domma-cms 0.88.0 → 0.89.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "0.88.0",
+  "version": "0.89.0",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/plugins/blog/CLAUDE.md

@@ -165,6 +165,12 @@ with `?display=` and swaps the cards, since each display is different block mark
 
 ## Gotchas
 
+- **In the sitemap (1.9.0, core 0.89+).** `registerSitemapSource('blog')` lists the index and every public post at the
+  live base path (a post with `seo.noindex` is left out); a non-GET that succeeds on /posts, /settings or /samples calls
+  `sitemapChanged()`. Post pages pass `baseUrl` (canonical/og:url - they had none before), `noindex` and
+  `item: {type: 'blog:post', id}` to renderBlogPage, so the SEO plugin knows what it is tagging. PUT /posts/:id MERGES
+  `seo` (the editor sends title + description only; the SEO Tool may have set image/noindex/focus).
+
 - **Public handlers must RETURN the reply.** `reply.type(...).send(html)` without `return` in an
   async handler loses the body under @fastify/compress - every browser got a 200 with nothing in it,
   while curl (no Accept-Encoding) saw the page. `tests/public.test.js` drives gzip and brotli.

package/plugins/blog/plugin.js

@@ -291,6 +291,23 @@ export default async function blogPlugin(fastify, options) {
         registerEmbedShortcodes(options.hooks.registerShortcode, () => liveBase(settings));
     }
 
+    // The blog in /sitemap.xml (core 0.89+; feature-detected): the index and
+    // every public post, at the base path as it is saved now. A post marked
+    // "hide from search engines" (seo.noindex) is left out.
+    if (typeof options.hooks?.registerSitemapSource === 'function') {
+        options.hooks.registerSitemapSource({id: 'blog', label: 'Blog posts', list: async () => {
+            const base = liveBase(settings);
+            const posts = (await loadAll('blog-posts')).filter(p => isVisible(p) && p.seo?.noindex !== true);
+            return [{urlPath: base, title: 'Blog', changefreq: 'daily'},
+                ...posts.map(p => ({urlPath: `${base}/${encodeURIComponent(p.slug)}`, title: p.title || '',
+                    lastmod: p.updatedAt || p.publishedAt || null, ...(safeImageUrl(p.featuredImage) && {image: safeImageUrl(p.featuredImage)})}))];
+        }});
+        // A saved post, publish or setting changes the list: the sitemap is rebuilt on its next request.
+        fastify.addHook('onResponse', async (request, reply) => {
+            if (request.method !== 'GET' && reply.statusCode < 400 && /\/(posts|settings|samples)\b/.test(request.url)) options.hooks.sitemapChanged?.();
+        });
+    }
+
     // The layouts are blocks; put the shipped ones where the Blocks tool can
     // edit them. Once each, never over a site's own copy (lib/render.js).
     try {
@@ -487,6 +504,12 @@ export default async function blogPlugin(fastify, options) {
         }
 
         const merged  = { ...entry.data, ...postFields(request.body ?? {}, user) };
+        // `seo` is merged too: the editor sends title and description only, and
+        // must not wipe what the SEO Tool set (image, noindex, focus keyword...).
+        if (merged.seo && typeof merged.seo === 'object' && entry.data.seo && typeof entry.data.seo === 'object') {
+            merged.seo = {...entry.data.seo, ...merged.seo};
+            for (const [k, v] of Object.entries(merged.seo)) if (v === null) delete merged.seo[k];
+        }
 
         const updated = await updateEntry(POSTS_SLUG, id, merged);
         return reply.send(toPost(updated));

package/plugins/blog/plugin.json

@@ -1,11 +1,11 @@
 {
   "name": "blog",
   "displayName": "Blog",
-  "version": "1.8.0",
+  "version": "1.9.0",
   "tier": "free",
   "description": "Public-facing blog with posts, categories and comments - layouts and listings built from editable blocks.",
   "author": "Domma CMS",
-  "date": "2026-09-26",
+  "date": "2026-09-27",
   "icon": "file-text",
   "admin": {
     "css": [

package/plugins/blog/plugin.public.js

@@ -15,6 +15,7 @@
 import path from 'path';
 import {fileURLToPath} from 'url';
 import {renderBlogPage} from '../../server/services/renderer.js';
+import {getConfig} from '../../server/config.js';
 import {byNewest, escapeHtml, matchBlogPath, pickDisplay, safeImageUrl} from './lib/layouts.js';
 import {catalogue, renderCards} from './lib/render.js';
 import {authorNamesFor, isVisible, liveBase, liveSettings, loadEntries, renderPostPage, resolveAuthorName} from './lib/page.js';
@@ -49,6 +50,15 @@ function buildPagination(page, totalPages, basePath, query = '') {
     return `<nav class="blog-pagination" aria-label="Pages">${parts.join('')}</nav>`;
 }
 
+/**
+ * The site's own origin for canonical and og:url - as core's getBaseUrl():
+ * the Settings address when there is one, else the request's.
+ */
+function originOf(request) {
+    const set = String(getConfig('site')?.baseUrl || '').trim().replace(/\/+$/, '');
+    return set || `${request.protocol}://${request.host || request.headers.host || request.hostname}`;
+}
+
 /** JSON inside a <script> element, safe against `</script>` in any value. */
 function scriptJson(value) {
     return JSON.stringify(value).replace(/</g, '\\u003c');
@@ -121,7 +131,7 @@ ${items || ''}
                 pagination: interactive ? '' : buildPagination(safePage, totalPages, base, requested),
                 assetV: ASSET_V
             },
-            {title, urlPath: request.url.split('?')[0]}
+            {title, urlPath: request.url.split('?')[0], baseUrl: originOf(request)}
         );
         return reply.type('text/html').send(html);
     }
@@ -215,7 +225,10 @@ ${items}
                     ogImage: safeImageUrl(post.featuredImage),
                     ogType: 'article',
                     usedComponents: page.usedComponents,
-                    urlPath: `${base}/${slug}`
+                    urlPath: `${base}/${slug}`,
+                    baseUrl: originOf(request),
+                    noindex: post.seo?.noindex === true,
+                    item: {type: 'blog:post', id: post.id}
                 }
             );
             return reply.type('text/html').send(html);

package/plugins/free-tier.lock.json

@@ -1,11 +1,11 @@
 {
   "note": "Written by `make sync-free-tier` in dcms-marketplace. Do not edit these plugins here - edit them there and sync.",
-  "source": "dcms-marketplace@c07af11",
+  "source": "dcms-marketplace@466a485",
   "plugins": {
     "blog": {
-      "version": "1.8.0",
+      "version": "1.9.0",
       "files": {
-        "CLAUDE.md": "026438d4d93f5a637be16ac22d5131e8248e93d2df1bd9b30d5f1cfe357ba2cc",
+        "CLAUDE.md": "5f3260acc22f202ce3dd1a262a41d4a98016a71e05da8f95732dcd73b6e08e33",
         "admin/css/index.css": "6142a6b756e1218157842528830b1e84f592f0b84b7d5ce6449db421b6f4b039",
         "admin/templates/blog.html": "a6054c1febe764bb1edf5c9e466d44a9080d9c83ba5486437b7a8244acf5ba54",
         "admin/templates/categories.html": "ab7d6fc2fedd48876c585bc216a1532b3bdd78c946dee976c1171bfe4664feb6",
@@ -48,9 +48,9 @@
         "lib/page.js": "464face32871185368de096ed9a6aa635523bf319af6459308cfceb77d66f82c",
         "lib/render.js": "0e97c6a950bc962c8d8ea4b2f21d06cb73fbcdc738d8942d6935d01309a29b1d",
         "lib/samples.js": "e8cdb77ce22e43937707f6854d3a5cb722437dc584e22ac7b24480bef686cf85",
-        "plugin.js": "db93fd831f6ff6762c6768d47e658830b6284b6f4a9efd2bbffaab5966ba0361",
-        "plugin.json": "d6a254e9ec114cbc469e8e2b5a9ca33376c3f88e49c54d42ea589ac883e3dac3",
-        "plugin.public.js": "8efc1ff3a2ead68d36fbd545f8ce590f600b293896ba6f4947418b1efcdf2947",
+        "plugin.js": "a6e4442400594116c43aab1db706f0b9c2953e85699aa458709752c6c27fd781",
+        "plugin.json": "234c8067a4bf9f214667b5c99e05933c3321f0b8b35815a76e8ac8eacbbda857",
+        "plugin.public.js": "ab23fadd5655fab8eea0e636a3e1f8ced78432d6da929059a4a147f0805ff3a4",
         "public/blog.css": "fd733e6b624190da1e70dc1b6613e2376efd7f7570a28fab311d81006d03d960",
         "public/blog.js": "d01c72a9834dcc7c5241923371f2b164ac30d20ac9f1a5c5dc5b71fa3cb09f08",
         "public/samples/aurora.svg": "feb29e2b46465913fc29de9eda221b00b1541f1fa3ea7120f0c1d1cd11a9a4f6",
@@ -82,27 +82,47 @@
       }
     },
     "security": {
-      "version": "1.0.3",
+      "version": "1.1.0",
       "files": {
-        "CLAUDE.md": "a9b7574236740de80513a535fb761127fa306f2177a5dda6e761213b1ad5b287",
+        "CLAUDE.md": "dc6f8755b8e6cdcac69cd928654395cde794e5b698032c132ce83dede24acead",
         "admin/lib/blocks.js": "5ef346b7de751518f8beb9212e3b89b270ae236560ae3d8a1f40d129c50918ff",
         "admin/lib/health.js": "3b233a3d29b2d69c333321602c13233b8221cfe1114aa03903739d9ae8ad65d5",
         "admin/lib/ip.js": "cf33be4fa2e2cad37bafd12ebec17f293891a88de402caad1bf9c9a57ce87680",
         "admin/lib/lockout.js": "c5e5e4b2934296f81ae8ed013725485bc269a0ef3cf3bdf3c16c53936635a1ee",
         "admin/lib/policy.js": "a4aedfd28f992e0e7759bbdac6344681eebe617c27849e91fa4405f6190f8462",
         "admin/lib/probes.js": "d56318903cb645a39f56e7762eddb7411941a72e1f446c1f9d79e35157f1d31b",
-        "admin/lib/settings.js": "9b6c2fb3b54a1dcb642e3af6f584f93375f824fce67717a1ee56bebee9c35645",
-        "admin/templates/security.html": "e96060b4849a1ef7691a918b9a77aff05ea3a2182a6093001454d04eb58c648d",
-        "admin/views/security.js": "dcd38e07c5e83bbe013f5d764c52edef76d28ed4c3fe1cba8c5a59ce1b93e962",
+        "admin/lib/resets.js": "3724a2aec9f3c18ada96948aa6ce375ae3505bb7623a2c556e2e2670c5ca343c",
+        "admin/lib/settings.js": "b319953914f3a6f029ba991b36fe6fcd521956ea099578be42505f30e6c32faf",
+        "admin/templates/security.html": "df5798497ca1fd5ed200ce0ff921a055168ac7720f38b2db1bebf2c0efe71f04",
+        "admin/views/security.js": "280c1681f1aae6cf82a141e670d046c160c5f5fc3cb9de43f9d134a08b15a199",
         "bin/unlock.js": "5fcc3c0ef3ba3c424a366aa62896f51abad578183dfde283aa838a86549ca785",
         "config.js": "e6a00f7816637687d6a68ebbac65a71489246a926c28523c2a78d859e75b7ae0",
-        "plugin.js": "3051c886f77b1b1e7f45873fbdcd78a5ba2d72caea97bde1235e84a298ab6114",
-        "plugin.json": "bdcc88f0f5dec2d707806687ca80e1697255af49b4f30f43650e3824775deef8",
+        "plugin.js": "db5dc669a6a26bbe8756da59bdd04217e403be48012921b6d2b868cec57af489",
+        "plugin.json": "319d4333d03ed7d42ef9c2d0999befff7594343be963b6fee9c90bf7916ad142",
         "server/common-passwords.NOTICE": "3b148a49a569bfa24feaa7879db602da8f0607fa61ab6c52b7a62391fc7c009a",
         "server/common-passwords.txt": "68782d6a4a19a4768d5f15dd66bd534e7a33055cc755411e33f16d18c50fdcce",
         "server/facts.js": "25538a8d1cfe012688fceb8ec0d0dd7b43ac9e168430723d6fb731183701fb46",
         "server/state.js": "1319b322e94a4aec176948990b2d674b28dfece761eef4d5685df474037bfc4a",
-        "tests/security.test.js": "951636a0e42ac8dbf78b69ca7e7e2adcd4e29d94a51998e738c3afa742c00866"
+        "tests/security.test.js": "f0cb70dcb28bc8b3de8d3b39064616296382c5b0f97bfd615ee8e24fe3b031bc"
+      }
+    },
+    "seo": {
+      "version": "1.0.0",
+      "files": {
+        "CLAUDE.md": "c4b326afeacded36d076f96ec3554b6cd875087ea5c84b29dffb144059292ff7",
+        "admin/lib/analyse.js": "368b9e20bc1eac957870272ee6909b5f7c09ecf0a2fc2c344fb5cd85473f18cd",
+        "admin/lib/redirects.js": "a506ca40b712c3d8087d6698397b900fe5005ae6094f80dbc3f3091d5d9b6819",
+        "admin/lib/schema.js": "4313e0ed528562ee8b85c18479663c8216101f892848b44426baefc8d7c1c7e8",
+        "admin/lib/settings.js": "94e76c2960376f0cc0570128a7226af177f5de7ee115357e37baba45b1e05e19",
+        "admin/templates/seo.html": "e8684d98bd0649c001d7395b75b2bc3c74234f947d3dbda508ff4ecb91e20d1c",
+        "admin/views/seo.js": "b37774a5df642bdbdb6f7fb89b12dbc6d45d06d2b70bd2de7faf4c3098c26189",
+        "config.js": "d90f4cfb10b2f44b528de37522d31fd01351a6ebbab95556b5dfa2820d69e1a8",
+        "plugin.js": "3dd88bec75535349e6a748bae90fc49e54e2781c4765b9c8ff02898795ef476d",
+        "plugin.json": "6fe2fb5d50d37cc9749cf84db7ed59c5557a52c1b38f63c8e7bc1744065cd7d6",
+        "server/audit.js": "f51fcf9403ad40fde9e9ba5f31e58ed95fc2a5c8514c921146f23ee1ca2e0bd3",
+        "server/registry.js": "9336614bff3ab8b4fe9d50de074a9633307ab41c46fa62113ca82379cfad90a6",
+        "server/store.js": "3584ec3efd8a2d0ba8fd5be7e56d97cca76b5b2358a7dda99e379c42be67253c",
+        "tests/seo.test.js": "bdc52f2a9f8f02aaa0cb907f76f1acf8ff887034172e18d9ae108d3675b68f1a"
       }
     },
     "shopping-cart": {

package/plugins/security/CLAUDE.md

@@ -15,6 +15,13 @@ Ships with the engine (free tier, `make sync-free-tier`); switched ON when it fi
   MIT - see the NOTICE), not containing the name/email, not one or two characters repeated.
 - **Sign-in log**: `data/signins.jsonl`, kept `signinDays`; notifications (sources `security:lockouts`,
   `security:suspicious`, `security:probes` - the last off by default).
+- **Reset requests** (1.1.0; core 0.88's `auth:resetRequested`): each "Forgot your password?" is a `kind: 'reset'`
+  line in the same log (`ok` = a link was sent, `reason` = the core's outcome - `admin/lib/resets.js` RESET_REASONS).
+  Sign-ins › Resets lists them; the overview tile counts 24 h. `security:resets` (setting `notify.resetProbing`, on) is
+  raised when one address asks about 3 different accounts within an hour - ALL the core allows it (forgot-password is
+  rate-limited to 3 an hour per address, so a higher threshold never trips) - or when 10 requests within an hour, from
+  any addresses, name accounts that do not exist (someone rotating addresses). Anything counting sign-ins must skip
+  `kind: 'reset'` lines - their `ok` is not a sign-in. Older engines never emit the event: nothing changes there.
 - **Health check**: `server/facts.js` gathers (users, engine vs npm latest, certificate via tls, security headers of the
   public home page, private paths fetched LOCALLY, TRUST_PROXY, bind, SMTP, licences); `admin/lib/health.js` judges.
   Unknown = 'info', never a pass. Cached 10 min; the sidebar badge (`/count`) = checks needing attention, red only

package/plugins/security/admin/lib/resets.js

@@ -0,0 +1,82 @@
+/**
+ * Security - password reset requests (core's auth:resetRequested, 0.88). Pure.
+ *
+ * Each "Forgot your password?" goes into the sign-in log as `kind: 'reset'`.
+ * One address asking for resets of many different accounts is someone trying
+ * addresses, or trying to fill inboxes - that is what `recordReset` watches.
+ */
+
+/** What became of a request, as the core reports it in `reason`. */
+export const RESET_REASONS = {
+    sent: 'Link sent',
+    unknown: 'No such account',
+    inactive: 'Account switched off',
+    throttled: 'Held back - 3 an hour already',
+    'no-smtp': 'Not sent - no mail server',
+    'no-origin': 'Not sent - no Site URL',
+    failed: 'Email failed'
+};
+
+/**
+ * When it is worth telling someone. The core lets one address ask 3 times an hour
+ * (a route rate limit), and a person only ever asks about their own account - so
+ * one address using all 3 on different accounts is trying addresses. Someone
+ * rotating addresses gets past that, which is what the site-wide count of
+ * requests for accounts that do not exist is for.
+ */
+export const RESET_PROBE = {threshold: 3, windowMin: 60};
+export const RESET_UNKNOWN = {threshold: 10, windowMin: 60};
+
+/**
+ * Note a reset request from an address and say whether it has just crossed the
+ * line: `threshold` different accounts within `windowMin`. Mutates `recent`
+ * (a Map of address -> [{at, email}]), dropping what is older than the window.
+ *
+ * @returns {{accounts: number, tripped: boolean}} tripped only on the request that reaches the threshold
+ */
+export function recordReset(recent, ip, email, {now = Date.now(), threshold = RESET_PROBE.threshold, windowMin = RESET_PROBE.windowMin} = {}) {
+    if (!ip) return {accounts: 0, tripped: false};
+    const since = now - windowMin * 60_000;
+    const list = (recent.get(ip) || []).filter(r => r.at >= since);
+    const before = new Set(list.map(r => r.email)).size;
+    list.push({at: now, email: String(email || '').trim().toLowerCase()});
+    recent.set(ip, list);
+    const accounts = new Set(list.map(r => r.email)).size;
+    return {accounts, tripped: accounts >= threshold && before < threshold};
+}
+
+/**
+ * Note a request for an account that does not exist, from any address, and say
+ * whether the site has just reached `threshold` of them within `windowMin`.
+ * Mutates `stamps` (an array of times).
+ *
+ * @returns {{count: number, tripped: boolean}} tripped only on the request that reaches the threshold
+ */
+export function recordUnknown(stamps, {now = Date.now(), threshold = RESET_UNKNOWN.threshold, windowMin = RESET_UNKNOWN.windowMin} = {}) {
+    const since = now - windowMin * 60_000;
+    const keep = stamps.filter(t => t >= since);
+    stamps.length = 0;
+    stamps.push(...keep, now);
+    return {count: stamps.length, tripped: stamps.length === threshold};
+}
+
+/** Forget site-wide stamps older than the window. Mutates `stamps`. */
+export function pruneUnknown(stamps, {now = Date.now(), windowMin = RESET_UNKNOWN.windowMin} = {}) {
+    const keep = stamps.filter(t => t >= now - windowMin * 60_000);
+    stamps.length = 0;
+    stamps.push(...keep);
+}
+
+/** Forget addresses with nothing inside the window. */
+export function pruneResets(recent, {now = Date.now(), windowMin = RESET_PROBE.windowMin} = {}) {
+    const since = now - windowMin * 60_000;
+    for (const [ip, list] of recent) {
+        const keep = list.filter(r => r.at >= since);
+        if (keep.length) recent.set(ip, keep); else recent.delete(ip);
+    }
+}
+
+/** One log entry as the Sign-ins list shows it. */
+export function resetRowText(e) {
+    return {okText: 'Reset asked', tone: 'reset', note: RESET_REASONS[e.reason] || e.reason || (e.ok ? 'Link sent' : 'Not sent')};
+}

package/plugins/security/admin/lib/settings.js

@@ -11,7 +11,7 @@ export const DEFAULT_SETTINGS = {
     probes: {enabled: true, blockAfter: 5, withinMin: 10, blockForMin: 60, extra: [], allow: []},
     signinDays: 30,
     staleAdminDays: 90,
-    notify: {lockouts: true, successAfterFails: true, probeBlocks: false}
+    notify: {lockouts: true, successAfterFails: true, probeBlocks: false, resetProbing: true}
 };
 
 const int = (v, min, max) => {

package/plugins/security/admin/templates/security.html

@@ -22,6 +22,7 @@
             <div class="scx-card scx-tile"><small>Failed sign-ins, 24h <span data-help="Failed sign-ins in the last 24 hours: a wrong password, an unknown email, a locked account."></span></small><strong data-bind-text="ov.value.failed">—</strong></div>
             <div class="scx-card scx-tile"><small>Blocked now <span data-help="Addresses blocked by a rule or for probing, and accounts or addresses locked after wrong passwords."></span></small><strong data-bind-text="ov.value.blocked">—</strong></div>
             <div class="scx-card scx-tile"><small>Probes refused today <span data-help="Requests for things no Domma site has - WordPress logins, .env files, database dumps. Scanners send them to every site they find; they are answered with an empty 'not found'."></span></small><strong data-bind-text="ov.value.probes">—</strong></div>
+            <div class="scx-card scx-tile"><small>Reset requests, 24h <span data-help="&quot;Forgot your password?&quot; requests in the last 24 hours, sent or not. Sign-ins › Resets lists them, with what happened and where from."></span></small><strong data-bind-text="ov.value.resets">—</strong></div>
         </div>
 
         <div class="scx-card">
@@ -41,6 +42,7 @@
                 <button type="button" data-on-click="res_all" data-bind-class="result.value === 'all' && 'is-on'">All</button>
                 <button type="button" data-on-click="res_failed" data-bind-class="result.value === 'failed' && 'is-on'">Failed</button>
                 <button type="button" data-on-click="res_ok" data-bind-class="result.value === 'ok' && 'is-on'">Succeeded</button>
+                <button type="button" data-on-click="res_resets" data-bind-class="result.value === 'resets' && 'is-on'">Resets</button>
             </div>
             <select class="form-input scx-days" aria-label="Period" data-model="days.value">
                 <option value="1">Last 24 hours</option><option value="7">Last 7 days</option><option value="30">Last 30 days</option><option value="365">All kept</option>
@@ -150,6 +152,7 @@
 .scx-cell { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 .scx-pill { display: inline-flex; align-items: center; justify-self: start; font-size: var(--dm-text-xs); font-weight: 600; padding: .05rem .5rem; border-radius: 999px; }
 .scx-pill[data-ok="true"] { color: var(--dm-success); background: color-mix(in srgb, var(--dm-success) 14%, transparent); }
+.scx-pill[data-ok="reset"] { color: var(--dm-info); background: color-mix(in srgb, var(--dm-info) 14%, transparent); }
 .scx-pill[data-ok="false"] { color: var(--dm-danger); background: color-mix(in srgb, var(--dm-danger) 12%, transparent); }
 .scx-kebab { border: 0; background: none; cursor: pointer; font-size: var(--dm-text-lg); line-height: 1; color: var(--dm-text-muted); border-radius: var(--dm-radius-sm); padding: 0 .25rem; }
 .scx-kebab:hover { color: var(--dm-primary); }

package/plugins/security/admin/views/security.js

@@ -10,6 +10,7 @@
  * only, and rows are addressed by index.
  * `#/plugins/security/<tab>` opens a tab. Pure logic: ../lib/*.js.
  */
+import {resetRowText} from '../lib/resets.js';
 import {checkSettings, DEFAULT_SETTINGS, mergeDefaults} from '../lib/settings.js';
 import {ipRuleValid} from '../lib/ip.js';
 
@@ -152,7 +153,8 @@ export const securityView = {
         const asOf = M.computed(() => (health.value?.at ? `Checked ${new Date(health.value.at).toLocaleTimeString('en-GB', {hour: '2-digit', minute: '2-digit'})}` : ''));
         const ov = M.computed(() => {
             const o = overview.value;
-            return o ? {failed: String(o.failed24h), blocked: String(o.blocked + o.locks), probes: String(o.today?.probes || 0)} : {failed: '—', blocked: '—', probes: '—'};
+            return o ? {failed: String(o.failed24h), blocked: String(o.blocked + o.locks), probes: String(o.today?.probes || 0), resets: String(o.resets24h ?? 0)}
+                : {failed: '—', blocked: '—', probes: '—', resets: '—'};
         });
         const blockedCount = M.computed(() => { const b = blocks.value; const n = b.rules.length + b.temp.length + b.locks.length; return n ? String(n) : ''; });
 
@@ -185,18 +187,25 @@ export const securityView = {
             const q = query.value.trim().toLowerCase();
             const r = result.value;
             const only = ipFilter.value;
-            signinList = signins.value.filter(e => (r === 'all' || (r === 'ok') === Boolean(e.ok))
+            // A reset request is in the log too (kind 'reset'): only under All and Resets.
+            const isReset = (e) => e.kind === 'reset';
+            signinList = signins.value.filter(e => (r === 'all' || (r === 'resets' ? isReset(e) : !isReset(e) && (r === 'ok') === Boolean(e.ok)))
                 && (!only || e.ip === only)
                 && (!q || [e.email, e.ip, e.ua, e.reason].some(v => String(v || '').toLowerCase().includes(q))));
-            signinRows.value = signinList.slice(0, 1000).map((e, i) => ({
-                id: `s${i}`, when: when(e.at), ok: String(Boolean(e.ok)), okText: e.ok ? 'Signed in' : 'Failed',
-                email: e.email || '—', ip: e.ip || '—', ua: e.ua || '',
-                note: e.ok ? browserOf(e.ua) : `${REASONS[e.reason] || e.reason || 'Failed'} · ${browserOf(e.ua)}`
-            }));
+            signinRows.value = signinList.slice(0, 1000).map((e, i) => {
+                const row = {id: `s${i}`, when: when(e.at), email: e.email || '—', ip: e.ip || '—', ua: e.ua || ''};
+                if (isReset(e)) {
+                    const t = resetRowText(e);
+                    return {...row, ok: t.tone, okText: t.okText, note: `${t.note} · ${browserOf(e.ua)}`};
+                }
+                return {...row, ok: String(Boolean(e.ok)), okText: e.ok ? 'Signed in' : 'Failed',
+                    note: e.ok ? browserOf(e.ua) : `${REASONS[e.reason] || e.reason || 'Failed'} · ${browserOf(e.ua)}`};
+            });
         }));
         const signinText = M.computed(() => {
             const n = signinList.length + 0 * signinRows.value.length;
             const f = ipFilter.value ? ` from ${ipFilter.value}` : '';
+            if (result.value === 'resets') return `${n.toLocaleString('en-GB')} reset request${n === 1 ? '' : 's'}${f}`;
             return `${n.toLocaleString('en-GB')} sign-in${n === 1 ? '' : 's'}${f}`;
         });
         const signinEmpty = M.computed(() => (query.value.trim() || ipFilter.value ? 'No sign-ins match.' : 'No sign-ins in this period.'));
@@ -280,7 +289,9 @@ export const securityView = {
         }
         function exportCsv() {
             if (!signinList.length) { E.toast('Nothing to export.', {type: 'info'}); return; }
-            const rows = signinList.map(e => ({time: e.at, result: e.ok ? 'signed in' : 'failed', email: e.email, address: e.ip, reason: e.ok ? '' : (REASONS[e.reason] || e.reason || ''), browser: e.ua}));
+            const rows = signinList.map(e => (e.kind === 'reset'
+                ? {time: e.at, result: 'reset requested', email: e.email, address: e.ip, reason: resetRowText(e).note, browser: e.ua}
+                : {time: e.at, result: e.ok ? 'signed in' : 'failed', email: e.email, address: e.ip, reason: e.ok ? '' : (REASONS[e.reason] || e.reason || ''), browser: e.ua}));
             const url = URL.createObjectURL(new Blob([toCsv(rows)], {type: 'text/csv;charset=utf-8'}));
             const a = Object.assign(document.createElement('a'), {href: url, download: `sign-ins-${location.hostname}-${new Date().toISOString().slice(0, 10)}.csv`});
             document.body.appendChild(a); a.click(); a.remove();
@@ -385,14 +396,14 @@ export const securityView = {
                 probeOn: M.observable(s.probes.enabled), after: M.observable(String(s.probes.blockAfter)), within: M.observable(String(s.probes.withinMin)), forMin: M.observable(String(s.probes.blockForMin)),
                 extra: M.observable(s.probes.extra.join('\n')), allow: M.observable(s.probes.allow.join('\n')),
                 signinDays: M.observable(String(s.signinDays)), staleDays: M.observable(String(s.staleAdminDays)),
-                nLock: M.observable(s.notify.lockouts), nAfter: M.observable(s.notify.successAfterFails), nProbe: M.observable(s.notify.probeBlocks)
+                nLock: M.observable(s.notify.lockouts), nAfter: M.observable(s.notify.successAfterFails), nProbe: M.observable(s.notify.probeBlocks), nReset: M.observable(s.notify.resetProbing)
             };
             const body = () => ({
                 lockout: {enabled: f.lockOn.value, accountThreshold: f.acc.value, addressThreshold: f.addr.value, windowMin: f.win.value, baseMin: f.base.value, maxMin: f.max.value},
                 policy: {enabled: f.polOn.value, minLength: f.minLen.value, blockCommon: f.common.value, blockPersonal: f.personal.value},
                 probes: {enabled: f.probeOn.value, blockAfter: f.after.value, withinMin: f.within.value, blockForMin: f.forMin.value, extra: f.extra.value, allow: f.allow.value},
                 signinDays: f.signinDays.value, staleAdminDays: f.staleDays.value,
-                notify: {lockouts: f.nLock.value, successAfterFails: f.nAfter.value, probeBlocks: f.nProbe.value}
+                notify: {lockouts: f.nLock.value, successAfterFails: f.nAfter.value, probeBlocks: f.nProbe.value, resetProbing: f.nReset.value}
             });
             const opened = JSON.stringify(body());
             const saving = M.observable(false);
@@ -436,6 +447,7 @@ export const securityView = {
                         ${sw('nLock', 'Notify when an account or address is locked')}
                         ${sw('nAfter', 'Notify when someone signs in after many wrong passwords')}
                         ${sw('nProbe', 'Notify when a scanner is blocked', 'Off by default: on a public site this happens daily.')}
+                        ${sw('nReset', 'Notify when password resets look like someone trying addresses', 'One address asking about 3 different accounts within an hour (a person only asks about their own), or 10 requests in an hour for accounts that do not exist, from anywhere. Every request is in the sign-in log either way.')}
                     </div></section>
                     <section><h4>Locked out yourself?</h4>
                         <p class="scx-note">Run this in the site's folder on the server - it clears lockouts and blocks, and the site notices within seconds:</p>
@@ -499,6 +511,7 @@ export const securityView = {
         const model = {tab, loading, error, checksOk, canManage, scoreText, scoreWidth, scoreTone, attentionText, asOf, ov, blockedCount, checks,
             result, days, query, signinRows, signinText, signinEmpty, lockRows, tempRows, ruleRows, newRule, newNote, youText};
         const methods = {
+            res_resets: () => { result.value = 'resets'; },
             tab_overview: () => setTab('overview'), tab_signins: () => setTab('signins'), tab_blocked: () => setTab('blocked'),
             res_all: () => { result.value = 'all'; }, res_failed: () => { result.value = 'failed'; }, res_ok: () => { result.value = 'ok'; },
             exportCsv,

package/plugins/security/plugin.js

@@ -31,6 +31,7 @@ import {checkSettings, mergeDefaults} from './admin/lib/settings.js';
 import {accountKey, activeLocks, addressKey, lockedUntil, pruneLockouts, recordFailure, recordSuccess, retryText} from './admin/lib/lockout.js';
 import {passwordProblems} from './admin/lib/policy.js';
 import {isProbe} from './admin/lib/probes.js';
+import {pruneResets, pruneUnknown, recordReset, recordUnknown} from './admin/lib/resets.js';
 import {blockedBy, isTrusted, pruneBlocks, recordProbe} from './admin/lib/blocks.js';
 import {ipRuleValid, isLoopbackIp, plainIp} from './admin/lib/ip.js';
 import {getConfig, saveConfig} from '../../server/config.js';
@@ -72,6 +73,7 @@ async function security(fastify, options = {}) {
     const notify = (p) => { try { hooks.notify?.(p); } catch { /* notifications are a courtesy */ } };
     hooks.registerNotificationSource?.({id: 'lockouts', label: 'Sign-in lockouts', description: 'An account or address was locked after repeated wrong passwords.', severity: 'warning', audience: 'admins'});
     hooks.registerNotificationSource?.({id: 'suspicious', label: 'Suspicious sign-ins', description: 'Someone signed in after many wrong passwords.', severity: 'warning', audience: 'admins'});
+    hooks.registerNotificationSource?.({id: 'resets', label: 'Password reset probing', description: 'One address asked for password resets of many different accounts.', severity: 'warning', audience: 'admins'});
     hooks.registerNotificationSource?.({id: 'probes', label: 'Scanners blocked', description: 'An address probing for weaknesses was blocked.', severity: 'info', audience: 'admins', defaultOn: false});
 
     // ---------------------------------------------------------------------
@@ -161,6 +163,38 @@ async function security(fastify, options = {}) {
         }
     });
 
+    // Password reset requests (core 0.88's auth:resetRequested): into the
+    // sign-in log, and a notice when one address asks about many accounts.
+    const recentResets = new Map();
+    const unknownResets = [];
+    hooks.on?.('auth:resetRequested', (e) => {
+        try {
+            const ip = plainIp(e.ip);
+            state.logSignin({at: new Date().toISOString(), kind: 'reset', ok: Boolean(e.sent), email: e.email || '', userId: e.userId || null,
+                ip, ua: e.ua || '', reason: e.reason || ''});
+            if (isLoopbackIp(ip)) return;
+            if (e.reason === 'unknown') {
+                const many = recordUnknown(unknownResets);
+                if (many.tripped && cfg.notify.resetProbing !== false) {
+                    notify({source: 'resets', severity: 'warning', title: `${many.count} password resets for accounts that do not exist`,
+                        dedupeKey: 'reset-unknown',
+                        body: `Within the hour, ${many.count} "Forgot your password?" requests named accounts this site does not have, from ${new Set(state.readSignins(Date.now() - 3_600_000).filter(x => x.kind === 'reset' && x.reason === 'unknown').map(x => x.ip)).size || 'several'} addresses - someone trying email addresses. The sign-in log (Resets) shows which.`,
+                        link: '#/plugins/security/signins'});
+                }
+            }
+            if (!ip) return;
+            const {accounts, tripped} = recordReset(recentResets, ip, e.email);
+            if (tripped && cfg.notify.resetProbing !== false) {
+                notify({source: 'resets', severity: 'warning', title: `Password resets asked for ${accounts} accounts from ${ip}`,
+                    dedupeKey: `reset-probe:${ip}`,
+                    body: `${ip} asked for password resets of ${accounts} different accounts within the hour - a person only ever asks about their own, so this is someone trying email addresses. The log shows which; block the address if it is not someone you know.`,
+                    link: '#/plugins/security/signins'});
+            }
+        } catch (err) {
+            log.warn(`[security] reset request not recorded: ${err.message}`);
+        }
+    });
+
     hooks.on?.('auth:loginSucceeded', (e) => {
         try {
             const ip = plainIp(e.ip);
@@ -217,12 +251,14 @@ async function security(fastify, options = {}) {
         routes.get('/overview', may('read'), async () => {
             const s = state.get();
             const now = Date.now();
-            const day = state.readSignins(now - 86_400_000);
+            const all = state.readSignins(now - 86_400_000);
+            const day = all.filter(e => e.kind !== 'reset');
             const today = s.counters.day === new Date().toISOString().slice(0, 10) ? s.counters : {probes: 0, blocks: 0, failed: 0};
             return {
                 today,
                 failed24h: day.filter(e => !e.ok).length,
                 succeeded24h: day.filter(e => e.ok).length,
+                resets24h: all.length - day.length,
                 locks: activeLocks(s.lockouts, now).length,
                 blocked: Object.values(s.temp).filter(t => t.until > now).length + s.rules.length,
                 checks: canCheck,
@@ -302,6 +338,8 @@ async function security(fastify, options = {}) {
     // ---------------------------------------------------------------------
     const tidy = () => {
         state.change((s) => { pruneLockouts(s.lockouts, {windowMin: cfg.lockout.windowMin}); pruneBlocks(s); });
+        pruneResets(recentResets);
+        pruneUnknown(unknownResets);
         state.pruneSignins(cfg.signinDays);
     };
     const daily = setInterval(tidy, 6 * 3_600_000);

package/plugins/security/plugin.json

@@ -1,11 +1,11 @@
 {
   "name": "security",
   "displayName": "Security",
-  "version": "1.0.3",
+  "version": "1.1.0",
   "tier": "free",
   "description": "Keeps a Domma CMS site safe: a health check of what is weak and how to fix it, sign-in lockout after repeated wrong passwords, password rules, a log of every sign-in, and blocking of the scanners that probe every site for WordPress, .env files and the like.",
   "author": "Domma CMS",
-  "date": "2026-09-26",
+  "date": "2026-09-27",
   "icon": "shield",
   "permissions": [
     {

package/plugins/security/tests/security.test.js

@@ -132,3 +132,37 @@ test('health: facts become checks; unknown is info, never a pass; the score coun
     assert.equal(unknown.checks.find(c => c.id === 'certificate').status, 'info');
     assert.equal(unknown.checks.find(c => c.id === 'headers').status, 'info');
 });
+
+test('resets: one address asking about 3 different accounts in an hour trips once', async () => {
+    const {recordReset, pruneResets, resetRowText} = await import('../admin/lib/resets.js');
+    const recent = new Map();
+    const now = Date.now();
+    const at = (m) => ({now: now + m * MIN});
+    assert.deepEqual(recordReset(recent, '1.2.3.4', 'a@x.test', at(0)), {accounts: 1, tripped: false});
+    // The same account again is not another account.
+    assert.equal(recordReset(recent, '1.2.3.4', 'A@x.test', at(1)).accounts, 1);
+    assert.equal(recordReset(recent, '1.2.3.4', 'b@x.test', at(2)).tripped, false);
+    assert.deepEqual(recordReset(recent, '1.2.3.4', 'c@x.test', at(3)), {accounts: 3, tripped: true});
+    assert.equal(recordReset(recent, '1.2.3.4', 'd@x.test', at(4)).tripped, false, 'only on crossing');
+    // Another address is counted on its own; an hour later the first starts again.
+    assert.equal(recordReset(recent, '5.6.7.8', 'a@x.test', at(5)).accounts, 1);
+    assert.equal(recordReset(recent, '1.2.3.4', 'z@x.test', at(70)).accounts, 1);
+    pruneResets(recent, {now: now + 200 * MIN});
+    assert.equal(recent.size, 0);
+    assert.equal(recordReset(recent, '', 'a@x.test').tripped, false);
+    assert.equal(resetRowText({reason: 'no-smtp'}).note, 'Not sent - no mail server');
+    assert.equal(resetRowText({reason: 'odd'}).note, 'odd');
+});
+
+test('resets: 10 requests for unknown accounts in an hour, from anywhere, trip once', async () => {
+    const {recordUnknown, pruneUnknown} = await import('../admin/lib/resets.js');
+    const stamps = [];
+    const now = Date.now();
+    for (let i = 0; i < 9; i++) assert.equal(recordUnknown(stamps, {now: now + i * MIN}).tripped, false);
+    assert.deepEqual(recordUnknown(stamps, {now: now + 9 * MIN}), {count: 10, tripped: true});
+    assert.equal(recordUnknown(stamps, {now: now + 10 * MIN}).tripped, false, 'only on reaching it');
+    // An hour on, the early ones have gone.
+    assert.equal(recordUnknown(stamps, {now: now + 65 * MIN}).count, 7, 'minutes 5-10 still inside the hour, and this one');
+    pruneUnknown(stamps, {now: now + 200 * MIN});
+    assert.equal(stamps.length, 0);
+});

package/plugins/seo/CLAUDE.md

@@ -0,0 +1,48 @@
+# SEO (free) - AI Assistant Guide
+
+How the site looks to search engines, and what to fix. Free tier (`make sync-free-tier` ships it with the engine).
+SEO Pro (paid) is an ADD-ON (`requires: ["seo"]`, no supersedes) that plugs in through `server/registry.js`.
+Social (paid, planned) will be its own plugin, sold with SEO Pro.
+
+Needs core 0.89 for: `hooks.registerSitemapSource` / `sitemapChanged`, and the `seo:meta`, `sitemap:entries`,
+`robots:lines` transforms (core `renderer.js` buildSeoMeta/renderSeoTags, `sitemap.js`). On an older engine the plugin
+logs it, the screen says so, and the audit, editor and redirects still work (`hasCore` in plugin.js).
+
+## What it does
+- **Audit** (`server/audit.js`): every sitemap URL (`listSitemapEntries`) plus published pages kept out of it, fetched
+  IN-PROCESS with `fastify.inject` (UA `DommaSEO/1 (audit)`, header `x-domma-seo: audit` - analytics / SEO Pro skip
+  those), judged by `admin/lib/analyse.js` (pure: `scanHtml` regex scanner - no DOM, `analyse`, `siteIssues`, `snippet`).
+  Every `audit.everyHours` (first run 3 min after start if stale), or POST /audit. Kept in `data/audit.json`.
+- **Editor per URL** (GET/PUT /item): a core page is edited IN PLACE (`updatePage(path, {seo})`, empty -> null so core's
+  merge removes the key); anything else (a blog post) gets an override in `data/overrides.json`, applied by the
+  `seo:meta` transform (`admin/lib/schema.js applySeo`). Fields: title, description, image, noindex, focus.
+- **Redirects** (`admin/lib/redirects.js`, pure): exact and "/prefix/*" rules, 301/302/307/308/410, query kept, no
+  loops (checkRule follows the chain), `onMoved` on core's `content:pageRenamed` re-aims older rules (no chains) and
+  drops a rule FROM the new address. Guard = global `onRequest` (fastify-plugin), GET/HEAD, never /api or /admin.
+  Hits counted in memory, saved each minute.
+- **Sitemap/robots**: `sitemap:entries` drops excluded paths, switched-off sources, overridden noindex and redirected
+  addresses; `robots:lines` adds rules (plain rules into the `*` group; `User-agent:` blocks as their own groups) or
+  blocks everything. JSON-LD: Organization/LocalBusiness/Person on `/`, BlogPosting when `page.item.type === 'blog:post'`.
+
+## Data (plugins/seo/data - kept by updates, never bundled)
+`redirects.json`, `overrides.json`, `audit.json` - in memory (the guard and transform run on every request), debounced
+writes, re-read within ~3 s when changed on disk (`server/store.js`).
+
+## Permission
+`seo` (read / manage), granted to admin. Routes: /overview /count /audit (GET, POST) /item (GET, PUT) /redirects
+(GET, POST, PUT/:id, DELETE/:id - ids comma-separated) /redirects/import /redirects/test /sitemap /settings /extensions.
+
+## Extensions (SEO Pro)
+`globalThis[Symbol.for('domma.seo')]` (`server/registry.js`): `register(owner, {label, tabs})`, `on('audit', fn)`,
+`services` {settings, listEntries, auditList, fetchPage, scanHtml, analyse, audit {latest, summary, run},
+redirects {list, match, add}, auditUserAgent}. Tabs: `{key, label, icon, module, help}`; `module` is a
+`/plugins/<slug>/...` URL exporting `mount(root, ctx)` -> dispose; ctx = {kit, api, scope, here, openItem, reload, E, M, I}.
+
+## Admin
+`admin/views/seo.js` + `admin/templates/seo.html` (prefix `sox-`): Pages (the audit + "Across the site"), Redirects,
+Sitemap, extension tabs; page editor slideover (search result + share card previews, meters, checks); settings
+slideover. Rows by index, text through data-bind-text only.
+
+## Tests
+`tests/seo.test.js` (pure). Headless: throwaway CMS from a clean domma-cms worktree with plugins/seo + blog copied in;
+puppeteer-core + ~/.cache/ms-playwright chromium_headless_shell for screenshots.