, which the admin asked
+                // for by pressing Update rather than Install.
+                allowUpgrade: update === true
+            });
+            return reply.send({
+                success: true,
+                name: slug,
+                action: result?.action ?? 'install',
+                from: result?.from ?? null,
+                version: result?.version ?? bundle.version,
+                restartRequired: true
+            });
         } catch (err) {
             fastify.log.error({ err }, '[marketplace] install failed');
-            // Known safe error messages from pluginInstaller (for admin clarity)
-            const safeMessages = ['Plugin already installed', 'Plugin signature invalid', 'Unknown public key', 'Invalid plugin slug'];
-            const safe = safeMessages.some(m => err.message.startsWith(m));
+            // Messages the installer raises deliberately, all of them things an
+            // admin can act on. Anything else is kept vague on purpose - an
+            // unexpected error can carry a path from this server.
+            const safe = [
+                'Plugin already installed', 'Plugin signature invalid', 'Unknown public key',
+                'Invalid plugin slug', 'Refusing to downgrade', 'Refusing to upgrade',
+                'This site accepts signed plugins only'
+            ].some(m => err.message.startsWith(m));
             return reply.code(400).send({ error: safe ? err.message : 'Installation failed.' });
         }
-
-        return reply.send({ success: true });
     });
 
     // DELETE /plugins/marketplace/:slug

package/server/routes/api/plugins.js

@@ -12,6 +12,7 @@ import {
 import {
     discoverPlugins,
     getAdminPluginConfig,
+    getEntitlementStates,
     getLoadedPlugins,
     getPluginStates,
     isCorePlugin,
@@ -23,6 +24,31 @@ import {getEffectiveLevel} from '../../services/userRoles.js';
 import {scaffoldPlugin} from '../../services/pluginScaffold.js';
 import {deletePluginFile, listPluginFiles, readPluginFile, writePluginFile} from '../../services/pluginFiles.js';
 import {getConfig} from '../../config.js';
+import path from 'path';
+import {existsSync, readFileSync} from 'node:fs';
+import {installPlugin} from '../../services/pluginInstaller.js';
+import {packEnvelope, readEnvelope, readManifestFromTarball, tarDirectory} from '../../services/pluginEnvelope.js';
+
+/**
+ * The version of a plugin currently on disk, or null if the slug is free.
+ *
+ * Deliberately a directory check rather than `discoverPlugins()`: a half-broken
+ * installation still occupies the slug - that is exactly what the installer
+ * refuses to overwrite - and it would be invisible to discovery. An unreadable
+ * manifest reports an occupied slug with an unknown version, which is honest.
+ *
+ * @param   {string} slug
+ * @returns {string|null|undefined} version, `null` when unreadable, `undefined` when absent
+ */
+function installedVersion(slug) {
+    const dir = path.join(path.resolve('plugins'), slug);
+    if (!existsSync(dir)) return undefined;
+    try {
+        return JSON.parse(readFileSync(path.join(dir, 'plugin.json'), 'utf8')).version ?? null;
+    } catch {
+        return null;
+    }
+}
 
 /**
  * True when something will bring the process back after a clean exit.
@@ -86,6 +112,7 @@ export async function pluginsRoutes(fastify, opts = {}) {
         const manifests = await discoverPlugins();
         const states = getPluginStates();
         const loadedPlugins = getLoadedPlugins();
+        const entitlementStates = getEntitlementStates();
 
         return manifests.map(manifest => ({
             name: manifest.name,
@@ -100,13 +127,15 @@ export async function pluginsRoutes(fastify, opts = {}) {
             // plainly running. It is on because it is built in.
             core: isCorePlugin(manifest.name),
             enabled: isCorePlugin(manifest.name) || !!(states[manifest.name]?.enabled),
-            bundled: !!(states[manifest.name]?.bundled),
             // A licensed plugin is distributed to run, not to be read: the
             // source endpoints refuse it (pluginFiles.isClosedSource). Sent so
             // the screen can leave the Code button off rather than offer one
             // that answers 403 - the refusal is the guard, not the UI.
             closedSource: manifest.closedSource === true,
             licence: pluginLicence(manifest),
+            // Why a licensed plugin is not running, when it is not. Null for
+            // anything open-source, which is never asked for an entitlement.
+            entitlement: entitlementStates[manifest.name] ?? null,
             // Whether the CODE button belongs on this viewer's card. Decided
             // here rather than in the browser: it is the same answer the file
             // endpoints will give, from the same two facts.
@@ -135,7 +164,7 @@ export async function pluginsRoutes(fastify, opts = {}) {
     // Enable/disable or update settings for a plugin
     fastify.put('/plugins/:name', canUpdate, async (request, reply) => {
         const { name } = request.params;
-        const {enabled, settings, bundled} = request.body || {};
+        const {enabled, settings} = request.body || {};
 
         const manifests = await discoverPlugins();
         const manifest = manifests.find(m => m.name === name);
@@ -155,7 +184,6 @@ export async function pluginsRoutes(fastify, opts = {}) {
         const update = {};
         if (enabled !== undefined) update.enabled = !!enabled;
         if (settings !== undefined) update.settings = settings;
-        if (bundled !== undefined) update.bundled = !!bundled;
         savePluginState(name, update);
 
         if (!prevState.enabled && !!enabled) {
@@ -203,6 +231,123 @@ export async function pluginsRoutes(fastify, opts = {}) {
     const licensed = (request) => ({allowLicensed: mayEditLicensed(request)});
 
     // List a plugin's editable files
+    // ---- Export: a plugin leaves as one file ----------------------------
+    //
+    // The same .dcmsplugin envelope a purchase arrives in, so an export can be
+    // installed by the ordinary route rather than a second "just unzip it" path
+    // that would skip the traversal guard and the manifest check.
+    //
+    // Unsigned by construction: the marketplace key is offline and never on this
+    // host. The importing site decides what to do about that.
+    // compress: false - the envelope is ALREADY gzip. @fastify/compress sees the
+    // gzip magic and labels it Content-Encoding: gzip, so the browser unzipped
+    // it on the way in and saved a bare tar; under brotli the download failed
+    // outright ("Decoding failed").
+    fastify.get('/plugins/:name/export', {...canDevelop, compress: false}, async (request, reply) => {
+        const {name} = request.params;
+        if (!/^[a-z0-9][a-z0-9-_]{0,63}$/.test(name)) {
+            return reply.code(400).send({error: 'Invalid plugin name'});
+        }
+
+        const manifests = await discoverPlugins();
+        const manifest = manifests.find(m => m.name === name);
+        if (!manifest) return reply.code(404).send({error: 'Plugin not found'});
+
+        // A licensed plugin is distributed to RUN here, not to be re-emitted as
+        // a redistributable file. Same flag that refuses the source editor, and
+        // the same reason: one click would otherwise turn every customer into a
+        // distribution channel.
+        if (manifest.closedSource === true) {
+            return reply.code(403).send({error: `"${name}" is a licensed plugin and cannot be exported.`});
+        }
+
+        const dir = path.join(path.resolve('plugins'), name);
+        const includeData = request.query?.includeData === '1';
+        const tarball = await tarDirectory(dir, name, {includeData});
+        const envelope = packEnvelope({tarball});
+
+        return reply
+            .header('Content-Type', 'application/octet-stream')
+            .header('Content-Disposition',
+                `attachment; filename="${name}-${manifest.version}.dcmsplugin"`)
+            .send(envelope);
+    });
+
+    // ---- Import: install from an uploaded envelope -----------------------
+    fastify.post('/plugins/install-upload', canCreate, async (request, reply) => {
+        const upload = await request.file().catch(() => null);
+        if (!upload) return reply.code(400).send({error: 'No file uploaded'});
+
+        // Drain the file first. Multipart is a STREAM: `upload.fields` only
+        // holds the parts seen so far, so reading a flag before the file body
+        // is consumed silently misses any field the browser put after it.
+        let body;
+        try {
+            body = await upload.toBuffer();
+        } catch (err) {
+            return reply.code(400).send({error: err.message});
+        }
+
+        // Checkboxes on the form, not defaults. Installing an unsigned plugin
+        // runs its code on this server; replacing one that is already here
+        // swaps out code that is running. Both should be decisions rather than
+        // side effects of dragging a file onto a page.
+        const flag = (name) => upload.fields?.[name]?.value === 'true';
+        const confirmUnsigned  = flag('confirmUnsigned');
+        const confirmUpgrade   = flag('confirmUpgrade');
+        const confirmDowngrade = flag('confirmDowngrade');
+
+        let parts;
+        try {
+            parts = readEnvelope(body);
+        } catch (err) {
+            return reply.code(400).send({error: err.message});
+        }
+
+        // The slug comes from the manifest inside, never from the filename: a
+        // file can be renamed by anyone, a manifest is what the installer then
+        // validates against what was actually extracted.
+        const manifest = readManifestFromTarball(parts.tarball);
+        const slug = manifest?.name;
+        if (!slug) return reply.code(400).send({error: 'No readable plugin manifest inside that file'});
+
+        const installed = installedVersion(slug);
+        if (installed !== undefined && !confirmUpgrade) {
+            return reply.code(409).send({
+                error: `${slug} ${installed ?? ''} is already installed.`.replace('  ', ' '),
+                code: 'already-installed',
+                name: slug,
+                installedVersion: installed,
+                incomingVersion: manifest.version ?? null
+            });
+        }
+
+        let result;
+        try {
+            result = await installPlugin(slug, {
+                tarball: parts.tarball,
+                signature: parts.signature,
+                publicKeyId: parts.signature ? (request.body?.keyId || 'marketplace-1') : null,
+                allowUnsigned: confirmUnsigned,
+                entitlement: parts.entitlement,
+                allowUpgrade: confirmUpgrade,
+                allowDowngrade: confirmDowngrade
+            });
+        } catch (err) {
+            fastify.log.warn({err}, '[plugins] upload install failed');
+            return reply.code(400).send({error: err.message});
+        }
+
+        return reply.send({
+            success: true,
+            name: slug,
+            action: result?.action ?? 'install',
+            from: result?.from ?? null,
+            version: result?.version ?? manifest.version ?? null,
+            restartRequired: true
+        });
+    });
+
     fastify.get('/plugins/:name/files', canDevelop, async (request, reply) => {
         try {
             return { files: await listPluginFiles(request.params.name, licensed(request)) };

package/server/routes/api/todo.js

@@ -0,0 +1,178 @@
+/**
+ * Todo API - /api/todo
+ *
+ * Was the `todo` plugin until 0.67.0. The logic is unchanged; what moved is
+ * where it lives and how it is gated.
+ *
+ * **Per-user scope.** Entries carry a `userId` and every read is filtered to the
+ * caller's own. The plugin made this configurable (`scope: 'user' | 'site'`) and
+ * no install ever set it to anything else, so it is a constant here. Note this
+ * is hand-filtering rather than `rowAccess.js`, which is the mechanism core has
+ * for exactly this - moving onto it is a behaviour change and belongs in its own
+ * task, not smuggled into a relocation.
+ *
+ * **The collection slug is `todo-items`, not the directory it used to sit in.**
+ * `setupPlugin()` read `schema.slug`, so the live collection has always been
+ * called this, and existing entries are found only if it stays exactly so.
+ */
+import {clip, plural} from '../../services/sidebarBadges.js';
+import {authenticate as defaultAuthenticate, requirePermission as defaultRequirePermission} from '../../middleware/auth.js';
+import {createEntry, deleteEntry, getEntry, listEntries, updateEntry} from '../../services/collections.js';
+
+const SLUG = 'todo-items';
+
+/** 'YYYY-MM-DD' of a date, in the server's local time. */
+function localDay(d) {
+    const pad = (n) => String(n).padStart(2, '0');
+    return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}`;
+}
+
+/** Flatten a collection entry into the shape the admin view expects. */
+function toTodo(entry) {
+    return {
+        id: entry.id,
+        ...entry.data,
+        createdAt: entry.meta.createdAt,
+        updatedAt: entry.meta.updatedAt
+    };
+}
+
+/**
+ * Auth is injectable so a test can drive these routes without registering
+ * @fastify/jwt or a role store - the same shape dashboard.js and plugins.js use.
+ *
+ * @param {import('fastify').FastifyInstance} fastify
+ * @param {object} [opts]
+ */
+export async function todoRoutes(fastify, opts = {}) {
+    const authenticate = opts.authenticate || defaultAuthenticate;
+    const requirePermission = opts.requirePermission || defaultRequirePermission;
+
+
+    function userId(request) {
+        return request.user?.id ?? request.user?.sub ?? null;
+    }
+
+    async function loadAll(uid) {
+        const {entries} = await listEntries(SLUG, {limit: 10000, sort: 'createdAt', order: 'asc'});
+        let items = entries.map(toTodo);
+        if (uid) items = items.filter(t => t.userId === uid);
+        return items;
+    }
+
+    /**
+     * GET /api/todo/count - the sidebar badge: open tasks, and how many are
+     * overdue. `?today=YYYY-MM-DD` is the BROWSER's calendar day - due dates
+     * are local days, and the server's today is not the reader's near midnight.
+     * Answers {count, label, tone}; tone is 'danger' while anything is overdue.
+     */
+    fastify.get('/count', {preHandler: [authenticate, requirePermission('todo', 'read')]}, async (request) => {
+        const given = String(request.query?.today ?? '');
+        const today = /^\d{4}-\d{2}-\d{2}$/.test(given) ? given : localDay(new Date());
+        const open = (await loadAll(userId(request))).filter(t => t.status !== 'completed');
+        const dayOf = (t) => /^(\d{4}-\d{2}-\d{2})/.exec(String(t.dueAt ?? ''))?.[1] ?? null;
+        const daysBetween = (a, b) => Math.round((Date.parse(a) - Date.parse(b)) / 86_400_000);
+        const overdue = open.filter(t => dayOf(t) && dayOf(t) < today);
+        const dueToday = open.filter(t => dayOf(t) === today);
+        const PRIORITY = {high: 0, medium: 1, low: 2};
+
+        // Most urgent first: overdue (oldest first), due today, then by due day, then priority.
+        const urgent = [...open].sort((a, b) =>
+            (dayOf(a) ?? '9999') .localeCompare(dayOf(b) ?? '9999')
+            || (PRIORITY[a.priority] ?? 1) - (PRIORITY[b.priority] ?? 1));
+        const items = urgent.slice(0, 5).map(t => {
+            const day = dayOf(t);
+            const d = day ? daysBetween(day, today) : null;
+            const when = d === null ? '' : d < 0 ? `${plural(-d, 'day')} overdue` : d === 0 ? 'due today' : d === 1 ? 'due tomorrow' : `due in ${d} days`;
+            const meta = [when, t.priority === 'high' ? 'high priority' : ''].filter(Boolean).join(' · ');
+            return {text: clip(t.text), meta, tone: d !== null && d < 0 ? 'danger' : undefined};
+        });
+
+        const label = `${plural(open.length, 'open task')}${overdue.length ? `, ${overdue.length} overdue` : ''}`;
+        return {
+            count: open.length, label, tone: overdue.length ? 'danger' : 'info',
+            details: {
+                title: 'Todo',
+                rows: [
+                    {label: 'Open', value: String(open.length)},
+                    {label: 'Overdue', value: String(overdue.length), tone: overdue.length ? 'danger' : undefined},
+                    {label: 'Due today', value: String(dueToday.length)},
+                    {label: 'In progress', value: String(open.filter(t => t.status === 'in-progress').length)}
+                ],
+                items,
+                empty: 'Nothing open - all done.'
+            }
+        };
+    });
+
+    /** GET /api/todo/items */
+    fastify.get('/items', {preHandler: [authenticate, requirePermission('todo', 'read')]}, async (request, reply) => {
+        const uid = userId(request);
+        const { status } = request.query;
+        let items = await loadAll(uid);
+        if (status) items = items.filter(t => t.status === status);
+        return reply.send(items);
+    });
+
+    /** POST /api/todo/items */
+    fastify.post('/items', {preHandler: [authenticate, requirePermission('todo', 'create')]}, async (request, reply) => {
+        const uid = userId(request);
+        const { text, priority, status } = request.body ?? {};
+
+        if (!text || typeof text !== 'string' || !text.trim()) {
+            return reply.code(400).send({ error: 'text is required' });
+        }
+
+        const {dueAt} = request.body ?? {};
+        const entry = await createEntry(SLUG, {
+            text: text.trim(),
+            status: status ?? 'not-started',
+            priority: priority ?? 'medium',
+            dueAt: dueAt ?? null,
+            userId: uid ?? null
+        }, {createdBy: uid, source: 'admin'});
+
+        return reply.code(201).send(toTodo(entry));
+    });
+
+    /** PUT /api/todo/items/:id */
+    fastify.put('/items/:id', {preHandler: [authenticate, requirePermission('todo', 'update')]}, async (request, reply) => {
+        const uid = userId(request);
+        const { id } = request.params;
+        const patch = request.body ?? {};
+
+        const entry = await getEntry(SLUG, id);
+        if (!entry) return reply.code(404).send({error: 'Todo not found'});
+        if (uid && entry.data.userId !== uid) return reply.code(404).send({error: 'Todo not found'});
+
+        const merged = {...entry.data};
+        for (const key of ['text', 'status', 'priority', 'dueAt']) {
+            if (key in patch) merged[key] = key === 'text' ? String(patch[key]).trim() : patch[key];
+        }
+
+        const updated = await updateEntry(SLUG, id, merged);
+        return reply.send(toTodo(updated));
+    });
+
+    /** DELETE /api/todo/completed - must be registered before /:id */
+    fastify.delete('/completed', {preHandler: [authenticate, requirePermission('todo', 'delete')]}, async (request, reply) => {
+        const uid = userId(request);
+        const all = await loadAll(uid);
+        const completed = all.filter(t => t.status === 'completed');
+        await Promise.all(completed.map(t => deleteEntry(SLUG, t.id)));
+        return reply.send({success: true, removed: completed.length});
+    });
+
+    /** DELETE /api/todo/items/:id */
+    fastify.delete('/items/:id', {preHandler: [authenticate, requirePermission('todo', 'delete')]}, async (request, reply) => {
+        const uid = userId(request);
+        const { id } = request.params;
+
+        const entry = await getEntry(SLUG, id);
+        if (!entry) return reply.code(404).send({error: 'Todo not found'});
+        if (uid && entry.data.userId !== uid) return reply.code(404).send({error: 'Todo not found'});
+
+        await deleteEntry(SLUG, id);
+        return reply.send({ success: true });
+    });
+}

package/server/server.js

@@ -9,6 +9,7 @@ import Fastify from 'fastify';
 import jwt from '@fastify/jwt';
 import staticPlugin from '@fastify/static';
 import cors from '@fastify/cors';
+import {isPublicAssetRead, normalisePublicPrefixes} from './services/publicCors.js';
 import multipart from '@fastify/multipart';
 import rateLimit from '@fastify/rate-limit';
 import helmet from '@fastify/helmet';
@@ -119,7 +120,24 @@ await app.register(helmet, {
 });
 
 await app.register(jwt, { secret: process.env.JWT_SECRET });
-await app.register(cors, serverConfig.cors);
+// publicPrefixes is ours, not @fastify/cors's, so it is stripped before the
+// register call rather than passed through as an unknown option.
+const {publicPrefixes: _cfgPublicPrefixes, ...corsOptions} = serverConfig.cors ?? {};
+await app.register(cors, corsOptions);
+
+// Open reads on explicitly listed asset prefixes. @fastify/cors decides per
+// origin and cannot express a path, so a site wanting its own assets
+// hot-linkable (module scripts are fetched in CORS mode) lists them here.
+const publicCorsPrefixes = normalisePublicPrefixes(serverConfig.cors);
+if (publicCorsPrefixes.length) {
+    app.addHook('onSend', async (request, reply, payload) => {
+        if (isPublicAssetRead(request.method, request.url, publicCorsPrefixes)) {
+            reply.header('Access-Control-Allow-Origin', '*');
+        }
+        return payload;
+    });
+    app.log.info(`[cors] open reads on ${publicCorsPrefixes.join(', ')}`);
+}
 await app.register(multipart, { limits: { fileSize: serverConfig.uploads.maxFileSize } });
 await app.register(rateLimit, {
     global: true, // apply default limit to all routes; stricter per-route limits override this
@@ -229,6 +247,19 @@ try {
     app.log.warn(`[theme] Migration skipped: ${err.message}`);
 }
 
+// ---------------------------------------------------------------------------
+// Plugins promoted into the CMS - one-shot retirement of the directories and
+// plugins.json entries they leave behind. Must run BEFORE registerPlugins(),
+// or the loader registers a second copy of a feature core now has itself.
+// ---------------------------------------------------------------------------
+try {
+    const {migratePromotedPlugins} = await import('./services/promoted-plugins-migration.js');
+    const promoted = migratePromotedPlugins();
+    if (promoted.length) app.log.info(`[plugins] Retired promoted plugins: ${promoted.join('; ')}`);
+} catch (err) {
+    app.log.warn(`[plugins] Promoted-plugin migration skipped: ${err.message}`);
+}
+
 // ---------------------------------------------------------------------------
 // Search - one-shot retirement of the site-search plugin (settings + files)
 // ---------------------------------------------------------------------------
@@ -414,6 +445,10 @@ const {sidebarRoutes}       = await import('./routes/api/sidebar.js');
 const { mediaRoutes }      = await import('./routes/api/media.js');
 const { usersRoutes }      = await import('./routes/api/users.js');
 const { pluginsRoutes }            = await import('./routes/api/plugins.js');
+const { notesRoutes }              = await import('./routes/api/notes.js');
+const { todoRoutes }               = await import('./routes/api/todo.js');
+const { analyticsRoutes }          = await import('./routes/api/analytics.js');
+const { contactsRoutes }           = await import('./routes/api/contacts.js');
 const { pluginMarketplaceRoutes }  = await import('./routes/api/plugin-marketplace.js');
 const { collectionsRoutes } = await import('./routes/api/collections.js');
 const { formsRoutes }       = await import('./routes/api/forms.js');
@@ -459,11 +494,36 @@ await app.register(notificationsRoutes, {prefix: '/api'});
 await app.register(dashboardRoutes, {prefix: '/api'});
 await app.register(cacheRoutes, {prefix: '/api'});
 await app.register(scaffoldRoutes, {prefix: '/api'});
+// Tools promoted out of plugins/ - their own prefixes, not /api/plugins/*.
+await app.register(notesRoutes, {prefix: '/api/notes'});
+await app.register(todoRoutes, {prefix: '/api/todo'});
+await app.register(analyticsRoutes, {prefix: '/api/analytics'});
+await app.register(contactsRoutes, {prefix: '/api/contacts'});
 
 // ---------------------------------------------------------------------------
 // CMS Plugins (server-side Fastify plugins from plugins/ directory)
 // ---------------------------------------------------------------------------
 
+// ---------------------------------------------------------------------------
+// Core Tools in the sidebar
+// ---------------------------------------------------------------------------
+// Registered through the same channel plugins use, deliberately. The sidebar
+// menu (config/menus/admin-sidebar.json) is seeded once and file-existence
+// guarded, so adding an entry there would reach new sites only - every existing
+// site would simply never see Notes or Todo. Registered items are merged at
+// render time on every site, and groupPluginItems() files them under Tools,
+// which is exactly where a promoted plugin belongs.
+//
+// `permission` is what hides each one from a role that cannot use it; the
+// renderer filters on it.
+const {registerSidebarItem} = await import('./services/hooks.js');
+// `countUrl` is the badge: the sidebar fetches it and shows {count, label, tone}
+// (see fetchCounts in admin/js/lib/sidebar-renderer.js).
+registerSidebarItem({item: {text: 'Notes', url: '#/notes', icon: 'edit-3', permission: 'notes', countUrl: '/api/notes/count'}});
+registerSidebarItem({item: {text: 'Todo', url: '#/todo', icon: 'check-square', permission: 'todo', countUrl: '/api/todo/count'}});
+registerSidebarItem({item: {text: 'Analytics', url: '#/analytics', icon: 'chart-bar', permission: 'analytics', countUrl: '/api/analytics/active-count'}});
+registerSidebarItem({item: {text: 'Contacts', url: '#/contacts', icon: 'users', permission: 'contacts'}});
+
 await registerPlugins(app);
 
 // ---------------------------------------------------------------------------

package/server/services/collections.js

@@ -131,11 +131,21 @@ export async function createCollection({title, slug, description = '', fields =
     if (!finalSlug) throw new Error('Could not derive a slug from the title');
 
     const dir = collectionDir(finalSlug);
+    // A directory with no schema.json is not a collection - getCollection()
+    // says so - but refusing to create one there made it impossible to ever
+    // have one. That is how dcm's blog lost its collections: three empty
+    // directories left behind, and setupPlugin() re-trying and failing on
+    // every boot. So such a directory is adopted rather than refused, and any
+    // entries it still holds are kept rather than overwritten.
+    let orphanHasData = false;
     try {
         await fs.mkdir(dir, { recursive: false });
     } catch (err) {
-        if (err.code === 'EEXIST') throw new Error(`A collection with slug "${finalSlug}" already exists`);
-        throw err;
+        if (err.code !== 'EEXIST') throw err;
+        if (await getCollection(finalSlug)) {
+            throw new Error(`A collection with slug "${finalSlug}" already exists`);
+        }
+        orphanHasData = await fs.access(path.join(dir, 'data.json')).then(() => true, () => false);
     }
 
     const now = new Date().toISOString();
@@ -154,7 +164,7 @@ export async function createCollection({title, slug, description = '', fields =
     };
 
     await writeSchema(schema);
-    await (await getAdapter(finalSlug)).insertMany(finalSlug, []);
+    if (!orphanHasData) await (await getAdapter(finalSlug)).insertMany(finalSlug, []);
     await cache.invalidateTags([`collection:${finalSlug}`]);
     return schema;
 }