domma-cms 0.74.0 → 0.76.0

package/server/routes/api/media.js

@@ -1,6 +1,7 @@
 /**
  * Media API
  * GET    /api/media       - list media files
+ * GET    /api/media/_count - the sidebar badge (plain text; see mediaBadge)
  * POST   /api/media       - upload a file
  * DELETE /api/media/:name - delete a file
  */
@@ -8,6 +9,7 @@ import path from 'path';
 import {deleteMedia, listMedia, renameMedia, saveMedia} from '../../services/content.js';
 import {getImageInfo, isEditableImage, transformImage} from '../../services/images.js';
 import {authenticate, requirePermission} from '../../middleware/auth.js';
+import {ago, clip, plural} from '../../services/sidebarBadges.js';
 
 const ALLOWED_MIME_TYPES = new Set([
   // Images
@@ -30,6 +32,50 @@ function sanitiseFilename(name) {
     return path.basename(name).replace(/[^a-zA-Z0-9._-]/g, '_');
 }
 
+/** 0 B, 812 B, 14.2 KB, 3.1 MB - the badge's sizes. */
+function bytes(n) {
+    const v0 = Number(n) || 0;
+    if (v0 < 1024) return `${v0} B`;
+    const units = ['KB', 'MB', 'GB', 'TB'];
+    let v = v0 / 1024;
+    let i = 0;
+    while (v >= 1024 && i < units.length - 1) { v /= 1024; i++; }
+    return `${v.toFixed(1)} ${units[i]}`;
+}
+
+const IMAGE_RE = /\.(png|jpe?g|gif|webp|svg|avif|ico|bmp|tiff?)$/i;
+
+/**
+ * The badge on Content › Media: how many files, how much space, the newest
+ * few. Informational - nothing on this screen is ever overdue. Every value is
+ * plain text; the sidebar popover sets it with textContent (file names are
+ * whatever was uploaded).
+ *
+ * @param {{name: string, size: number, createdAt: string}[]} files
+ * @param {number} [now]
+ */
+export function mediaBadge(files = [], now = Date.now()) {
+    const total = files.reduce((s, f) => s + (Number(f.size) || 0), 0);
+    const images = files.filter(f => IMAGE_RE.test(f.name)).length;
+    const newest = [...files].sort((a, b) => String(b.createdAt).localeCompare(String(a.createdAt)));
+    return {
+        count: files.length,
+        label: files.length ? `${plural(files.length, 'file')}, ${bytes(total)}` : 'No media yet',
+        tone: 'info',
+        details: {
+            title: 'Media',
+            rows: [
+                {label: 'Files', value: String(files.length)},
+                {label: 'Images', value: String(images)},
+                {label: 'Other files', value: String(files.length - images)},
+                {label: 'Space used', value: bytes(total)}
+            ],
+            items: newest.slice(0, 5).map(f => ({text: clip(f.name, 48), meta: `${bytes(f.size)} · ${ago(f.createdAt, now)}`})),
+            empty: 'Nothing uploaded yet.'
+        }
+    };
+}
+
 export async function mediaRoutes(fastify) {
     const canRead = {preHandler: [authenticate, requirePermission('media', 'read')]};
     const canCreate = {preHandler: [authenticate, requirePermission('media', 'create')]};
@@ -40,6 +86,9 @@ export async function mediaRoutes(fastify) {
         return listMedia();
     });
 
+    // `_count` is not a file route: the only GET under /media/:name is /media/:name/info.
+    fastify.get('/media/_count', canRead, async () => mediaBadge(await listMedia()));
+
     fastify.post('/media', canCreate, async (request, reply) => {
       const results = [];
       for await (const data of request.files()) {
@@ -84,7 +133,13 @@ export async function mediaRoutes(fastify) {
 
     fastify.delete('/media/:name', canDelete, async (request, reply) => {
         const name = sanitiseFilename(request.params.name);
-        await deleteMedia(name);
+        try {
+            await deleteMedia(name);
+        } catch (err) {
+            // Gone already (another tab, another admin) is a 404, not a server error.
+            if (err.code === 'ENOENT') return reply.status(404).send({error: 'File not found'});
+            throw err;
+        }
         return { success: true };
     });
 

package/server/routes/api/menus.js

@@ -2,6 +2,7 @@
  * Menus API
  *
  * GET    /api/menus                  - list (metadata only)
+ * GET    /api/menus/_count           - the sidebar badge (the underscore can never be a slug)
  * GET    /api/menus/:slug            - full menu
  * POST   /api/menus                  - create
  * PUT    /api/menus/:slug            - replace
@@ -21,6 +22,7 @@ import {
     createMenu,
     deleteMenu,
     duplicateMenu,
+    getLocationRegistry,
     getLocations,
     getMenu,
     listMenus,
@@ -28,6 +30,43 @@ import {
 } from '../../services/menus.js';
 import * as cache from '../../services/cache/index.js';
 
+/**
+ * The sidebar badge on Menus (its countUrl): how many menus, which locations
+ * have none, and which menus are in no location. A count to glance at, not a
+ * warning. Plain text throughout - the popover sets it with textContent.
+ *
+ * "Not in a location" is not "unused": a `[menu]` shortcode can show any menu.
+ * The overlay slot is left out of "empty" - it is optional by design.
+ *
+ * @param {{menus: object[], locations: Record<string, string>, registry: object[]}} state
+ * @returns {{count: number, label: string, tone: string, details: object}}
+ */
+export function menusBadge({menus = [], locations = {}, registry = []} = {}) {
+    const mapped = new Set(Object.values(locations || {}).filter(Boolean));
+    const placed = (m) => mapped.has(m.slug) || Boolean(m.binding?.slot);
+    const unplaced = menus.filter(m => !placed(m));
+    const bindable = registry.filter(r => r.slot !== 'overlay');
+    const empty = bindable.filter(r => !locations?.[r.slot]);
+    const n = menus.length;
+    return {
+        count: n,
+        label: `${n} menu${n === 1 ? '' : 's'}${unplaced.length ? `, ${unplaced.length} not in a location` : ''}`,
+        tone: 'info',
+        details: {
+            title: 'Menus',
+            rows: [
+                {label: 'In a location', value: `${n - unplaced.length} of ${n}`},
+                {label: 'Locations filled', value: `${bindable.length - empty.length} of ${bindable.length}`}
+            ],
+            items: [
+                ...empty.map(r => ({text: r.label || r.slot, meta: 'location - no menu'})),
+                ...unplaced.map(m => ({text: m.name || m.slug, meta: `${m.slug} · not in a location`}))
+            ].slice(0, 8),
+            empty: 'Every location has a menu, and every menu is in one.'
+        }
+    };
+}
+
 /**
  * Register the menus routes.
  *
@@ -44,17 +83,25 @@ export async function menusRoutes(fastify, opts = {}) {
     const canUpdate = {preHandler: [authenticate, requirePermission('menus', 'update')]};
     const canDelete = {preHandler: [authenticate, requirePermission('menus', 'delete')]};
 
-    fastify.get('/menus', canRead, async (request) => {
+    /** The menus this user may see - listMenus is metadata only, so each is read for its meta. */
+    async function visibleMenus(user) {
         const {canSeeArtefact} = await import('../../services/projects.js');
-        const all = await listMenus();
         const filtered = [];
-        for (const m of all) {
-            // listMenus returns metadata only; getMenu returns full record with meta
+        for (const m of await listMenus()) {
             const full = await getMenu(m.slug);
-            if (canSeeArtefact(request.user, full)) filtered.push(m);
+            if (canSeeArtefact(user, full)) filtered.push(m);
         }
         return filtered;
-    });
+    }
+
+    fastify.get('/menus', canRead, async (request) => visibleMenus(request.user));
+
+    // Registered before /menus/:slug; `_` is outside the slug alphabet, so no menu can shadow it.
+    fastify.get('/menus/_count', canRead, async (request) => menusBadge({
+        menus: await visibleMenus(request.user),
+        locations: await getLocations(),
+        registry: getLocationRegistry()
+    }));
 
     fastify.get('/menus/:slug', canRead, async (request, reply) => {
         const menu = await getMenu(request.params.slug);

package/server/routes/api/notifications.js

@@ -3,7 +3,11 @@
  * POST   /api/system/notifications              - Manager push (requireManager)
  * GET    /api/system/notifications              - List active notifications (admin/manager)
  * GET    /api/system/notifications/unread-count - Unread count for bell badge
+ * GET    /api/system/notifications/_count       - The sidebar badge (unread, with a popover)
  * POST   /api/system/notifications/:id/read     - Mark read (idempotent)
+ * POST   /api/system/notifications/:id/unread   - Mark unread again (idempotent)
+ * POST   /api/system/notifications/dismiss-all  - Dismiss every active one, for this user
+ * POST   /api/system/notifications/read-all     - Mark every active one read, for this user
  * POST   /api/system/notifications/:id/dismiss  - Mark dismissed
  * DELETE /api/system/notifications/:id          - Hard delete (admin only)
  */
@@ -12,6 +16,7 @@ import {
     requirePermission as defaultRequirePermission
 } from '../../middleware/auth.js';
 import { requireManager } from '../../middleware/managerAuth.js';
+import { randomUUID } from 'crypto';
 import { getAdapter } from '../../services/adapterRegistry.js';
 
 const SLUG = 'notifications';
@@ -45,6 +50,18 @@ function notificationData(entry, log) {
     return null;
 }
 
+/**
+ * Write a notification's payload back as a whole entry - `{id, data, meta}`.
+ *
+ * The adapter's update() REPLACES the stored entry with what it is given, and
+ * until 0.76.0 these routes gave it the bare payload: marking a notification
+ * read turned it into a flat record with no id and no `data`, which the list
+ * then skipped as malformed - read once, gone for good.
+ */
+async function saveData(adapter, entry, data) {
+    return adapter.update(SLUG, entry.id, {...entry, data, meta: {...(entry.meta || {}), updatedAt: new Date().toISOString()}});
+}
+
 /**
  * Is this notification live for this user right now: not expired, not dismissed.
  *
@@ -58,6 +75,43 @@ function isActiveFor(data, userId, now) {
     return !(Array.isArray(data.dismissedBy) && data.dismissedBy.includes(userId));
 }
 
+/**
+ * The sidebar badge on Notifications (its countUrl): the unread ones - the same
+ * number the sidebar always showed there - red while any of them is critical.
+ * Plain text throughout: the popover sets it with textContent.
+ *
+ * @param {object[]} active - this user's active entries, each with `unread`
+ * @returns {{count: number, label: string, tone: string, details: object}}
+ */
+export function notificationsBadge(active = []) {
+    const unread = active.filter(e => e.unread)
+        .sort((a, b) => String(b.data.createdAt || '').localeCompare(String(a.data.createdAt || '')));
+    const sev = (e) => e.data?.severity || 'info';
+    const critical = unread.filter(e => sev(e) === 'critical').length;
+    const warning = unread.filter(e => sev(e) === 'warning').length;
+    const n = unread.length;
+    return {
+        count: n,
+        label: n ? `${n} unread notification${n === 1 ? '' : 's'}${critical ? `, ${critical} critical` : ''}` : 'No unread notifications',
+        tone: critical ? 'danger' : 'info',
+        details: {
+            title: 'Notifications',
+            rows: [
+                {label: 'Unread', value: String(n)},
+                {label: 'Critical', value: String(critical), ...(critical && {tone: 'danger'})},
+                {label: 'Warnings', value: String(warning)},
+                {label: 'In the inbox', value: String(active.length)}
+            ],
+            items: unread.slice(0, 6).map(e => ({
+                text: String(e.data.title || '(no title)').slice(0, 80),
+                meta: [sev(e), String(e.data.createdAt || '').slice(0, 10)].filter(Boolean).join(' · '),
+                ...(sev(e) === 'critical' && {tone: 'danger'})
+            })),
+            empty: 'Nothing unread.'
+        }
+    };
+}
+
 export async function notificationsRoutes(fastify, opts = {}) {
     // Injectable so tests can supply no-ops rather than a seeded roles cache -
     // the same DI pattern as menus.js, projects.js and context-menus.js.
@@ -94,17 +148,25 @@ export async function notificationsRoutes(fastify, opts = {}) {
             }
         }
 
+        // A whole entry, {id, data, meta}: the adapter stores what it is given, and
+        // before 0.76.0 this handed it the bare payload - no id, no `data` - so the
+        // list skipped every pushed notification as malformed and none ever showed.
         const adapter = await getAdapter(SLUG);
+        const now = new Date().toISOString();
         const entry = await adapter.insert(SLUG, {
-            title: title.trim(),
-            body: body.trim(),
-            severity,
-            source: 'manager',
-            link: link || null,
-            createdAt: new Date().toISOString(),
-            expiresAt: expiresAt || null,
-            readBy: [],
-            dismissedBy: []
+            id: randomUUID(),
+            data: {
+                title: title.trim(),
+                body: body.trim(),
+                severity,
+                source: 'manager',
+                link: link || null,
+                createdAt: now,
+                expiresAt: expiresAt || null,
+                readBy: [],
+                dismissedBy: []
+            },
+            meta: {createdAt: now, updatedAt: now, source: 'manager'}
         });
 
         return reply.code(201).send(entry);
@@ -147,6 +209,73 @@ export async function notificationsRoutes(fastify, opts = {}) {
         return { count };
     });
 
+    /** This user's active notifications, newest first, each flagged `unread`. */
+    async function activeFor(userId) {
+        const now = new Date().toISOString();
+        const adapter = await getAdapter(SLUG);
+        return (await adapter.all(SLUG))
+            .filter(entry => {
+                const d = notificationData(entry, fastify.log);
+                return !!d && isActiveFor(d, userId, now);
+            })
+            .map(entry => ({...entry, unread: !Array.isArray(entry.data.readBy) || !entry.data.readBy.includes(userId)}));
+    }
+
+    // --- Sidebar badge (static path: GET has no /:id route to shadow) ---
+    fastify.get('/system/notifications/_count', canRead, async (request) => notificationsBadge(await activeFor(request.user.id)));
+
+    // --- Dismiss everything active, for this user ---
+    fastify.post('/system/notifications/dismiss-all', canRead, async (request) => {
+        const userId = request.user.id;
+        const adapter = await getAdapter(SLUG);
+        let dismissed = 0;
+        for (const entry of await activeFor(userId)) {
+            const {unread: _u, ...stored} = entry;
+            const data = stored.data;
+            const dismissedBy = Array.isArray(data.dismissedBy) ? data.dismissedBy : [];
+            const readBy = Array.isArray(data.readBy) ? data.readBy : [];
+            await saveData(adapter, stored, {
+                ...data,
+                dismissedBy: [...dismissedBy, userId],
+                readBy: readBy.includes(userId) ? readBy : [...readBy, userId]
+            });
+            dismissed++;
+        }
+        return {ok: true, dismissed};
+    });
+
+    // --- Mark everything active read, for this user ---
+    // One request, one pass: the screen used to fire a mark-read per notification
+    // at once, and on file storage each read-modify-write overwrote the others -
+    // six marked, one stuck.
+    fastify.post('/system/notifications/read-all', canRead, async (request) => {
+        const userId = request.user.id;
+        const adapter = await getAdapter(SLUG);
+        let marked = 0;
+        for (const entry of await activeFor(userId)) {
+            if (!entry.unread) continue;
+            const {unread: _u, ...stored} = entry;
+            const readBy = Array.isArray(stored.data.readBy) ? stored.data.readBy : [];
+            await saveData(adapter, stored, {...stored.data, readBy: [...readBy, userId]});
+            marked++;
+        }
+        return {ok: true, marked};
+    });
+
+    // --- Mark unread again (idempotent) ---
+    fastify.post('/system/notifications/:id/unread', canRead, async (request, reply) => {
+        const { id } = request.params;
+        const userId = request.user.id;
+        const adapter = await getAdapter(SLUG);
+        const entry = await adapter.get(SLUG, id);
+        const data = notificationData(entry, fastify.log);
+        if (!data) return reply.code(404).send({ error: 'Notification not found.' });
+        const readBy = Array.isArray(data.readBy) ? data.readBy : [];
+        if (!readBy.includes(userId)) return { ok: true };
+        const updated = await saveData(adapter, entry, {...data, readBy: readBy.filter(u => u !== userId)});
+        return { ok: true, entry: updated };
+    });
+
     // --- Mark read (idempotent) ---
     fastify.post('/system/notifications/:id/read', canRead, async (request, reply) => {
         const { id } = request.params;
@@ -161,10 +290,7 @@ export async function notificationsRoutes(fastify, opts = {}) {
         const readBy = Array.isArray(data.readBy) ? data.readBy : [];
         if (readBy.includes(userId)) return { ok: true }; // already read - idempotent
 
-        const updated = await adapter.update(SLUG, id, {
-            ...data,
-            readBy: [...readBy, userId]
-        });
+        const updated = await saveData(adapter, entry, {...data, readBy: [...readBy, userId]});
 
         return { ok: true, entry: updated };
     });
@@ -182,7 +308,7 @@ export async function notificationsRoutes(fastify, opts = {}) {
         const dismissedBy = Array.isArray(data.dismissedBy) ? data.dismissedBy : [];
         const readBy = Array.isArray(data.readBy) ? data.readBy : [];
 
-        const updated = await adapter.update(SLUG, id, {
+        const updated = await saveData(adapter, entry, {
             ...data,
             dismissedBy: dismissedBy.includes(userId) ? dismissedBy : [...dismissedBy, userId],
             readBy: readBy.includes(userId) ? readBy : [...readBy, userId] // dismissing also marks read

package/server/routes/api/pages.js

@@ -1,6 +1,7 @@
 /**
  * Pages API
  * GET    /api/pages          - list all pages
+ * GET    /api/pages/_count   - the sidebar badge on Pages (drafts)
  * GET    /api/pages/*        - get single page by URL path
  * POST   /api/pages          - create page
  * PUT    /api/pages/*        - update page
@@ -23,6 +24,44 @@ import {
 import {getVersionCount} from '../../services/versions.js';
 import {authenticate, requirePermission} from '../../middleware/auth.js';
 import {getConfig, saveConfig} from '../../config.js';
+import {ago, clip, plural} from '../../services/sidebarBadges.js';
+
+/**
+ * The sidebar badge on Pages (its countUrl): the drafts - unpublished work -
+ * with a popover of what is published, restricted and recently changed, and
+ * the drafts themselves, newest first. No drafts, no badge. Plain text
+ * throughout: the popover sets it with textContent.
+ *
+ * @param {object[]} pages - listPages()
+ * @param {number} [now]
+ */
+export function pagesBadge(pages, now = Date.now()) {
+    const list = pages || [];
+    const drafts = list.filter(p => p.status !== 'published')
+        .sort((a, b) => String(b.updatedAt || '').localeCompare(String(a.updatedAt || '')));
+    const restricted = list.filter(p => p.visibility && p.visibility !== 'public').length;
+    const week = list.filter(p => p.updatedAt && now - new Date(p.updatedAt).getTime() < 7 * 86_400_000).length;
+    return {
+        // The number stays what the sidebar has always shown on Pages (all of them); drafts are the label.
+        count: list.length,
+        label: drafts.length ? `${plural(list.length, 'page')}, ${plural(drafts.length, 'draft')}` : `${plural(list.length, 'page')}, no drafts`,
+        tone: 'info',
+        details: {
+            title: 'Pages',
+            rows: [
+                {label: 'Published', value: String(list.length - drafts.length)},
+                {label: 'Drafts', value: String(drafts.length)},
+                {label: 'Not public', value: String(restricted)},
+                {label: 'Changed this week', value: String(week)}
+            ],
+            items: drafts.slice(0, 6).map(p => ({
+                text: clip(p.title || p.urlPath),
+                meta: [p.urlPath, p.updatedAt ? ago(p.updatedAt, now) : ''].filter(Boolean).join(' · ')
+            })),
+            empty: 'No drafts - everything is published.'
+        }
+    };
+}
 
 export async function pagesRoutes(fastify) {
     const canRead = {preHandler: [authenticate, requirePermission('pages', 'read')]};
@@ -116,6 +155,9 @@ export async function pagesRoutes(fastify) {
         return { tags: [...tagSet].sort() };
     });
 
+    // The sidebar badge. Static, so it is matched before the /pages/* wildcard below.
+    fastify.get('/pages/_count', canRead, async () => pagesBadge(await listPages()));
+
     // List all pages
     fastify.get('/pages', canRead, async (request, reply) => {
         const pages = await listPages();
@@ -133,6 +175,10 @@ export async function pagesRoutes(fastify) {
             tags: p.tags || [],
             project: p.project ?? null,
             resolvedProject: p.resolvedProject ?? null,
+            // The list's "managed by a plugin" chip and delete warning read these;
+            // they were dropped here, so neither ever showed.
+            plugin: p.plugin || null,
+            bundled: p.bundled === true,
             updatedAt: p.updatedAt,
             createdAt: p.createdAt,
             versionCount: counts[i]

package/server/routes/api/plugins.js

@@ -1,6 +1,7 @@
 /**
  * Plugins API
  * GET  /api/plugins              - list all discovered plugins + state (admin only)
+ * GET  /api/plugins/_count       - the sidebar badge (`_` is outside the slug alphabet)
  * POST /api/plugins/scaffold     - create a new plugin from plugins/_template (admin only)
  * PUT  /api/plugins/:name        - enable/disable, update settings (admin only)
  * GET  /api/plugins/admin-config - sidebar/routes/views for enabled plugins (authenticated)
@@ -14,6 +15,7 @@ import {
     getAdminPluginConfig,
     getEntitlementStates,
     getLoadedPlugins,
+    getPluginSettings,
     getPluginStates,
     isCorePlugin,
     pluginLicence,
@@ -26,7 +28,8 @@ import {deletePluginFile, listPluginFiles, readPluginFile, writePluginFile} from
 import {getConfig} from '../../config.js';
 import path from 'path';
 import {existsSync, readFileSync} from 'node:fs';
-import {installPlugin} from '../../services/pluginInstaller.js';
+import {compareVersions, installPlugin} from '../../services/pluginInstaller.js';
+import {fetchCatalogue, isManaged} from '../../services/managerClient.js';
 import {packEnvelope, readEnvelope, readManifestFromTarball, tarDirectory} from '../../services/pluginEnvelope.js';
 
 /**
@@ -95,6 +98,111 @@ function autoRestartEnabled() {
     }
 }
 
+/** Entitlement states that stop a plugin running (the loader refuses them). */
+const BLOCKING = new Set(['expired', 'unlicensed']);
+
+/**
+ * The sidebar badge on Plugins (its countUrl, GET /api/plugins/_count). The
+ * number stays what the sidebar always showed there - how many are installed -
+ * and the tone and popover say what needs doing: red while a licensed plugin
+ * that is switched on is not running, amber for an update or a licence in its
+ * grace period. Plain text throughout; the popover sets it with textContent.
+ *
+ * @param {{name, displayName, version, enabled, core, entitlement}[]} plugins
+ * @param {Map<string, string>} [latest] - slug -> newest catalogue version (managed sites only)
+ * @returns {{count, label, tone, details}}
+ */
+export function pluginsBadge(plugins = [], latest = new Map()) {
+    const name = (p) => String(p.displayName || p.name);
+    const stopped = plugins.filter(p => p.enabled && BLOCKING.has(p.entitlement));
+    const grace = plugins.filter(p => p.entitlement === 'grace');
+    const updates = plugins.filter(p => latest.has(p.name) && compareVersions(latest.get(p.name), p.version) > 0);
+    const on = plugins.filter(p => p.enabled || p.core).length;
+    const n = plugins.length;
+    const extra = [
+        stopped.length && `${stopped.length} not running`,
+        updates.length && `${updates.length} update${updates.length === 1 ? '' : 's'}`
+    ].filter(Boolean).join(', ');
+    return {
+        count: n,
+        label: `${n} plugin${n === 1 ? '' : 's'} installed${extra ? `, ${extra}` : ''}`,
+        tone: stopped.length ? 'danger' : (updates.length || grace.length) ? 'attention' : 'info',
+        details: {
+            title: 'Plugins',
+            rows: [
+                {label: 'Switched on', value: String(on)},
+                {label: 'Switched off', value: String(n - on)},
+                ...(latest.size ? [{label: 'Updates available', value: String(updates.length)}] : []),
+                ...(stopped.length ? [{label: 'Not running (licence)', value: String(stopped.length), tone: 'danger'}] : [])
+            ],
+            items: [
+                ...stopped.map(p => ({text: name(p), meta: `not running - licence ${p.entitlement}`, tone: 'danger'})),
+                ...grace.map(p => ({text: name(p), meta: 'licence ended - running in its grace period, renew'})),
+                ...updates.map(p => ({text: name(p), meta: `update ${p.version} → ${latest.get(p.name)}`}))
+            ].slice(0, 8),
+            empty: 'Everything is running and up to date.'
+        }
+    };
+}
+
+/**
+ * The newest catalogue version of each plugin, for a managed site - kept ten
+ * minutes: the badge is asked for every minute from every admin tab, and each
+ * ask would otherwise be a round trip to the manager.
+ */
+let _latest = {at: 0, value: new Map()};
+async function latestVersions() {
+    if (!isManaged()) return new Map();
+    if (Date.now() - _latest.at < 10 * 60_000) return _latest.value;
+    const catalogue = await fetchCatalogue().catch(() => []);
+    _latest = {at: Date.now(), value: new Map((catalogue || []).map(e => [e.slug, e.version]))};
+    return _latest.value;
+}
+
+/**
+ * Plugin settings reach the admin browser (the Marketplace's Configure form), so
+ * a value whose key looks secret - a DVLA key, an SMTP password, a connection
+ * URI - is sent as SETTING_MASK instead. Saving sends the mask back for any
+ * secret left untouched, and restoreMasked() puts the stored value back; a
+ * mask with nothing stored behind it (a config.js default) is dropped, so the
+ * default still applies. Same rule as isSecretKey() in admin/js/lib/plugins-arrange.js.
+ */
+export const SETTING_MASK = '\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022';
+const SECRET_KEY = /pass(word)?|secret|token|api[-_]?key|private|credential|uri$|dsn/i;
+
+/** @param {Set<string>} [secretKeys] - keys a plugin's settingsSchema marks `secret: true` */
+export function maskSettings(value, key = '', secretKeys = new Set()) {
+    // An array's strings are secret when its key is (apiKeys: ['a', 'b']).
+    if (Array.isArray(value)) return value.map(v => maskSettings(v, key, secretKeys));
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, maskSettings(v, k, secretKeys)]));
+    }
+    const secret = SECRET_KEY.test(key) || secretKeys.has(key);
+    return secret && typeof value === 'string' && value !== '' ? SETTING_MASK : value;
+}
+
+const schemaSecrets = (manifest) => new Set((Array.isArray(manifest.settingsSchema) ? manifest.settingsSchema : [])
+    .filter(f => f && f.secret === true && typeof f.key === 'string').map(f => f.key));
+
+export function restoreMasked(incoming, stored) {
+    // Arrays by position: maskSettings masks inside them too ({accounts: [{password}]}),
+    // and returning the array as sent stored the mask over the real value.
+    if (Array.isArray(incoming)) {
+        const before = Array.isArray(stored) ? stored : [];
+        return incoming.map((v, i) => (v === SETTING_MASK ? (before[i] ?? '') : restoreMasked(v, before[i])));
+    }
+    if (incoming && typeof incoming === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(incoming)) {
+            const before = stored && typeof stored === 'object' ? stored[k] : undefined;
+            if (v === SETTING_MASK) { if (before !== undefined) out[k] = before; continue; }
+            out[k] = restoreMasked(v, before);
+        }
+        return out;
+    }
+    return incoming;
+}
+
 export async function pluginsRoutes(fastify, opts = {}) {
     const authenticate      = opts.authenticate      || defaultAuthenticate;
     const requirePermission = opts.requirePermission || defaultRequirePermission;
@@ -114,7 +222,7 @@ export async function pluginsRoutes(fastify, opts = {}) {
         const loadedPlugins = getLoadedPlugins();
         const entitlementStates = getEntitlementStates();
 
-        return manifests.map(manifest => ({
+        return Promise.all(manifests.map(async manifest => ({
             name: manifest.name,
             displayName: manifest.displayName || manifest.name,
             version: manifest.version || '1.0.0',
@@ -143,8 +251,30 @@ export async function pluginsRoutes(fastify, opts = {}) {
             // Enabled but displaced by another plugin that replaces it. Shown
             // so the screen can explain the inactivity instead of looking broken.
             supersededBy: loadedPlugins[manifest.name]?.supersededBy ?? null,
-            settings: states[manifest.name]?.settings || {}
+            settings: maskSettings(states[manifest.name]?.settings || {}, '', schemaSecrets(manifest)),
+            // What Configure edits: an optional plugin.json `settingsSchema`
+            // ([{key, label, type: text|number|select|boolean, options, min,
+            // max, help}]), else the plugin's config.js defaults merged with the
+            // stored overrides (`effectiveSettings`) - so every plugin with a
+            // config.js can be configured, not only one that declared a schema
+            // (none ever had, so the old Settings button never appeared).
+            settingsSchema: Array.isArray(manifest.settingsSchema) ? manifest.settingsSchema : null,
+            effectiveSettings: maskSettings(await getPluginSettings(manifest.name).catch(() => ({})), '', schemaSecrets(manifest))
+        })));
+    });
+
+    // The sidebar badge. Registered with the other static /plugins/* routes;
+    // `_` is outside the plugin slug alphabet, so no plugin can shadow it.
+    fastify.get('/plugins/_count', canRead, async () => {
+        const manifests = await discoverPlugins();
+        const states = getPluginStates();
+        const ent = getEntitlementStates();
+        const plugins = manifests.map(m => ({
+            name: m.name, displayName: m.displayName || m.name, version: m.version || '1.0.0',
+            core: isCorePlugin(m.name), enabled: isCorePlugin(m.name) || !!states[m.name]?.enabled,
+            entitlement: ent[m.name] ?? null
         }));
+        return pluginsBadge(plugins, await latestVersions());
     });
 
     // Scaffold a new plugin from plugins/_template. The plugin is created
@@ -183,7 +313,8 @@ export async function pluginsRoutes(fastify, opts = {}) {
         const prevState = getPluginStates()[name] || {};
         const update = {};
         if (enabled !== undefined) update.enabled = !!enabled;
-        if (settings !== undefined) update.settings = settings;
+        // A secret sent back as the mask keeps its stored value (see maskSettings).
+        if (settings !== undefined) update.settings = restoreMasked(settings, prevState.settings || {});
         savePluginState(name, update);
 
         if (!prevState.enabled && !!enabled) {