domma-cms 1.10.35 → 1.10.37

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [1.10.37] - 2026-10-27
+
+- The updater's backup no longer copies the runtime data of plugins it does not update. A marketplace or site plugin's `data/`, `backups/` and `node_modules/` stay out of `.domma-backups` (its code is still copied); the engine's own plugins are still backed up whole. A File Store's members' uploads were otherwise copied into every one of up to sixteen kept backups.
+
+## [1.10.36] - 2026-10-27
+
+- Trash folder menus offer Empty Trash with an explicit permanent-deletion confirmation. Clear every message in the server-designated Trash folder, including more than one list page, while retaining the folder and its subfolders. Requires Email Pro 0.10.1.
+
 ## [1.10.35] - 2026-10-27
 
 - Email lists always show the local date and time. Ctrl-click adds or removes individual messages, starting with the open message; Shift-click selects a range from it.

package/bin/lib/plugin-backup.js

@@ -0,0 +1,40 @@
+/**
+ * What the update backup takes of plugins/, for the engine updater.
+ *
+ * The backup is there to undo the update, and the update only ever rewrites
+ * the plugins the engine ships (Blog, Mail Reader, ...). Every other plugin -
+ * installed from the marketplace or written by the site - is left exactly as
+ * it is, so copying its runtime state would back up something the update never
+ * touches. And that state can be large: a File Store keeps members' uploads in
+ * its data/, and the update backups are kept up to sixteen deep. So:
+ *
+ *   - a plugin the engine ships: copied whole, data/ included (the update
+ *     replaces its folder, carrying data/ across through memory - the backup
+ *     is the safety net if that goes wrong);
+ *   - any other plugin: its code only - no data/, backups/ or node_modules/.
+ *
+ * @module bin/lib/plugin-backup
+ */
+import path from 'node:path';
+
+/** Runtime folders inside a plugin that a plugin the update does not touch never needs backed up. */
+export const STATE_DIRS = ['data', 'backups', 'node_modules'];
+
+/**
+ * A `cpSync` filter for copying `pluginsDir` into the backup.
+ *
+ * @param {string} pluginsDir the site's plugins/ folder
+ * @param {Iterable<string>} shipped names of the plugins the engine package ships
+ * @returns {(src: string) => boolean}
+ */
+export function pluginBackupFilter(pluginsDir, shipped) {
+    const engine = new Set(shipped);
+    const root = path.resolve(pluginsDir);
+    return (src) => {
+        const rel = path.relative(root, path.resolve(src));
+        if (!rel || rel.startsWith('..')) return true;
+        const [plugin, second] = rel.split(path.sep);
+        if (second === undefined || engine.has(plugin)) return true;
+        return !STATE_DIRS.includes(second);
+    };
+}

package/bin/update.js

@@ -16,6 +16,7 @@ import {fileURLToPath} from 'node:url';
 import {deepMergeNewKeys} from './lib/config-merge.js';
 import {shouldReplacePlugin} from './lib/plugin-version.js';
 import {KEEP_UPDATE_BACKUPS, pruneUpdateBackups} from './lib/backup-retention.js';
+import {pluginBackupFilter} from './lib/plugin-backup.js';
 import {removeLeftFreeTier} from './lib/left-free-tier.js';
 
 // ---------------------------------------------------------------------------
@@ -306,10 +307,13 @@ export default async function update(_positional, flags) {
             }
         }
 
-        // Back up plugins dir (code only, not data)
+        // Back up plugins/: the engine's own plugins whole (the update replaces them), every other
+        // plugin's code only - the update never touches it, and its data/ can be large (bin/lib/plugin-backup.js).
         const pluginsDir = path.join(cwd, 'plugins');
         if (existsSync(pluginsDir)) {
-            cpSync(pluginsDir, path.join(backupPath, 'plugins'), {recursive: true});
+            const shippedDir = path.join(PACKAGE_ROOT, 'plugins');
+            const shipped = existsSync(shippedDir) ? readdirSync(shippedDir, {withFileTypes: true}).filter(e => e.isDirectory()).map(e => e.name) : [];
+            cpSync(pluginsDir, path.join(backupPath, 'plugins'), {recursive: true, filter: pluginBackupFilter(pluginsDir, shipped)});
         }
 
         done();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "1.10.35",
+  "version": "1.10.37",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/plugins/_lib/admin/mail/reader-view.js

@@ -5114,6 +5114,12 @@ return {
                     action: () => setFolderVisible(folder, folder.subscribed === false)
                 },
                 {type: 'divider'},
+                ...(folder.specialUse === '\\Trash' && features.emptyTrash ? [{
+                    label: 'Empty Trash...',
+                    icon: 'trash',
+                    danger: true,
+                    action: () => emptyTrashFolder(folder)
+                }, {type: 'divider'}] : []),
                 {
                     label: 'Rename',
                     icon: 'edit-3',
@@ -5362,6 +5368,33 @@ return {
             }
         }
 
+        /** Empty Trash after explicitly confirming permanent deletion. */
+        async function emptyTrashFolder(folder) {
+            const accountId = currentAccountId;
+            const count = Number.isFinite(folder.messages) ? `${folder.messages} message${folder.messages === 1 ? '' : 's'}` : 'all messages';
+            const question = `Are you sure you want to permanently delete ${count} from "${folder.path}"? This cannot be undone. The folder and its subfolders will be kept.`;
+            if (!dialogOnce.claim()) return;
+            let confirmed;
+            try {
+                confirmed = await ask(esc(question), {title: 'Empty Trash?', confirmText: 'Permanently delete', cancelText: 'Cancel'});
+            } finally {
+                dialogOnce.release();
+            }
+            if (!confirmed || !here() || accountId !== currentAccountId) return;
+            try {
+                const params = new URLSearchParams({account: accountId ?? ''});
+                const result = await api(`${BASE}/folders/empty?${params}`, 'POST', {path: folder.path, confirmed: true});
+                if (!here() || accountId !== currentAccountId) return;
+                E.toast(`Permanently deleted ${result.deleted} message${result.deleted === 1 ? '' : 's'} from Trash.`, {type: 'success'});
+                const open = currentFolder;
+                await loadFolders({quiet: true});
+                const shown = folders.find(f => f.path === open);
+                if (here() && accountId === currentAccountId && shown && currentFolder !== open) await selectFolder(shown);
+            } catch (err) {
+                E.toast(err.message || 'Trash could not be emptied.', {type: 'error'});
+            }
+        }
+
         /**
          * Delete a folder and everything inside it.
          *

package/plugins/_lib/mail/write.js

@@ -471,3 +471,26 @@ export async function setSpamBulk({
         uidMap: moved.uidMap, keywords, mirrored: moved.mirrored
     };
 }
+
+/** Permanently empty a server-designated Trash folder, retaining the folder and its children. */
+export async function emptyTrash({pool, store, account, poolKey, connection, folder}) {
+    const boxes = await pool.withClient(poolKey, connection, client => client.list());
+    if (!boxes.some(box => box.path === folder && box.specialUse === '\\Trash')) {
+        const error = new Error('Only the server-designated Trash folder can be emptied.');
+        error.statusCode = 409;
+        throw error;
+    }
+    const deleted = await pool.withMailbox(poolKey, connection, folder, async (client, mailbox) => {
+        const count = Number(mailbox.exists);
+        if (count === 0) return 0;
+        const lastUid = Number(mailbox.uidNext) - 1;
+        if (!Number.isSafeInteger(count) || count < 0 || !Number.isSafeInteger(lastUid) || lastUid < 1) {
+            throw new Error('The Trash message count could not be verified. Refresh and try again.');
+        }
+        const result = await client.messageDelete({uid: `1:${lastUid}`}, {uid: true});
+        if (result === false) throw new Error('The server refused to empty Trash.');
+        return count;
+    }, {writable: true});
+    if (store) await store.clearFolder(account.id, folder);
+    return {deleted, path: folder, expunged: true};
+}