domma-cms 1.10.28 → 1.10.29

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## [1.10.29] - 2026-10-26
+
+- **Pro Tools open again on sites behind the Manager.** The admin's versioned-file check ran before the Manager handed a request to its site, so a site's request for a Tool's screen (Analytics Pro's dashboard, for one) was answered from the Manager's own copy of that plugin; where the two builds differ the fingerprint never matched and the screen 404'd. The check now runs after the plugins' hooks, so the site answers its own files.
+
 ## [1.10.28] - 2026-10-26
 
 - Admin pages and Tools have clearer section boundaries: stronger outlines, coloured header bands, icon tiles and a shaded canvas, all using the active theme palette. Settings and editor sections have distinct identities, and optional generated CSS and template-variable references fold away with keyboard-accessible controls.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "1.10.28",
+  "version": "1.10.29",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/server/server.js

@@ -166,7 +166,7 @@ if (publicCorsPrefixes.length) {
 await app.register(multipart, { limits: { fileSize: serverConfig.uploads.maxFileSize } });
 await app.register(rateLimit, rateLimitOptions());
 
-registerAdminAssets(app, {root: ROOT, dommaDist: DOMMA_DIST});
+const adminAssets = registerAdminAssets(app, {root: ROOT, dommaDist: DOMMA_DIST});
 // Text assets (scripts, stylesheets, SVG, JSON) from memory, compressed once
 // per encoding - services/assetCache.js. Its onSend hook must be added BEFORE
 // compress registers its own, so compress finds content-encoding set and
@@ -727,6 +727,8 @@ await registerCoreSources();
 (await import('./services/passwordReset.js')).registerPasswordChangeNotice({log: app.log});
 
 await registerPlugins(app);
+// After the plugins' onRequest hooks - see serve() in services/adminAssets.js.
+adminAssets.serve();
 
 // ---------------------------------------------------------------------------
 // Public Plugin Routes (root-level, before catch-all)

package/server/services/adminAssets.js

@@ -76,7 +76,10 @@ export function registerAdminAssets(app, {root, dommaDist, maxBytes = 16 * 1024
         app.get(url, async (_request, reply) => reply.header('Cache-Control', 'no-store')
             .type('text/html; charset=utf-8').send(await index()));
     }
-    app.addHook('onRequest', async (request, reply) => {
+    // Added by serve(), after the plugins: a plugin's onRequest hook that answers a request
+    // itself (site-manager proxying another site's host) must run before this one, or this
+    // answers from the manager's own files - a different build of the same plugin 404s.
+    const serve = () => app.addHook('onRequest', async (request, reply) => {
         if (!['GET', 'HEAD'].includes(request.method)) return;
         let url;
         try { url = new URL(request.raw.url, 'http://localhost'); } catch { return; }
@@ -113,5 +116,5 @@ export function registerAdminAssets(app, {root, dommaDist, maxBytes = 16 * 1024
         reply.removeHeader('content-length');
         return JSON.stringify(config);
     });
-    return {version};
+    return {version, serve};
 }