domma-cms 1.6.60 → 1.7.1

package/plugins/booking/tests/email.test.js

@@ -0,0 +1,69 @@
+/**
+ * admin/lib/email.js - the mailto: fallback and link reading (node has no
+ * /admin/js/lib/mail-compose.js, so emailTo() here is the older-core path).
+ */
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {emailTo, looksLikeAddress, mailtoHref, parseMailto} from '../admin/lib/email.js';
+
+test('mailtoHref: one person in To, subject and body encoded, @ readable', () => {
+    assert.equal(mailtoHref({to: [{name: 'Ann', address: 'ann+x@example.test'}], subject: 'Hi & bye', body: 'Line 1\nLine 2'}),
+        'mailto:ann%2Bx@example.test?subject=Hi%20%26%20bye&body=Line%201%0ALine%202');
+});
+
+test('mailtoHref: several people in Bcc, strings and contacts alike', () => {
+    assert.equal(mailtoHref({bcc: ['a@x.test', {email: 'b@x.test'}], subject: 'S'}), 'mailto:?bcc=a@x.test,b@x.test&subject=S');
+});
+
+test('parseMailto reads back what mailtoHref writes, and plain links', () => {
+    const r = parseMailto(mailtoHref({to: 'a@x.test', cc: ['c@x.test'], bcc: ['b@x.test', 'd@x.test'], subject: 'Hi + there', body: 'Join: https://x.test/?a=1&b=2'}));
+    assert.deepEqual(r, {to: ['a@x.test'], cc: ['c@x.test'], bcc: ['b@x.test', 'd@x.test'], subject: 'Hi + there', body: 'Join: https://x.test/?a=1&b=2'});
+    assert.deepEqual(parseMailto('mailto:ann@example.test'), {to: ['ann@example.test'], cc: [], bcc: [], subject: '', body: ''});
+    assert.equal(parseMailto('https://example.test'), null);
+});
+
+test('emailTo on a core without mail-compose.js keeps the old mailto:', async () => {
+    const saved = globalThis.location;
+    globalThis.location = {href: '', hash: ''};
+    try {
+        assert.equal(await emailTo({to: [{name: 'Ann', address: 'ann@example.test'}], subject: 'Hello'}), 'mailto');
+        assert.equal(globalThis.location.href, 'mailto:ann@example.test?subject=Hello');
+        assert.equal(globalThis.location.hash, '');
+    } finally {
+        globalThis.location = saved;
+    }
+});
+
+test('fallback hardening: bad addresses dropped, repeats once, subject one line, text capped', () => {
+    for (const bad of ['a b@x.test', 'a@x.test\r\nBcc: c@x.test', '<a@x.test>', 'a@x.test,b@x.test', 'a@x.test?body=hi', 'nobody']) assert.equal(looksLikeAddress(bad), false, bad);
+    const href = mailtoHref({to: ['A@x.test', 'a@x.test', 'a b@x.test', 'me@x.test?body=evil'], subject: 'Hi\r\nBcc: c@x.test', body: 'x'.repeat(3000)});
+    assert.ok(href.startsWith('mailto:A@x.test?subject=Hi%20Bcc%3A%20c%40x.test&body='), href);
+    assert.equal(decodeURIComponent(href.split('body=')[1]).length, 2000);
+});
+
+test('parseMailto ignores the query when the address part is not an address', () => {
+    // An address stored as "me@x.com?body=..." and encoded into a link.
+    assert.deepEqual(parseMailto(`mailto:${encodeURIComponent('me@x.test?body=Pay now')}`), {to: [], cc: [], bcc: [], subject: '', body: ''});
+    assert.deepEqual(parseMailto('mailto:me@x.test%0D%0Abcc:z@x.test?subject=Hi&bcc=y@x.test'), {to: [], cc: [], bcc: [], subject: '', body: ''});
+    assert.deepEqual(parseMailto('mailto:?subject=Join&body=link').subject, 'Join');
+});
+
+test('emailTo on an old core: a mailto over 1800 characters is not opened - the addresses are copied', async () => {
+    const saved = {location: globalThis.location, E: globalThis.E, nav: Object.getOwnPropertyDescriptor(globalThis, 'navigator')};
+    let copied = '';
+    const toasts = [];
+    globalThis.location = {href: '', hash: ''};
+    globalThis.E = {toast: (m) => toasts.push(m)};
+    Object.defineProperty(globalThis, 'navigator', {value: {clipboard: {writeText: async (t) => { copied = t; }}}, configurable: true});
+    try {
+        const bcc = Array.from({length: 120}, (_, i) => `person${i}@example.test`);
+        assert.equal(await emailTo({bcc, subject: 'News'}), 'copied');
+        assert.equal(globalThis.location.href, '');
+        assert.equal(copied, bcc.join(', '));
+        assert.match(toasts[0], /120 addresses are copied.*Not carried over: the subject/);
+    } finally {
+        globalThis.location = saved.location;
+        globalThis.E = saved.E;
+        if (saved.nav) Object.defineProperty(globalThis, 'navigator', saved.nav); else delete globalThis.navigator;
+    }
+});

package/plugins/free-tier.lock.json

@@ -1,13 +1,14 @@
 {
   "note": "Written by `make sync-free-tier` in dcms-marketplace. Do not edit these plugins here - edit them there and sync.",
-  "source": "dcms-marketplace@72b2ff0",
+  "source": "dcms-marketplace@ddb1e0c",
   "plugins": {
     "blog": {
-      "version": "1.10.0",
+      "version": "1.10.1",
       "files": {
-        "CLAUDE.md": "67bea3889545180a0f385a42f8392453f89c8568d59303f3afb23804edbcf078",
+        "CLAUDE.md": "357072eb15b3c2b04b25a18ed44b3d569e1bbdf927118d5b472a9b952c3778d0",
         "admin/css/index.css": "8d6dfd2bfadf0bbe8efbd52ef9b397ca9d36ca699c80e260aec11f677c77a248",
         "admin/lib/drafts.js": "60446f6bf93b790f07041fbb95dac30b12cd0ebc3caa71d15f2a7dc16c661b0d",
+        "admin/lib/email.js": "89b9a96251b4ba7323376b6a59b9b31c52387ab7fad02cddef57e7629ea5e119",
         "admin/templates/blog.html": "1632dc30cbdd39dad3939a6b137c52fcc76fbd3ea52bd5f5574d8a4d915aac0b",
         "admin/templates/categories.html": "d87d20704fb661d50276a4a1447d350656aee808bcf36af73e33bc4e2ccca464",
         "admin/templates/comments.html": "70893fe44a60de42c7977a91edc87c86cbc065d68c2f80d0b5fbe7fb83176ebc",
@@ -15,7 +16,7 @@
         "admin/templates/settings.html": "e0730cd57435e592034328a699198d5e1326084767156bfc2289852f5f1a45af",
         "admin/views/blog.js": "959a2e9e22ba3e9ab19932cdf34002ec6bc592ac83a65febf08f5626e39765ba",
         "admin/views/categories.js": "92946bba9740e5f3ce6770bf283d5db5f061353cf7afa10ecf1dac38ead7d837",
-        "admin/views/comments.js": "e122a8a4120203535bd8345263cb4d511e8e4750e0b68b83fe0e722c3b096244",
+        "admin/views/comments.js": "ead4477f75c751cc1940ce2e5d272f6498c4940a34f69b3e896c47c7c9c4e263",
         "admin/views/kit.js": "a7d705de235bd7f125e5ff0607134863c1e67112f3b5876ed97dbbdded202dbc",
         "admin/views/post-editor.js": "a522f6f9692180e207b64b932d1ed999578dc6b14a2011dc9a74c4ab7f489d12",
         "admin/views/settings-cog.js": "307efc93835863dd8511f8fb17a224cf45a77532c90b854a86d2cd1d4e5f9f18",
@@ -52,8 +53,8 @@
         "lib/render.js": "0e97c6a950bc962c8d8ea4b2f21d06cb73fbcdc738d8942d6935d01309a29b1d",
         "lib/samples.js": "e8cdb77ce22e43937707f6854d3a5cb722437dc584e22ac7b24480bef686cf85",
         "plugin.js": "74b791100e3382fe62faf78e135df07f1ebafb4b52269890dac357ded7e54832",
-        "plugin.json": "37dda4ee698f50eb444422fbd7454e91db195ce6b635b19b7946aa4f0b14565e",
-        "plugin.public.js": "081ca0ef3e91fa5712392b332f19f17f45bd9ef741f1372c8a583c28bfa7f535",
+        "plugin.json": "d4e9376ee0fe982317d421e50d670d883d4f914406c77689ed56aa82195fa0f3",
+        "plugin.public.js": "0718b1610cebbdcca43012c9c4b67774c1baca2d4ccdcec4ddbd991458951cd8",
         "public/blog.css": "fd733e6b624190da1e70dc1b6613e2376efd7f7570a28fab311d81006d03d960",
         "public/blog.js": "d01c72a9834dcc7c5241923371f2b164ac30d20ac9f1a5c5dc5b71fa3cb09f08",
         "public/samples/aurora.svg": "feb29e2b46465913fc29de9eda221b00b1541f1fa3ea7120f0c1d1cd11a9a4f6",
@@ -70,6 +71,7 @@
         "tests/cache.test.js": "f823d9ff65c5b5594a8e3d1d3b598cc3524f10885ddf34017cf0a9364878a98f",
         "tests/comment-notices.test.js": "34026cc9a2a4746cf87bc41df8be849fadaa43091a72ac2aa1d06c1f437bf618",
         "tests/drafts.test.js": "7d4c86f13b61a99bab3ef17448f4c633b401c1cd79a41d346fe59288042c437f",
+        "tests/email.test.js": "2190b6dd7cc9afad99d2170f002343fe3dad306aa14ac718428e5df0be54ded1",
         "tests/layouts.test.js": "554cff8194bd650cfb5f2a83c1f51c25f427c07f7dbfdc2ad9ad69bb38fca6a0",
         "tests/nav-link.test.js": "d36e33ad7483abca27ae6e2098ad2f75bafa18d91f3beba70372ebe6b9b88994",
         "tests/notices.test.js": "2b02aa84e780dc4c82e6c503fc8fe17c64a63bee0709627866ef97c99cb4e131",
@@ -77,20 +79,21 @@
       }
     },
     "booking": {
-      "version": "1.7.0",
+      "version": "1.7.1",
       "files": {
-        "CLAUDE.md": "afca62bf08d8dca02402c784d33e3882a480f09c8a11e60f54ad20d1424f748d",
+        "CLAUDE.md": "d65d0008f84d42f71167d24477dd9dcdb78c31bd6fd146ad8ac60f06989f745f",
         "admin/css/index.css": "4f7731921c0c5038cb1566a6ab2d43ffc35bf9b161e58f87a0cff423e81b47fa",
         "admin/lib/details.js": "8b37536bfa9ccfcc5265cc957ba8266d3f5f777133e7c0946ae49540f1c80e3c",
         "admin/lib/diary-layout.js": "d0e36674ff454e5217b02c3ef3b820e4dece97a62df618a6052016dfeefab1c9",
         "admin/lib/drafts.js": "90d6c8403ef7c6a01569ad925939ce7634ab0853f7e3097d522c1e850636d6b1",
+        "admin/lib/email.js": "46e3e24b6be5a4667054a31dc0e73641f763d189129c93457900273ee4c8d5a8",
         "admin/lib/extension-sections.js": "0588ad47660e511b0dd8077bb9c3999c775d97597333a75e87ee12d915bbf00b",
         "admin/lib/kit.js": "403e792195e95770f6304bafab14ff13295c2bcc68cccda27e019a6739d0e888",
         "admin/templates/booking.html": "20b9a3bfe3e5d5bbee613f29be99551b12790fb38f80d119585360cc38e9ec57",
         "admin/views/booking.js": "939bf77016880ee091a9ee6cd6633cac0014801426b4c5bff9863d63aecd87a6",
         "admin/views/bookings.js": "bbe1068448e78134a5102ad9d7af16892f75a4449f150e92e649e66e7232e56b",
         "admin/views/diary.js": "bea962e57fc3be6ed07f5c6588889fffb106bc251193c0c48743f1f2442a6eef",
-        "admin/views/panels.js": "313bf09704e9fbed379c6f7a4ffb000c53460b9747311310482514c0c6d680c1",
+        "admin/views/panels.js": "cf6abeb6fc5f37aa3a30eec98d3b90ece5adab9436a8479899216043b28be07c",
         "admin/views/people.js": "55cc6d07b98ed305d577772b921eb8d09b564b099cb8d35441c1b39631e4764a",
         "admin/views/services.js": "32a2539391d06ec576c0af6d7aef1bbf71e22d6335c3654acb80491e56f19f41",
         "admin/views/settings.js": "7af543fa0e2772025c436b60b9a49282baa45f8af42e6d202096b9fcbc6336c2",
@@ -105,7 +108,7 @@
         "lib/mail.js": "cad8f409df62d6e42f0f4024ec364bbe018a62b842fa3f7c38786fd4e7f92408",
         "lib/store.js": "7aa7967e4694e5a3b85378f60302e5a47394b1d90c7dd86e09578156f1c13e03",
         "plugin.js": "4a303855a5a7f746e07e45a937dfeac8984dc9254c2f9b1a60b6f6306912ed84",
-        "plugin.json": "d05342466f1f48d18e2a1bf8452a2609de69f9c470d523985bd24ef518eb2ab7",
+        "plugin.json": "38a463f7c9c73de1419bb256d86b320abfd92b04eb5638716edcbd76702f1939",
         "plugin.public.js": "4d5b4e8ad6943182ee3b6c6e6f6762a2d3f676d8d7ee363fcb07bd47d3d6532e",
         "public/booking.css": "8b88989fdd04e50efc1688a2f32fe2e422299d7d13b81bb8fce0cc162fa99df6",
         "public/booking.js": "7dfc3d205696967013886567f67a867443c2e370bac29019d69911d695fdbade",
@@ -117,6 +120,7 @@
         "tests/admin-diary.test.js": "6bd117af798e748234c94e4e66339ff1ec3bba9633790a2a5fd291f64c30e484",
         "tests/admin-drafts.test.js": "c9e857b2326965b3dbb34e344282d874348f84b5cd9338ced2ca2c7a07713a25",
         "tests/api.test.js": "efb3767f7efde08c11c8edcb5753889773b421188798f725aff0e4e533860aff",
+        "tests/email.test.js": "2190b6dd7cc9afad99d2170f002343fe3dad306aa14ac718428e5df0be54ded1",
         "tests/public.test.js": "0b7b626d60df5a3d73d7c0077b73f59b62a9fded98ce84a8d93cd32cd0333159",
         "tests/pure.test.js": "8ba0c8f76b4c9efcc422f39ff29509612544d81f760025a4b9a5594af14e7bcf"
       }
@@ -189,15 +193,16 @@
       }
     },
     "shopping-cart": {
-      "version": "1.7.0",
+      "version": "1.7.1",
       "files": {
-        "CLAUDE.md": "52ee2002bf60f1a1164c52be5040351a593f38ef8366e5258032b07b10739af0",
+        "CLAUDE.md": "632cfa9f526394a20046f8a0817289ea6c6bd20508b385d0baf50cc9d118c394",
         "admin/css/index.css": "cdd7790511deef162ad30e299b4512d289583e978ba3b87d65945cdf1da3cdda",
         "admin/lib/chart.js": "b01ce5cfac773c8df8efccab50b67d3dfa99fbead0037d817553db4a6688d4d6",
         "admin/lib/drafts.js": "9e71b939f6c98d5c25875f35b02c367a5e89e0d2c6d084d6a4de0c71128930a2",
+        "admin/lib/email.js": "9f842932c8de39ac6878463bd49c443df82ecf64872dad48ff5362d6b61c1e2c",
         "admin/lib/kit.js": "94e5b5d979ded3318df2d0291bc9aeeb44af945aa0e84e68f9af10f5a53ae458",
         "admin/templates/shop.html": "c5bb03f1f7cbabfbd8202f3533783eb1848103755b1ba25fdcf1fd8e9478cb8e",
-        "admin/views/orders.js": "8c4b3e03e91a2caa4b9a5143b4ecafd1870da27888755b4205efb1e8d8bee59e",
+        "admin/views/orders.js": "3bf34dc8efaf4b044e92e494b95471a256988655a60c81a4ec1e6def3766f701",
         "admin/views/overview.js": "02241e75976cfa759d6ba738dd13ca0bd2bcb760d66a5f184becc2e472807efc",
         "admin/views/products.js": "b35893d85b92db0048459431258f2a235b1f0824b3601bebc5e5d94fdcc0d10f",
         "admin/views/sales.js": "001c08963e26df72f43d2357bbcc5a0f54f74f9d22bca319c23a28a50f40c124",
@@ -220,7 +225,7 @@
         "lib/shop.js": "baa5dfc4e410210e8ba13678997ee5752eb2ebe72fc4d3e449465d29b60b458d",
         "lib/summary.js": "cdb13ce3d1799d429059fa03f179281711dc00427ccf2eb6b8f8aa52fef26295",
         "plugin.js": "824dba8336846d443b2427ed9a5adeba11740570566fc6e89257f9847a488632",
-        "plugin.json": "03a80c969e7e7acb0a07c37da23fb2867e56b109d506235254d60c270d45da94",
+        "plugin.json": "2d9faac96c212946d911fa1bb031969721a3169aac69cc453ac318e2fd1cf3b4",
         "plugin.public.js": "2f92e8340c9da653401c11dd99dab033dc6772d63fa2114489192c48e9e0be00",
         "public/account.js": "5f644016c098c7879c59948d662f5997cb61680996204ecb7897baab8945d434",
         "public/cart.js": "7338141392ec653ff616eb75688d2a2ad08cff8427d7020d381f540be0037b73",
@@ -247,22 +252,24 @@
         "tests/api.test.js": "15c71751a3d31171707cbb3119d21b85c1c59fb7a67272b318dd4655809ac8d2",
         "tests/commission.test.js": "fbc4cf83e0ed6446a09e57e4ff37a9608c81947c633c78ac6049eb0aedf6cb58",
         "tests/drafts.test.js": "2dec0cfeadd6df1d3b90f3fd8bce1f33762811eb6e94cd7325bcb8ec31edac42",
+        "tests/email.test.js": "2190b6dd7cc9afad99d2170f002343fe3dad306aa14ac718428e5df0be54ded1",
         "tests/pure.test.js": "59a351c813784e8131b96a118c79de2e3858a2fba0fc5c0a6baed79e28cafda8",
         "tests/refunds.test.js": "0ae06afca3cf9fd1fe89f1fbc63b3676216c79e174dbcb83788180c01d078366",
         "tests/sales.test.js": "9025bc608b04bcc14f5bb2c98b4f7c35de99f3ddab4ffa59772d045795bf2cb7"
       }
     },
     "support": {
-      "version": "1.2.0",
+      "version": "1.2.1",
       "files": {
-        "CLAUDE.md": "99e2856a5d57486c876126b9fb8249ff44c2ac5af1a8b471c0bbf8b888102e2a",
+        "CLAUDE.md": "68f5c1cda64b87f6b1c9a20e874cf884c36f6cb4aec1611a546586b80bbc579d",
         "admin/css/index.css": "e7fefb4e6d58010d8fd4c6acdf4e9597506a11a25f0fd4a450377551723ae89e",
         "admin/lib/drafts.js": "fe60c4792d34f4f92b19908ab9d030704992e463a26c0bdd6aac0284ec643d1a",
+        "admin/lib/email.js": "a159b09c00af6056363209b5373612957e3b9f9eb530e53a7e4ae1e5bbd194f5",
         "admin/lib/kit.js": "1208f0b2df2bb4e4d9366fda4c62464e783a10cb9e3477335c54cd14ca2da407",
         "admin/lib/settings.js": "293196cded3dbc72a092869e870a75ca587560bf76ffca3c5ab9b90c1fa09b33",
         "admin/templates/support.html": "2bb69d0443a367a402e6160fe68f4af3e8983b578cfff9575b4df9a534fcb480",
-        "admin/views/desk.js": "5da6fa6a48cd2bbf628b7effcd72e1006338938d001cd4432eae9ccbb8fe7782",
-        "admin/views/inbox.js": "dea7954f982317288f9517840f6cf85728e5e011bd708c4448984766f6f8b45d",
+        "admin/views/desk.js": "8c4ac9ee5db56942d08ebc91f138a935640849ac091188f4e86c40c7a48f9156",
+        "admin/views/inbox.js": "4703df468537bc752ace5046df1f3ba22e21336d277116980dd4f5f985015d8a",
         "admin/views/support.js": "0319c9150f76edc5456cc66145ce00ef082710a6c0aa3c6febba19a98f546ec9",
         "collections/support-tickets.json": "55a0856bacd66c2e8f1e3c85bdf3638e5ff826560943cda854a8f2d336a88905",
         "config.js": "eb7ccc1169fa8b2be52a213536825492fedaec5fa73fd749cba9f498dd54b503",
@@ -274,9 +281,10 @@
         "lib/sender.js": "2b308422ac60a8a2801570e06319d5972797a601640c67beee95ccab9ac64092",
         "lib/shape.js": "d60b48410aa5582ea80451c3d831686b0e29525a958733a8bc9dfaae8eca94d2",
         "plugin.js": "91fff8d66bf5fa0fa4502bb177460ae234f0ed0494a4fbe6dd94d63e2f88b571",
-        "plugin.json": "e6e7eb5058e247be225ced7d09463e6c8c66af6904b042df726b10f6bd148b2a",
+        "plugin.json": "13318ff0bb1a5b5ad14dbab79a287991976d8502f2f4f9a898786c22dfb174eb",
         "tests/api.test.js": "1af65f0cba8a83c080a6e3e65544abc86fc43c8e25ca05c7f3e1ab4e3f7ac5a2",
         "tests/drafts.test.js": "08d3920cf77b61fc92cb7785853afd8a5ff55c8851c1a7237a34464fd82e842e",
+        "tests/email.test.js": "2190b6dd7cc9afad99d2170f002343fe3dad306aa14ac718428e5df0be54ded1",
         "tests/settings.test.js": "434acbfd940eef800b1166a9aaf36363351af5652fcfb06527b8498866b7b964",
         "tests/shape.test.js": "7866c6c1d140716bf0817449937d6d711d7c3b97be1db1e1eb33bde341e36296"
       }

package/plugins/shopping-cart/CLAUDE.md

@@ -263,3 +263,7 @@ amount is all that is left), a Refund button. Never put form fields in `E.confir
   destructive.
 - Fulfil and Refund panels are in `actionPanels`, closed by the screen teardown; their saves refuse once it has gone.
 - The accounts test sets a Site URL in `config/site.json` and restores it (`/account/register` needs a link base).
+
+## 1.7.1
+
+- **Email (openEmail).** Email actions go through `admin/lib/email.js`: `emailTo()` for menu actions (several people always in Bcc), `routeMailLinks(root)` for visible `mailto:` links. Core's `/admin/js/lib/mail-compose.js` (CMS 1.6.61+) opens Email Pro's compose window when the user has a mailbox there; older cores keep a cleaned, capped `mailto:` (over 1800 chars the addresses are copied instead). Stored addresses are encoded into links, or shown as text when invalid. Never set `location.href = 'mailto:…'` directly.

package/plugins/shopping-cart/admin/lib/email.js

@@ -0,0 +1,191 @@
+/**
+ * Email someone from this Tool: Email Pro's compose window when the user can
+ * send from it, otherwise the device's mail program through `mailto:`.
+ *
+ * Core makes the choice (`/admin/js/lib/mail-compose.js`, CMS 1.6.61+). It is
+ * imported at RUN time, never statically, so this Tool still loads on an older
+ * core - where every action keeps the plain `mailto:` it always had.
+ *
+ * `emailTo()` is for menu actions; `routeMailLinks()` is for a visible
+ * `<a href="mailto:…">` - the link stays a link (copy, hover, middle-click all
+ * still work) and a plain click goes the same way as the menu action.
+ *
+ * @module shopping-cart/admin/lib/email
+ */
+
+const CORE = '/admin/js/lib/mail-compose.js';
+let core = null;
+
+/** The core module, or null on a core without it. Asked once. */
+const loadCore = () => (core ??= import(CORE).catch(() => null));
+
+/** Longest subject or body carried (as core's). */
+const MAX_TEXT = 2000;
+/** Longest mailto: handed to the device - mail programs cut or refuse longer ones. */
+const MAX_MAILTO = 1800;
+
+/**
+ * Something that can only be an email address: one @, no spaces or line
+ * breaks, nothing that would start another recipient or a query.
+ *
+ * @param   {*} value
+ * @returns {boolean}
+ */
+export function looksLikeAddress(value) {
+    return typeof value === 'string' && /^[^\s@<>,;"?&]+@[^\s@<>,;"?&]+$/.test(value);
+}
+
+/** Valid addresses only, once each (ignoring case), from a string, `{address}`/`{email}`, or a list. */
+function addressesOf(list) {
+    const seen = new Set();
+    return (Array.isArray(list) ? list : list == null ? [] : [list])
+        .map(x => String(typeof x === 'string' ? x : (x?.address ?? x?.email ?? '')).trim())
+        .filter(a => looksLikeAddress(a) && !seen.has(a.toLowerCase()) && seen.add(a.toLowerCase()));
+}
+
+/** Trim and cap; a subject loses its line breaks (they would be a header). */
+function cleanText(value, {oneLine = false} = {}) {
+    let text = String(value ?? '');
+    if (oneLine) text = text.replace(/[\r\n]+/g, ' ');
+    return text.slice(0, MAX_TEXT).trim();
+}
+
+/**
+ * The request as a `mailto:` link (the fallback on an older core).
+ *
+ * @param   {{to?: *, cc?: *, bcc?: *, subject?: string, body?: string}} request
+ * @returns {string}
+ */
+export function mailtoHref({to, cc, bcc, subject, body} = {}) {
+    const enc = (list) => addressesOf(list).map(a => encodeURIComponent(a).replace(/%40/g, '@')).join(',');
+    const s = cleanText(subject, {oneLine: true});
+    const b = cleanText(body);
+    const query = [];
+    if (enc(cc)) query.push(`cc=${enc(cc)}`);
+    if (enc(bcc)) query.push(`bcc=${enc(bcc)}`);
+    if (s) query.push(`subject=${encodeURIComponent(s)}`);
+    if (b) query.push(`body=${encodeURIComponent(b)}`);
+    return `mailto:${enc(to)}${query.length ? `?${query.join('&')}` : ''}`;
+}
+
+/** Copy text: the clipboard, else the old copy command, else a box to copy it from by hand. */
+async function copyText(text) {
+    try {
+        await navigator.clipboard.writeText(text);
+        return true;
+    } catch { /* next */ }
+    const box = document.createElement('textarea');
+    box.className = 'form-input';
+    box.readOnly = true;
+    box.rows = 6;
+    box.value = text;
+    try {
+        box.style.position = 'fixed';
+        box.style.opacity = '0';
+        document.body.appendChild(box);
+        box.select();
+        if (document.execCommand('copy')) return true;
+    } catch { /* next */ } finally {
+        box.remove();
+        box.style.position = '';
+        box.style.opacity = '';
+    }
+    const modal = E.modal({title: 'Copy the addresses', size: 'medium', buttons: [{id: 'close', text: 'Close', variant: 'secondary'}]});
+    modal.element.appendChild(box);   // light DOM: setContent would strip the textarea
+    modal.open();
+    box.select();
+    return false;
+}
+
+/**
+ * Hand the request to the device's mail program - unless the link would be
+ * too long for it, when the addresses are copied instead and the toast says
+ * what did not go.
+ */
+async function openMailto(request) {
+    const href = mailtoHref(request);
+    if (href.length <= MAX_MAILTO) {
+        location.href = href;
+        return 'mailto';
+    }
+    const all = addressesOf([...addressesOf(request.to), ...addressesOf(request.cc), ...addressesOf(request.bcc)]);
+    const copied = all.length ? await copyText(all.join(', ')) : false;
+    const lost = [cleanText(request.subject) && 'the subject', cleanText(request.body) && 'the message'].filter(Boolean);
+    E.toast(`Too long for your mail program to open. ${all.length
+        ? `${copied ? 'The' : 'Copy the'} ${all.length} address${all.length === 1 ? '' : 'es'}${copied ? ' are copied' : ''} - paste them into Bcc of a new email.` : ''}${lost.length ? ` Not carried over: ${lost.join(' and ')}.` : ''}`,
+    {type: 'warning', duration: 9000});
+    return 'copied';
+}
+
+const decode = (s) => { try { return decodeURIComponent(s); } catch { return s; } };
+
+/**
+ * A `mailto:` link read back into a request (what a visible link carries).
+ * When the address part holds anything that is not an address, the query
+ * is ignored: an address stored as `me@x.com?body=…` must not prefill a message.
+ *
+ * @param   {string} href
+ * @returns {null|{to: string[], cc: string[], bcc: string[], subject: string, body: string}}
+ */
+export function parseMailto(href) {
+    const m = String(href ?? '').match(/^mailto:([^?]*)(?:\?(.*))?$/i);
+    if (!m) return null;
+    const split = (s) => decode(s || '').split(/[,;]/).map(x => x.trim()).filter(Boolean);
+    const named = split(m[1]);
+    const out = {to: addressesOf(named), cc: [], bcc: [], subject: '', body: ''};
+    if (named.some(a => !looksLikeAddress(a))) return out;
+    for (const pair of (m[2] || '').split('&')) {
+        const i = pair.indexOf('=');
+        if (i < 1) continue;
+        const key = pair.slice(0, i).toLowerCase();
+        const value = pair.slice(i + 1);
+        if (key === 'to') out.to = addressesOf([...out.to, ...split(value)]);
+        else if (key === 'cc' || key === 'bcc') out[key] = addressesOf([...out[key], ...split(value)]);
+        else if (key === 'subject') out.subject = cleanText(decode(value), {oneLine: true});
+        else if (key === 'body') out.body = cleanText(decode(value));
+    }
+    return out;
+}
+
+/**
+ * Email someone. Recipients are `{name, address}`, `{name, email}` or bare
+ * addresses; several people belong in `bcc`, so nobody sees the others.
+ * With nobody to address (a link to pass on) compose still opens, To empty.
+ *
+ * @param   {{to?: *, cc?: *, bcc?: *, subject?: string, body?: string}} request
+ * @returns {Promise<'compose'|'mailto'|'copied'|'none'>}
+ */
+export async function emailTo(request = {}) {
+    const mail = await loadCore();
+    if (!mail) return openMailto(request);
+    const r = mail.composeRequest(request);
+    if (r.to.length || r.cc.length || r.bcc.length) return mail.openEmail(r);
+    if (await mail.emailReady()) {
+        location.hash = mail.composeHash(r);
+        return 'compose';
+    }
+    location.href = mail.mailtoHref(r);
+    return 'mailto';
+}
+
+/**
+ * Send plain clicks on the `mailto:` links inside `root` through `emailTo()`.
+ * A modified click (new tab/window) or one already handled is left alone.
+ *
+ * @param   {Element} root
+ * @returns {() => void} removes the listener
+ */
+export function routeMailLinks(root) {
+    if (!root) return () => {};
+    const onClick = (e) => {
+        if (e.defaultPrevented || e.button !== 0 || e.metaKey || e.ctrlKey || e.shiftKey || e.altKey) return;
+        const a = e.target?.closest?.('a[href^="mailto:" i]');
+        if (!a || !root.contains(a)) return;
+        const request = parseMailto(a.getAttribute('href'));
+        if (!request) return;
+        e.preventDefault();
+        emailTo(request);
+    };
+    root.addEventListener('click', onClick);
+    return () => root.removeEventListener('click', onClick);
+}

package/plugins/shopping-cart/admin/views/orders.js

@@ -11,6 +11,7 @@
 
 import {api, claims, copy, deferItems, entriesOf, esc, fmtDate, fmtDateTime, money, moneyIn, moneyOut, mountPanels, openPanel, refreshBadge, store, when, wireRows} from '../lib/kit.js';
 import {NEXT, STATUS_LABEL, STATUS_TONE, addressLines, orderLabel} from '/plugins/shopping-cart/public/lib/orders.js';
+import {emailTo, looksLikeAddress, routeMailLinks} from '../lib/email.js';
 
 const FILTERS = [
     {key: 'open', label: 'To do', match: (s) => s === 'paid' || s === 'awaiting'},
@@ -347,7 +348,7 @@ ${(d.lines || []).map(l => `<tr><td class="q">${l.qty}</td><td>${esc(l.name)}${l
             {type: 'divider'},
             {label: 'Packing slip', icon: 'printer', action: () => packingSlip(o)},
             {label: 'Copy receipt link', icon: 'link', action: () => copy(receiptUrl(o), 'Receipt link copied')},
-            {label: 'Email the shopper', icon: 'mail', action: () => { location.href = `mailto:${encodeURIComponent(o.data.email)}?subject=${encodeURIComponent(`Your order ${orderLabel(o.data)}`)}`; }},
+            {label: 'Email the shopper', icon: 'mail', action: () => emailTo({to: [{name: o.data.customer?.name, address: o.data.email}], subject: `Your order ${orderLabel(o.data)}`})},
             ...(['pending', 'cancelled', 'awaiting'].includes(o.data.status) ? [{type: 'divider'}, {label: 'Delete…', icon: 'trash', danger: true, action: () => remove(o)}] : [])
         ];
     }
@@ -398,6 +399,7 @@ ${(d.lines || []).map(l => `<tr><td class="q">${l.qty}</td><td>${esc(l.name)}${l
             }
         };
         let extPanels = null;
+        let unrouteMail = () => {};
         const ext = Object.entries(d.ext || {}).flatMap(([owner, facts]) => Object.entries(facts || {}).map(([k, v]) => ({owner, k, v})))
             .filter(x => ['string', 'number', 'boolean'].includes(typeof x.v));
         const addr = addressLines(d.address);
@@ -420,7 +422,7 @@ ${(d.lines || []).map(l => `<tr><td class="q">${l.qty}</td><td>${esc(l.name)}${l
     <div class="is-total"><dt>Total</dt><dd>${esc(money(d.total))}</dd></div>
   </dl>
   <div class="shp-order-cols">
-    <section><h4>Shopper</h4><p><strong>${esc(d.customer?.name || '')}</strong><br><a href="mailto:${esc(d.email)}">${esc(d.email)}</a>${d.customer?.phone ? `<br><a href="tel:${esc(d.customer.phone)}">${esc(d.customer.phone)}</a>` : ''}</p></section>
+    <section><h4>Shopper</h4><p><strong>${esc(d.customer?.name || '')}</strong><br>${looksLikeAddress(d.email) ? `<a href="mailto:${esc(encodeURIComponent(d.email))}">${esc(d.email)}</a>` : esc(d.email || '')}${d.customer?.phone ? `<br><a href="tel:${esc(d.customer.phone)}">${esc(d.customer.phone)}</a>` : ''}</p></section>
     <section><h4>${d.delivery === 'collect' ? 'Collecting' : d.requiresShipping ? 'Deliver to' : 'Delivery'}</h4>
       <p>${d.delivery === 'collect' ? esc(settings.collectionLabel || 'In person') : addr.length ? addr.map(esc).join('<br>') : 'Nothing to ship.'}</p>
       ${d.tracking ? `<p class="shp-muted">${esc([d.tracking.carrier, d.tracking.number].filter(Boolean).join(' · '))}${d.tracking.url ? ` · <a href="${esc(d.tracking.url)}" target="_blank" rel="noopener">track</a>` : ''}</p>` : ''}</section>
@@ -443,8 +445,14 @@ ${(d.lines || []).map(l => `<tr><td class="q">${l.qty}</td><td>${esc(l.name)}${l
             size: 'lg',
             model: {staffNote, status},
             html,
-            before: (el) => { const n = el.querySelector('.shp-callout p'); if (n) n.textContent = d.note; },
+            before: (el) => {
+                const n = el.querySelector('.shp-callout p');
+                if (n) n.textContent = d.note;
+                // The shopper's address stays a link; a click goes to Email Pro's compose when it can.
+                unrouteMail = routeMailLinks(el);
+            },
             cleanup: () => {
+                unrouteMail();
                 if (panels.get(o.id) === panel) panels.delete(o.id);
                 release();
                 extPanels?.destroy();

package/plugins/shopping-cart/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "shopping-cart",
   "displayName": "Shopping Cart",
-  "version": "1.7.0",
+  "version": "1.7.1",
   "tier": "free",
   "description": "Sell from your site: products with options, stock and pictures, a storefront and a cart that follows shoppers from page to page, and checkout with Stripe, PayPal or payment offline. Orders to fulfil in the sidebar, refunds from the order.",
   "author": "Domma CMS",
@@ -45,7 +45,7 @@
     ],
     "views": {
       "plugin-shopping-cart": {
-        "entry": "shopping-cart/admin/views/shop.js?v=1.7.0",
+        "entry": "shopping-cart/admin/views/shop.js?v=1.7.1",
         "exportName": "shopView"
       }
     }

package/plugins/shopping-cart/tests/email.test.js

@@ -0,0 +1,69 @@
+/**
+ * admin/lib/email.js - the mailto: fallback and link reading (node has no
+ * /admin/js/lib/mail-compose.js, so emailTo() here is the older-core path).
+ */
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {emailTo, looksLikeAddress, mailtoHref, parseMailto} from '../admin/lib/email.js';
+
+test('mailtoHref: one person in To, subject and body encoded, @ readable', () => {
+    assert.equal(mailtoHref({to: [{name: 'Ann', address: 'ann+x@example.test'}], subject: 'Hi & bye', body: 'Line 1\nLine 2'}),
+        'mailto:ann%2Bx@example.test?subject=Hi%20%26%20bye&body=Line%201%0ALine%202');
+});
+
+test('mailtoHref: several people in Bcc, strings and contacts alike', () => {
+    assert.equal(mailtoHref({bcc: ['a@x.test', {email: 'b@x.test'}], subject: 'S'}), 'mailto:?bcc=a@x.test,b@x.test&subject=S');
+});
+
+test('parseMailto reads back what mailtoHref writes, and plain links', () => {
+    const r = parseMailto(mailtoHref({to: 'a@x.test', cc: ['c@x.test'], bcc: ['b@x.test', 'd@x.test'], subject: 'Hi + there', body: 'Join: https://x.test/?a=1&b=2'}));
+    assert.deepEqual(r, {to: ['a@x.test'], cc: ['c@x.test'], bcc: ['b@x.test', 'd@x.test'], subject: 'Hi + there', body: 'Join: https://x.test/?a=1&b=2'});
+    assert.deepEqual(parseMailto('mailto:ann@example.test'), {to: ['ann@example.test'], cc: [], bcc: [], subject: '', body: ''});
+    assert.equal(parseMailto('https://example.test'), null);
+});
+
+test('emailTo on a core without mail-compose.js keeps the old mailto:', async () => {
+    const saved = globalThis.location;
+    globalThis.location = {href: '', hash: ''};
+    try {
+        assert.equal(await emailTo({to: [{name: 'Ann', address: 'ann@example.test'}], subject: 'Hello'}), 'mailto');
+        assert.equal(globalThis.location.href, 'mailto:ann@example.test?subject=Hello');
+        assert.equal(globalThis.location.hash, '');
+    } finally {
+        globalThis.location = saved;
+    }
+});
+
+test('fallback hardening: bad addresses dropped, repeats once, subject one line, text capped', () => {
+    for (const bad of ['a b@x.test', 'a@x.test\r\nBcc: c@x.test', '<a@x.test>', 'a@x.test,b@x.test', 'a@x.test?body=hi', 'nobody']) assert.equal(looksLikeAddress(bad), false, bad);
+    const href = mailtoHref({to: ['A@x.test', 'a@x.test', 'a b@x.test', 'me@x.test?body=evil'], subject: 'Hi\r\nBcc: c@x.test', body: 'x'.repeat(3000)});
+    assert.ok(href.startsWith('mailto:A@x.test?subject=Hi%20Bcc%3A%20c%40x.test&body='), href);
+    assert.equal(decodeURIComponent(href.split('body=')[1]).length, 2000);
+});
+
+test('parseMailto ignores the query when the address part is not an address', () => {
+    // An address stored as "me@x.com?body=..." and encoded into a link.
+    assert.deepEqual(parseMailto(`mailto:${encodeURIComponent('me@x.test?body=Pay now')}`), {to: [], cc: [], bcc: [], subject: '', body: ''});
+    assert.deepEqual(parseMailto('mailto:me@x.test%0D%0Abcc:z@x.test?subject=Hi&bcc=y@x.test'), {to: [], cc: [], bcc: [], subject: '', body: ''});
+    assert.deepEqual(parseMailto('mailto:?subject=Join&body=link').subject, 'Join');
+});
+
+test('emailTo on an old core: a mailto over 1800 characters is not opened - the addresses are copied', async () => {
+    const saved = {location: globalThis.location, E: globalThis.E, nav: Object.getOwnPropertyDescriptor(globalThis, 'navigator')};
+    let copied = '';
+    const toasts = [];
+    globalThis.location = {href: '', hash: ''};
+    globalThis.E = {toast: (m) => toasts.push(m)};
+    Object.defineProperty(globalThis, 'navigator', {value: {clipboard: {writeText: async (t) => { copied = t; }}}, configurable: true});
+    try {
+        const bcc = Array.from({length: 120}, (_, i) => `person${i}@example.test`);
+        assert.equal(await emailTo({bcc, subject: 'News'}), 'copied');
+        assert.equal(globalThis.location.href, '');
+        assert.equal(copied, bcc.join(', '));
+        assert.match(toasts[0], /120 addresses are copied.*Not carried over: the subject/);
+    } finally {
+        globalThis.location = saved.location;
+        globalThis.E = saved.E;
+        if (saved.nav) Object.defineProperty(globalThis, 'navigator', saved.nav); else delete globalThis.navigator;
+    }
+});

package/plugins/support/CLAUDE.md

@@ -154,3 +154,7 @@ removes the rest. Found on the dcm click-through.
   keydown while the opening Enter is still bubbling and would read it as OK = Throw away.
 - Opening a request: only a 404 counts as deleted; any other failure toasts and keeps the draft. The desk's file picker
   has `drop(ids)` - remove only the attachments that went with the message.
+
+## 1.2.1
+
+- **Email (openEmail).** Email actions go through `admin/lib/email.js`: `emailTo()` for menu actions (several people always in Bcc), `routeMailLinks(root)` for visible `mailto:` links. Core's `/admin/js/lib/mail-compose.js` (CMS 1.6.61+) opens Email Pro's compose window when the user has a mailbox there; older cores keep a cleaned, capped `mailto:` (over 1800 chars the addresses are copied instead). Stored addresses are encoded into links, or shown as text when invalid. Never set `location.href = 'mailto:…'` directly.