domma-cms 1.8.25 → 1.8.26

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## [1.8.26] - 2026-10-18
+
+- **Updates clear out their old backups.** Every `npx domma-cms update` copies the engine and plugins into `.domma-backups/` first, and nothing ever removed those copies - some sites held 250+ of up to 490 MB each. After a successful update it now keeps the newest 7, plus one about a week, a month, three, six and twelve months old (at most 16), and nothing older than a year. Backups you put in that folder yourself, under any other name, are never touched.
+
 ## [1.8.25] - 2026-10-18
 
 - **Tutorial: The Editor.** A walk through a working session in the editor - the list, the tabs, coloured text, the live preview, saving and drafts, and the settings (font, wrapping, smooth typing, the admin menu folding away). Under Documentation › Tutorials, first in the list on every site.

package/bin/lib/backup-retention.js

@@ -0,0 +1,66 @@
+/**
+ * Update backups, for the engine updater.
+ *
+ * Every update copies the engine's code, structural configs and plugins into
+ * .domma-backups/<timestamp>/ (about 500 MB on a site with plugins) and nothing
+ * ever removed them: a site that rolled a few times a day had 250+ of them. The
+ * updater now keeps the newest few plus one backup per age band - about a week,
+ * a month, three months, six months and a year old - and nothing older than a
+ * year. Only the names the updater writes are counted: anything else in the
+ * folder was put there by hand and is left alone.
+ *
+ * Each band keeps its OLDEST backup - that is what lets one move up: it ages out
+ * of its band into the next. Past the first week a band also keeps its NEWEST,
+ * the next in line, so when the oldest moves on the band is never left empty
+ * (with only the oldest kept, the year band stood empty 44% of the time at three
+ * updates a day). So at most 7 + 1 + 2 x 4 = 16 are kept.
+ *
+ * @module bin/lib/backup-retention
+ */
+
+import {existsSync, readdirSync, rmSync} from 'node:fs';
+import path from 'node:path';
+
+/** How many of the newest update backups a site keeps outright. */
+export const KEEP_UPDATE_BACKUPS = 7;
+
+const DAY = 24 * 60 * 60 * 1000;
+
+/** Age bands, in days: [from, to). The first starts at 0 so a backup can survive long enough to reach a week. */
+export const BACKUP_BANDS = [[0, 7], [7, 30], [30, 90], [90, 180], [180, 365]];
+
+/** `new Date().toISOString()` with `:` and `.` made `-` - the updater's own names. */
+const UPDATE_BACKUP_NAME = /^(\d{4}-\d{2}-\d{2})T(\d{2})-(\d{2})-(\d{2})-(\d{3})Z$/;
+
+/** When an update backup was taken, from its name; null for a name the updater did not write. */
+export function backupTime(name) {
+    const m = UPDATE_BACKUP_NAME.exec(name);
+    if (!m) return null;
+    const t = Date.parse(`${m[1]}T${m[2]}:${m[3]}:${m[4]}.${m[5]}Z`);
+    return Number.isNaN(t) ? null : t;
+}
+
+/** The update backups to remove from a listing, oldest first. Pure: `now` is a timestamp in ms. */
+export function backupsToPrune(names, now = Date.now(), keep = KEEP_UPDATE_BACKUPS) {
+    const ours = names
+        .map(name => ({name, at: backupTime(name)}))
+        .filter(b => b.at !== null)
+        .sort((a, b) => a.at - b.at);
+    const kept = new Set(ours.slice(-keep).map(b => b.name));
+    BACKUP_BANDS.forEach(([from, to], i) => {
+        const inBand = ours.filter(b => now - b.at >= from * DAY && now - b.at < to * DAY);
+        if (!inBand.length) return;
+        kept.add(inBand[0].name);
+        if (i > 0) kept.add(inBand.at(-1).name);
+    });
+    return ours.filter(b => !kept.has(b.name)).map(b => b.name);
+}
+
+/** Apply the retention rule to `dir`. Returns the names removed. */
+export function pruneUpdateBackups(dir, now = Date.now()) {
+    if (!existsSync(dir)) return [];
+    const names = readdirSync(dir, {withFileTypes: true}).filter(e => e.isDirectory()).map(e => e.name);
+    const doomed = backupsToPrune(names, now);
+    for (const name of doomed) rmSync(path.join(dir, name), {recursive: true, force: true});
+    return doomed;
+}

package/bin/update.js

@@ -15,6 +15,7 @@ import {createInterface} from 'node:readline';
 import {fileURLToPath} from 'node:url';
 import {deepMergeNewKeys} from './lib/config-merge.js';
 import {shouldReplacePlugin} from './lib/plugin-version.js';
+import {KEEP_UPDATE_BACKUPS, pruneUpdateBackups} from './lib/backup-retention.js';
 
 // ---------------------------------------------------------------------------
 // Paths
@@ -567,6 +568,13 @@ export default async function update(_positional, flags) {
         console.log('');
     }
 
+    // -------------------------------------------------------------------------
+    // 13b. Thin the update backups (bin/lib/backup-retention.js) - done last, so a failed update
+    //      never costs a backup, and only when this run took one.
+    // -------------------------------------------------------------------------
+
+    const prunedBackups = backupPath ? pruneUpdateBackups(path.join(cwd, '.domma-backups')) : [];
+
     // -------------------------------------------------------------------------
     // 14. Summary
     // -------------------------------------------------------------------------
@@ -581,6 +589,9 @@ export default async function update(_positional, flags) {
 
     if (backupPath) {
         info(`Backup saved to: .domma-backups/${path.basename(backupPath)}/`);
+        if (prunedBackups.length) {
+            info(`Removed ${prunedBackups.length} older update backup(s): the newest ${KEEP_UPDATE_BACKUPS} are kept, plus one about a week, a month, 3, 6 and 12 months old.`);
+        }
     }
 
     if (newPlugins.length > 0) {

package/docs/DommaFeatures.md

@@ -1280,9 +1280,10 @@ The four Tools below were plugins until 0.67.0 and are now part of the CMS. They
   - Registers new plugins, disabled except the protective ones such as Security.
   - Adds only new keys to `server.json`, `auth.json`, `content.json` and `presets.json`.
   - Swaps the CMS dependencies but keeps dependencies you added, self-heals `.gitignore`, updates the marker and runs `npm install`.
+  - Thins `.domma-backups/` after a successful update: the newest 7 update backups, plus the oldest and newest backup aged 7-30 days, 30-90 days, 90-180 days and 180-365 days (and the oldest under a week), so one about a week, a month, three, six and twelve months old is always there - at most 16. Nothing older than a year is kept, and backups not named by the updater are never touched (unreleased).
   
   Options: `--yes`, `--no-backup`, `--no-install`, `--dry-run` (preview only), `--force` (reinstall the same version).
-  Where: `bin/update.js`, `bin/lib/config-merge.js`, `bin/lib/plugin-version.js` - Since: 0.6.5.
+  Where: `bin/update.js`, `bin/lib/config-merge.js`, `bin/lib/plugin-version.js`, `bin/lib/backup-retention.js` - Since: 0.6.5.
 - **`npm run setup`** - The terminal setup wizard:
   1. Generates `JWT_SECRET` and `INSTANCE_SECRET`.
   2. Creates the first admin if there are no users (password of at least 8 characters).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "1.8.25",
+  "version": "1.8.26",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",