domma-cms 1.6.36 → 1.6.38

package/admin/dist/domma/domma-tools.css

@@ -1,9 +1,9 @@
 /*!
- * Domma Tools CSS v0.51.11
+ * Domma Tools CSS v0.51.12
  * Dynamic Object Manipulation & Modeling API
  * (c) 2026 Darryl Waterhouse & DCBW-IT
- * Built: 2026-10-12T06:05:33.864Z
- * Commit: a53de2f
+ * Built: 2026-10-13T13:46:21.895Z
+ * Commit: ce9f5f1
  */
 
 /*!

package/admin/dist/domma/domma-tools.min.js

@@ -1,9 +1,9 @@
 /*!
- * Domma Tools v0.51.11
+ * Domma Tools v0.51.12
  * Developer tools: Theme Roller & Page Roller
  * (c) 2026 Darryl Waterhouse & DCBW-IT
- * Built: 2026-10-12T06:05:20.912Z
- * Commit: a53de2f
+ * Built: 2026-10-13T13:46:07.193Z
+ * Commit: ce9f5f1
  *
  * Requires: domma.min.js
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "1.6.36",
+  "version": "1.6.38",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",
@@ -84,7 +84,7 @@
     "@fastify/rate-limit": "^10.3.0",
     "@fastify/static": "9.1.1",
     "bcryptjs": "^3.0.3",
-    "domma-js": "0.51.11",
+    "domma-js": "0.51.12",
     "dotenv": "^17.2.3",
     "fastify": "5.8.5",
     "gray-matter": "^4.0.3",

package/plugins/_lib/admin/mail/compose-window.js

@@ -664,6 +664,7 @@ export function openCompose({
             html,
             inReplyTo: draft.inReplyTo ?? null,
             references: draft.references ?? [],
+            sourceMessage: draft.sourceMessage ?? null,
             attachments: attachments.peek().map(({filename, contentType, content}) =>
                 ({filename, contentType, content}))
         };
@@ -789,6 +790,9 @@ export function openCompose({
                         : 'Sent. No copy could be filed in Sent.',
                     {type: result.filedTo ? 'success' : 'warning'}
                 );
+                if (result.messageAction && !result.messageAction.recorded) {
+                    E.toast('Sent, but the original message could not be marked as replied to or forwarded.', {type: 'warning'});
+                }
                 onSent(result);
             }
         } catch (err) {

package/plugins/_lib/admin/mail/mail.css

@@ -1 +1 @@
-#view-container.mail-fullbleed{max-width:none}.mail-layout [hidden],.dm-slideover [hidden]{display:none!important}.mail-reader-summary{display:flex;align-items:baseline;gap:.5rem;flex-wrap:wrap}.mail-header-toggle,.mail-extras-toggle{padding:0!important;font-size:.78rem;opacity:.75;text-decoration:underline}.mail-header-toggle:hover,.mail-extras-toggle:hover{opacity:1}.mail-header-details{display:grid;grid-template-columns:max-content 1fr;gap:.15rem .75rem;margin:.5rem 0 0;font-size:.8rem}.mail-header-details dt{opacity:.65}.mail-header-details dd{margin:0;overflow-wrap:anywhere}.mail-layout{display:grid;grid-template-columns:var(--mail-col-1, 190px) auto var(--mail-col-2, 340px) auto 1fr;height:calc(100vh - 140px);min-height:320px;border:1px solid var(--dm-border, #e2e8f0);border-radius:var(--dm-radius-md, 8px);overflow:hidden;background:var(--dm-surface, #fff)}.mail-folders-pane,.mail-list-pane{display:flex;flex-direction:column;border-right:1px solid var(--dm-border, #e2e8f0);min-width:0;min-height:0}.mail-reader-pane{display:flex;flex-direction:column;min-width:0;min-height:0}.mail-pane-head{display:flex;align-items:center;justify-content:space-between;gap:.5rem;padding:.5rem .75rem;font-size:.8rem;font-weight:600;text-transform:uppercase;letter-spacing:.04em;color:var(--dm-text-muted, #64748b);border-bottom:1px solid var(--dm-border, #e2e8f0);flex-shrink:0}.mail-folders-list,.mail-list{overflow-y:auto;flex:1;min-height:0}.mail-search{display:flex;align-items:center;gap:.4rem;padding:.4rem .6rem;border-bottom:1px solid var(--dm-border, #e2e8f0);color:var(--dm-text-muted, #64748b);flex-shrink:0}.mail-search input{flex:1;min-width:0;font-size:.85rem;padding:.25rem .4rem}.mail-search-note{padding:.3rem .6rem;font-size:.74rem;color:var(--dm-text-muted, #64748b);border-bottom:1px solid var(--dm-border, #e2e8f0);flex-shrink:0}.mail-slideover-resizer{padding:0;position:absolute;left:0;top:0;bottom:0;width:6px;cursor:col-resize;z-index:2;background:transparent}.mail-slideover-resizer:hover,.is-resizing>.mail-slideover-resizer{background:var(--dm-primary, #2563eb);opacity:.7}.is-resizing{user-select:none;transition:none!important}.mail-selection{display:flex;align-items:center;gap:.35rem;flex-wrap:wrap;padding:.35rem .6rem;font-size:.78rem;background:var(--dm-primary, #2563eb);color:var(--dm-primary-text, #fff);flex-shrink:0}.mail-selection span{flex:1;min-width:0}.mail-selection .btn{color:var(--dm-primary-text, #fff);border:1px solid currentColor;background:transparent}.mail-selection .btn:hover{background:color-mix(in srgb,var(--dm-primary-text, #fff) 15%,transparent)}.mail-item.is-selected{background:var(--dm-active-bg, rgba(15, 23, 42, .07));box-shadow:inset 3px 0 0 var(--dm-primary, #2563eb)}.mail-undo{display:flex;align-items:center;gap:.5rem;padding:.4rem .6rem;font-size:.78rem;background:var(--dm-active-bg, rgba(15, 23, 42, .07));border-bottom:1px solid var(--dm-border, #e2e8f0);flex-shrink:0}.mail-undo span{flex:1;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.mail-splitter{width:5px;cursor:col-resize;background:var(--dm-border, #e2e8f0);flex-shrink:0;background-clip:content-box;border-left:2px solid transparent;border-right:2px solid transparent;box-sizing:content-box}.mail-splitter:hover,.mail-layout.is-resizing .mail-splitter{background-color:var(--dm-primary, #2563eb)}.mail-layout.is-resizing{user-select:none}.mail-layout.is-resizing .mail-folders-pane,.mail-layout.is-resizing .mail-list-pane,.mail-layout.is-resizing .mail-reader-pane,.mail-layout.is-resizing iframe{pointer-events:none}.mail-unread-filter{display:flex;align-items:center;gap:.3rem;font-size:.7rem;text-transform:none;letter-spacing:0;cursor:pointer;margin-left:auto;margin-right:.25rem}.mail-unread-pill{flex-shrink:0;min-width:1.15rem;padding:0 .3rem;border-radius:999px;background:var(--dm-primary, #2563eb);color:var(--dm-primary-text, #fff);font-size:.66rem;font-weight:700;line-height:1.35;text-align:center}.mail-folder.is-context .mail-folder-name{opacity:.6}.mail-account{display:flex;align-items:center;gap:.4rem;width:100%;padding:.45rem .6rem;border:none;background:var(--dm-surface, #fff);cursor:pointer;text-align:left;font-size:.78rem;font-weight:700;text-transform:uppercase;letter-spacing:.03em;color:var(--dm-text-muted, #64748b)}.mail-account:hover{background:var(--dm-hover-bg, rgba(15, 23, 42, .04))}.mail-account.is-active{color:var(--dm-text, #1e293b);position:sticky;top:0;z-index:1;background:var(--dm-surface, #fff)}.mail-account-name{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.mail-folder{display:flex;align-items:center;gap:.5rem;padding:.45rem .75rem;font-size:.875rem;cursor:pointer;border:none;background:none;width:100%;text-align:left;color:var(--dm-text, #1e293b)}.mail-folder:hover{background:var(--dm-hover-bg, rgba(15, 23, 42, .04))}.mail-folder.is-active{background:var(--dm-active-bg, rgba(15, 23, 42, .07));color:var(--dm-primary, #2563eb);font-weight:600}.mail-folder.is-unselectable{opacity:.6;cursor:default}.mail-folder.is-unselectable:hover{background:none}.mail-folder-name{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.mail-item{display:block;width:100%;text-align:left;padding:.55rem .75rem;border:none;border-bottom:1px solid var(--dm-border, #e2e8f0);background:none;cursor:pointer;color:var(--dm-text, #1e293b)}.mail-item:hover{background:var(--dm-hover-bg, rgba(15, 23, 42, .04))}.mail-item.is-active{background:var(--dm-active-bg, rgba(15, 23, 42, .07))}.mail-item-top{display:flex;justify-content:space-between;gap:.5rem;align-items:baseline}.mail-item-from{font-size:.85rem;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.mail-item.is-unread .mail-item-from,.mail-item.is-unread .mail-item-subject{font-weight:700}.mail-item-date{font-size:.72rem;color:var(--dm-text-muted, #64748b);flex-shrink:0}.mail-item-subject{font-size:.82rem;margin-top:.1rem;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.mail-item-meta{display:flex;align-items:center;gap:.35rem;margin-top:.15rem;color:var(--dm-text-muted, #64748b)}.mail-pager{display:flex;align-items:center;justify-content:space-between;gap:.5rem;padding:.4rem .6rem;border-top:1px solid var(--dm-border, #e2e8f0);font-size:.75rem;color:var(--dm-text-muted, #64748b);flex-shrink:0}.mail-reader-head{padding:.75rem 1rem;border-bottom:1px solid var(--dm-border, #e2e8f0);flex-shrink:0}.mail-reader-head:empty{display:none}.mail-reader-subject{font-size:1.05rem;font-weight:600;margin:0 0 .3rem;color:var(--dm-text, #1e293b)}.mail-reader-actions{display:flex;gap:.25rem;margin:.1rem 0 .35rem;flex-wrap:wrap}.mail-reader-meta{font-size:.8rem;color:var(--dm-text-muted, #64748b)}.mail-reader-body{flex:1;position:relative;overflow:hidden;display:flex;flex-direction:column;min-height:0;background:var(--dm-surface, #fff)}.mail-reader-body iframe{width:100%;flex:1;border:none;display:block;background:#fff}.mail-notice{display:flex;align-items:center;gap:.5rem;flex-wrap:wrap;padding:.4rem .75rem;font-size:.78rem;background:var(--dm-warning, #8a6d1f);color:var(--dm-warning-text, #fff);border-bottom:1px solid var(--dm-border, #e2e8f0)}.mail-notice .btn{color:var(--dm-warning-text, #fff);border:1px solid currentColor;background:transparent;opacity:.95}.mail-notice .btn:hover{background:color-mix(in srgb,var(--dm-warning-text, #fff) 15%,transparent);opacity:1}.mail-attachments{display:flex;flex-wrap:wrap;gap:.4rem;padding:.5rem .75rem;border-bottom:1px solid var(--dm-border, #e2e8f0);background:var(--dm-background-alt, rgba(15, 23, 42, .03))}.mail-empty{display:flex;flex-direction:column;align-items:center;justify-content:center;gap:.5rem;height:100%;color:var(--dm-text-muted, #94a3b8);text-align:center;padding:1rem}.mail-empty p{margin:0;font-size:.875rem}@media(max-width:900px){.mail-layout{grid-template-columns:1fr;height:auto!important}.mail-splitter{display:none}.mail-folders-pane,.mail-list-pane{border-right:none;border-bottom:1px solid var(--dm-border, #e2e8f0)}.mail-folders-list,.mail-list{max-height:240px}.mail-reader-body{min-height:60vh}}.mail-box-row{display:flex;align-items:center;gap:.5rem;padding:.5rem .6rem;border:1px solid var(--dm-border, #e2e8f0);border-radius:var(--dm-radius-md, 6px)}.mail-default-badge{margin-left:.4rem;font-size:.7rem;font-weight:500;vertical-align:middle}.mail-item.is-dragging{opacity:.45}.mail-folder.is-drop-target{background:var(--dm-primary, #2563eb);color:var(--dm-primary-text, #fff);outline:2px solid var(--dm-primary, #2563eb);outline-offset:-2px}.mail-folder.is-drop-target .mail-folder-name,.mail-folder.is-drop-target .mail-unread-pill{color:inherit}.mail-item.is-dragging *{pointer-events:none}.mail-item{position:relative}.mail-item-tick{position:absolute;left:.45rem;top:.55rem;display:inline-flex;opacity:0;color:var(--dm-text-muted, #64748b);transition:opacity .12s ease;padding:2px;margin:-2px;border-radius:var(--dm-radius-sm, 3px)}.mail-item:hover .mail-item-tick,.mail-item:focus-visible .mail-item-tick,.mail-list.is-selecting .mail-item-tick,.mail-item-tick[aria-checked=true]{opacity:1}.mail-item-tick[aria-checked=true]{color:var(--dm-primary, #2563eb)}.mail-item-tick:hover{color:var(--dm-primary, #2563eb);background:var(--dm-hover-bg)}.mail-item-top,.mail-item-subject,.mail-item-meta{padding-left:1.5rem}.mail-select-all{display:inline-flex;align-items:center;margin-right:.1rem;cursor:pointer}.mail-select-all input{cursor:pointer;margin:0}.sr-only{position:absolute;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;clip:rect(0,0,0,0);white-space:nowrap;border:0}.mail-item-meta>span{display:inline-flex}.mail-item-meta .is-high{color:var(--dm-danger, #dc2626)}.mail-item-meta .is-low{color:var(--dm-text-muted, #64748b);opacity:.7}.mail-folder.is-hidden-folder .mail-folder-name{opacity:.5;font-style:italic}.mail-thread-chip{display:inline-flex;align-items:center;margin-left:.4rem;padding:0 .35rem;border-radius:999px;font-size:.68rem;font-weight:700;line-height:1.5;color:var(--dm-text-muted, #64748b);background:var(--dm-active-bg, rgba(15, 23, 42, .07));cursor:pointer}.mail-thread-chip:hover{color:var(--dm-primary, #2563eb)}.mail-thread-chip.is-unread{background:var(--dm-primary, #2563eb);color:var(--dm-primary-text, #fff)}.mail-item.is-in-thread{padding-left:1.6rem;box-shadow:inset 3px 0 0 var(--dm-border, #e2e8f0)}.mail-item.is-in-thread .mail-item-from{font-size:.8rem}.mail-pane-head .btn.is-on{color:var(--dm-primary, #2563eb);background:var(--dm-active-bg, rgba(15, 23, 42, .07))}#mail-outbox-btn{font-size:.72rem;font-weight:700}#mail-outbox-btn.is-failed{color:var(--dm-danger, #dc2626)}.mail-attachment{display:inline-flex;align-items:center;border:1px solid var(--dm-border, #e2e8f0);border-radius:var(--dm-radius-md, 6px);overflow:hidden}.mail-attachment .btn{border:none;border-radius:0}.mail-attachment-save{padding-left:.4rem!important;padding-right:.4rem!important;border-left:1px solid var(--dm-border, #e2e8f0)!important;opacity:.7}.mail-attachment-save:hover{opacity:1;color:var(--dm-primary, #2563eb)}.mail-section-heading{margin:1rem 0 .1rem;font-size:.8rem;text-transform:uppercase;letter-spacing:.04em;color:var(--dm-text-muted, #64748b)}.mail-section-heading:first-child{margin-top:.25rem}.mail-section-form .domma-form{margin:0}.mail-section-form .domma-form-field:last-child{margin-bottom:0}.mail-item-card{margin:0}.mail-item-card .card-header{padding:.5rem .6rem}.mail-item-card .card-body{padding:.6rem}.mail-ellipsis{overflow:hidden;text-overflow:ellipsis;white-space:nowrap;min-width:0}.mail-status{min-height:1.2em}.mail-empty-line{margin:.25rem 0}.mail-editor-fallback{min-height:8rem;font-family:inherit;resize:vertical}.mail-clause{display:flex;gap:.3rem;align-items:center;flex-wrap:wrap}.mail-clause .form-select,.mail-clause .form-input{width:auto;flex:0 1 auto}.mail-clause .mail-clause-value{flex:1 1 8rem;min-width:8rem}.mail-section-list{display:flex;flex-direction:column;gap:.5rem}.mail-scroll-sm{max-height:20vh;overflow-y:auto}.mail-scroll-md{max-height:46vh;overflow-y:auto}.mail-section-form .domma-form-field:has(select) .form-label .text-danger{display:none}.mail-compose-form{padding:.25rem 0 .5rem;display:flex;flex-direction:column;gap:.6rem;height:100%}.mail-compose-body{display:flex;flex-direction:column;flex:1;min-height:0}.mail-compose-editor{flex:1;min-height:0}.mail-compose-textarea{flex:1;min-height:34vh;font-family:inherit;resize:vertical}.mail-attach-list{display:flex;flex-direction:column;gap:.2rem}.mail-template-row{margin:-.15rem 0 .35rem}.mail-template-picker{max-width:16rem}.mail-suggest-row{display:flex;flex-direction:column;line-height:1.25}.mail-suggest-detail{opacity:.7}.mail-rule-off{opacity:.55}.mail-panel{padding:.25rem 0 .5rem}.mail-panel-stack{padding:.25rem 0 .5rem;display:flex;flex-direction:column;gap:1rem}.mail-form-stack{padding:.25rem 0 .5rem;display:flex;flex-direction:column;gap:.75rem}.mail-dialog-stack{display:flex;flex-direction:column;gap:.5rem;padding:.25rem 0}.mail-hint{margin-top:.2rem}.mail-box-sub{overflow:hidden;text-overflow:ellipsis}.mail-add-btn{align-self:flex-start;margin-top:.5rem}.mail-none{margin:0;padding:.5rem .6rem}.mail-kv{padding:.5rem 0;display:flex;flex-direction:column;gap:.35rem}.mail-kv-row{display:flex;gap:.75rem}.mail-kv-key{min-width:8.5rem;flex-shrink:0}.mail-toggle-row{display:flex;align-items:center;gap:.5rem;margin-bottom:.75rem}.mail-sender-list{display:flex;flex-direction:column;gap:.2rem;max-height:40vh;overflow-y:auto}.mail-folder-pick{display:flex;align-items:center;gap:.5rem;padding:.3rem .4rem;border-radius:var(--dm-radius-md, 6px)}.mail-diag-log{width:100%;height:30vh;margin-top:.5rem;font-family:monospace;font-size:.72rem}.mail-facts{display:flex;flex-direction:column;gap:.2rem;margin-bottom:.75rem}.mail-item-more{position:absolute;right:.4rem;bottom:.35rem;display:inline-flex;align-items:center;justify-content:center;min-width:1.4rem;height:1.4rem;border-radius:var(--dm-radius-sm, 3px);font-size:1rem;line-height:1;color:var(--dm-text-muted, #64748b);background:inherit;opacity:0;transition:opacity .12s ease}.mail-item:hover .mail-item-more,.mail-item:focus-visible .mail-item-more,.mail-item.is-active .mail-item-more{opacity:1}.mail-item-more:hover{color:var(--dm-primary, #2563eb)}.mail-section-intro{display:flex;align-items:center;gap:.35rem;margin:0 0 .75rem;padding-bottom:.5rem;border-bottom:1px solid var(--dm-border, #e2e8f0)}.mail-pager-middle{display:flex;align-items:center;gap:.5rem;min-width:0}.mail-page-size{font:inherit;color:inherit;background:transparent;border:1px solid var(--dm-border, #e2e8f0);border-radius:4px;padding:.1rem .25rem}
+#view-container.mail-fullbleed{max-width:none}.mail-layout [hidden],.dm-slideover [hidden]{display:none!important}.mail-reader-summary{display:flex;align-items:baseline;gap:.5rem;flex-wrap:wrap}.mail-header-toggle,.mail-extras-toggle{padding:0!important;font-size:.78rem;opacity:.75;text-decoration:underline}.mail-header-toggle:hover,.mail-extras-toggle:hover{opacity:1}.mail-header-details{display:grid;grid-template-columns:max-content 1fr;gap:.15rem .75rem;margin:.5rem 0 0;font-size:.8rem}.mail-header-details dt{opacity:.65}.mail-header-details dd{margin:0;overflow-wrap:anywhere}.mail-layout{display:grid;grid-template-columns:var(--mail-col-1, 190px) auto var(--mail-col-2, 340px) auto 1fr;height:calc(100vh - 140px);min-height:320px;border:1px solid var(--dm-border, #e2e8f0);border-radius:var(--dm-radius-md, 8px);overflow:hidden;background:var(--dm-surface, #fff)}.mail-folders-pane,.mail-list-pane{display:flex;flex-direction:column;border-right:1px solid var(--dm-border, #e2e8f0);min-width:0;min-height:0}.mail-reader-pane{display:flex;flex-direction:column;min-width:0;min-height:0}.mail-pane-head{display:flex;align-items:center;justify-content:space-between;gap:.5rem;padding:.5rem .75rem;font-size:.8rem;font-weight:600;text-transform:uppercase;letter-spacing:.04em;color:var(--dm-text-muted, #64748b);border-bottom:1px solid var(--dm-border, #e2e8f0);flex-shrink:0}.mail-folders-list,.mail-list{overflow-y:auto;flex:1;min-height:0}.mail-search{display:flex;align-items:center;gap:.4rem;padding:.4rem .6rem;border-bottom:1px solid var(--dm-border, #e2e8f0);color:var(--dm-text-muted, #64748b);flex-shrink:0}.mail-search input{flex:1;min-width:0;font-size:.85rem;padding:.25rem .4rem}.mail-search-note{padding:.3rem .6rem;font-size:.74rem;color:var(--dm-text-muted, #64748b);border-bottom:1px solid var(--dm-border, #e2e8f0);flex-shrink:0}.mail-slideover-resizer{padding:0;position:absolute;left:0;top:0;bottom:0;width:6px;cursor:col-resize;z-index:2;background:transparent}.mail-slideover-resizer:hover,.is-resizing>.mail-slideover-resizer{background:var(--dm-primary, #2563eb);opacity:.7}.is-resizing{user-select:none;transition:none!important}.mail-selection{display:flex;align-items:center;gap:.35rem;flex-wrap:wrap;padding:.35rem .6rem;font-size:.78rem;background:var(--dm-primary, #2563eb);color:var(--dm-primary-text, #fff);flex-shrink:0}.mail-selection span{flex:1;min-width:0}.mail-selection .btn{color:var(--dm-primary-text, #fff);border:1px solid currentColor;background:transparent}.mail-selection .btn:hover{background:color-mix(in srgb,var(--dm-primary-text, #fff) 15%,transparent)}.mail-item.is-selected{background:var(--dm-active-bg, rgba(15, 23, 42, .07));box-shadow:inset 3px 0 0 var(--dm-primary, #2563eb)}.mail-undo{display:flex;align-items:center;gap:.5rem;padding:.4rem .6rem;font-size:.78rem;background:var(--dm-active-bg, rgba(15, 23, 42, .07));border-bottom:1px solid var(--dm-border, #e2e8f0);flex-shrink:0}.mail-undo span{flex:1;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.mail-splitter{width:5px;cursor:col-resize;background:var(--dm-border, #e2e8f0);flex-shrink:0;background-clip:content-box;border-left:2px solid transparent;border-right:2px solid transparent;box-sizing:content-box}.mail-splitter:hover,.mail-layout.is-resizing .mail-splitter{background-color:var(--dm-primary, #2563eb)}.mail-layout.is-resizing{user-select:none}.mail-layout.is-resizing .mail-folders-pane,.mail-layout.is-resizing .mail-list-pane,.mail-layout.is-resizing .mail-reader-pane,.mail-layout.is-resizing iframe{pointer-events:none}.mail-unread-filter{display:flex;align-items:center;gap:.3rem;font-size:.7rem;text-transform:none;letter-spacing:0;cursor:pointer;margin-left:auto;margin-right:.25rem}.mail-unread-pill{flex-shrink:0;min-width:1.15rem;padding:0 .3rem;border-radius:999px;background:var(--dm-primary, #2563eb);color:var(--dm-primary-text, #fff);font-size:.66rem;font-weight:700;line-height:1.35;text-align:center}.mail-folder.is-context .mail-folder-name{opacity:.6}.mail-account{display:flex;align-items:center;gap:.4rem;width:100%;padding:.45rem .6rem;border:none;background:var(--dm-surface, #fff);cursor:pointer;text-align:left;font-size:.78rem;font-weight:700;text-transform:uppercase;letter-spacing:.03em;color:var(--dm-text-muted, #64748b)}.mail-account:hover{background:var(--dm-hover-bg, rgba(15, 23, 42, .04))}.mail-account.is-active{color:var(--dm-text, #1e293b);position:sticky;top:0;z-index:1;background:var(--dm-surface, #fff)}.mail-account-name{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.mail-folder{display:flex;align-items:center;gap:.5rem;padding:.45rem .75rem;font-size:.875rem;cursor:pointer;border:none;background:none;width:100%;text-align:left;color:var(--dm-text, #1e293b)}.mail-folder:hover{background:var(--dm-hover-bg, rgba(15, 23, 42, .04))}.mail-folder.is-active{background:var(--dm-active-bg, rgba(15, 23, 42, .07));color:var(--dm-primary, #2563eb);font-weight:600}.mail-folder.is-unselectable{opacity:.6;cursor:default}.mail-folder.is-unselectable:hover{background:none}.mail-folder-name{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.mail-item{display:block;width:100%;text-align:left;padding:.55rem .75rem;border:none;border-bottom:1px solid var(--dm-border, #e2e8f0);background:none;cursor:pointer;color:var(--dm-text, #1e293b)}.mail-item:hover{background:var(--dm-hover-bg, rgba(15, 23, 42, .04))}.mail-item.is-active{background:var(--dm-active-bg, rgba(15, 23, 42, .07))}.mail-item-top{display:flex;justify-content:space-between;gap:.5rem;align-items:baseline}.mail-item-from{font-size:.85rem;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.mail-item.is-unread .mail-item-from,.mail-item.is-unread .mail-item-subject{font-weight:700}.mail-item-date{font-size:.72rem;color:var(--dm-text-muted, #64748b);flex-shrink:0}.mail-item-subject{font-size:.82rem;margin-top:.1rem;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.mail-item-meta{display:flex;align-items:center;gap:.35rem;margin-top:.15rem;color:var(--dm-text-muted, #64748b)}.mail-pager{display:flex;align-items:center;justify-content:space-between;gap:.5rem;padding:.4rem .6rem;border-top:1px solid var(--dm-border, #e2e8f0);font-size:.75rem;color:var(--dm-text-muted, #64748b);flex-shrink:0}.mail-reader-head{padding:.75rem 1rem;border-bottom:1px solid var(--dm-border, #e2e8f0);flex-shrink:0}.mail-reader-head:empty{display:none}.mail-reader-subject{font-size:1.05rem;font-weight:600;margin:0 0 .3rem;color:var(--dm-text, #1e293b)}.mail-reader-actions{display:flex;gap:.25rem;margin:.1rem 0 .35rem;flex-wrap:wrap}.mail-reader-meta{font-size:.8rem;color:var(--dm-text-muted, #64748b)}.mail-reader-body{flex:1;position:relative;overflow:hidden;display:flex;flex-direction:column;min-height:0;background:var(--dm-surface, #fff)}.mail-reader-body iframe{width:100%;flex:1;border:none;display:block;background:#fff}.mail-notice{display:flex;align-items:center;gap:.5rem;flex-wrap:wrap;padding:.4rem .75rem;font-size:.78rem;background:var(--dm-warning, #8a6d1f);color:var(--dm-warning-text, #fff);border-bottom:1px solid var(--dm-border, #e2e8f0)}.mail-notice .btn{color:var(--dm-warning-text, #fff);border:1px solid currentColor;background:transparent;opacity:.95}.mail-notice .btn:hover{background:color-mix(in srgb,var(--dm-warning-text, #fff) 15%,transparent);opacity:1}.mail-attachments{display:flex;flex-wrap:wrap;gap:.4rem;padding:.5rem .75rem;border-bottom:1px solid var(--dm-border, #e2e8f0);background:var(--dm-background-alt, rgba(15, 23, 42, .03))}.mail-empty{display:flex;flex-direction:column;align-items:center;justify-content:center;gap:.5rem;height:100%;color:var(--dm-text-muted, #94a3b8);text-align:center;padding:1rem}.mail-empty p{margin:0;font-size:.875rem}@media(max-width:900px){.mail-layout{grid-template-columns:1fr;height:auto!important}.mail-splitter{display:none}.mail-folders-pane,.mail-list-pane{border-right:none;border-bottom:1px solid var(--dm-border, #e2e8f0)}.mail-folders-list,.mail-list{max-height:240px}.mail-reader-body{min-height:60vh}}.mail-box-row{display:flex;align-items:center;gap:.5rem;padding:.5rem .6rem;border:1px solid var(--dm-border, #e2e8f0);border-radius:var(--dm-radius-md, 6px)}.mail-default-badge{margin-left:.4rem;font-size:.7rem;font-weight:500;vertical-align:middle}.mail-item.is-dragging{opacity:.45}.mail-folder.is-drop-target{background:var(--dm-primary, #2563eb);color:var(--dm-primary-text, #fff);outline:2px solid var(--dm-primary, #2563eb);outline-offset:-2px}.mail-folder.is-drop-target .mail-folder-name,.mail-folder.is-drop-target .mail-unread-pill{color:inherit}.mail-item.is-dragging *{pointer-events:none}.mail-item{position:relative}.mail-item-tick{position:absolute;left:.45rem;top:.55rem;display:inline-flex;opacity:0;color:var(--dm-text-muted, #64748b);transition:opacity .12s ease;padding:2px;margin:-2px;border-radius:var(--dm-radius-sm, 3px)}.mail-item:hover .mail-item-tick,.mail-item:focus-visible .mail-item-tick,.mail-list.is-selecting .mail-item-tick,.mail-item-tick[aria-checked=true]{opacity:1}.mail-item-tick[aria-checked=true]{color:var(--dm-primary, #2563eb)}.mail-item-tick:hover{color:var(--dm-primary, #2563eb);background:var(--dm-hover-bg)}.mail-item-top,.mail-item-subject,.mail-item-meta{padding-left:1.5rem}.mail-select-all{display:inline-flex;align-items:center;margin-right:.1rem;cursor:pointer}.mail-select-all input{cursor:pointer;margin:0}.sr-only{position:absolute;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;clip:rect(0,0,0,0);white-space:nowrap;border:0}.mail-item-meta>span{display:inline-flex}.mail-item-meta .is-replied{color:var(--dm-success)}.mail-item-meta .is-forwarded{color:var(--dm-info, var(--dm-primary))}.mail-item-meta .is-high{color:var(--dm-danger, #dc2626)}.mail-item-meta .is-low{color:var(--dm-text-muted, #64748b);opacity:.7}.mail-folder.is-hidden-folder .mail-folder-name{opacity:.5;font-style:italic}.mail-thread-chip{display:inline-flex;align-items:center;margin-left:.4rem;padding:0 .35rem;border-radius:999px;font-size:.68rem;font-weight:700;line-height:1.5;color:var(--dm-text-muted, #64748b);background:var(--dm-active-bg, rgba(15, 23, 42, .07));cursor:pointer}.mail-thread-chip:hover{color:var(--dm-primary, #2563eb)}.mail-thread-chip.is-unread{background:var(--dm-primary, #2563eb);color:var(--dm-primary-text, #fff)}.mail-item.is-in-thread{padding-left:1.6rem;box-shadow:inset 3px 0 0 var(--dm-border, #e2e8f0)}.mail-item.is-in-thread .mail-item-from{font-size:.8rem}.mail-pane-head .btn.is-on{color:var(--dm-primary, #2563eb);background:var(--dm-active-bg, rgba(15, 23, 42, .07))}#mail-outbox-btn{font-size:.72rem;font-weight:700}#mail-outbox-btn.is-failed{color:var(--dm-danger, #dc2626)}.mail-attachment{display:inline-flex;align-items:center;border:1px solid var(--dm-border, #e2e8f0);border-radius:var(--dm-radius-md, 6px);overflow:hidden}.mail-attachment .btn{border:none;border-radius:0}.mail-attachment-save{padding-left:.4rem!important;padding-right:.4rem!important;border-left:1px solid var(--dm-border, #e2e8f0)!important;opacity:.7}.mail-attachment-save:hover{opacity:1;color:var(--dm-primary, #2563eb)}.mail-section-heading{margin:1rem 0 .1rem;font-size:.8rem;text-transform:uppercase;letter-spacing:.04em;color:var(--dm-text-muted, #64748b)}.mail-section-heading:first-child{margin-top:.25rem}.mail-section-form .domma-form{margin:0}.mail-section-form .domma-form-field:last-child{margin-bottom:0}.mail-item-card{margin:0}.mail-item-card .card-header{padding:.5rem .6rem}.mail-item-card .card-body{padding:.6rem}.mail-ellipsis{overflow:hidden;text-overflow:ellipsis;white-space:nowrap;min-width:0}.mail-status{min-height:1.2em}.mail-empty-line{margin:.25rem 0}.mail-editor-fallback{min-height:8rem;font-family:inherit;resize:vertical}.mail-clause{display:flex;gap:.3rem;align-items:center;flex-wrap:wrap}.mail-clause .form-select,.mail-clause .form-input{width:auto;flex:0 1 auto}.mail-clause .mail-clause-value{flex:1 1 8rem;min-width:8rem}.mail-section-list{display:flex;flex-direction:column;gap:.5rem}.mail-scroll-sm{max-height:20vh;overflow-y:auto}.mail-scroll-md{max-height:46vh;overflow-y:auto}.mail-section-form .domma-form-field:has(select) .form-label .text-danger{display:none}.mail-compose-form{padding:.25rem 0 .5rem;display:flex;flex-direction:column;gap:.6rem;height:100%}.mail-compose-body{display:flex;flex-direction:column;flex:1;min-height:0}.mail-compose-editor{flex:1;min-height:0}.mail-compose-textarea{flex:1;min-height:34vh;font-family:inherit;resize:vertical}.mail-attach-list{display:flex;flex-direction:column;gap:.2rem}.mail-template-row{margin:-.15rem 0 .35rem}.mail-template-picker{max-width:16rem}.mail-suggest-row{display:flex;flex-direction:column;line-height:1.25}.mail-suggest-detail{opacity:.7}.mail-rule-off{opacity:.55}.mail-panel{padding:.25rem 0 .5rem}.mail-panel-stack{padding:.25rem 0 .5rem;display:flex;flex-direction:column;gap:1rem}.mail-form-stack{padding:.25rem 0 .5rem;display:flex;flex-direction:column;gap:.75rem}.mail-dialog-stack{display:flex;flex-direction:column;gap:.5rem;padding:.25rem 0}.mail-hint{margin-top:.2rem}.mail-box-sub{overflow:hidden;text-overflow:ellipsis}.mail-add-btn{align-self:flex-start;margin-top:.5rem}.mail-none{margin:0;padding:.5rem .6rem}.mail-kv{padding:.5rem 0;display:flex;flex-direction:column;gap:.35rem}.mail-kv-row{display:flex;gap:.75rem}.mail-kv-key{min-width:8.5rem;flex-shrink:0}.mail-toggle-row{display:flex;align-items:center;gap:.5rem;margin-bottom:.75rem}.mail-sender-list{display:flex;flex-direction:column;gap:.2rem;max-height:40vh;overflow-y:auto}.mail-folder-pick{display:flex;align-items:center;gap:.5rem;padding:.3rem .4rem;border-radius:var(--dm-radius-md, 6px)}.mail-diag-log{width:100%;height:30vh;margin-top:.5rem;font-family:monospace;font-size:.72rem}.mail-facts{display:flex;flex-direction:column;gap:.2rem;margin-bottom:.75rem}.mail-item-more{position:absolute;right:.4rem;bottom:.35rem;display:inline-flex;align-items:center;justify-content:center;min-width:1.4rem;height:1.4rem;border-radius:var(--dm-radius-sm, 3px);font-size:1rem;line-height:1;color:var(--dm-text-muted, #64748b);background:inherit;opacity:0;transition:opacity .12s ease}.mail-item:hover .mail-item-more,.mail-item:focus-visible .mail-item-more,.mail-item.is-active .mail-item-more{opacity:1}.mail-item-more:hover{color:var(--dm-primary, #2563eb)}.mail-section-intro{display:flex;align-items:center;gap:.35rem;margin:0 0 .75rem;padding-bottom:.5rem;border-bottom:1px solid var(--dm-border, #e2e8f0)}.mail-pager-middle{display:flex;align-items:center;gap:.5rem;min-width:0}.mail-page-size{font:inherit;color:inherit;background:transparent;border:1px solid var(--dm-border, #e2e8f0);border-radius:4px;padding:.1rem .25rem}

package/plugins/_lib/admin/mail/reader-view.js

@@ -1829,7 +1829,8 @@ return {
                         // attention each time.
                         [message.priority === 'high', 'arrow-up', 'High priority', 'is-high'],
                         [message.priority === 'low', 'arrow-down', 'Low priority', 'is-low'],
-                        [flags.includes('\\Answered'), 'corner-up-left', 'Replied to', ''],
+                        [flags.includes('\\Answered') || message.repliedAt, 'corner-up-left', 'Replied to', 'is-replied'],
+                        [flags.includes('$Forwarded') || message.forwardedAt, 'corner-up-right', 'Forwarded', 'is-forwarded'],
                         [flags.includes('\\Flagged'), 'flag', 'Starred', ''],
                         [message.hasAttachment, 'paperclip', 'Has an attachment', '']
                     ]) {
@@ -4309,9 +4310,11 @@ return {
          * @returns {Promise<void>}
          */
         async function editDraft(message) {
+            const accountId = currentAccountId;
+            const profile = identitySoon();
             try {
                 const params = new URLSearchParams({
-                    account: currentAccountId ?? '',
+                    account: accountId ?? '',
                     folder: message.folder ?? openFolder ?? currentFolder,
                     mode: 'edit'
                 });
@@ -4321,7 +4324,8 @@ return {
                 // is from. What it does NOT get is a second signature -
                 // `openCompose` reads the saved UID and treats the draft as
                 // already written.
-                openCompose(composeOptions(await identitySoon(), {
+                openCompose(composeOptions(await profile, {
+                    accountId,
                     draft: result.draft,
                     mode: 'edit',
                     // Saving or sending changes which UIDs are in Drafts, so
@@ -4559,14 +4563,17 @@ return {
          * @returns {Promise<void>}
          */
         async function compose(message, mode, {quote = null} = {}) {
+            const accountId = currentAccountId;
+            const profile = identitySoon();
             try {
                 const params = new URLSearchParams({
-                    account: currentAccountId ?? '',
+                    account: accountId ?? '',
                     folder: message.folder ?? openFolder ?? currentFolder,
                     mode
                 });
                 const result = await api(`${BASE}/messages/${message.uid}/draft?${params}`);
-                openCompose(composeOptions(await identitySoon(), {
+                openCompose(composeOptions(await profile, {
+                    accountId,
                     // Quote in reply: just the selected text under the
                     // attribution line, not the whole message.
                     draft: quote ? quoteSelection(result.draft, quote) : result.draft,
@@ -5002,7 +5009,9 @@ return {
                 const result = await api(`${BASE}/messages?${params}`);
                 if (!here() || currentAccountId !== account || currentFolder !== folder ||
                     page !== 1 || searchQuery || selected.size) return;
-                const signature = rows => JSON.stringify(rows.map(m => [m.uid, m.flags]));
+                const signature = rows => JSON.stringify(rows.map(m => [
+                    m.uid, m.flags, m.repliedAt ?? null, m.forwardedAt ?? null
+                ]));
                 const snapshot = JSON.stringify([account, folder, result.total, signature(result.messages)]);
                 const changed = threadsOn
                     ? snapshot !== observedThreadPage

package/plugins/_lib/mail/compose.js

@@ -10,6 +10,7 @@
  * @module _lib/mail/compose
  */
 import {readPriority} from './priority.js';
+import {normaliseMessageSource, readMessageSource} from './message-action.js';
 
 /**
  * Addresses to reply to.
@@ -162,11 +163,13 @@ export function quoteHtml(message, html, text, sanitise) {
  * @param   {{message: object, self: string, mode: 'reply'|'replyAll'|'forward', body: string}} options
  * @returns {object} a draft the compose window can open with
  */
-export function buildDraft({message, self, mode, body, html = null, sanitise = null}) {
+export function buildDraft({message, self, mode, body, html = null, sanitise = null, sourceMessage = null}) {
     const htmlQuote = sanitise ? quoteHtml(message, html, body, sanitise) : null;
+    const source = normaliseMessageSource(sourceMessage);
 
     if (mode === 'forward') {
         return {
+            ...(source ? {sourceMessage: source} : {}),
             to: [],
             cc: [],
             subject: replySubject(message.subject, 'Fwd'),
@@ -185,6 +188,7 @@ export function buildDraft({message, self, mode, body, html = null, sanitise = n
         : {to: replyRecipients(message), cc: []};
 
     return {
+        ...(source ? {sourceMessage: source} : {}),
         to,
         cc,
         subject: replySubject(message.subject),
@@ -239,7 +243,8 @@ export function editableDraft(message, uid = null) {
             content: file.content ?? '',
             size: file.size ?? 0
         })),
-        savedUid: uid
+        savedUid: uid,
+        sourceMessage: readMessageSource(message.headers)
     };
 }
 

package/plugins/_lib/mail/message-action.js

@@ -0,0 +1,56 @@
+/** Remember replies and forwards on the original message after delivery. */
+export const SOURCE_HEADER = 'X-Domma-Message-Source';
+
+export function normaliseMessageSource(source) {
+    if (!source || !['reply', 'forward'].includes(source.action)) return null;
+    const uid = Number(source.uid);
+    const folder = typeof source.folder === 'string' ? source.folder : '';
+    const accountId = typeof source.accountId === 'string' ? source.accountId : '';
+    const messageId = typeof source.messageId === 'string' ? source.messageId : null;
+    if (!Number.isSafeInteger(uid) || uid < 1 || !folder || folder.length > 1024
+        || /[\r\n\0]/.test(folder) || !accountId || accountId.length > 128
+        || (messageId && (messageId.length > 1024 || /[\r\n\0]/.test(messageId)))) return null;
+    return {accountId, folder, uid, action: source.action, messageId};
+}
+
+export function readMessageSource(headers) {
+    const value = typeof headers?.get === 'function'
+        ? headers.get(SOURCE_HEADER.toLowerCase()) : headers?.[SOURCE_HEADER.toLowerCase()];
+    if (typeof value !== 'string' || value.length > 4096) return null;
+    try {
+        return normaliseMessageSource(JSON.parse(Buffer.from(value, 'base64url').toString('utf8')));
+    } catch { return null; }
+}
+
+/** Best effort: recording a delivered message must never turn it into a failed send. */
+export async function recordMessageAction({source, account, pool, poolKey, connection, store = null}) {
+    source = normaliseMessageSource(source);
+    if (!source || source.accountId !== account?.id) return null;
+    const flag = source.action === 'reply' ? '\\Answered' : '$Forwarded';
+    let flags = null;
+    let error = null;
+    let sourceVerified = false;
+    try {
+        flags = await pool.withMailbox(poolKey, connection, source.folder, async client => {
+            const original = await client.fetchOne(source.uid, {envelope: true, flags: true}, {uid: true});
+            if (!original || (source.messageId && original.envelope?.messageId !== source.messageId)) {
+                throw new Error('The original message is no longer in that folder.');
+            }
+            sourceVerified = true;
+            await client.messageFlagsAdd({uid: String(source.uid)}, [flag], {uid: true});
+            const after = await client.fetchOne(source.uid, {flags: true}, {uid: true});
+            const recorded = [...(after?.flags ?? [])];
+            if (!recorded.includes(flag)) throw new Error('The mail server did not keep the message marker.');
+            return recorded;
+        }, {writable: true});
+    } catch (err) { error = err.message; }
+
+    let mirrored = false;
+    if (store && sourceVerified) {
+        try {
+            if (flags) await store.setFlags(account.id, source.folder, [{uid: source.uid, flags}]);
+            mirrored = await store.setMessageAction(account.id, source.folder, source.uid, source.action);
+        } catch (err) { error ??= err.message; }
+    }
+    return {...source, flags, recorded: Boolean(flags || mirrored), error: flags || mirrored ? null : error};
+}

package/plugins/_lib/mail/scheduler.js

@@ -82,6 +82,8 @@ export function createScheduler({store, pool, config, logger, tickMs = TICK_MS})
         try {
             const result = await sendMessage({
                 smtp,
+                account,
+                store,
                 draft: item.draft,
                 pool,
                 poolKey: `${item.userId}:${item.accountId}`,

package/plugins/_lib/mail/send.js

@@ -15,6 +15,7 @@ import nodemailer from 'nodemailer';
 import {bareAddress, formatFrom} from '../admin/mail/identity.js';
 import {describeError} from './imapPool.js';
 import {normalisePriority, priorityHeaders} from './priority.js';
+import {normaliseMessageSource, recordMessageAction, SOURCE_HEADER} from './message-action.js';
 
 // MailComposer is not on nodemailer's public export, but it is the piece that
 // turns a message object into the bytes that go on the wire - which is what a
@@ -191,7 +192,7 @@ class SkipFiling extends Error {}
  */
 export async function sendMessage({
     smtp, draft, pool, poolKey, connection, sentFolder = null, allowInsecureTLS = false,
-    replaces = null, draftsFolder = null, headers = {}, fileCopy = true
+    replaces = null, draftsFolder = null, headers = {}, fileCopy = true, account = null, store = null
 }) {
     // The header carries the display name; the envelope never can. They are
     // built from the same stored address so they cannot name two different
@@ -229,6 +230,10 @@ export async function sendMessage({
     });
     transport.close();
 
+    const messageAction = await recordMessageAction({
+        source: draft.sourceMessage, account, pool, poolKey, connection, store
+    });
+
     let filedTo = null;
     let fileError = null;
     try {
@@ -260,7 +265,8 @@ export async function sendMessage({
         rejected: info.rejected ?? [],
         filedTo,
         fileError,
-        draftRemoved
+        draftRemoved,
+        messageAction
     };
 }
 
@@ -315,9 +321,12 @@ export async function saveDraft({
 }) {
     // Written into the draft, not applied when it is eventually sent: a draft
     // opened on the phone should show the same headers it will go out with.
+    const source = normaliseMessageSource(draft.sourceMessage);
     const raw = await buildRaw(draft, from, {
         replyTo,
-        readReceiptTo: draft.readReceipt ? (replyTo || bareAddress(from)) : ''
+        readReceiptTo: draft.readReceipt ? (replyTo || bareAddress(from)) : '',
+        // Private draft metadata: it is omitted from SMTP and the Sent copy.
+        headers: source ? {[SOURCE_HEADER]: Buffer.from(JSON.stringify(source)).toString('base64url')} : {}
     });
 
     const destination = draftsFolder ?? await findSpecialFolder(pool, poolKey, connection, '\\Drafts');

package/plugins/_lib/mail/store.js

@@ -249,7 +249,7 @@ export function createStore(connection) {
     }
 
     /**
-     * Store a batch of envelopes, replacing any already held for those UIDs.
+     * Store envelopes while retaining the local reply and forward history.
      *
      * @param   {string} accountId
      * @param   {string} path
@@ -262,15 +262,14 @@ export function createStore(connection) {
         const now = new Date();
         const rooted = await inheritThreadRoots(database, accountId, messages);
         const operations = rooted.map(message => ({
-            replaceOne: {
+            updateOne: {
                 filter: {_id: messageId(accountId, path, message.uid)},
-                replacement: {
+                update: {$set: {
                     ...message,
-                    _id: messageId(accountId, path, message.uid),
                     accountId,
                     folder: path,
                     fetchedAt: now
-                },
+                }},
                 upsert: true
             }
         }));
@@ -350,6 +349,17 @@ export function createStore(connection) {
         return result.modifiedCount ?? 0;
     }
 
+    /** Keep action history even when a server refuses the $Forwarded keyword. */
+    async function setMessageAction(accountId, path, uid, action) {
+        if (!['reply', 'forward'].includes(action)) return false;
+        const database = await connect();
+        const field = action === 'reply' ? 'repliedAt' : 'forwardedAt';
+        const result = await database.collection(MESSAGES).updateOne(
+            {_id: messageId(accountId, path, uid)}, {$set: {[field]: new Date()}}
+        );
+        return result.matchedCount > 0;
+    }
+
     /**
      * Forget messages that are no longer on the server.
      *
@@ -1012,7 +1022,7 @@ export function createStore(connection) {
     return {
         connect,
         getFolder, saveFolder,
-        putMessages, setFlags, removeMessages, clearFolder,
+        putMessages, setFlags, setMessageAction, removeMessages, clearFolder,
         storedUids, listMessages, listThreads, searchMessages, countUnread, listUnread, forgetAccount,
         queueSend, listQueuedSends, claimDueSends, finishSend, cancelSend, getQueuedSend,
         queueSnooze, listSnoozed, claimDueSnoozes, finishSnooze, wakeSnooze,

package/plugins/_lib/outreach/index.js

@@ -12,4 +12,4 @@ export {createLedger} from './ledger.js';
 export {createSuppression, normaliseEmail} from './suppression.js';
 export {escapeHtml, escapeAttr, outreachBaseUrl, renderInvite, sendBatch} from './sending.js';
 export {dayOf, codeState, closedReason} from './expiry.js';
-export {UNSUBSCRIBE_PATH, mintSecret, signEmail, unsubscribeUrl, verifyUnsubscribe} from './unsubscribe.js';
+export {UNSUBSCRIBE_PATH, mintSecret, signEmail, unsubscribeHeaders, unsubscribeUrl, verifyUnsubscribe} from './unsubscribe.js';

package/plugins/_lib/outreach/ledger.js

@@ -25,8 +25,15 @@ export function createLedger(col, {slug = 'outreach-invites', refField = 'ref',
         return entries;
     }
 
-    async function invitesFor(refId) {
-        return (await allInvites()).filter(e => e.data[refField] === refId);
+    /**
+     * Rows for one campaign/survey/journey. The filter does the narrowing in
+     * the adapter (a Mongo query, or the file adapter's in-memory match) so a
+     * per-hit lookup no longer reads every invite on the site; the in-memory
+     * filter stays because a test's fake store ignores `opts.filter`.
+     */
+    async function invitesFor(refId, extra = {}) {
+        const {entries} = await col.listEntries(slug, {limit: 100000, filter: {[refField]: refId, ...extra}});
+        return entries.filter(e => e.data[refField] === refId);
     }
 
     /** Issue pending invites for contacts that don't already have one. Returns [{id, contactId, token}]. */
@@ -83,7 +90,7 @@ export function createLedger(col, {slug = 'outreach-invites', refField = 'ref',
     /** Find an invite by submitted code (any format). Null if unknown. */
     async function findByCode(refId, code) {
         const hash = hashToken(normaliseCode(code));
-        const invites = await invitesFor(refId);
+        const invites = await invitesFor(refId, {tokenHash: hash});
         return invites.find(e => e.data.tokenHash === hash) ?? null;
     }
 

package/plugins/_lib/outreach/sending.js

@@ -97,11 +97,15 @@ export function renderInvite(template, contact, link, opts = {}) {
  *
  * @param {Array<{invite: {id: string}, contact: {name?: string, email: string}, token: string}>} recipients
  * @param {{subject?: string, body?: string}} template
- * @param {object} deps {sendEmail, transport, from, fromName, linkFor(recipient), suppressed?: Set<string>, render?: opts for renderInvite}
+ * `headersFor(recipient)` returns extra message headers - the List-Unsubscribe
+ * pair (unsubscribe.js unsubscribeHeaders) when the message carries an
+ * unsubscribe link - so a mail client can offer its own opt-out button.
+ *
+ * @param {object} deps {sendEmail, transport, from, fromName, linkFor(recipient), suppressed?: Set<string>, render?: opts for renderInvite, headersFor?: (recipient) => object}
  * @returns {Promise<Array<{inviteId: string, ok: boolean, suppressed?: true}>>}
  */
 export async function sendBatch(recipients, template, deps) {
-    const {sendEmail, transport, from, fromName, linkFor, suppressed = null, render = {}} = deps;
+    const {sendEmail, transport, from, fromName, linkFor, suppressed = null, render = {}, headersFor = null} = deps;
     const results = [];
     for (const r of recipients) {
         if (suppressed && suppressed.has(normaliseEmail(r.contact.email))) {
@@ -110,8 +114,10 @@ export async function sendBatch(recipients, template, deps) {
         }
         const link = linkFor(r);
         const msg = renderInvite(template, r.contact, link, render);
+        const headers = typeof headersFor === 'function' ? headersFor(r) : null;
         try {
-            await sendEmail(transport, {from, fromName, to: r.contact.email, subject: msg.subject, html: msg.html, text: msg.text});
+            await sendEmail(transport, {from, fromName, to: r.contact.email, subject: msg.subject, html: msg.html, text: msg.text,
+                ...(headers && Object.keys(headers).length ? {headers} : {})});
             results.push({inviteId: r.invite.id, ok: true});
         } catch {
             results.push({inviteId: r.invite.id, ok: false});

package/plugins/_lib/outreach/suppression.js

@@ -30,17 +30,28 @@ export function createSuppression(col, {slug = 'outreach-unsubscribes'} = {}) {
         return new Set((await rows()).map(e => normaliseEmail(e.data.email)).filter(Boolean));
     }
 
+    /**
+     * The rows for one address, narrowed by the adapter: `_contains` is
+     * case-insensitive on both adapters (older rows may not be lower-cased),
+     * and the exact comparison here keeps a fake store that ignores the
+     * filter honest. One address, one small read - not the whole list.
+     */
+    async function rowsFor(want) {
+        const {entries} = await col.listEntries(slug, {limit: 100000, filter: {email_contains: want}}).catch(() => ({entries: []}));
+        return entries.filter(e => normaliseEmail(e.data.email) === want);
+    }
+
     async function isSuppressed(email) {
         const want = normaliseEmail(email);
         if (!want) return false;
-        return (await suppressedSet()).has(want);
+        return (await rowsFor(want)).length > 0;
     }
 
     /** Add an address (idempotent). `source` says which Tool took the opt-out. */
     async function add(email, source = 'outreach') {
         const want = normaliseEmail(email);
         if (!want) return null;
-        const existing = (await rows()).find(e => normaliseEmail(e.data.email) === want);
+        const existing = (await rowsFor(want))[0];
         if (existing) return existing;
         return col.createEntry(slug, {email: want, at: new Date().toISOString(), source}, {source});
     }
@@ -49,7 +60,7 @@ export function createSuppression(col, {slug = 'outreach-unsubscribes'} = {}) {
     async function remove(email) {
         if (typeof col.deleteEntry !== 'function') return false;
         const want = normaliseEmail(email);
-        const hits = (await rows()).filter(e => normaliseEmail(e.data.email) === want);
+        const hits = want ? await rowsFor(want) : [];
         for (const e of hits) await col.deleteEntry(slug, e.id).catch(() => {});
         return hits.length > 0;
     }

package/plugins/_lib/outreach/unsubscribe.js

@@ -31,6 +31,19 @@ export function unsubscribeUrl(baseUrl, secret, email) {
     return `${baseUrl}${UNSUBSCRIBE_PATH}?e=${e}&k=${signEmail(secret, email)}`;
 }
 
+/**
+ * The RFC 8058 headers for a message that carries `url`: mail clients show
+ * their own Unsubscribe button and POST `List-Unsubscribe=One-Click` to the
+ * URL, which the engine's route treats as the confirmed opt-out. Gmail and
+ * Yahoo require them of bulk senders.
+ *
+ * @param {string} url - unsubscribeUrl()
+ * @returns {{'List-Unsubscribe': string, 'List-Unsubscribe-Post': string}}
+ */
+export function unsubscribeHeaders(url) {
+    return {'List-Unsubscribe': `<${url}>`, 'List-Unsubscribe-Post': 'List-Unsubscribe=One-Click'};
+}
+
 /** The verified address from ?e=&k=, or null. Constant-time on the signature. */
 export function verifyUnsubscribe(secret, e, k) {
     let email = '';

package/plugins/blog/CLAUDE.md

@@ -20,7 +20,8 @@ Public-facing blog for the CMS. Supports posts with categories, tags, and option
 - `blocks/*.html|css` - the shipped layouts, copied into content/blocks/ once
 - `public/blog.js`, `public/blog.css` - the browser half (listing, right-click menu, post extras)
 - `public/samples/*.svg` - sample covers
-- `tests/access.test.js`, `tests/comment-notices.test.js`, `tests/layouts.test.js`, `tests/nav-link.test.js`, `tests/notices.test.js`, `tests/public.test.js`
+- `tests/access.test.js`, `tests/comment-notices.test.js`, `tests/layouts.test.js`, `tests/nav-link.test.js`, `tests/notices.test.js`, `tests/public.test.js`, `tests/cache.test.js`
+- `lib/cache.js` - PURE: the 30 s read cache (forgotten on every write route)
 - `admin/views/blog.js` - post list (KPIs + status/category/search filters)
 - `admin/views/post-editor.js` - create / edit a post
 - `admin/views/categories.js`, `admin/views/comments.js`, `admin/views/settings.js`
@@ -329,3 +330,12 @@ Declared in plugin.json `permissions` (granted once to `admin`), checked on EVER
   tested), needs a plausible email, and refuses a post that does not exist or is not visible (404) - each of those
   used to raise a staff notification.
 - `ASSET_V` / the preview `assetV` are 1.9.6 (they were 1.6.x while the plugin was 1.9.5 - keep them with the version).
+
+## 1.9.7 (2026-10-13 Tool sweep - caching)
+
+- **Whole-collection reads are cached 30 s** (`lib/cache.js`, pure, `tests/cache.test.js`): `loadEntries()` in
+  lib/page.js (public pages, shortcodes, the sitemap source, the `/comments/pending-count` badge) and
+  `resolveAuthorName()` (one user lookup per author per window). The promise is kept, so concurrent misses share one
+  read. **Every non-GET route of this plugin forgets it in an `onSend` hook** - before the writer's response leaves -
+  so the admin's own next read, and the public POST /comments, are fresh. The TTL only covers writes made outside
+  the plugin (Collections tool, Blog Pro). Callers share the cached array: filter/sort copies, never mutate it.

package/plugins/blog/lib/cache.js

@@ -0,0 +1,43 @@
+/**
+ * A short memory for whole-collection reads.
+ *
+ * Every public page view and every sidebar badge poll (once a minute from
+ * every open admin tab) read ALL posts, categories and comments from the
+ * adapter. The data changes only when someone writes, so a read is kept for a
+ * little while and every write route of this plugin throws the memory away
+ * (`forget()`, from an onSend hook in plugin.js - before the writer's own
+ * response leaves, so their next read is fresh). The TTL is the safety net
+ * for writes this plugin never sees (the Collections tool, a Pro take-over).
+ *
+ * PURE - no I/O of its own; the loader is handed in. Tested in tests/cache.test.js.
+ *
+ * @module blog/lib/cache
+ */
+
+export const CACHE_MS = 30_000;
+
+/**
+ * @param {{ttl?: number, clock?: () => number}} [opts]
+ * @returns {{get: (key: string, load: () => Promise<any>) => Promise<any>, forget: () => void, size: number}}
+ */
+export function createCache({ttl = CACHE_MS, clock = Date.now} = {}) {
+    // key -> {at, value: Promise}. The PROMISE is kept, not the result, so
+    // concurrent misses share one read, and a write landing while a read is in
+    // flight clears the map before that read can be stored - nothing stale
+    // survives a forget().
+    const kept = new Map();
+    return {
+        get(key, load) {
+            const hit = kept.get(key);
+            if (hit && clock() - hit.at < ttl) return hit.value;
+            const value = Promise.resolve().then(load);
+            const entry = {at: clock(), value};
+            kept.set(key, entry);
+            // A failed read is not remembered: the next caller tries again.
+            value.catch(() => { if (kept.get(key) === entry) kept.delete(key); });
+            return value;
+        },
+        forget() { kept.clear(); },
+        get size() { return kept.size; }
+    };
+}