domma-cms 1.10.29 → 1.10.31

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [1.10.31] - 2026-10-26
+
+- **Plugins can fetch user-chosen addresses safely.** `hooks.safeFetch(url, opts)` hands plugins the CMS's own outbound guard: public addresses only, the connection pinned to the checked address, redirects re-checked, ports 80 and 443, and the site's `outboundAllowPrivate` rule (ignored on hosted sites). Through the hook a plugin cannot pass in its own policy or resolver, and may raise the size, time and redirect limits only to 25 MB, 60 s and 5. It guards against plugin mistakes; on hosted sites plugin signing is what keeps out hostile code.
+
+## [1.10.30] - 2026-10-26
+
+- Admin navigation keeps My Profile in the top account menu, removing its redundant System entry. Search defaults to Content, and existing System entries move there once while retaining saved settings and renamed folders.
+
 ## [1.10.29] - 2026-10-26
 
 - **Pro Tools open again on sites behind the Manager.** The admin's versioned-file check ran before the Manager handed a request to its site, so a site's request for a Tool's screen (Analytics Pro's dashboard, for one) was answered from the Manager's own copy of that plugin; where the two builds differ the fingerprint never matched and the screen 404'd. The check now runs after the plugins' hooks, so the site answers its own files.

package/CLAUDE.md

@@ -132,7 +132,7 @@ Collection entry I/O is delegated to a storage adapter. Schema management is alw
   `$graphLookup`, server-state stages, a `$lookup` not into a site `cms_<slug>` collection) and `__proto__`/`constructor`/
   `prototype`. A new path that hands user input to `find`/`aggregate` must go through one of the two
 - **Outbound requests to user-chosen URLs go through `services/outbound.js` `safeFetch()`** (Actions' webhook step,
-  form webhooks; plugins fetching a user's URL should too) - never bare `fetch`. Public addresses only after DNS, the
+  form webhooks; plugins use `hooks.safeFetch` - `pluginSafeFetch()`, which drops any policy/resolver they pass) - never bare `fetch`. Public addresses only after DNS, the
   connection pinned to the checked address, never this server's own addresses, redirects re-checked, ports 80/443.
   `server.json` `outboundAllowPrivate` (`true` or a list of hosts/addresses/CIDRs) lifts it for self-hosters and is
   ignored when `codePolicy.signedOnly()`. `wpImport/fetch.js` shares its address rules and pinned request

package/admin/js/lib/sidebar-grouping.js

@@ -1 +1 @@
-import{isPathAllowed as F}from"./admin-scope.js";export const TOOLS_FOLDER_TEXT="Tools",MANAGE_PLUGINS_URL="#/plugins",MANAGE_PLUGINS_ITEM={text:"Marketplace",url:MANAGE_PLUGINS_URL,icon:"store",permission:"plugins"};export function stripItemByUrl(e,t){const n=[];for(const r of e||[]){if(!r||r.url===t)continue;const s={...r};Array.isArray(r.items)&&r.items.length&&(s.items=stripItemByUrl(r.items,t)),n.push(s)}return n}export function managePluginsItem(){return{...MANAGE_PLUGINS_ITEM}}export const TOOLS_FOLDER_KEY="tools";const E=["countUrl","core","permission"],c=e=>String(e??"").toLowerCase();export function slugify(e){return c(e).trim().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")}export function groupKeyFor(e,t){return`${c(e)}.${slugify(t)}`}export const GROUP_ICON="folder";const P=e=>e&&(e.type==="separator"||e.type==="spacer"||e.type==="theme-switcher"),A=e=>e&&!P(e)&&!e.url;function w(e){return(e||[]).filter(Boolean).map(t=>Array.isArray(t.items)?{...t,items:w(t.items)}:{...t})}function M(e,t,n=[]){for(const r of e||[]){if(!r)continue;if(t(r))return[...n,r];const s=M(r.items,t,[...n,r]);if(s)return s}return null}function I(e,t,n=[],r=[]){for(const s of e||[])s&&(t(s)&&r.push([...n,s]),I(s.items,t,[...n,s],r));return r}const U=e=>!e.some(t=>t.hidden||t.restricted);function $(e,t){for(const n of e||[]){if(t(n))return n;const r=$(n?.items,t);if(r)return r}return null}export function findFolder(e,t){if(!t)return null;const n=c(t);return $(e,r=>A(r)&&c(r.key)===n)||$(e,r=>A(r)&&!r.key&&c(r.text)===n)}function b(e,t){const n={...t,...e};for(const r of E)t[r]!==void 0&&(n[r]=t[r]);return!(Array.isArray(e.items)&&e.items.length)&&Array.isArray(t.items)&&(n.items=t.items),e.text||(n.text=t.text),!e.icon&&t.icon&&(n.icon=t.icon),delete n.ref,delete n.folder,delete n.group,n}function O(e,{persisted:t,orphan:n=!1,node:r=null}){const s=e?.item||{};return{persisted:t,orphan:n,source:s.source||(s.core?"Built in":""),folder:e?.folder||TOOLS_FOLDER_KEY,defaults:n?{text:null,icon:null}:{text:s.text||"",icon:s.icon||""},...n&&r&&{label:r.text||r.url},...(e?.group||e?.item?.group)&&{group:e.group||e.item.group}}}export function placeTools(e,t,{forEditor:n=!1}={}){const r=w(e),s=(t||[]).filter(o=>o&&o.item&&typeof o.item.text=="string"),m=new Map;for(const o of s)o.item.url&&!m.has(o.item.url)&&m.set(o.item.url,o);const y=new Set,d=o=>{const i=[];for(const u of o){const h=u.url?m.get(u.url):null;if(h&&!y.has(u.url)){y.add(u.url);const g=b(u,h.item);Array.isArray(u.items)&&u.items.length?g.items=d(u.items):n&&(g.items=[]),n&&(g.$tool=O(h,{persisted:!0})),i.push(g);continue}if(u.ref){if(!n)continue;const{ref:g,...f}=u;i.push({...f,items:d(u.items||[]),$tool:O(null,{persisted:!0,orphan:!0,node:u})});continue}Array.isArray(u.items)&&(u.items=d(u.items)),i.push(u)}return i},a=d(r),T=new Set,S=o=>{for(const i of o||[])i.hidden&&i.text&&!i.url&&!(Array.isArray(i.items)&&i.items.length)&&T.add(c(i.text)),S(i.items)};S(a);let x=null;const L=()=>{const o=findFolder(a,TOOLS_FOLDER_KEY);if(o)return o;if(!x){x={text:TOOLS_FOLDER_TEXT,key:TOOLS_FOLDER_KEY,icon:"tool",items:[],synthesised:!0};const i=a.findIndex(u=>["system","documentation"].includes(c(u?.key||u?.text)));a.splice(i===-1?a.length:i,0,x)}return x},l=new Set,k=(o,i)=>{const u=groupKeyFor(o.key||slugify(o.text),i),h=$(a,p=>A(p)&&c(p.key)===u)||(o.items||[]).find(p=>A(p)&&(!p.key||c(p.key)===u)&&c(p.text)===c(i));if(h)return h;const g={text:String(i),key:u,icon:GROUP_ICON,items:[],synthesised:!0},f=o.items.findIndex(p=>l.has(p));return o.items.splice(f===-1?o.items.length:f,0,g),g};for(const o of s){const{item:i}=o;if(i.url&&y.has(i.url))continue;i.url&&y.add(i.url);const u=T.has(c(i.text));if(u&&!n)continue;const h=b({},i);n&&(h.items=[],h.$tool=O(o,{persisted:!1}),u&&(h.hidden=!0));let f=(o.parent?findFolder(a,o.parent)||$(a,_=>!P(_)&&c(_.text)===c(o.parent)):null)||findFolder(a,o.folder||i.folder)||L();f.items=Array.isArray(f.items)?f.items:[];const p=typeof(o.group||i.group)=="string"?(o.group||i.group).trim():"";p&&slugify(p)&&(f=k(f,p),f.items=Array.isArray(f.items)?f.items:[]),f.items.push(h),l.add(h)}return a}export const LOCKED_TOOLS=[{folder:"overview",item:{text:"Dashboard",url:"#/",icon:"home"}},{folder:"content",item:{text:"Site menus",url:"#/menus",icon:"menu",permission:"menus"}},{folder:"system",item:{text:"Users",url:"#/users",icon:"users",permission:"users"}},{folder:"system",item:{text:"My Profile",url:"#/my-profile",icon:"user"}}];export function isLockedUrl(e){return LOCKED_TOOLS.some(t=>t.item.url===e)}export function ensureLockedTools(e,{leaveInHiddenFolders:t=!1}={}){const n=w(e);for(const{folder:r,item:s}of LOCKED_TOOLS){const m=I(n,l=>l?.url===s.url),y=m.find(l=>!l.some(k=>k.restricted));if(!y&&m.length)continue;const d=y?.at(-1);if(d){if(d.hidden&&delete d.hidden,!y.slice(0,-1).some(o=>o.hidden)||t)continue;const k=y.at(-2);k.items=k.items.filter(o=>o!==d)}const a=c(r),T=I(n,l=>A(l)&&c(l.key)===a).filter(U),S=I(n,l=>A(l)&&!l.key&&c(l.text)===a).filter(U),x=(T[0]||S[0])?.at(-1)||null,L=d||{...s};x?(x.items=Array.isArray(x.items)?x.items:[],x.items.push(L)):n.push(L)}return n}export function insertFoldersBeforeSystem(e,t){const n=(t||[]).filter(Boolean);if(!n.length)return e;const r=["system","documentation"],s=e.findIndex(m=>r.includes(c(m?.key||m?.text)));return s===-1?[...e,...n]:[...e.slice(0,s),...n,...e.slice(s)]}export function canAny(e,t){return t?!e||!e.length?!1:e.includes(t)?!0:["read","create","update","delete"].some(n=>e.includes(`${t}.${n}`)):!0}export function filterByPermission(e,t,n=null){const r=[];for(const s of e){if(s.hidden||s.permission&&!canAny(t,s.permission))continue;const m=typeof s.url=="string"?s.url:"";if(n&&m.startsWith("#/")&&!F(n,m.slice(1)))continue;const y=Array.isArray(s.items)&&s.items.length>0,d=y?filterByPermission(s.items,t,n):[];y&&!d.length&&!m||r.push({...s,items:d})}return r}export function sidebarStateKey(e,t=null){const n=String(e?.text||"").replace(/\s*\(\d+\)\s*$/,"").toLowerCase().replace(/\s+/g,"-"),r=String(e?.url||"").match(/^#\/projects\/([^/]+)/);let s="";if(r)try{s=`project-${decodeURIComponent(r[1])}.`}catch{s=`project-${r[1]}.`}return t?e?.key?`sidebar.expanded.key.${c(e.key)}`:`${t}/${s}${n}`:`sidebar.expanded.${s}${n}`}export function pruneEmptyToolsFolder(e){return(e||[]).filter(t=>A(t)?!(c(t.key)===TOOLS_FOLDER_KEY||!t.key&&t.text===TOOLS_FOLDER_TEXT)||Array.isArray(t.items)&&t.items.length>0:!0)}
+import{isPathAllowed as F}from"./admin-scope.js";export const TOOLS_FOLDER_TEXT="Tools",MANAGE_PLUGINS_URL="#/plugins",MANAGE_PLUGINS_ITEM={text:"Marketplace",url:MANAGE_PLUGINS_URL,icon:"store",permission:"plugins"};export function stripItemByUrl(e,t){const n=[];for(const r of e||[]){if(!r||r.url===t)continue;const s={...r};Array.isArray(r.items)&&r.items.length&&(s.items=stripItemByUrl(r.items,t)),n.push(s)}return n}export function managePluginsItem(){return{...MANAGE_PLUGINS_ITEM}}export const TOOLS_FOLDER_KEY="tools";const E=["countUrl","core","permission"],c=e=>String(e??"").toLowerCase();export function slugify(e){return c(e).trim().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")}export function groupKeyFor(e,t){return`${c(e)}.${slugify(t)}`}export const GROUP_ICON="folder";const P=e=>e&&(e.type==="separator"||e.type==="spacer"||e.type==="theme-switcher"),A=e=>e&&!P(e)&&!e.url;function w(e){return(e||[]).filter(Boolean).map(t=>Array.isArray(t.items)?{...t,items:w(t.items)}:{...t})}function N(e,t,n=[]){for(const r of e||[]){if(!r)continue;if(t(r))return[...n,r];const s=N(r.items,t,[...n,r]);if(s)return s}return null}function I(e,t,n=[],r=[]){for(const s of e||[])s&&(t(s)&&r.push([...n,s]),I(s.items,t,[...n,s],r));return r}const U=e=>!e.some(t=>t.hidden||t.restricted);function $(e,t){for(const n of e||[]){if(t(n))return n;const r=$(n?.items,t);if(r)return r}return null}export function findFolder(e,t){if(!t)return null;const n=c(t);return $(e,r=>A(r)&&c(r.key)===n)||$(e,r=>A(r)&&!r.key&&c(r.text)===n)}function b(e,t){const n={...t,...e};for(const r of E)t[r]!==void 0&&(n[r]=t[r]);return!(Array.isArray(e.items)&&e.items.length)&&Array.isArray(t.items)&&(n.items=t.items),e.text||(n.text=t.text),!e.icon&&t.icon&&(n.icon=t.icon),delete n.ref,delete n.folder,delete n.group,n}function O(e,{persisted:t,orphan:n=!1,node:r=null}){const s=e?.item||{};return{persisted:t,orphan:n,source:s.source||(s.core?"Built in":""),folder:e?.folder||TOOLS_FOLDER_KEY,defaults:n?{text:null,icon:null}:{text:s.text||"",icon:s.icon||""},...n&&r&&{label:r.text||r.url},...(e?.group||e?.item?.group)&&{group:e.group||e.item.group}}}export function placeTools(e,t,{forEditor:n=!1}={}){const r=w(e),s=(t||[]).filter(o=>o&&o.item&&typeof o.item.text=="string"),d=new Map;for(const o of s)o.item.url&&!d.has(o.item.url)&&d.set(o.item.url,o);const y=new Set,m=o=>{const i=[];for(const u of o){const h=u.url?d.get(u.url):null;if(h&&!y.has(u.url)){y.add(u.url);const g=b(u,h.item);Array.isArray(u.items)&&u.items.length?g.items=m(u.items):n&&(g.items=[]),n&&(g.$tool=O(h,{persisted:!0})),i.push(g);continue}if(u.ref){if(!n)continue;const{ref:g,...f}=u;i.push({...f,items:m(u.items||[]),$tool:O(null,{persisted:!0,orphan:!0,node:u})});continue}Array.isArray(u.items)&&(u.items=m(u.items)),i.push(u)}return i},a=m(r),T=new Set,S=o=>{for(const i of o||[])i.hidden&&i.text&&!i.url&&!(Array.isArray(i.items)&&i.items.length)&&T.add(c(i.text)),S(i.items)};S(a);let x=null;const L=()=>{const o=findFolder(a,TOOLS_FOLDER_KEY);if(o)return o;if(!x){x={text:TOOLS_FOLDER_TEXT,key:TOOLS_FOLDER_KEY,icon:"tool",items:[],synthesised:!0};const i=a.findIndex(u=>["system","documentation"].includes(c(u?.key||u?.text)));a.splice(i===-1?a.length:i,0,x)}return x},l=new Set,k=(o,i)=>{const u=groupKeyFor(o.key||slugify(o.text),i),h=$(a,p=>A(p)&&c(p.key)===u)||(o.items||[]).find(p=>A(p)&&(!p.key||c(p.key)===u)&&c(p.text)===c(i));if(h)return h;const g={text:String(i),key:u,icon:GROUP_ICON,items:[],synthesised:!0},f=o.items.findIndex(p=>l.has(p));return o.items.splice(f===-1?o.items.length:f,0,g),g};for(const o of s){const{item:i}=o;if(i.url&&y.has(i.url))continue;i.url&&y.add(i.url);const u=T.has(c(i.text));if(u&&!n)continue;const h=b({},i);n&&(h.items=[],h.$tool=O(o,{persisted:!1}),u&&(h.hidden=!0));let f=(o.parent?findFolder(a,o.parent)||$(a,_=>!P(_)&&c(_.text)===c(o.parent)):null)||findFolder(a,o.folder||i.folder)||L();f.items=Array.isArray(f.items)?f.items:[];const p=typeof(o.group||i.group)=="string"?(o.group||i.group).trim():"";p&&slugify(p)&&(f=k(f,p),f.items=Array.isArray(f.items)?f.items:[]),f.items.push(h),l.add(h)}return a}export const LOCKED_TOOLS=[{folder:"overview",item:{text:"Dashboard",url:"#/",icon:"home"}},{folder:"content",item:{text:"Site menus",url:"#/menus",icon:"menu",permission:"menus"}},{folder:"system",item:{text:"Users",url:"#/users",icon:"users",permission:"users"}}];export function isLockedUrl(e){return LOCKED_TOOLS.some(t=>t.item.url===e)}export function ensureLockedTools(e,{leaveInHiddenFolders:t=!1}={}){const n=w(e);for(const{folder:r,item:s}of LOCKED_TOOLS){const d=I(n,l=>l?.url===s.url),y=d.find(l=>!l.some(k=>k.restricted));if(!y&&d.length)continue;const m=y?.at(-1);if(m){if(m.hidden&&delete m.hidden,!y.slice(0,-1).some(o=>o.hidden)||t)continue;const k=y.at(-2);k.items=k.items.filter(o=>o!==m)}const a=c(r),T=I(n,l=>A(l)&&c(l.key)===a).filter(U),S=I(n,l=>A(l)&&!l.key&&c(l.text)===a).filter(U),x=(T[0]||S[0])?.at(-1)||null,L=m||{...s};x?(x.items=Array.isArray(x.items)?x.items:[],x.items.push(L)):n.push(L)}return n}export function insertFoldersBeforeSystem(e,t){const n=(t||[]).filter(Boolean);if(!n.length)return e;const r=["system","documentation"],s=e.findIndex(d=>r.includes(c(d?.key||d?.text)));return s===-1?[...e,...n]:[...e.slice(0,s),...n,...e.slice(s)]}export function canAny(e,t){return t?!e||!e.length?!1:e.includes(t)?!0:["read","create","update","delete"].some(n=>e.includes(`${t}.${n}`)):!0}export function filterByPermission(e,t,n=null){const r=[];for(const s of e){if(s.hidden||s.permission&&!canAny(t,s.permission))continue;const d=typeof s.url=="string"?s.url:"";if(n&&d.startsWith("#/")&&!F(n,d.slice(1)))continue;const y=Array.isArray(s.items)&&s.items.length>0,m=y?filterByPermission(s.items,t,n):[];y&&!m.length&&!d||r.push({...s,items:m})}return r}export function sidebarStateKey(e,t=null){const n=String(e?.text||"").replace(/\s*\(\d+\)\s*$/,"").toLowerCase().replace(/\s+/g,"-"),r=String(e?.url||"").match(/^#\/projects\/([^/]+)/);let s="";if(r)try{s=`project-${decodeURIComponent(r[1])}.`}catch{s=`project-${r[1]}.`}return t?e?.key?`sidebar.expanded.key.${c(e.key)}`:`${t}/${s}${n}`:`sidebar.expanded.${s}${n}`}export function pruneEmptyToolsFolder(e){return(e||[]).filter(t=>A(t)?!(c(t.key)===TOOLS_FOLDER_KEY||!t.key&&t.text===TOOLS_FOLDER_TEXT)||Array.isArray(t.items)&&t.items.length>0:!0)}

package/config/menus/admin-sidebar.json

@@ -90,6 +90,12 @@
           "url": "#/content-api",
           "icon": "file-text",
           "permission": "settings"
+        },
+        {
+          "text": "Search",
+          "url": "#/search",
+          "icon": "search",
+          "permission": "settings"
         }
       ],
       "key": "content"
@@ -173,22 +179,11 @@
           "icon": "layout",
           "permission": "layouts"
         },
-        {
-          "text": "My Profile",
-          "url": "#/my-profile",
-          "icon": "user"
-        },
         {
           "text": "API Tokens",
           "url": "#/api-tokens",
           "icon": "key",
           "permission": "api-tokens"
-        },
-        {
-          "text": "Search",
-          "url": "#/search",
-          "icon": "search",
-          "permission": "settings"
         }
       ],
       "key": "system"

package/docs/plugin-development.md

@@ -356,6 +356,7 @@ roles and notifications are stamped with it). The sections below cover the main
 | `registerNotificationSource({id, label, severity, defaultOn, every, atBoot, check, audience})` | A switchable notification source, optionally scheduled (`boot`, `15m`, `hourly`, `daily`) (0.80.0) |
 | `registerLoginCheck({id, phase, check, verify?})` | A sign-in check: `phase: 'before'` (e.g. lockout, before the password is checked) or `'after'` (e.g. two-factor, can ask one more question) (0.83.0) |
 | `registerPasswordCheck({id, check})` | A password rule applied wherever a password is set (0.83.0) |
+| `safeFetch(url, {method, headers, body, timeoutMs, maxBytes, maxRedirects, truncate, signal})` | Fetch an address a site user chose, under the site's outbound rules (`services/outbound.js`): public addresses only, the connection pinned to the checked address, redirects re-checked, ports 80/443; `outboundAllowPrivate` applies on a self-hosted site and never on a signed-only one. Limits default to 1 MB / 15 s / 3 redirects and may be raised to 25 MB / 60 s / 5. Resolves `{ok, status, headers, buffer, text(), json(), url, truncated}`; a refusal rejects with `err.code === 'EREFUSED_SSRF'`. `body` is a string, Buffer or Uint8Array and `headers` a plain object or `Headers`; anything else rejects with a TypeError rather than going out empty. Use it instead of `fetch` for any user-chosen URL. Call it with `?.` - older cores lack it (1.10.31) |
 | `registerComponent({name, source})` | Add a Domma component from a `.dmc` source string, used on pages as `<dm-name>` or `[component]`; it is listed read-only in Components (0.92.2) |
 
 `onEnable` / `onDisable` exports receive `{fastify, services, hooks}` where `hooks` holds only the role and notification

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "1.10.29",
+  "version": "1.10.31",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/server/server.js

@@ -338,7 +338,7 @@ try {
         item: {text: 'Theme', url: '#/theme', icon: 'droplet', permission: 'theme'}
     });
     await ensureSidebarItem({
-        groupText: 'System',
+        groupText: 'Content',
         item: {text: 'Search', url: '#/search', icon: 'search', permission: 'settings'}
     });
     // Restructure Documentation: Tutorials → submenu, add Components reference set.
@@ -699,11 +699,10 @@ registerSidebarItem({folder: 'system', item: {source: 'Built in', text: 'Roles',
 registerSidebarItem({folder: 'system', item: {source: 'Built in', text: 'Users', url: '#/users', icon: 'users', permission: 'users', countUrl: '/api/users/_count', inventory: true}});
 registerSidebarItem({folder: 'system', item: {source: 'Built in', text: 'Site Settings', url: '#/settings', icon: 'settings', permission: 'settings', countUrl: '/api/settings/_count'}});
 registerSidebarItem({folder: 'system', item: {source: 'Built in', text: 'Effects', url: '#/effects', icon: 'sparkles', permission: 'settings', countUrl: '/api/effects/_count', inventory: true}});
-registerSidebarItem({folder: 'system', item: {source: 'Built in', text: 'My Profile', url: '#/my-profile', icon: 'user', countUrl: '/api/auth/me/_count'}});
 registerSidebarItem({folder: 'system', item: {source: 'Built in', text: 'Layouts', url: '#/layouts', icon: 'layout', permission: 'layouts', countUrl: '/api/layouts/_count'}});
 registerSidebarItem({folder: 'system', item: {source: 'Built in', text: 'Plugins', url: '#/plugins', icon: 'package', permission: 'plugins', countUrl: '/api/plugins/_count', inventory: true}});
 registerSidebarItem({folder: 'system', item: {source: 'Built in', text: 'API Tokens', url: '#/api-tokens', icon: 'key', permission: 'api-tokens', countUrl: '/api/api-tokens/_count'}});
-registerSidebarItem({folder: 'system', item: {source: 'Built in', text: 'Search', url: '#/search', icon: 'search', permission: 'settings', countUrl: '/api/search/_count', inventory: true}});
+registerSidebarItem({folder: 'content', item: {source: 'Built in', text: 'Search', url: '#/search', icon: 'search', permission: 'settings', countUrl: '/api/search/_count', inventory: true}});
 registerSidebarItem({folder: 'content', item: {source: 'Built in', text: 'Content API', url: '#/content-api', icon: 'file-text', permission: 'settings', countUrl: '/api/content-api/_count', inventory: true}});
 // Documentation pages added after the sidebar menu was seeded (0.93.1). The menu is
 // seeded once, so new pages reach existing sites only by registering here. The two

package/server/services/outbound.js

@@ -392,3 +392,62 @@ export async function safeFetch(url, opts = {}) {
     }
     throw new FetchRefused('Too many redirects.');
 }
+
+/** The most a plugin may raise safeFetch's limits to. */
+export const PLUGIN_FETCH_CAPS = Object.freeze({maxBytes: 25 * 1024 * 1024, timeoutMs: 60_000, maxRedirects: 5});
+
+/** A Headers instance or a plain object, as a plain object; anything else is refused. */
+function pluginHeaders(h) {
+    if (h == null) return undefined;
+    if (typeof Headers !== 'undefined' && h instanceof Headers) return Object.fromEntries(h.entries());
+    if (typeof h === 'object' && !Array.isArray(h)) return h;
+    throw new TypeError('safeFetch: headers must be an object or a Headers instance.');
+}
+
+/** A string, Buffer or byte array; anything else is refused rather than sent empty. */
+function pluginBody(b) {
+    if (b == null) return undefined;
+    if (typeof b === 'string' || Buffer.isBuffer(b)) return b;
+    if (b instanceof Uint8Array) return Buffer.from(b.buffer, b.byteOffset, b.byteLength);
+    throw new TypeError('safeFetch: body must be a string, Buffer or Uint8Array.');
+}
+
+/**
+ * The options a plugin's safeFetch call keeps: the request's own. `policy`,
+ * `lookup` and `own` are dropped - the site's policy is always read fresh (so
+ * `outboundAllowPrivate` still applies on a self-hosted site and is still
+ * ignored on a signed-only one) and a plugin cannot hand in its own resolver.
+ * The limits may be raised up to PLUGIN_FETCH_CAPS, never past them.
+ *
+ * @param {object} [opts] - method, headers, body, timeoutMs, maxBytes, maxRedirects, truncate, signal
+ * @returns {object}
+ */
+export function pluginFetchOptions(opts = {}) {
+    const o = opts && typeof opts === 'object' ? opts : {};
+    const capped = (key) => {
+        const n = Number(o[key]);
+        return o[key] != null && Number.isFinite(n) && n >= 0 ? Math.min(n, PLUGIN_FETCH_CAPS[key]) : undefined;
+    };
+    return {
+        method: typeof o.method === 'string' ? o.method : undefined,
+        headers: pluginHeaders(o.headers),
+        body: pluginBody(o.body),
+        timeoutMs: capped('timeoutMs'),
+        maxBytes: capped('maxBytes'),
+        maxRedirects: capped('maxRedirects'),
+        truncate: o.truncate === true,
+        signal: o.signal instanceof AbortSignal ? o.signal : undefined
+    };
+}
+
+/**
+ * `hooks.safeFetch(url, opts)` as plugins get it - see pluginFetchOptions().
+ * A refusal rejects with FetchRefused (`err.code === 'EREFUSED_SSRF'`); a body or
+ * headers of the wrong type reject with a TypeError.
+ *
+ * @param {string} url
+ * @param {object} [opts]
+ */
+export async function pluginSafeFetch(url, opts = {}) {
+    return safeFetch(String(url), pluginFetchOptions(opts));
+}

package/server/services/plugins.js

@@ -39,6 +39,7 @@ import {registerThemeProvider} from './themeSettings.js';
 import {classifyEntitlement, mayLoad} from './pluginEntitlement.js';
 import {notifierFor} from './notify.js';
 import {disableInstantCalls, enableInstantCalls, grantInstantCallsOnce} from './instantCalls.js';
+import {pluginSafeFetch} from './outbound.js';
 import {disableDashboardPro, enableDashboardPro, registerWidget, unregisterWidgetsFrom} from './widgets.js';
 import {createCollection, getCollection} from './collections.js';
 import * as defaultRolesService from './roles.js';
@@ -570,7 +571,9 @@ export async function registerPlugins(fastify) {
                   // Who may read a contact that is not their own (Contacts Pro's sharing) - hooks.js 7b.
                   registerContactAccess: (fn) => registerContactAccess(manifest.name, fn),
                   // Direct messages between team members (Messages) - hooks.js 7c; a call's "Add people" uses it.
-                  registerDirectMessenger: (fn) => registerDirectMessenger(manifest.name, fn)},
+                  registerDirectMessenger: (fn) => registerDirectMessenger(manifest.name, fn),
+                  // Fetching an address a site user chose (services/outbound.js) - the site's policy, never the plugin's.
+                  safeFetch: pluginSafeFetch},
               settings,
               config: {}
           });

package/server/services/sidebar-migration.js

@@ -41,7 +41,8 @@ const SEED_ITEMS = [
             {text: 'Blocks',      url: '#/blocks',      icon: 'box',       permission: 'pages'},
             {text: 'Components',  url: '#/components',  icon: 'component', permission: 'components'},
             {text: 'Views',       url: '#/views',       icon: 'eye',       permission: 'views'},
-            {text: 'Content API', url: '#/content-api', icon: 'file-text', permission: 'settings'}
+            {text: 'Content API', url: '#/content-api', icon: 'file-text', permission: 'settings'},
+            {text: 'Search',        url: '#/search',               icon: 'search',   permission: 'settings'}
         ]
     },
     {
@@ -65,11 +66,9 @@ const SEED_ITEMS = [
             {text: 'Users',         url: '#/users',                icon: 'users',    permission: 'users'},
             {text: 'Site Settings', url: '#/settings',             icon: 'settings', permission: 'settings'},
             {text: 'Effects',       url: '#/effects',              icon: 'sparkles', permission: 'settings'},
-            {text: 'Search',        url: '#/search',               icon: 'search',   permission: 'settings'},
             {text: 'Layouts',       url: '#/layouts',              icon: 'layout',   permission: 'layouts'},
             {text: 'Plugins',       url: '#/plugins',              icon: 'package',  permission: 'plugins'},
-            {text: 'API Tokens',    url: '#/api-tokens',           icon: 'key',      permission: 'api-tokens'},
-            {text: 'My Profile',    url: '#/my-profile',           icon: 'user'}
+            {text: 'API Tokens',    url: '#/api-tokens',           icon: 'key',      permission: 'api-tokens'}
         ]
     },
     {
@@ -441,6 +440,35 @@ export async function ensureFolderKeys(opts = {}) {
         changed = true;
     }
 
+    // Account access lives in the top menu. Move Search out of the old
+    // System default once, preserving saved labels, permissions and folders.
+    if (!menu.meta?.accountSearchNavigation && items.length) {
+        const moving = [];
+        const removeProfile = nodes => nodes.filter(n => n?.url !== '#/my-profile').map(n => {
+            if (Array.isArray(n?.items)) n.items = removeProfile(n.items);
+            return n;
+        });
+        for (const folder of items.filter(n => isFolder(n) && n.key === 'system')) {
+            moving.push(...(folder.items || []).filter(n => n?.url === '#/search'));
+            folder.items = removeProfile((folder.items || []).filter(n => n?.url !== '#/search'));
+        }
+        const hasSearch = nodes => nodes.some(n => n?.url === '#/search'
+            || (Array.isArray(n?.items) && hasSearch(n.items)));
+        let content = items.find(n => isFolder(n) && n.key === 'content');
+        for (const item of moving) {
+            if (hasSearch(items)) break;
+            if (!content) {
+                content = {text: 'Content', key: 'content', icon: 'edit', items: []};
+                const index = items.findIndex(n => isFolder(n) && n.key === 'system');
+                items.splice(index === -1 ? items.length : index, 0, content);
+            }
+            if (!Array.isArray(content.items)) content.items = [];
+            content.items.push(item);
+        }
+        menu.meta = {...(menu.meta || {}), accountSearchNavigation: true};
+        changed = true;
+    }
+
     // An empty menu is left empty: the renderer's minimal fallback (Dashboard,
     // Menus) is what an admin needs to repair it, and a lone Tools folder would
     // stop that fallback from applying.