domma-cms 1.6.37 → 1.6.38

package/admin/dist/domma/domma-tools.css

@@ -1,9 +1,9 @@
 /*!
- * Domma Tools CSS v0.51.11
+ * Domma Tools CSS v0.51.12
  * Dynamic Object Manipulation & Modeling API
  * (c) 2026 Darryl Waterhouse & DCBW-IT
- * Built: 2026-10-12T06:05:33.864Z
- * Commit: a53de2f
+ * Built: 2026-10-13T13:46:21.895Z
+ * Commit: ce9f5f1
  */
 
 /*!

package/admin/dist/domma/domma-tools.min.js

@@ -1,9 +1,9 @@
 /*!
- * Domma Tools v0.51.11
+ * Domma Tools v0.51.12
  * Developer tools: Theme Roller & Page Roller
  * (c) 2026 Darryl Waterhouse & DCBW-IT
- * Built: 2026-10-12T06:05:20.912Z
- * Commit: a53de2f
+ * Built: 2026-10-13T13:46:07.193Z
+ * Commit: ce9f5f1
  *
  * Requires: domma.min.js
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "1.6.37",
+  "version": "1.6.38",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",
@@ -84,7 +84,7 @@
     "@fastify/rate-limit": "^10.3.0",
     "@fastify/static": "9.1.1",
     "bcryptjs": "^3.0.3",
-    "domma-js": "0.51.11",
+    "domma-js": "0.51.12",
     "dotenv": "^17.2.3",
     "fastify": "5.8.5",
     "gray-matter": "^4.0.3",

package/plugins/blog/CLAUDE.md

@@ -20,7 +20,8 @@ Public-facing blog for the CMS. Supports posts with categories, tags, and option
 - `blocks/*.html|css` - the shipped layouts, copied into content/blocks/ once
 - `public/blog.js`, `public/blog.css` - the browser half (listing, right-click menu, post extras)
 - `public/samples/*.svg` - sample covers
-- `tests/access.test.js`, `tests/comment-notices.test.js`, `tests/layouts.test.js`, `tests/nav-link.test.js`, `tests/notices.test.js`, `tests/public.test.js`
+- `tests/access.test.js`, `tests/comment-notices.test.js`, `tests/layouts.test.js`, `tests/nav-link.test.js`, `tests/notices.test.js`, `tests/public.test.js`, `tests/cache.test.js`
+- `lib/cache.js` - PURE: the 30 s read cache (forgotten on every write route)
 - `admin/views/blog.js` - post list (KPIs + status/category/search filters)
 - `admin/views/post-editor.js` - create / edit a post
 - `admin/views/categories.js`, `admin/views/comments.js`, `admin/views/settings.js`
@@ -329,3 +330,12 @@ Declared in plugin.json `permissions` (granted once to `admin`), checked on EVER
   tested), needs a plausible email, and refuses a post that does not exist or is not visible (404) - each of those
   used to raise a staff notification.
 - `ASSET_V` / the preview `assetV` are 1.9.6 (they were 1.6.x while the plugin was 1.9.5 - keep them with the version).
+
+## 1.9.7 (2026-10-13 Tool sweep - caching)
+
+- **Whole-collection reads are cached 30 s** (`lib/cache.js`, pure, `tests/cache.test.js`): `loadEntries()` in
+  lib/page.js (public pages, shortcodes, the sitemap source, the `/comments/pending-count` badge) and
+  `resolveAuthorName()` (one user lookup per author per window). The promise is kept, so concurrent misses share one
+  read. **Every non-GET route of this plugin forgets it in an `onSend` hook** - before the writer's response leaves -
+  so the admin's own next read, and the public POST /comments, are fresh. The TTL only covers writes made outside
+  the plugin (Collections tool, Blog Pro). Callers share the cached array: filter/sort copies, never mutate it.

package/plugins/blog/lib/cache.js

@@ -0,0 +1,43 @@
+/**
+ * A short memory for whole-collection reads.
+ *
+ * Every public page view and every sidebar badge poll (once a minute from
+ * every open admin tab) read ALL posts, categories and comments from the
+ * adapter. The data changes only when someone writes, so a read is kept for a
+ * little while and every write route of this plugin throws the memory away
+ * (`forget()`, from an onSend hook in plugin.js - before the writer's own
+ * response leaves, so their next read is fresh). The TTL is the safety net
+ * for writes this plugin never sees (the Collections tool, a Pro take-over).
+ *
+ * PURE - no I/O of its own; the loader is handed in. Tested in tests/cache.test.js.
+ *
+ * @module blog/lib/cache
+ */
+
+export const CACHE_MS = 30_000;
+
+/**
+ * @param {{ttl?: number, clock?: () => number}} [opts]
+ * @returns {{get: (key: string, load: () => Promise<any>) => Promise<any>, forget: () => void, size: number}}
+ */
+export function createCache({ttl = CACHE_MS, clock = Date.now} = {}) {
+    // key -> {at, value: Promise}. The PROMISE is kept, not the result, so
+    // concurrent misses share one read, and a write landing while a read is in
+    // flight clears the map before that read can be stored - nothing stale
+    // survives a forget().
+    const kept = new Map();
+    return {
+        get(key, load) {
+            const hit = kept.get(key);
+            if (hit && clock() - hit.at < ttl) return hit.value;
+            const value = Promise.resolve().then(load);
+            const entry = {at: clock(), value};
+            kept.set(key, entry);
+            // A failed read is not remembered: the next caller tries again.
+            value.catch(() => { if (kept.get(key) === entry) kept.delete(key); });
+            return value;
+        },
+        forget() { kept.clear(); },
+        get size() { return kept.size; }
+    };
+}

package/plugins/blog/lib/page.js

@@ -13,6 +13,13 @@ import defaultConfig from '../config.js';
 import {fmtDate} from '../../_lib/admin/ui/dates.js';
 import {buildToc, byNewest, cardVars, cleanBasePath, DEFAULT_POST_LAYOUT, DISPLAY_DEFAULTS, escapeHtml, interpolate, pickPostLayout, relatedPosts, safeImageUrl} from './layouts.js';
 import {catalogue, loadBlock, renderCards, styleTag} from './render.js';
+import {createCache} from './cache.js';
+
+// Whole-collection reads and author names, kept a short while (lib/cache.js):
+// every public page view and every badge poll read all posts, categories and
+// comments. plugin.js calls forgetEntries() on every write route of this plugin.
+const remembered = createCache();
+export const forgetEntries = () => remembered.forget();
 
 /**
  * Whether readers see a post. Blog Pro files posts under several blogs
@@ -69,12 +76,21 @@ export function liveBase(registered) {
 }
 
 /** Always returns the actual array of entries, regardless of adapter shape. */
-export async function loadEntries(slug) {
+async function readEntries(slug) {
     const result = await listEntries(slug, {limit: 100000, sort: 'createdAt', order: 'desc'});
     const arr = Array.isArray(result) ? result : (Array.isArray(result?.entries) ? result.entries : []);
     return arr.map((entry) => ({id: entry.id, ...(entry.data ?? entry)}));
 }
 
+/**
+ * A collection's entries, newest first - from the cache when a read is fresh.
+ * Callers get the SAME array, so none may change it in place (they filter and
+ * sort copies, as before).
+ */
+export function loadEntries(slug) {
+    return remembered.get(`entries:${slug}`, () => readEntries(slug));
+}
+
 /** Render a post body through the full Markdown + shortcode pipeline. */
 export async function renderPostBody(content) {
     if (!content) return {html: '', usedComponents: []};
@@ -87,14 +103,17 @@ export async function renderPostBody(content) {
     }
 }
 
-export async function resolveAuthorName(authorId) {
-    if (!authorId) return 'Unknown';
-    try {
-        const user = await getUserById(authorId);
-        return user?.name || user?.email || 'Unknown';
-    } catch {
-        return 'Unknown';
-    }
+/** A user's display name - one lookup per author per cache window, not per card. */
+export function resolveAuthorName(authorId) {
+    if (!authorId) return Promise.resolve('Unknown');
+    return remembered.get(`author:${authorId}`, async () => {
+        try {
+            const user = await getUserById(authorId);
+            return user?.name || user?.email || 'Unknown';
+        } catch {
+            return 'Unknown';
+        }
+    });
 }
 
 /** One lookup per author, however many posts they wrote. */

package/plugins/blog/plugin.js

@@ -5,7 +5,7 @@ import {getPluginStates, savePluginState} from '../../server/services/plugins.js
 import {renderBlogPage} from '../../server/services/renderer.js';
 import {cleanBasePath, DISPLAY_DEFAULTS, pickDisplaySettings, safeImageUrl} from './lib/layouts.js';
 import {catalogue, seedBlocks} from './lib/render.js';
-import {liveBase, liveSettings, loadEntries as loadAll, renderPostPage, slugHolder} from './lib/page.js';
+import {forgetEntries, liveBase, liveSettings, loadEntries as loadAll, renderPostPage, slugHolder} from './lib/page.js';
 import {addNavLink, moveNavLink, removeNavLink} from './lib/nav-link.js';
 import {SAMPLE_CATEGORIES, samplePosts} from './lib/samples.js';
 import {commentKey, commentNotice} from './lib/notices.js';
@@ -167,17 +167,9 @@ function isVisible(post) {
         || (post.status === 'scheduled' && post.publishedAt && new Date(post.publishedAt) <= new Date());
 }
 
-async function loadPosts() {
-    const result = await listEntries(POSTS_SLUG, { limit: 100000, sort: 'createdAt', order: 'desc' });
-    const arr = Array.isArray(result) ? result : (result?.entries || []);
-    return arr.map((e) => ({ id: e.id, ...(e.data ?? e) }));
-}
-
-async function loadCategories() {
-    const result = await listEntries(CATEGORIES_SLUG, { limit: 10000 });
-    const arr = Array.isArray(result) ? result : (result?.entries || []);
-    return arr.map((e) => ({ id: e.id, ...(e.data ?? e) }));
-}
+// The shortcodes run on public page views: the same cached reads as the pages.
+const loadPosts = () => loadAll(POSTS_SLUG);
+const loadCategories = () => loadAll(CATEGORIES_SLUG);
 
 function selectPosts(posts, { limit, categorySlug, categoryMap }) {
     let filtered = posts.filter(isVisible);
@@ -337,6 +329,15 @@ export default async function blogPlugin(fastify, options) {
         });
     }
 
+    // Every write route of this plugin (posts, categories, comments - the public
+    // POST /comments too - samples) retires the cached reads behind the public
+    // pages, the shortcodes and the badge. onSend, not onResponse: the memory is
+    // gone BEFORE the writer's response leaves, so their very next read is fresh.
+    // The hook is encapsulated - only this plugin's routes reach it.
+    fastify.addHook('onSend', async (request) => {
+        if (request.method !== 'GET' && request.method !== 'HEAD') forgetEntries();
+    });
+
     // The layouts are blocks; put the shipped ones where the Blocks tool can
     // edit them. Once each, never over a site's own copy (lib/render.js).
     try {
@@ -392,7 +393,7 @@ export default async function blogPlugin(fastify, options) {
         });
         const html = await renderBlogPage(
             fileURLToPath(new URL('./templates/post.html', import.meta.url)),
-            { post: page.html, assetV: '1.9.6' },
+            { post: page.html, assetV: '1.9.7' },
             { title: post.title || 'Preview', description: post.excerpt || '', ogImage: safeImageUrl(post.featuredImage),
               usedComponents: page.usedComponents, urlPath: `${basePath}/${post.slug}`, noindex: true }
         );

package/plugins/blog/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "blog",
   "displayName": "Blog",
-  "version": "1.9.6",
+  "version": "1.9.7",
   "tier": "free",
   "description": "Public-facing blog with posts, categories and comments - layouts and listings built from editable blocks.",
   "author": "Domma CMS",

package/plugins/blog/plugin.public.js

@@ -24,7 +24,7 @@ const __dirname = fileURLToPath(new URL('.', import.meta.url));
 const TEMPLATES_DIR = path.join(__dirname, 'templates');
 
 /** Bumped with the plugin, so a release is never served a stale script. */
-const ASSET_V = '1.9.6';
+const ASSET_V = '1.9.7';
 
 /**
  * Above this many posts a listing pages on the server instead: the browser

package/plugins/blog/tests/cache.test.js

@@ -0,0 +1,65 @@
+/**
+ * Blog - the short memory behind the public pages and the badge (lib/cache.js),
+ * and the rule that matters: a write is seen by the very next read.
+ */
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import Fastify from 'fastify';
+import {createCache} from '../lib/cache.js';
+
+test('a read is shared for the cache window, then read again', async () => {
+    let now = 0;
+    let reads = 0;
+    const c = createCache({ttl: 30_000, clock: () => now});
+    const load = async () => { reads++; return ['post']; };
+    const [a, b] = await Promise.all([c.get('posts', load), c.get('posts', load)]);
+    assert.equal(reads, 1, 'concurrent misses share one read');
+    assert.equal(a, b, 'the same array - callers must not change it in place');
+    now = 29_999;
+    await c.get('posts', load);
+    assert.equal(reads, 1);
+    now = 30_000;
+    await c.get('posts', load);
+    assert.equal(reads, 2, 'the window passed: read again');
+});
+
+test('forget() retires every key, and a read in flight when the write landed is not kept', async () => {
+    const c = createCache({ttl: 60_000});
+    let value = 'old';
+    let release;
+    const slow = () => new Promise(r => { release = r; });
+    const inFlight = c.get('posts', slow);
+    await c.get('categories', async () => ['cat']);
+    assert.equal(c.size, 2);
+    // The write finishes while the read is still on its way.
+    value = 'new';
+    c.forget();
+    release('old');
+    assert.equal(await inFlight, 'old', 'the caller who started before the write still gets what they read');
+    assert.equal(await c.get('posts', async () => value), 'new', 'the next read is fresh, not the stale one');
+    assert.deepEqual(await c.get('categories', async () => ['fresh']), ['fresh']);
+});
+
+test('a failed read is not remembered', async () => {
+    const c = createCache();
+    await assert.rejects(() => c.get('posts', async () => { throw new Error('adapter down'); }), /adapter down/);
+    assert.equal(c.size, 0);
+    assert.deepEqual(await c.get('posts', async () => ['ok']), ['ok']);
+});
+
+test('the plugin forgets on every write route, before the writer\'s response leaves', async () => {
+    // The hook as plugin.js registers it, on a stand-in app: the point under test
+    // is the method rule and that it fires in onSend (the writer's next read is fresh).
+    const c = createCache();
+    const app = Fastify();
+    app.addHook('onSend', async (request) => { if (request.method !== 'GET' && request.method !== 'HEAD') c.forget(); });
+    app.get('/posts', async () => c.get('posts', async () => ({at: Date.now()})));
+    app.put('/posts/1', async () => ({ok: true}));
+    await c.get('posts', async () => 'stale');
+    assert.equal(c.size, 1);
+    await app.inject({method: 'GET', url: '/posts'});
+    assert.equal(c.size, 1, 'a GET keeps the memory');
+    await app.inject({method: 'PUT', url: '/posts/1', payload: {}});
+    assert.equal(c.size, 0, 'a write retires it');
+    await app.close();
+});

package/plugins/booking/CLAUDE.md

@@ -17,8 +17,8 @@ Calendar events block their times (read from `calendar-occurrences` / `calendar-
 service - no import of the Calendar, which is a separate paid Tool).
 
 `tier: free`, ships with the engine, disabled on arrival. Plan and phases: `dcms-marketplace/docs/booking-plan.md`.
-Booking Pro (not yet built) is an ADD-ON that registers into this one (`lib/extensions.js`), the Cart / Cart Pro
-pattern - it does not supersede it. Payment is Pro only.
+Booking Pro (marketplace `booking-pro`, 0.4.x) is an ADD-ON that registers into this one (`lib/extensions.js`), the
+Cart / Cart Pro pattern - it does not supersede it. Neither takes payment yet.
 
 1.6.0 (2026-09-30): "Add people" in an online booking's call (core with `server/services/callInvites.js` and
 `_lib/call/invite.js`; both imported dynamically - lib/call.js by top-level `await import`, plugin.js beside
@@ -168,3 +168,15 @@ only to roles that hold it.
   the run (restored after) and forges a Host to prove it.
 - The API tests create contacts in domma-cms's `content/collections/contacts-contacts/data.json` (tracked) - they
   snapshot and restore it; a crashed run can leave it changed: `git checkout` it in domma-cms.
+
+## 1.6.4 (2026-10-13 Tool sweep, upgrades)
+- The Diary is domma-reactive end to end: heads, hour gutter and columns are keyed `data-each` lists (`HEAD`, `HOUR`,
+  `COL` in diary.js; each column's open bands and blocks are `{{#each}}` inside it). One `draw` effect works out every
+  measure as a CSS length (`blockRow`) and the markup only binds; the empty state, "add a service" tip and first-run
+  checklist (`STEP`) are bound too. Kebab / right-click / Shift+F10 still come from `wireRows(gridBox, {match: '.bk-block'})`
+  (delegated, so re-rendered blocks need no rewiring). `mergeWindows` moved to admin/lib/diary-layout.js (tested).
+- Settings > Closed days (`CLOSURE_ROW`) and a person's opening hours / days off (`DAY_ROW` with a nested
+  `{{#each windows}}`, `OFF_ROW`) are keyed lists of per-field observables; `hoursOut` / `daysOffOut` / `closuresOut`
+  turn them back into plain data for the dirty snapshot and the save. A "from" after the "to" still pulls "to" along.
+- Icons in rows added after binding are drawn by `I.scan` after a flush (`rescan`), because new rows arrive after
+  the panel's first scan.

package/plugins/booking/admin/lib/diary-layout.js

@@ -138,3 +138,21 @@ export function columnItems(bookings, {bookableId = ''} = {}) {
     }
     return [...groups.values()].map(g => ({...g, session: g.bookings.length > 1}));
 }
+
+/**
+ * Opening windows (minutes) merged where they touch or overlap - the week view's one band per day for everyone.
+ * Moved here from diary.js (1.6.4) so it is tested with the rest of the geometry.
+ *
+ * @param   {{from: number, to: number}[]} list
+ * @returns {{from: number, to: number}[]} sorted, non-overlapping copies
+ */
+export function mergeWindows(list) {
+    const sorted = [...(list || [])].sort((a, b) => a.from - b.from);
+    const out = [];
+    for (const w of sorted) {
+        const last = out[out.length - 1];
+        if (last && w.from <= last.to) last.to = Math.max(last.to, w.to);
+        else out.push({...w});
+    }
+    return out;
+}