domma-cms 0.75.0 → 0.76.0

package/plugins/_lib/mail/readRoutes.js

@@ -38,6 +38,7 @@ import {readPriority} from './priority.js';
 import {listAttachments, renderBody} from './render.js';
 import {readUnsubscribe} from './unsubscribe.js';
 import {MailKeyError} from './secretbox.js';
+import {unreadBadge} from './unreadBadge.js';
 
 /**
  * Flatten an envelope address list into something the browser can render.
@@ -52,7 +53,7 @@ function addresses(list) {
     }));
 }
 
-export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginName, cachedList = null, diagnostics = null}) {
+export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginName, cachedList = null, diagnostics = null, unreadBadge: withUnreadBadge = false}) {
     const {authenticate} = auth;
 
     // A deleted user's stored mailbox passwords must not outlive their
@@ -165,6 +166,47 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
     // Accounts
     // -------------------------------------------------------------------------
 
+    /**
+     * GET /unread - the sidebar badge (the plugin.json countUrl). Opt-in:
+     * Email Pro counts from its store and registers its own. INBOX only, by
+     * STATUS (no select, so nothing can be marked read), and kept a minute
+     * per user - the sidebar asks every minute from every open admin tab.
+     */
+    if (withUnreadBadge) {
+        const badgeCache = new Map();
+        // A mailbox that failed (a changed password, a server down) is not asked
+        // again every minute: that is a failed IMAP login per minute per open tab,
+        // enough to trip fail2ban or a provider lockout. It backs off 5 min, doubling
+        // to an hour; saving the account (a new updatedAt) retries straight away.
+        const failures = new Map();
+        const failKey = (uid, account) => `${uid}:${account.id}:${account.updatedAt || account.createdAt || ''}`;
+        fastify.get('/unread', {preHandler: [authenticate]}, async (request, reply) => {
+            const uid = userId(request);
+            if (!uid) return reply.code(401).send({error: 'Authentication required.'});
+            const hit = badgeCache.get(uid);
+            if (hit && Date.now() - hit.at < 60_000) return hit.value;
+            const boxes = [];
+            for (const account of await accounts.listAccounts(uid)) {
+                const key = failKey(uid, account);
+                const failed = failures.get(key);
+                if (failed && Date.now() < failed.until) { boxes.push({label: account.label, unseen: null}); continue; }
+                try {
+                    const status = await pool.withClient(`${uid}:${account.id}`, accounts.toConnection(account),
+                        client => client.status('INBOX', {unseen: true}));
+                    failures.delete(key);
+                    boxes.push({label: account.label, unseen: status?.unseen ?? 0});
+                } catch {
+                    const wait = Math.min((failed?.wait || 150_000) * 2, 3_600_000);
+                    failures.set(key, {wait, until: Date.now() + wait});
+                    boxes.push({label: account.label, unseen: null});
+                }
+            }
+            const value = unreadBadge(boxes);
+            badgeCache.set(uid, {at: Date.now(), value});
+            return value;
+        });
+    }
+
     /** GET /accounts - every mailbox this user owns, without passwords. */
     fastify.get('/accounts', {preHandler: [authenticate]}, async (request, reply) => {
         const uid = userId(request);

package/plugins/_lib/mail/unreadBadge.js

@@ -0,0 +1,42 @@
+/**
+ * The free reader's sidebar badge - unread mail in each mailbox's INBOX.
+ *
+ * Pure: the route asks IMAP (STATUS, which reads without selecting and so can
+ * never mark anything read) and hands the figures here. Email Pro has its own
+ * badge over the synchronised store; this is the edition without one, so it
+ * counts INBOX only - asking a server about every folder once a minute is
+ * how a mailbox gets rate-limited.
+ *
+ * Plain text throughout: the sidebar popover sets it with textContent.
+ *
+ * @module _lib/mail/unreadBadge
+ */
+
+const plural = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
+
+/**
+ * @param   {{label?: string, unseen: number|null, error?: string}[]} boxes - one per mailbox
+ * @returns {{count: number, label: string, tone: string, details: object}}
+ */
+export function unreadBadge(boxes = []) {
+    const known = boxes.filter(b => Number.isFinite(b.unseen));
+    const count = known.reduce((n, b) => n + b.unseen, 0);
+    const failed = boxes.length - known.length;
+    return {
+        count,
+        label: boxes.length
+            ? `${plural(count, 'unread message')} in the inbox${boxes.length > 1 ? 'es' : ''}${failed ? ` (${plural(failed, 'mailbox', 'mailboxes')} could not be checked)` : ''}`
+            : 'No mailbox set up',
+        tone: 'info',
+        details: {
+            title: 'Mail',
+            rows: boxes.map(b => ({
+                label: String(b.label || 'Mailbox'),
+                value: Number.isFinite(b.unseen) ? plural(b.unseen, 'unread', 'unread') : 'not reachable',
+                ...(Number.isFinite(b.unseen) ? {} : {tone: 'danger'})
+            })),
+            items: [],
+            empty: boxes.length ? 'Nothing unread in the inbox.' : 'Add a mailbox to see unread mail here.'
+        }
+    };
+}

package/plugins/free-tier.lock.json

@@ -1,6 +1,6 @@
 {
   "note": "Written by `make sync-free-tier` in dcms-marketplace. Do not edit these plugins here - edit them there and sync.",
-  "source": "dcms-marketplace@d9bfe49",
+  "source": "dcms-marketplace@5f64a68",
   "plugins": {
     "blog": {
       "version": "1.6.3",
@@ -67,13 +67,13 @@
       }
     },
     "mail-reader": {
-      "version": "1.0.0",
+      "version": "1.1.0",
       "files": {
-        "CLAUDE.md": "a8dd2cb285e1d24b2f072aa11a644e1c8c1be89013da6f6cc46d9820fe24ccd5",
+        "CLAUDE.md": "7f317e69b560457f2d4c401b466754850afe75f6983bc41414c71d8c276c3583",
         "admin/views/mail.js": "c5c6483f9618c75cac8f4be32d3aea99511db76d4b9d38b8ef43bdc1d35db3c5",
         "config.js": "6e65803ad822a9acda40c203631b8eb32a87cf9d9e5f1c7cb59d01aa406075c6",
-        "plugin.js": "79b17346ed0192b092040460cc8d762d5207ee6e4af7bfc2d1cf654a51e2fa81",
-        "plugin.json": "5f5b98757514aa70d7c7a2be5a1fbfdde8ef21a2ccc7586b3b5aea9b44fbe5e6"
+        "plugin.js": "ebe4c41bdd8836fb3128af3a0e789d47f89b00e9e37dc9378bb308aaae8d41b2",
+        "plugin.json": "ed1f02d9405f6ae1257313ea4155ea49e307fb2210650fd247b92e6988aa78d1"
       }
     }
   }

package/plugins/mail-reader/CLAUDE.md

@@ -24,6 +24,7 @@ All under `/api/plugins/mail-reader`, all requiring authentication.
 
 | Method | Path | Purpose |
 |---|---|---|
+| GET | `/unread` | The sidebar badge: unread in each mailbox's INBOX, by STATUS (never selects, so nothing is marked read), cached a minute per user. `registerReadRoutes({unreadBadge: true})` - Email Pro counts from its store instead. |
 | GET | `/accounts` | Every mailbox this user owns. Never returns passwords, only `hasPassword`. |
 | POST | `/accounts` | Add a mailbox. |
 | PUT | `/accounts/:id` | Update one. A blank password means "keep the stored one". |

package/plugins/mail-reader/plugin.js

@@ -30,7 +30,9 @@ export default async function mailReaderPlugin(fastify, options) {
         hooks: options.hooks,
         config,
         pool,
-        pluginName: 'mail-reader'
+        pluginName: 'mail-reader',
+        // The sidebar badge (plugin.json countUrl): unread in each INBOX.
+        unreadBadge: true
     });
 }
 

package/plugins/mail-reader/plugin.json

@@ -1,11 +1,11 @@
 {
   "name": "mail-reader",
   "displayName": "Mail Reader",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "tier": "free",
   "description": "Read-only IMAP mailbox reader. Connects to a standard IMAP server and reads mail without ever writing to it.",
   "author": "Darryl Waterhouse",
-  "date": "2026-09-19",
+  "date": "2026-09-25",
   "icon": "mail",
   "admin": {
     "sidebar": [
@@ -14,7 +14,8 @@
         "text": "Mail Reader",
         "icon": "mail",
         "url": "#/plugins/mail-reader",
-        "section": "#/plugins/mail-reader"
+        "section": "#/plugins/mail-reader",
+        "countUrl": "/api/plugins/mail-reader/unread"
       }
     ],
     "routes": [
@@ -26,7 +27,7 @@
     ],
     "views": {
       "plugin-mail-reader": {
-        "entry": "mail-reader/admin/views/mail.js?v=1",
+        "entry": "mail-reader/admin/views/mail.js?v=2",
         "exportName": "mailView"
       }
     }

package/server/routes/api/api-tokens.js

@@ -2,6 +2,7 @@
  * API Tokens API
  *
  * GET    /api/api-tokens      - list tokens visible to the caller (sanitised; never the hash)
+ * GET    /api/api-tokens/_count - the sidebar badge: tokens that need attention (expired / expiring)
  * POST   /api/api-tokens      - create; response carries the plaintext ONCE
  * PUT    /api/api-tokens/:id  - rename, enable/disable, edit scopes/expiry
  * DELETE /api/api-tokens/:id  - revoke (immediate)
@@ -23,6 +24,58 @@ import {
 } from '../../services/apiTokens.js';
 import {canSeeArtefact} from '../../services/projects.js';
 
+/** A token this close to its expiry is called out - SOON_DAYS in admin/js/lib/api-tokens-arrange.js. */
+const SOON_DAYS = 14;
+const DAY = 86_400_000;
+
+/**
+ * The sidebar badge on API Tokens (its countUrl, GET /api/api-tokens/_count).
+ *
+ * The number is a signal, not an inventory: the tokens that need someone -
+ * switched on but already expired (every call with one is being refused, and
+ * nothing else says so), and switched on and expiring within SOON_DAYS. Zero is
+ * no badge. Red while any has expired. Plain text - the popover sets it with
+ * textContent; token names are the admin's own, never the secret.
+ *
+ * @param {object[]} tokens - sanitised, as listTokensSanitised returns them
+ * @param {number} [now]
+ */
+export function apiTokensBadge(tokens = [], now = Date.now()) {
+    const on = tokens.filter(t => t.enabled !== false);
+    const at = (t) => (t.expiresAt ? Date.parse(t.expiresAt) : NaN);
+    const expired = on.filter(t => at(t) <= now);
+    const soon = on.filter(t => at(t) > now && at(t) - now <= SOON_DAYS * DAY)
+        .sort((a, b) => at(a) - at(b));
+    const off = tokens.length - on.length;
+    const need = expired.length + soon.length;
+    const plural = (n, one) => `${n} ${one}${n === 1 ? '' : 's'}`;
+    const days = (t) => {
+        const d = Math.ceil((at(t) - now) / DAY);
+        return d <= 0 ? 'today' : d === 1 ? 'tomorrow' : `in ${d} days`;
+    };
+    return {
+        count: need,
+        label: need
+            ? [expired.length && `${plural(expired.length, 'token')} expired`, soon.length && `${soon.length} expiring soon`].filter(Boolean).join(', ')
+            : `${plural(tokens.length, 'token')}, none expiring soon`,
+        tone: expired.length ? 'danger' : 'attention',
+        details: {
+            title: 'API Tokens',
+            rows: [
+                {label: 'Working', value: String(on.length - expired.length)},
+                {label: 'Expiring soon', value: String(soon.length)},
+                {label: 'Expired', value: String(expired.length), ...(expired.length && {tone: 'danger'})},
+                {label: 'Switched off', value: String(off)}
+            ],
+            items: [
+                ...expired.map(t => ({text: String(t.name || '(unnamed)'), meta: `${t.project} · expired - callers are refused`, tone: 'danger'})),
+                ...soon.map(t => ({text: String(t.name || '(unnamed)'), meta: `${t.project} · expires ${days(t)}`}))
+            ].slice(0, 8),
+            empty: 'No token has expired or expires in the next two weeks.'
+        }
+    };
+}
+
 /**
  * Register the api-tokens routes.
  *
@@ -43,6 +96,9 @@ export async function apiTokensRoutes(fastify, opts = {}) {
         return listTokensSanitised(request.user);
     });
 
+    // There is no GET /api-tokens/:id, and ids are uuids - nothing can shadow this.
+    fastify.get('/api-tokens/_count', canRead, async (request) => apiTokensBadge(await listTokensSanitised(request.user)));
+
     fastify.post('/api-tokens', canCreate, async (request, reply) => {
         const {name, project, scopes, expiresAt} = request.body || {};
         if (project && !canSeeArtefact(request.user, {meta: {project}})) {

package/server/routes/api/auth.js

@@ -170,7 +170,13 @@ export async function authRoutes(fastify) {
         if (email) coreUpdates.email = email;
         if (password) coreUpdates.password = password;
 
-        const user = await updateUser(id, coreUpdates);
+        let user;
+        try {
+            user = await updateUser(id, coreUpdates);
+        } catch (err) {
+            if (err.code === 'EMAIL_TAKEN') return reply.status(409).send({error: err.message});
+            throw err;
+        }
 
         if (profile && typeof profile === 'object') {
             await updateProfile(id, profile);

package/server/routes/api/collections.js

@@ -54,7 +54,7 @@ import {
     updateEntry
 } from '../../services/collections.js';
 import {authenticate, requireAdmin, requirePermission} from '../../middleware/auth.js';
-import {getRoleLevel, invalidate as invalidateRoles} from '../../services/roles.js';
+import {getRoleLevel, invalidate as invalidateRoles, isBaseRole} from '../../services/roles.js';
 import {getEffectiveLevel} from '../../services/userRoles.js';
 import {getConfig, saveConfig} from '../../config.js';
 import {PRESET_COLLECTION_SLUGS} from '../../services/presetCollections.js';
@@ -262,6 +262,9 @@ async function keepRoleSystemFields(id, data) {
         if (existing[field] !== undefined) out[field] = existing[field];
         else delete out[field];
     }
+    // A built-in role keeps its name: renaming `admin` and then deleting it went round
+    // the delete guard (and every user and route that names it would lose it).
+    if (isBaseRole(existing.name)) out.name = existing.name;
     return out;
 }
 
@@ -494,6 +497,11 @@ export async function collectionsRoutes(fastify) {
             if (entry?.data?.level === 0) {
                 return reply.status(403).send({ error: 'Cannot delete the root admin role' });
             }
+            // admin and user too: removeRole() refused them by name, but this route did not,
+            // and the old Roles screen offered Delete on both.
+            if (isBaseRole(entry?.data?.name)) {
+                return reply.status(403).send({ error: `Cannot delete the built-in role '${entry.data.name}'` });
+            }
         }
         try {
             await deleteEntry(request.params.slug, request.params.id);
@@ -507,6 +515,10 @@ export async function collectionsRoutes(fastify) {
 
     // Clear all entries - DELETE /collections/:slug/entries (no :id)
     fastify.delete('/collections/:slug/entries', canDelete, async (request, reply) => {
+        // Clearing roles would leave every user holding a role that no longer exists.
+        if (request.params.slug === 'roles') {
+            return reply.status(403).send({ error: 'Roles cannot be cleared - delete them one at a time' });
+        }
         try {
             await clearEntries(request.params.slug);
             return { success: true };

package/server/routes/api/effects.js

@@ -2,22 +2,77 @@
  * Effects API Routes
  * GET  /api/effects/settings  - public (read by public site IIFE)
  * PUT  /api/effects/settings  - admin-only (save user overrides)
+ *
+ * The PUT whitelists and checks what it stores (normaliseEffectsSettings): it
+ * used to write the request body to config/effects.json verbatim, and GET
+ * hands that file to every public page. Keys this route does not know are
+ * left as they are in the file, never added from a request.
  */
-import {authenticate, requireAdmin} from '../../middleware/auth.js';
+import {
+    authenticate as defaultAuthenticate,
+    requireAdmin as defaultRequireAdmin
+} from '../../middleware/auth.js';
 import {getConfig, saveConfig} from '../../config.js';
 
-export async function effectsRoutes(fastify) {
-    fastify.get('/effects/settings', async () => {
-        try {
-            return getConfig('effects');
-        } catch {
-            return {respectMotion: true, defaultDuration: 600, defaultAnimation: 'fade', defaultThreshold: 0.1};
-        }
-    });
+export const EFFECT_ANIMATIONS = ['fade', 'slide-up', 'slide-down', 'zoom', 'flip'];
+export const EFFECTS_DEFAULTS = {respectMotion: true, defaultDuration: 600, defaultAnimation: 'fade', defaultThreshold: 0.1};
+
+/**
+ * A request body -> {errors, settings}. The same rules as checkSettings() in
+ * admin/js/lib/effects-arrange.js. A duration of 0 is refused: public/js/effects.js
+ * reads `defaultDuration || 600`, so 0 would silently mean 600.
+ *
+ * @param {object} body
+ * @returns {{errors: string[], settings: object}}
+ */
+export function normaliseEffectsSettings(body) {
+    const b = body && typeof body === 'object' ? body : {};
+    const errors = [];
+    const settings = {};
+    if ('respectMotion' in b) settings.respectMotion = b.respectMotion !== false;
+    if ('defaultDuration' in b) {
+        const n = Number(b.defaultDuration);
+        if (!Number.isInteger(n) || n < 1 || n > 10000) errors.push('defaultDuration must be a whole number from 1 to 10000');
+        else settings.defaultDuration = n;
+    }
+    if ('defaultAnimation' in b) {
+        if (!EFFECT_ANIMATIONS.includes(b.defaultAnimation)) errors.push(`defaultAnimation must be one of ${EFFECT_ANIMATIONS.join(', ')}`);
+        else settings.defaultAnimation = b.defaultAnimation;
+    }
+    if ('defaultThreshold' in b) {
+        const n = Number(b.defaultThreshold);
+        if (b.defaultThreshold === '' || b.defaultThreshold === null || !Number.isFinite(n) || n < 0 || n > 1) {
+            errors.push('defaultThreshold must be a number from 0 to 1');
+        } else settings.defaultThreshold = n;
+    }
+    return {errors, settings};
+}
+
+function loadSettings() {
+    try {
+        return {...EFFECTS_DEFAULTS, ...(getConfig('effects') || {})};
+    } catch {
+        return {...EFFECTS_DEFAULTS};
+    }
+}
+
+/**
+ * @param {import('fastify').FastifyInstance} fastify
+ * @param {{authenticate?: Function, requireAdmin?: Function}} [opts] - injectable for tests
+ */
+export async function effectsRoutes(fastify, opts = {}) {
+    const authenticate = opts.authenticate || defaultAuthenticate;
+    const requireAdmin = opts.requireAdmin || defaultRequireAdmin;
+
+    fastify.get('/effects/settings', async () => loadSettings());
 
-    fastify.put('/effects/settings', {preHandler: [authenticate, requireAdmin]}, async (request) => {
-        const body = request.body || {};
-        saveConfig('effects', body);
-        return {ok: true};
+    fastify.put('/effects/settings', {preHandler: [authenticate, requireAdmin]}, async (request, reply) => {
+        const {errors, settings} = normaliseEffectsSettings(request.body);
+        if (errors.length) return reply.status(400).send({error: errors.join('; ')});
+        let current = {};
+        try { current = getConfig('effects') || {}; } catch { /* no file yet */ }
+        const next = {...current, ...settings};
+        saveConfig('effects', next);
+        return {ok: true, settings: {...EFFECTS_DEFAULTS, ...next}};
     });
 }

package/server/routes/api/layouts.js

@@ -7,9 +7,16 @@
  * DELETE /api/layouts/:key   - delete a preset (builtin presets cannot be deleted)
  * GET    /api/layouts/options - get layout options
  * PUT    /api/layouts/options - save layout options
+ * GET    /api/layouts/_usage  - which pages use each layout, and which use one that is gone
+ * GET    /api/layouts/_count  - the sidebar badge: pages whose layout no longer exists
+ *
+ * `_` is outside the key alphabet (slugify below), so no layout can shadow the last two.
  */
 import {getConfig, saveConfig} from '../../config.js';
-import {authenticate, requirePermission} from '../../middleware/auth.js';
+import {
+    authenticate as defaultAuthenticate,
+    requirePermission as defaultRequirePermission
+} from '../../middleware/auth.js';
 
 const VALID_WIDTHS = new Set(['narrow', 'normal', 'wide', 'full']);
 const BG_COLOR_RE = /^[a-zA-Z0-9#(),.\s%/-]+$/;
@@ -78,7 +85,74 @@ function sanitisePreset(data) {
     };
 }
 
-export async function layoutsRoutes(fastify) {
+/**
+ * Which pages use each layout. A page names its layout in frontmatter
+ * (`layout: key`); none means `default`. A page naming a layout that no longer
+ * exists is rendered with the default one (renderer.js: presets[page.layout] ||
+ * presets.default) - nothing says so, which is what `missing` is for.
+ *
+ * @param {Record<string, object>} presets
+ * @param {{urlPath: string, title?: string, status?: string, layout?: string}[]} pages
+ * @returns {{byKey: Record<string, {urlPath, title, status}[]>, missing: {urlPath, title, status, layout}[]}}
+ */
+export function layoutUsage(presets = {}, pages = []) {
+    const byKey = Object.fromEntries(Object.keys(presets).map(k => [k, []]));
+    const missing = [];
+    for (const p of pages) {
+        const key = typeof p.layout === 'string' && p.layout.trim() ? p.layout.trim() : 'default';
+        const item = {urlPath: p.urlPath, title: p.title || p.urlPath, status: p.status || 'published'};
+        if (byKey[key]) byKey[key].push(item);
+        else missing.push({...item, layout: key});
+    }
+    return {byKey, missing};
+}
+
+/**
+ * The sidebar badge on Layouts: pages that name a layout which no longer
+ * exists (they quietly show as Default). A count of layouts would be noise -
+ * nothing needs doing about it - so this answers 0 (no badge) until something
+ * is wrong. Plain text throughout: the popover sets it with textContent.
+ *
+ * @param {Record<string, object>} presets
+ * @param {ReturnType<typeof layoutUsage>} usage
+ */
+export function layoutsBadge(presets = {}, usage = {byKey: {}, missing: []}) {
+    const all = Object.values(presets);
+    const builtin = all.filter(p => p.builtin).length;
+    const missing = usage.missing || [];
+    const inUse = Object.values(usage.byKey || {}).filter(list => list.length).length;
+    const n = missing.length;
+    return {
+        count: n,
+        label: n
+            ? `${n} page${n === 1 ? '' : 's'} use${n === 1 ? 's' : ''} a layout that no longer exists`
+            : `${all.length} layout${all.length === 1 ? '' : 's'}, every page's layout exists`,
+        tone: 'attention',
+        details: {
+            title: 'Layouts',
+            rows: [
+                {label: 'Layouts', value: `${all.length} (${builtin} built in)`},
+                {label: 'In use', value: String(inUse)},
+                {label: 'Pages on a missing layout', value: String(n), ...(n && {tone: 'danger'})}
+            ],
+            items: missing.slice(0, 8).map(p => ({
+                text: String(p.title || p.urlPath),
+                meta: `${p.urlPath} · "${p.layout}" is gone - showing as Default`,
+                tone: 'danger'
+            })),
+            empty: "Every page's layout exists."
+        }
+    };
+}
+
+/**
+ * @param {import('fastify').FastifyInstance} fastify
+ * @param {{authenticate?: Function, requirePermission?: Function, listPages?: Function}} [opts] - DI for tests
+ */
+export async function layoutsRoutes(fastify, opts = {}) {
+    const authenticate      = opts.authenticate      || defaultAuthenticate;
+    const requirePermission = opts.requirePermission || defaultRequirePermission;
+    const listPages = opts.listPages || (async () => (await import('../../services/content.js')).listPages());
     // ── Merge-in seeding: ensure built-in presets exist ──────────────────────
     const existing = getConfig('presets') || {};
     let seeded = false;
@@ -174,6 +248,23 @@ export async function layoutsRoutes(fastify) {
         return {success: true};
     });
 
+    // ── Usage and the sidebar badge ──────────────────────────────────────────
+    const usageNow = async () => layoutUsage(getConfig('presets') || {}, await listPages().catch(() => []));
+
+    fastify.get('/layouts/_usage', canRead, async () => usageNow());
+
+    // Polled every minute from every open admin tab, and reading every page is not
+    // free: the answer is kept a minute (the screen's own _usage always reads afresh).
+    let badgeCache = {at: 0, key: '', value: null};
+    fastify.get('/layouts/_count', canRead, async () => {
+        const presets = getConfig('presets') || {};
+        const key = Object.keys(presets).sort().join('|');
+        if (!badgeCache.value || badgeCache.key !== key || Date.now() - badgeCache.at > 60_000) {
+            badgeCache = {at: Date.now(), key, value: layoutsBadge(presets, await usageNow())};
+        }
+        return badgeCache.value;
+    });
+
     // ── Layout options ────────────────────────────────────────────────────────
     fastify.get('/layouts/options', canRead, async () => {
         return getConfig('site')?.layoutOptions ?? {spacerSize: 8};