domma-cms 1.6.34 → 1.6.36

package/plugins/free-tier.lock.json

@@ -1,11 +1,11 @@
 {
   "note": "Written by `make sync-free-tier` in dcms-marketplace. Do not edit these plugins here - edit them there and sync.",
-  "source": "dcms-marketplace@bd6f228",
+  "source": "dcms-marketplace@b1edb76",
   "plugins": {
     "blog": {
-      "version": "1.9.5",
+      "version": "1.9.6",
       "files": {
-        "CLAUDE.md": "926730d510cc38f6764ffcb9afbed1c3ae3a547117c6c0243b14f899271350fb",
+        "CLAUDE.md": "5164b58785b979b828a707ac94088d80eb1a1655fc48a23404aeca8cef316e70",
         "admin/css/index.css": "6142a6b756e1218157842528830b1e84f592f0b84b7d5ce6449db421b6f4b039",
         "admin/templates/blog.html": "a6054c1febe764bb1edf5c9e466d44a9080d9c83ba5486437b7a8244acf5ba54",
         "admin/templates/categories.html": "ab7d6fc2fedd48876c585bc216a1532b3bdd78c946dee976c1171bfe4664feb6",
@@ -41,17 +41,17 @@
         "collections/comments/schema.json": "29cbd289cbfcfc4158c9357a218db4ce06eddc3370bfbf9afb7d7f52065a849e",
         "collections/posts/schema.json": "19a5a770d3eefea73f4117454bd1312a7a7e3d727cfcdfde141139fbc81cabd7",
         "config.js": "ee67396262762f5c31269d258affd75f7392a3e364f72f7792c2f1cdafd94bba",
-        "docs/guide.md": "6a7466881851797789a18e0d32c4fcb515f2259b110948c55be03923c38e0de5",
+        "docs/guide.md": "d9f70afe4612a2464fc537a0348e987873d09cc30ce44692a22cf79c40a4c0b4",
         "lib/access.js": "af47440c7233a56000641a3231d7e9ff81b12f40dfb9528aa6dd4e2dd9bca8df",
         "lib/layouts.js": "dbb6ae9e514ccaf600a732702925b905131dea166d90fe759a62b6652e78e1de",
         "lib/nav-link.js": "6a8f9368bb8aee1c21e90fb335a691859cb9a9bc250c2b9167a33ca9189fa2ff",
         "lib/notices.js": "a9a2918ee6f5f7e0bbaeced0d3539584279bdbe68d15472a8615bdddb4ef905b",
-        "lib/page.js": "bfb6a355a027feaf775d6d8ac871fc6d999354774e018f8e16caec551e99f40a",
+        "lib/page.js": "ca84803672c3815c9606402bd24e9c6bdef167f7a342eb6d3d51a8b9a9c692ba",
         "lib/render.js": "0e97c6a950bc962c8d8ea4b2f21d06cb73fbcdc738d8942d6935d01309a29b1d",
         "lib/samples.js": "e8cdb77ce22e43937707f6854d3a5cb722437dc584e22ac7b24480bef686cf85",
-        "plugin.js": "0aa46a01b5298065497f39729b88e34a9f56ac684b0a14f8d94ab6007f0221d0",
-        "plugin.json": "b4d7637ecb053df7ab182aaed7962c52e47fbee0eedcd041964585fbc85ea7da",
-        "plugin.public.js": "67e109da613237d9ec52e7cc2f3442bb61ca5a51cb184448b9f0d993e50f7ae3",
+        "plugin.js": "278d269eb8fb6df2f64f23ae26b5e5b5fe96e7f9d07241539d261d66d4ccd7f7",
+        "plugin.json": "ff7466d42c41dd64117861d4d88914be1d367854ade67cb4ca42d8b42068bcf4",
+        "plugin.public.js": "33387fa7636b877dec3881b0698918bc1a7379d5690d010c826aedc4091284d8",
         "public/blog.css": "fd733e6b624190da1e70dc1b6613e2376efd7f7570a28fab311d81006d03d960",
         "public/blog.js": "d01c72a9834dcc7c5241923371f2b164ac30d20ac9f1a5c5dc5b71fa3cb09f08",
         "public/samples/aurora.svg": "feb29e2b46465913fc29de9eda221b00b1541f1fa3ea7120f0c1d1cd11a9a4f6",
@@ -69,13 +69,13 @@
         "tests/layouts.test.js": "554cff8194bd650cfb5f2a83c1f51c25f427c07f7dbfdc2ad9ad69bb38fca6a0",
         "tests/nav-link.test.js": "d36e33ad7483abca27ae6e2098ad2f75bafa18d91f3beba70372ebe6b9b88994",
         "tests/notices.test.js": "2b02aa84e780dc4c82e6c503fc8fe17c64a63bee0709627866ef97c99cb4e131",
-        "tests/public.test.js": "a6fcdc4ede242aa050ffe5a52f970d6bec1f4a70ae78967eb8a7bdeec73df19d"
+        "tests/public.test.js": "cd4cc53da9709d400d082ef6df01b3f49e6fc419e4b020b588464306a5d907e9"
       }
     },
     "booking": {
-      "version": "1.6.2",
+      "version": "1.6.3",
       "files": {
-        "CLAUDE.md": "9a862d4f9ee4676c67af9699820015d7e0ab98b14b62deee6d51cefe0cc28471",
+        "CLAUDE.md": "1709e58b31a3ac7c1cbadbe6d4f8b0a01cf696b72981ccfa14cd1861133fac85",
         "admin/css/index.css": "4f7731921c0c5038cb1566a6ab2d43ffc35bf9b161e58f87a0cff423e81b47fa",
         "admin/lib/details.js": "8b37536bfa9ccfcc5265cc957ba8266d3f5f777133e7c0946ae49540f1c80e3c",
         "admin/lib/diary-layout.js": "d818c79001fb9a9ecc15c96239ba961b0a1d98b9e8fce903eefb57d85adf2a73",
@@ -93,14 +93,14 @@
         "collections/booking-bookings.json": "fa0b15cc81b4a2114734a0bc8adc4b4d25049d16cf62549b83634cdbeb543b52",
         "collections/booking-services.json": "cecb500a9215a0eba894e6b4c9ae78f5fbeb209830d07d47050c56c75143f66a",
         "config.js": "5565fd627481cf809322257cc300a7cbb7ccbf6cae076b4cf8a7453fcf554bd3",
-        "docs/guide.md": "5dbe9a4e0cabdc85a3c6a0b40ea4e1bc02976ad465891d28001c1485b0b1cd50",
+        "docs/guide.md": "8f5898627abb1b21f90809b4f2e4c29f80d478bd11c0f1aec5319cddc40d14f9",
         "inject/body.html": "ab55ce945eec2302eb0c836a4626cffa5e091d050c6a59c6f2af332b05570777",
         "lib/call.js": "87c11b8531e1a6d247d52d4e03ea8e5aa06a1af49cbd7cbd0af97e2586237f7b",
         "lib/extensions.js": "8cec28ff8685daad8083b23f034f1c3bf82fd2322943dd19d46570ccdc311105",
         "lib/mail.js": "cad8f409df62d6e42f0f4024ec364bbe018a62b842fa3f7c38786fd4e7f92408",
         "lib/store.js": "7aa7967e4694e5a3b85378f60302e5a47394b1d90c7dd86e09578156f1c13e03",
-        "plugin.js": "948cf76ee8495d9a6bce85c4f5549107385c8a947bc7690ff08d6d2b870f458d",
-        "plugin.json": "6032a3e333e3ae492a2484fbb0ab93cfffe20c9d01e85f67ef7369c55e5c6f10",
+        "plugin.js": "4a303855a5a7f746e07e45a937dfeac8984dc9254c2f9b1a60b6f6306912ed84",
+        "plugin.json": "d099b136335028b2bca2bd21065c6ae343099f71635f9c793c95567a6e8a63db",
         "plugin.public.js": "4d5b4e8ad6943182ee3b6c6e6f6762a2d3f676d8d7ee363fcb07bd47d3d6532e",
         "public/booking.css": "8b88989fdd04e50efc1688a2f32fe2e422299d7d13b81bb8fce0cc162fa99df6",
         "public/booking.js": "7dfc3d205696967013886567f67a867443c2e370bac29019d69911d695fdbade",
@@ -110,42 +110,42 @@
         "public/lib/time.js": "48e13a23e3d7a4916e2097e8f87c03a87d37b71c4ef037a5a16143c6a4185c41",
         "templates/booking.html": "a4995de46dfdab7e692b56f21347f29c76320cf3b0477889dc3c5d14e0b6dcd7",
         "tests/admin-diary.test.js": "4e34b447d62b41272ceec49bad9d491ae00dd04f4760d8a7a3046be1912f4abe",
-        "tests/api.test.js": "b9076e6a5fb7d43cf13cd937751aa20a05e17fa13c55fc3fc52caa1f206d5d10",
+        "tests/api.test.js": "efb3767f7efde08c11c8edcb5753889773b421188798f725aff0e4e533860aff",
         "tests/public.test.js": "0b7b626d60df5a3d73d7c0077b73f59b62a9fded98ce84a8d93cd32cd0333159",
         "tests/pure.test.js": "8ba0c8f76b4c9efcc422f39ff29509612544d81f760025a4b9a5594af14e7bcf"
       }
     },
     "feedback": {
-      "version": "1.1.3",
+      "version": "1.1.4",
       "files": {
-        "CLAUDE.md": "7d6cbce582050a8e0cb74b7e177cbee0051b940369cd9a438546a66eb53051c2",
+        "CLAUDE.md": "af921af5c262cac7ac784fa86b780e4f31dac1baa510b4b3fd32a52521d4cccf",
         "admin/css/index.css": "f2e934c8b94f883340148aba17945dfa725eeb2b0ddb6cabb8a8c17e2487c1de",
         "admin/lib/kit.js": "913761a2cc19b69bed3f05267d45fdb1c08338b1edb081b9272231733d9b5790",
         "admin/templates/feedback.html": "a366dce78f6c3e84a7cb0ac63eba53e1980a4eb44154496a0536f5214c5bb36f",
-        "admin/views/feedback.js": "ac33bf7de7445722dd055dcd9b6737a545b70379863328bc0d112abe52ce29c3",
+        "admin/views/feedback.js": "768d76da473dc4905e8e8e9133a715c1db8c3cb53d91756b5c7d067a92971463",
         "admin/views/inbox.js": "649b86844230be73939d82aa7c97432252c0b119baa102ebf53808e1d5f23737",
         "admin/views/send.js": "5868038a4020158746c5705d2a0ab5f552ac5021328a1dcf64a2def890495427",
         "collections/feedback-reports.json": "a072291b52463f7785a77f5f77d36b8238ba8f89cfc2672c6642eccdb3144486",
         "config.js": "29d9999d1028c2c11931f67fb9abdf35132430b7cf58c161681e734c0b45143a",
         "docs/guide.md": "e006cc3f3c114583285964bc1b5d22b2a01285c2d2015d132434bfed363917d4",
-        "lib/receiver.js": "c6ab2858dc7bfff6de19b41c84295c0c918ba50ddc57f6d3d83f1352662ebd91",
+        "lib/receiver.js": "d77962c895617f9adf2fb16d29992fd83b75a3419a4aa71ac3e3bbe8c2089839",
         "lib/sender.js": "037f9b4469a34ffe1d302a633e664860d625f7fb3be4dfadd01b8a3d094849b7",
         "lib/shape.js": "67acf62f812c2c9a01b52776641ed7ae1601c59ebab8ea278a07d1087a9f299b",
         "plugin.js": "c388bbc2a49b5902773b15a74379c40eeaea58396058136e7901e405b3a396f8",
-        "plugin.json": "a2e627cc6c126878a5756080782cc7f29a4024b50b1c485211ecdd0ce6399d94",
+        "plugin.json": "612357f1b3166f5bad11a563d0e7759c262a2328eba9890c5937dc98d7752363",
         "tests/api.test.js": "3fd27c561af593168ff0c2d717900feda89da4e306f8e0ecac0a6ad68c6d3359",
         "tests/shape.test.js": "5133578142a79cc1a100b3215436372129f01fb0de8c757fd743ff99e1d7e37f"
       }
     },
     "mail-reader": {
-      "version": "1.2.6",
+      "version": "1.2.7",
       "files": {
-        "CLAUDE.md": "40b25e33b9f14636bf766b68d1af5be24dcf69ccf6d770b9d080c1ed81664abb",
+        "CLAUDE.md": "6c1fe7956f0d2cc637bff3441061d083e6d938ccf58045473ec49c8fb38f41c1",
         "admin/views/mail.js": "c5c6483f9618c75cac8f4be32d3aea99511db76d4b9d38b8ef43bdc1d35db3c5",
         "config.js": "6e65803ad822a9acda40c203631b8eb32a87cf9d9e5f1c7cb59d01aa406075c6",
-        "docs/guide.md": "a8febdc46bf60af35c6d980ac37629baa93da94e0970473f6fbe2d3f242ceb63",
+        "docs/guide.md": "d6b5944740ea1bbd689034ef726d8bc0f9bfeb28ea62b63c258292962d45cf18",
         "plugin.js": "7f602a60c4eca7d3637659d03d5de9e242584666846b16c9e5a1b758e4856c9f",
-        "plugin.json": "af84350ede3edcb8b07ca752f8799245519a475c2242e89919a7e3e9b74cc8ff"
+        "plugin.json": "05a5fa1e0ff69eb2cfe0c07a1abbe2cb4a1cd57a75511d0ae6fb1a74524a65e4"
       }
     },
     "security": {
@@ -175,36 +175,43 @@
       }
     },
     "shopping-cart": {
-      "version": "1.3.0",
+      "version": "1.6.1",
       "files": {
-        "CLAUDE.md": "2115832507c6c667e36bc1c8a70e1a2d05aee03e79bdbb8e509c8d533a4e2ab6",
-        "admin/css/index.css": "2ea348d9f969193f198dac25b1962a400967566b835c7bf1402e17e33d81bfd2",
-        "admin/lib/kit.js": "ebb439a31123b9c4fbda8a2c299cc79d1ec50e66d019b5cc49dcd00f269124d5",
+        "CLAUDE.md": "2759884523ebf0f9323cdefdd220fc9c0ad952f9964c065f19b97530e61f7533",
+        "admin/css/index.css": "dfe1ffc05b9161af3d8a74e82bd36c46991cb3b0409223b213eb8eca6fba9d55",
+        "admin/lib/chart.js": "b01ce5cfac773c8df8efccab50b67d3dfa99fbead0037d817553db4a6688d4d6",
+        "admin/lib/kit.js": "d9aa90469b3f589beaff0c3fb6ad3d983ab3fd6d94c06965be639a665bfe052f",
         "admin/templates/shop.html": "c5bb03f1f7cbabfbd8202f3533783eb1848103755b1ba25fdcf1fd8e9478cb8e",
-        "admin/views/orders.js": "4cacf502ae754252cd5a68e53412121a4bae8e0c4265ebcf800d5d04b4b5211a",
-        "admin/views/overview.js": "6abd9779cf5fc359c4708f96cf0e8ecad155fb52583b2ec854400b288fc9ba98",
+        "admin/views/orders.js": "97699e18f0fe4be8f3a811cd2fa7c07ad6139ac312e05b70ab5e80a21e40f09b",
+        "admin/views/overview.js": "97045c069c6560b3f67e1b2230bdc9c4133ed92ec6f732886470f886f11c755a",
         "admin/views/products.js": "e109660355aaec8db07eb65fa1169e7d2ec20bc2ec45293cc20e34f7c1bd62bf",
-        "admin/views/settings.js": "28cb0b5e8d45e3723ffe77e46299bfc13fbad02a2ae8103843c6894dc232387a",
-        "admin/views/shop.js": "c36f63edf4c581cc740e62f2611872b63efc9faffd4f13491de5745efec0acd3",
+        "admin/views/sales.js": "da71b9fbb7d39e39ecd8be35b1187e88bc4b5b28f18baaeddc6ea4cd202bb330",
+        "admin/views/settings.js": "54d4b52409d0bdd1eb4c6e4d86c07a285914659eb6b7053183f77e2fb4b9feaa",
+        "admin/views/shop.js": "83d1cb3b053ff16768959c6fd243a9428b274a3f7cdfd98929a8adc51a71d03e",
         "collections/shop-orders.json": "0bca8eef2d5f9108651f73d273480265c167dc983aa115ce59613d13015ca255",
         "collections/shop-products.json": "4d4613ecec7b8a5a0744c4f0a57b17a4429b461e060206a4bbdea5ad7c8c75dc",
-        "config.js": "dcb91db2839c1ab9e40bb1811397024fad9e37e3753d17e2baa2b9b31d4a7d7c",
-        "docs/guide.md": "4b4fbf3d61d73114f3b1b42ba48c72debb720e2c65bcd17df2feaa372463882f",
-        "inject/body.html": "9deda0324d60ef1e62f653513748faa4c6ac546493906c8bd195e445a55f7476",
-        "lib/extensions.js": "180820bcfb8ada9acfb260d0cc0a1c8cc4f37f9ab969400f4b6e8bf2d5babb3f",
-        "lib/payments.js": "84ad14813688de1f38448b4935180a786cda8af2f7f4b8890a8f1d426982d1aa",
+        "config.js": "31b336560d21a802d799ed487d5c3116de898446ba3521068b10d192f4ebbb2d",
+        "docs/guide.md": "5b63bd03b015e273c2880ac431a9faccdcc389e8c5f367697aeb4502be8e280b",
+        "inject/body.html": "7e7e5b408f47abb8650e0a7d5e277daf8a634f4c6877c5259f837b1bf3d6c8e8",
+        "lib/accounts.js": "5115cec6a145da18c106dfdbf5fd0b2a1bad0c68e8fac4ef623287e85db75e5c",
+        "lib/commission.js": "5b10475d98cff2aaf4c76b9950f8d698d6262e36754a8963669690a8e3e9bd52",
+        "lib/extensions.js": "73d3515b52c066e3e616c425d91a7a48a6aab153e7d14ae7278b38ee32649352",
+        "lib/payments.js": "de093035ce732cd4f7f569fcd32cb5a86e68596a3ae54ec7d00e949b3024f7a7",
         "lib/pricing.js": "5644f2dd55fc3cfd7f40b0169dea5fb547e8b302239b8c17f23cfa177e42eab5",
-        "lib/render.js": "530446d75a9c99a684fe593e2acdaf9914e7e54056728333d6b84fdb60ffd7b2",
+        "lib/render.js": "2a2b9ab4a24728186e1e45e6429c7406a6d5ca3d4b43db1758bbd54405d105b7",
+        "lib/sales.js": "16804f0ba4e61e8a2887a7c4172da37533850a1cd975a177b754f3350268e946",
         "lib/samples.js": "912b3d5bd543dffa5f870caf3c2b873f642fd55e3ebf3f97e1b31eeaaac77d3b",
-        "lib/shop.js": "734943e332f061446a0c5372179447c3bd25a105e7077b26e80e1f5ca16a62e6",
+        "lib/shop.js": "190ad53acffb88ca9462900091918ea5d3e40fb666e89b9c060832035284115c",
         "lib/summary.js": "cdb13ce3d1799d429059fa03f179281711dc00427ccf2eb6b8f8aa52fef26295",
-        "plugin.js": "976a8756ce3d3bb89172d2d13f2b72ddffc101b3806c032ebcc3d5177a588f20",
-        "plugin.json": "b212951c39f978c0b3cc7378ac04d15717852c7c40cea9cc57e42fb40017cbd5",
-        "plugin.public.js": "99ef559dc8c3bd369047091623bbad29a1f6067322f07ac0db547938d97fe014",
-        "public/cart.js": "fcc706773a36e4bfd02ea235bcdad629137e996218e0a0e23892e33c689f2a6e",
+        "plugin.js": "f776e6bbdd98bf0b487e8247bc7334e78a1f8601a54b26b8c30df817619c2ebc",
+        "plugin.json": "abc448993e39b008d2f8d69deb55176bd090f5272003164a0931059dca4a5fc5",
+        "plugin.public.js": "2f92e8340c9da653401c11dd99dab033dc6772d63fa2114489192c48e9e0be00",
+        "public/account.js": "5f644016c098c7879c59948d662f5997cb61680996204ecb7897baab8945d434",
+        "public/cart.js": "7338141392ec653ff616eb75688d2a2ad08cff8427d7020d381f540be0037b73",
         "public/lib/money.js": "d22b2b6f80dde6f7887b69e24188c05ea93c02217aba639b5331aa3bd616f4fc",
         "public/lib/orders.js": "09478e20d238adc8e387b3d9efcb13c441898fab18387ce6a1a8a92304ac4c5b",
         "public/lib/products.js": "65a033b4b03c1b6d9cd7035e6be4c3fe47c7ad309dc14c4d417b6ac0fc10e2f4",
+        "public/lib/session.js": "4f71e98818a52cf2321c8dc57e33e5591deb04ebb2c0bea19dd6758827719a08",
         "public/samples/candle-2.svg": "aca5691b9168467caf6feb7622ab154ee92504be8b887ac6c818db22476e7bed",
         "public/samples/candle.svg": "ef75e95a53ce13e88928004c6f1290c45a1094765e2ba741ae1fc55d404b881f",
         "public/samples/mug-2.svg": "5f37d23e90b7e79e42d38009a56b3ea26adae03586830a0cd418565491bd4532",
@@ -217,30 +224,35 @@
         "public/samples/tee.svg": "287a82d7fc00acb1543b3209927ae20dcbe3d4b2a2b3de03574ab0c463385f3c",
         "public/samples/tote-2.svg": "9c7f41cc57866e71973e413a6c87f46be48f7488d3490ceea58e24559c334813",
         "public/samples/tote.svg": "01de817a32c8d3d8ea47ff491049f439ca3e4d4fce943dbdc62a4187139e016c",
-        "public/shop.css": "c5adbc7b08cff3dc3b1c2b796ba693ad52c586ef35d236d0bba9a0cb7c3673c1",
+        "public/shop.css": "c01603589727c91ff4204222e594b3f52e3ca165c1ebf9e6cef6c9f006f6e57b",
+        "roles/shop-customer.json": "3f3366c536c9fbf2b2ce146bb3090b008d5fbfe22752e764eb8e5a1de9cd611c",
         "templates/shop.html": "4649e57d23458833a157799dc80141824eb0f658d96734bd1859c68e0ba9a8b9",
-        "tests/api.test.js": "187bd5268797b2f4e5ef93da8de99e4862f6ee86005c889f48a817b406c385ef",
-        "tests/pure.test.js": "7fd6ad3b1955dc2c3d9a9ef175b458e2150f63cdc526c1bc0c1acba83c4e01e2"
+        "tests/accounts.test.js": "e64adc2a855d4ca017682bba7f75b052534f826556d8d35d825fb79cbc66596a",
+        "tests/api.test.js": "8bccf43e520bca7bb73837a74b3c3cf1fdb3a8db8fb5026a27bc0e5ed9d5ca80",
+        "tests/commission.test.js": "1dfb26a90d3dfcf9f57f2174ac5d9b2310570b21f82c79bf9a2011e7f4911e85",
+        "tests/pure.test.js": "13620f708f21e2590979e8579e2e7788d6109e1682bf73d7b1eb64838da35196",
+        "tests/sales.test.js": "9025bc608b04bcc14f5bb2c98b4f7c35de99f3ddab4ffa59772d045795bf2cb7"
       }
     },
     "support": {
-      "version": "1.1.1",
+      "version": "1.1.2",
       "files": {
-        "CLAUDE.md": "ff42515f210dfdbeb1b14992012177ad8513323a340a0d4fe69a6ec13773db5a",
+        "CLAUDE.md": "9b35a7df9335e69278c261f3e68944a4fea87c495c2ff500c14990dc8a6c7337",
         "admin/css/index.css": "bad02a487ebb131b64ee55e2a4533c8b79d6ada80fffd34b0952bf3b68204a36",
         "admin/lib/kit.js": "22f02768625bcad9d9c8e64bf0a8fe95f7c5ff6dcf8abb189df8203362a7a4e1",
         "admin/templates/support.html": "2bb69d0443a367a402e6160fe68f4af3e8983b578cfff9575b4df9a534fcb480",
         "admin/views/desk.js": "ac043630ad08c8f2053f3f908be18586d9a4798976d20427cf5215ee042c807c",
         "admin/views/inbox.js": "f570595d7b2c831d151e0aaf85ff903e6e2b7066124b3f9d23c2c24f5b1734cf",
-        "admin/views/support.js": "360a50ff54b81f93fcd6fb6949710e0cff5d342bb8573408415ef3faf3fd29ff",
+        "admin/views/support.js": "4be6cce46067ee7af140f43253da36e060add2a9190e91f013fd1aad668fcd7b",
         "collections/support-tickets.json": "55a0856bacd66c2e8f1e3c85bdf3638e5ff826560943cda854a8f2d336a88905",
         "config.js": "eb7ccc1169fa8b2be52a213536825492fedaec5fa73fd749cba9f498dd54b503",
+        "docs/guide.md": "d0d38dacbdf68bfaba1ed4e62c8d182372a683d255a8ff75ca57bd0be2a0b082",
         "lib/mail.js": "d14aae3a59aad6af61451863cdaaf94fc4a87810b16e1dcb9c655dda6c803b3b",
-        "lib/receiver.js": "b95c569932c261a48849f0a6b7005f649d9c2a50d319b098a47d02da9363050c",
+        "lib/receiver.js": "64c292281bde5a942de4d04a16911d0730a4da7e80ce6d91a9da864b9f886b59",
         "lib/sender.js": "b20aaee34ade89814a897f68467f9902693843fa6b5c8eb0090c4059193c8227",
         "lib/shape.js": "04d840b589d20700ccb2cfa4c72072f8d9f8e03f0573e2ea1177a7a83a383bea",
         "plugin.js": "e3c50a05fa99cb24375782bbb3ca8c58cf5ddc3036937e6115f4d963715c120e",
-        "plugin.json": "85ea5009e63d12ddbcf2be9d0df330827e3bf3babd35deddd47fce1da807049e",
+        "plugin.json": "c45819016588e7e26426830ce30fd6d7561b61ffcac2a8ad48bb4c178c138188",
         "tests/api.test.js": "1fa87f6ae12c48fc34a5fb2b5bbeed6cfaa36329610674d4fae05d64734dbb15",
         "tests/shape.test.js": "364c6b7680699f59fcd449cd448184486488838300f155135daea4c05387cf74"
       }

package/plugins/mail-reader/CLAUDE.md

@@ -108,3 +108,9 @@ Right-click on the open message is engine code (`_lib/admin/mail/body-menu.js`,
 The page-size picker under the list is engine code (`listPageSize()`/`pageAfterResize()` in
 `_lib/admin/mail/settings-section.js`, sent as `limit` by `reader-view.js`, capped by `maxListLimit`);
 this version only documents it in docs/guide.md. 0.116.8 is already released, so it can ship now.
+
+## Private hosts refused (guide only, 1.2.7, 2026-10-13; engine `_lib/mail/hostGuard.js`)
+
+Saving or testing a mailbox on a private, loopback or link-local address is refused by the shared read routes
+unless it is the site's own outgoing server or `allowPrivateMailHosts` is set; `/accounts/test` is limited to
+10 a minute. Engine code - this version only documents the option in docs/guide.md. Ship with the matching core.

package/plugins/mail-reader/docs/guide.md

@@ -99,6 +99,7 @@ Whoever runs the site can change these in the plugin's configuration file (`conf
 | `listLimit` | 50 | Messages per page until you pick another size under the list |
 | `allowRemoteImages` | false | Load remote images without asking |
 | `allowInsecureTLS` | false | Accept mail server certificates that do not verify (see Tips) |
+| `allowPrivateMailHosts` | false | Let a mailbox be on the site's own private network (a LAN or loopback address). Off, a mailbox on such an address is refused; the site's own outgoing server is always allowed |
 | `connectionTimeoutMs` | 20000 | How long to wait for a mail server, in milliseconds |
 | `maxConnections` | 20 | Most mail server connections kept open at once |
 | `maxMessageBytes` | 25000000 | Largest message that will be opened, in bytes |

package/plugins/mail-reader/plugin.json

@@ -1,11 +1,11 @@
 {
   "name": "mail-reader",
   "displayName": "Mail Reader",
-  "version": "1.2.6",
+  "version": "1.2.7",
   "tier": "free",
   "description": "Read-only IMAP mailbox reader. Connects to a standard IMAP server and reads mail without ever writing to it.",
   "author": "Darryl Waterhouse",
-  "date": "2026-09-27",
+  "date": "2026-10-13",
   "icon": "mail",
   "uses": {
     "contacts": "Add sender to contacts"

package/plugins/shopping-cart/CLAUDE.md

@@ -94,7 +94,8 @@ A cached page can show a stale stock flag until it is re-rendered; checkout re-p
 - Storefront CSS tokens are defined on `body`, not `:root`: themes set --dm-* on body's dm-theme-* class.
 - The site's own input/link styles reach the storefront: see the "reach in here" block at the end of shop.css.
 - `siteBase()` uses `request.host` (with the port); `request.hostname` drops it under Fastify 5.
-- A test site on a non-standard port needs `site.baseUrl` for Stripe/PayPal return addresses behind a proxy.
+- A test site on a non-standard port needs `site.baseUrl` for Stripe/PayPal return addresses behind a proxy, and
+  emails have no links to the order until it (or a real sign-in) gives the site a trusted address (1.6.1).
 - Admin views: item templates live in JS (a templateUrl goes through _.render); checkboxes are set after render
   and listened to; slideovers via kit.openPanel (disposed and removed on close).
 
@@ -156,3 +157,63 @@ these, behaves as 1.1.
   offline instructions; on the order and in `publicOrder`.
 - **`services.refund(id, {note, restock, viaProvider})`** - the admin's refund (through Stripe / PayPal first),
   `refundOrder()` in plugin.js, shared by `POST /orders/:id/refund`.
+
+## 1.4.0: customer accounts (optional; plan dcms-marketplace/docs/customer-accounts-plan.md)
+
+`settings.accounts` (off by default). `lib/accounts.js`, routes `/account/*`, pages `<shop>/account`, `/account/confirm`,
+`/account/reset` (plugin.public.js -> `accountHtml`; `public/account.js` does the work), browser session in
+`public/lib/session.js` (shared with extensions - Takeaway imports it).
+- A customer = core user, role `shop-customer` (roles/shop-customer.json: no permissions, admin confined to My Profile),
+  created INACTIVE with `meta.shop.pending` {hash, until (48 h)}; the emailed link activates it. Register answers the
+  same for a taken email (the holder is emailed instead) - no account discovery. A pending account that ran out is
+  replaced. A confirmation email that fails removes the account again (502). Needs SMTP (`mailReady`).
+- Signing in, refresh, logout and the new password are CORE's routes (`/api/auth/login|refresh|logout|reset-password`);
+  the Cart issues core's reset token (`issueResetToken`) and mails a link to `<shop>/account/reset`, never /admin.
+  Tokens live in localStorage `dm-shop:account`; account routes take core's Bearer (`authenticate`).
+- An account's orders = orders with its (confirmed) email, any time - nothing linked. `meta.shop` keeps phone and up
+  to 8 addresses. Delete my account: customers only (staff 409), with the password; orders stay.
+- Checkout fills in a signed-in customer (details + first saved address); the receipt offers "Save your details"
+  (`[data-shop-join]`); the storefront and basket link to the account page.
+- Extension hook `account(order, {settings})` -> HTML beside the order on the account page (`registry.accountParts`;
+  `receiptParts` and it share `registry.parts(kind)`). Takeaway: Reorder.
+- Trap fixed on the way: `if (await fail(reply, …))` - awaiting a Fastify reply resolves EMPTY once sent, so the route
+  ran on after its 404. `accountsOff` returns a boolean and sends the reply on the side.
+
+## 1.5.0: Sales (plan dcms-marketplace/docs/sales-commission-tenancy-plan.md, part 1)
+
+A **Sales** tab (admin/views/sales.js): ranges (today, this week, last 7 days, this month, last month, last 30 days,
+this year, dates), by day / week / month; tiles, takings chart, where it came from, how it was paid, the figures, a
+table of periods, CSV. `GET /sales?range|from&to&by`, `GET /sales.csv` (shop:read). All figures are `lib/sales.js` (PURE):
+- A sale = paid / fulfilled / refunded order, dated by `paidAt` in the shop's zone (`settings.timeZone`, Europe/London
+  unless set - there is no setting in the UI yet); a refund dated by `refundedAt`, so a period's net is what stayed.
+- Sources per line: `takeaway` (ref takeaway:…), `addons` (any other ref), `downloads` (a product Pro gave a link or
+  key for on that order), `shop`. Line amounts are before discounts; discount, delivery and tax are order-level.
+- `admin/lib/chart.js` - the one bar chart (single series, primary hue, rounded ends, tooltips), shared with Overview.
+
+## 1.6.0: platform commission (plan part 2; the manager side is site-manager's Customers › Commission)
+
+A value on each sale, per tenant, set by the platform's super admin on the manager - which writes this site's rates to
+`config/commission.json` (`{rates: {default?, shop?, takeaway?, addons?: {percent, fixed}}, updatedAt, by}`); the
+Cart only READS it (`lib/commission.js currentCommission`, re-read when the file's mtime changes - no restart).
+- When an order becomes paid (`markPaid`, `moveOrder` -> paid) it gets `order.data.commission` = `{type, base, percent,
+  fixed, amount, at}` - the rate of that day, kept for good (a later rate never rewrites it). `percent` is of the
+  order total; `fixed` per sale; never more than the sale; a free order gets none. Type: `takeaway` (ref takeaway:),
+  `addons` (other ref), `shop`. A refund sets `reversed`, `reversedAt`.
+- Never shown to the customer (`publicOrder` leaves it out). Shown to the shop: Sales (commission, returned, after
+  commission; a CSV column), the order, Shop settings › Payment ("set by your provider" - read-only).
+- The manager's statements add up what the orders carry - nothing is recalculated there.
+
+## 1.6.1 (2026-10-13): no Host headers in email links; confirm says nothing; refunds under the lock
+
+- `siteBase(request)` is for a payment provider's return addresses only (Site URL, else the shopper's own origin) and
+  remembers nothing: a forged Host on one `/quote` used to become the address - with the receipt tokens - in every email
+  until the next request. Email links use `quietBase()` (async: Site URL, else core's `trustedOrigin` - an address someone
+  has really signed in on, as password resets do), exposed to extensions as `services.linkBase()`; `services.siteBase()`
+  stays sync and is the Site URL or ''. `receiptUrl` is '' when there is none and the log says so once; `startCheckout`
+  prefers the Site URL to the extension's `base`. Account confirm and forgotten-password links use the same rule for the
+  request (`linkBase(request)`); with no trusted address, register answers 409 and forgot sends nothing.
+- `POST /account/confirm` needs the token (shape-checked) and a waiting account, answers `{confirmed: true}` only, and
+  is off when accounts are: user ids are public (`createdBy`), so "already confirmed -> here is the email" leaked emails.
+- `refundOrder` runs under `withLock` (provider call and `moveOrderNow` in one), and Stripe refunds carry
+  `Idempotency-Key: shopping-cart-refund-<orderId>` (sessions: `shop-session-<orderId>`) so a retry after a timeout
+  returns the first result.

package/plugins/shopping-cart/admin/css/index.css

@@ -224,3 +224,19 @@ a.shp-tile:hover { border-color: var(--dm-primary); }
 .shp-copy code { flex: 1; overflow-wrap: anywhere; font-size: var(--dm-text-xs); }
 .shp-steps li .shp-step-btns { grid-column: 3; grid-row: 1 / 3; display: flex; gap: .3rem; color: inherit; font-size: inherit; }
 .shp-steps li .shp-step-btns .btn { grid-column: auto; grid-row: auto; }
+
+/* Sales */
+.shp-sales { display: flex; flex-direction: column; gap: 1rem; }
+.shp-sales-bar { display: flex; flex-wrap: wrap; align-items: center; gap: .6rem; }
+.shp-sales-custom { display: inline-flex; align-items: center; gap: .4rem; }
+.shp-sales-custom input { width: auto; padding-top: .25rem; padding-bottom: .25rem; }
+.shp-sales-cols { display: grid; grid-template-columns: repeat(auto-fit, minmax(20rem, 1fr)); gap: 1rem; }
+.shp-sales-note { margin: .6rem 0 0; font-size: var(--dm-text-sm); }
+.shp-sales-table { width: 100%; border-collapse: collapse; font-variant-numeric: tabular-nums; font-size: var(--dm-text-sm); }
+.shp-sales-table th, .shp-sales-table td { padding: .4rem .5rem; border-bottom: 1px solid var(--dm-border); text-align: right; }
+.shp-sales-table th:first-child, .shp-sales-table td:first-child { text-align: left; font-weight: 500; }
+.shp-sales-table thead th { color: var(--dm-text-muted); font-size: var(--dm-text-xs); font-weight: 600; }
+.shp-sales-table tr.is-sum th, .shp-sales-table tr.is-sum td { font-weight: 600; }
+.shp-sales-table tr.is-total th, .shp-sales-table tr.is-total td { font-weight: 800; font-size: 1rem; border-bottom: 0; }
+.shp-sales-table tr.is-muted th, .shp-sales-table tr.is-muted td { color: var(--dm-text-muted); font-weight: 400; }
+.shp-sales-periods summary { cursor: pointer; font-weight: 600; }

package/plugins/shopping-cart/admin/lib/chart.js

@@ -0,0 +1,64 @@
+/**
+ * The Shop's one chart: a single series of bars - one hue (the theme's primary), 2px apart, 4px rounded ends on the
+ * baseline, a recessive grid with three ticks, three date labels, and a tooltip on hover or keyboard focus. Shared by
+ * the Overview and Sales. One series, so no legend: the card's title names it.
+ *
+ * @module shopping-cart/admin/lib/chart
+ */
+import {esc} from './kit.js';
+
+/** A round top for the axis: 1, 2 or 5 × a power of ten, in minor units. */
+export function niceMax(v) {
+    if (v <= 0) return 1000;
+    const p = 10 ** Math.floor(Math.log10(v));
+    for (const m of [1, 2, 5, 10]) if (m * p >= v) return m * p;
+    return 10 * p;
+}
+
+/**
+ * @param {HTMLElement} el
+ * @param {{value: number, label: string, tip: string}[]} series - `label` under the axis, `tip` beside the value
+ * @param {{money: Function, ariaLabel: string, scope: Function}} o
+ */
+export function barChart(el, series, {money, ariaLabel, scope}) {
+    const W = Math.max(360, Math.round(el.clientWidth) || 600), H = 170, padL = 44, padB = 22, padT = 8;
+    const top = niceMax(Math.max(0, ...series.map(d => d.value)));
+    const n = series.length || 1;
+    const slot = (W - padL) / n;
+    const bw = Math.max(2, slot - 2);
+    const y = (v) => padT + (H - padT - padB) * (1 - v / top);
+    const bars = series.map((d, i) => {
+        const x = padL + i * slot + 1;
+        const h = Math.max(0, H - padB - y(Math.max(0, d.value)));
+        const r = Math.min(4, bw / 2, h);
+        const path = h > 0 ? `M${x},${H - padB} v${-(h - r)} q0,${-r} ${r},${-r} h${bw - 2 * r} q${r},0 ${r},${r} v${h - r} z` : '';
+        return `<g class="shp-bar" data-i="${i}" tabindex="0" aria-label="${esc(d.label)}: ${esc(money(d.value))}, ${esc(d.tip)}">
+  <rect x="${padL + i * slot}" y="${padT}" width="${slot}" height="${H - padT - padB}" fill="transparent"/>
+  ${path ? `<path d="${path}"/>` : `<rect class="shp-bar-zero" x="${x}" y="${H - padB - 1}" width="${bw}" height="1"/>`}
+</g>`;
+    }).join('');
+    const at = [...new Set([0, Math.floor((n - 1) / 2), n - 1])].filter(i => series[i]);
+    const labels = at.map(i => `<text x="${padL + i * slot + slot / 2}" y="${H - 6}" text-anchor="middle">${esc(series[i].label)}</text>`).join('');
+    el.innerHTML = `<svg viewBox="0 0 ${W} ${H}" role="img" aria-label="${esc(ariaLabel)}">
+  ${[0, top / 2, top].map(t => `<line class="shp-gridline" x1="${padL}" x2="${W}" y1="${y(t)}" y2="${y(t)}"/><text class="shp-axis" x="${padL - 6}" y="${y(t) + 4}" text-anchor="end">${esc(money(t, {compact: true}))}</text>`).join('')}
+  ${bars}
+  <g class="shp-axis">${labels}</g>
+</svg><div class="shp-tip" hidden></div>`;
+    const tip = el.querySelector('.shp-tip');
+    const show = (g) => {
+        const d = series[Number(g.dataset.i)];
+        tip.innerHTML = `<strong>${esc(money(d.value))}</strong><span>${esc(d.label)} · ${esc(d.tip)}</span>`;
+        tip.hidden = false;
+        const r = g.getBoundingClientRect(), box = el.getBoundingClientRect();
+        tip.style.left = `${Math.min(box.width - 140, Math.max(0, r.left - box.left + r.width / 2 - 70))}px`;
+        el.querySelectorAll('.shp-bar.is-on').forEach(b => b.classList.remove('is-on'));
+        g.classList.add('is-on');
+    };
+    const hide = () => { tip.hidden = true; el.querySelectorAll('.shp-bar.is-on').forEach(b => b.classList.remove('is-on')); };
+    const over = (e) => { const g = e.target.closest('.shp-bar'); if (g) show(g); };
+    el.addEventListener('mouseover', over);
+    el.addEventListener('focusin', over);
+    el.addEventListener('mouseleave', hide);
+    el.addEventListener('focusout', hide);
+    scope?.(() => { el.removeEventListener('mouseover', over); el.removeEventListener('focusin', over); el.removeEventListener('mouseleave', hide); el.removeEventListener('focusout', hide); });
+}

package/plugins/shopping-cart/admin/lib/kit.js

@@ -42,6 +42,21 @@ export function loadKit() {
 const seg = (id) => encodeURIComponent(String(id));
 export const api = {
     summary: () => H.get(`${BASE}/summary`),
+    sales: (q) => H.get(`${BASE}/sales?${new URLSearchParams(Object.entries(q).filter(([, v]) => v && v !== 'custom'))}`),
+    /** The CSV: fetched with the session (authenticate is Bearer-only) and saved as a file. */
+    async salesCsv(q) {
+        let token = null;
+        try { token = S.get('auth_token'); } catch { /* none */ }
+        const res = await fetch(`${BASE}/sales.csv?${new URLSearchParams(Object.entries(q).filter(([, v]) => v && v !== 'custom'))}`, {headers: token ? {Authorization: `Bearer ${token}`} : {}});
+        if (!res.ok) throw new Error(`the server answered ${res.status}`);
+        const name = (res.headers.get('content-disposition') || '').match(/filename="([^"]+)"/)?.[1] || 'sales.csv';
+        const a = document.createElement('a');
+        a.href = URL.createObjectURL(await res.blob());
+        a.download = name;
+        document.body.appendChild(a);
+        a.click();
+        setTimeout(() => { URL.revokeObjectURL(a.href); a.remove(); }, 1000);
+    },
     extensions: () => H.get(`${BASE}/extensions`),
     products: {
         list: () => H.get(`${BASE}/products`),

package/plugins/shopping-cart/admin/views/orders.js

@@ -301,6 +301,7 @@ ${(d.lines || []).map(l => `<tr><td class="q">${l.qty}</td><td>${esc(l.name)}${l
   <label class="form-label">Staff note <span data-help="Only you see this. Saved when you click away."></span></label>
   <textarea class="form-input" rows="2" data-model="staffNote.value" data-part="staff" placeholder="Wrapped as a gift, sent second class…"></textarea>
   ${d.paymentRef || d.providerRef ? `<p class="shp-muted shp-ref">Payment reference: <code>${esc(d.paymentRef || d.providerRef)}</code></p>` : ''}
+  ${d.commission ? `<p class="shp-muted shp-ref">Platform commission: ${esc(money(d.commission.amount))} (${esc(`${d.commission.percent}%${d.commission.fixed ? ` + ${money(d.commission.fixed)}` : ''}`)})${d.commission.reversed ? ' - returned with the refund' : ''}</p>` : ''}
   ${ext.length ? `<div class="shp-ext">${ext.map(x => `<span class="shp-chip is-muted">${esc(x.k)}: ${esc(String(x.v))}</span>`).join('')}</div>` : ''}
   <div data-part="ext-panels" hidden></div>
   <h4>History</h4>

package/plugins/shopping-cart/admin/views/overview.js

@@ -7,6 +7,7 @@
  * steps to its first sale instead.
  */
 
+import {barChart} from '../lib/chart.js';
 import {api, esc, fmtDate, money, when} from '../lib/kit.js';
 import {STATUS_LABEL, STATUS_TONE} from '/plugins/shopping-cart/public/lib/orders.js';
 
@@ -157,58 +158,8 @@ export async function mount(root, ctx) {
     I.scan(view);
 }
 
-/** Thirty bars, 2px apart, rounded tops on the baseline; hover (or focus) says the day and the takings. */
+/** Thirty days of takings, one bar a day. */
 function drawChart(el, series, scope) {
-    const W = Math.max(360, Math.round(el.clientWidth) || 600), H = 170, padL = 44, padB = 22, padT = 8;
-    const max = Math.max(...series.map(d => d.revenue));
-    const top = niceMax(max);
-    const n = series.length;
-    const slot = (W - padL) / n;
-    const bw = Math.max(2, slot - 2);
-    const y = (v) => padT + (H - padT - padB) * (1 - v / top);
-    const ticks = [0, top / 2, top];
-    const day = (k) => fmtDate(k);
-    const bars = series.map((d, i) => {
-        const x = padL + i * slot + 1;
-        const h = Math.max(0, H - padB - y(d.revenue));
-        const r = Math.min(4, bw / 2, h);
-        const path = h > 0
-            ? `M${x},${H - padB} v${-(h - r)} q0,${-r} ${r},${-r} h${bw - 2 * r} q${r},0 ${r},${r} v${h - r} z`
-            : '';
-        return `<g class="shp-bar" data-i="${i}" tabindex="0" aria-label="${esc(day(d.day))}: ${esc(money(d.revenue))}, ${d.orders} orders">
-  <rect x="${padL + i * slot}" y="${padT}" width="${slot}" height="${H - padT - padB}" fill="transparent"/>
-  ${path ? `<path d="${path}"/>` : `<rect class="shp-bar-zero" x="${x}" y="${H - padB - 1}" width="${bw}" height="1"/>`}
-</g>`;
-    }).join('');
-    const labels = [0, Math.floor(n / 2), n - 1].map(i => `<text x="${padL + i * slot + slot / 2}" y="${H - 6}" text-anchor="middle">${esc(day(series[i].day))}</text>`).join('');
-    el.innerHTML = `<svg viewBox="0 0 ${W} ${H}" role="img" aria-label="Takings for each of the last 30 days">
-  ${ticks.map(t => `<line class="shp-gridline" x1="${padL}" x2="${W}" y1="${y(t)}" y2="${y(t)}"/><text class="shp-axis" x="${padL - 6}" y="${y(t) + 4}" text-anchor="end">${esc(money(t, {compact: true}))}</text>`).join('')}
-  ${bars}
-  <g class="shp-axis">${labels}</g>
-</svg><div class="shp-tip" hidden></div>`;
-    const tip = el.querySelector('.shp-tip');
-    const show = (g) => {
-        const d = series[Number(g.dataset.i)];
-        tip.innerHTML = `<strong>${esc(money(d.revenue))}</strong><span>${esc(day(d.day))} · ${d.orders} order${d.orders === 1 ? '' : 's'}</span>`;
-        tip.hidden = false;
-        const r = g.getBoundingClientRect(), box = el.getBoundingClientRect();
-        tip.style.left = `${Math.min(box.width - 120, Math.max(0, r.left - box.left + r.width / 2 - 60))}px`;
-        el.querySelectorAll('.shp-bar.is-on').forEach(b => b.classList.remove('is-on'));
-        g.classList.add('is-on');
-    };
-    const hide = () => { tip.hidden = true; el.querySelectorAll('.shp-bar.is-on').forEach(b => b.classList.remove('is-on')); };
-    const over = (e) => { const g = e.target.closest('.shp-bar'); if (g) show(g); };
-    el.addEventListener('mouseover', over);
-    el.addEventListener('focusin', over);
-    el.addEventListener('mouseleave', hide);
-    el.addEventListener('focusout', hide);
-    scope(() => { el.removeEventListener('mouseover', over); el.removeEventListener('focusin', over); });
-}
-
-/** A round top for the axis: 1, 2 or 5 × a power of ten, in minor units. */
-function niceMax(v) {
-    if (v <= 0) return 1000;
-    const p = 10 ** Math.floor(Math.log10(v));
-    for (const m of [1, 2, 5, 10]) if (m * p >= v) return m * p;
-    return 10 * p;
+    barChart(el, series.map(d => ({value: d.revenue, label: fmtDate(d.day), tip: `${d.orders} order${d.orders === 1 ? '' : 's'}`})),
+        {money, ariaLabel: 'Takings for each of the last 30 days', scope});
 }