domma-cms 1.8.32 → 1.8.34

package/plugins/docs/tests/shortcuts.test.js

@@ -0,0 +1,30 @@
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {markdownTrigger} from '../admin/lib/shortcuts.js';
+
+/** Docs - Markdown shortcuts while typing. */
+
+test('space after a marker turns the line into that block', () => {
+    assert.deepEqual(markdownTrigger('#', ' '), {length: 1, action: {type: 'block', tag: 'h1'}});
+    assert.deepEqual(markdownTrigger('###', ' ').action, {type: 'block', tag: 'h3'});
+    assert.equal(markdownTrigger('-', ' ').action.type, 'ul');
+    assert.equal(markdownTrigger('*', ' ').action.type, 'ul');
+    assert.equal(markdownTrigger('1.', ' ').action.type, 'ol');
+    assert.equal(markdownTrigger('1)', ' ').action.type, 'ol');
+    assert.equal(markdownTrigger('[]', ' ').action.type, 'checklist');
+    assert.equal(markdownTrigger('[ ]', ' ').length, 3);
+    assert.deepEqual(markdownTrigger('>', ' ').action, {type: 'block', tag: 'blockquote'});
+    assert.deepEqual(markdownTrigger('```', ' ').action, {type: 'block', tag: 'pre'});
+});
+
+test('Enter after three dashes draws a line; ordinary text never triggers', () => {
+    assert.equal(markdownTrigger('---', 'Enter').action.type, 'hr');
+    assert.equal(markdownTrigger('***', 'Enter').action.type, 'hr');
+    assert.equal(markdownTrigger('---', ' '), null);
+    assert.equal(markdownTrigger('#', 'Enter'), null);
+    assert.equal(markdownTrigger('a#', ' '), null);
+    assert.equal(markdownTrigger('#####', ' '), null);
+    assert.equal(markdownTrigger('2.', ' '), null);
+    assert.equal(markdownTrigger('', ' '), null);
+    assert.equal(markdownTrigger('# ', ' '), null);
+});

package/plugins/free-tier.lock.json

@@ -1,6 +1,6 @@
 {
   "note": "Written by `make sync-free-tier` in dcms-marketplace. Do not edit these plugins here - edit them there and sync.",
-  "source": "dcms-marketplace@af8baa8",
+  "source": "dcms-marketplace@ec1e685",
   "plugins": {
     "blog": {
       "version": "1.10.1",
@@ -125,6 +125,70 @@
         "tests/pure.test.js": "8ba0c8f76b4c9efcc422f39ff29509612544d81f760025a4b9a5594af14e7bcf"
       }
     },
+    "crossword": {
+      "version": "1.1.0",
+      "files": {
+        "CLAUDE.md": "598736eec2dfa833f7bb84ca9376071d1143d98a5c01106d0ff453749af18e43",
+        "admin/css/index.css": "d8d32268504d5aefa9c5fbf48a0c67b978cdd01d3be0bc747205a001972e05db",
+        "admin/templates/crossword.html": "336b4a3b7efff1ab8004c0516d55f11ae2efdc98cb3b18133ea00ca07311e2aa",
+        "admin/views/crossword.js": "42f3aabd09483eddf34d25dae243a853c562a13348eafe4fc1977361c1b03f4e",
+        "collections/crossword-plays.json": "20577250f00ebe0f6503cc2aae83dba93d88381b76b0b1dbc76c7b856d4295ff",
+        "collections/crossword-puzzles.json": "1b70950c96e50ede4d6a0c8e59ca7767b3c684c1a7c68588dc6462e69dad596e",
+        "config.js": "7a15db33506a432f5c43a095366c2e82a3bd20ceded585fb4fb78b93ad6dff29",
+        "docs/guide.md": "1189300bbe20f032e9040fe027e84a6137ab560e2fe9b88219aba66ea336ec4d",
+        "inject/body.html": "9dad7927d5afbd5e53f1edaa4a420403cd2325ce908624f9643a087388c090ab",
+        "lib/crossword.js": "f8149db65fb3a7f82b2fbae6a9f8d3ceeeec95730e426cf6fc36ea058527df34",
+        "lib/store.js": "284b3b8abe9fdaa64a660d5ab0120856b893d166b28e8bda6cf0ef038baa74bc",
+        "plugin.js": "5c1885955d122200c7ff9629d7fb9fcb54c232edb4cec4658574ca90d73730e5",
+        "plugin.json": "c5f9e3d934423161af6ef5fbf52c0c3394e737245a4de21da72da6d75a790f44",
+        "public/crossword.css": "656f369ea6587b000ff56b8ab80010f4f76af10966537c180950074ec5169f61",
+        "public/crossword.js": "8418a2c52a3d351a95e271d3c9f564b7336243ccde75106a9998995575802173",
+        "public/lib/layout.js": "0026afd8b42277838c55e1c031fa07cfea1c640c47aaf385e461cc998c4619c0"
+      }
+    },
+    "docs": {
+      "version": "2.14.0",
+      "files": {
+        "CLAUDE.md": "7c3b32e6e4b3456b8d6acafde57cbe6af519d6771d81294cfb90318801da43e3",
+        "admin/css/docs.css": "89304c596f2d36492198885359fa86998f9f36be522238983e32e5d01319c759",
+        "admin/lib/api.js": "0ddd567995a79e2379b92049de3b09a8bdf1c0d798042c7fbe3937f14e3631bf",
+        "admin/lib/convert.js": "37e8310aa0c225fad9c063649e31351c05fe4371081ede9fe4466aac64123b0e",
+        "admin/lib/drafts.js": "b3562434b6ddfba6c3759932b91a0c41bdf8190921ab7a65a004367b70d74278",
+        "admin/lib/editor.js": "78c136e474e04039073173aea97c3a4b7650692d0561cd2fd08c95923b6c2451",
+        "admin/lib/find-replace.js": "eee60406cd963ac9e936f67488ec71b99f526ab32079736f4370516a1cd6c238",
+        "admin/lib/folders.js": "e62d964358aea84a29eebef28dc1050a34bfce081dea37d8a4b874fc1d22b3a8",
+        "admin/lib/panel-guard.js": "928f23a4d38df91e6fcde52c64e69b36c87e72147973dd28eb8d7ce952072875",
+        "admin/lib/pdf-view.js": "3d2c05f0ea0b6978e759f56083c3300139d25c5abf116230135b8a6a64bc8174",
+        "admin/lib/send.js": "422ae97c8e89e09529fe0e5621b8d7a770f14e67cd8cb0892d2d729d696dde78",
+        "admin/lib/settings.js": "efcdf74799abd6c46a1b70034545c1cc89492cc625e6af88efcf63563f9d3e40",
+        "admin/lib/share.js": "bd1e4310a73416848281284da1fa1a5b06d996eeb49724cbf3dc4a14a7e45eb9",
+        "admin/lib/shortcuts.js": "b96088bda42714ae92da37d28fb3ead5390e45b8d39d01c8f5e1e981e09df0b0",
+        "admin/lib/templates.js": "3a2c678c8be5bd29baac39ab8e06e1c37d385d909fa6502bc9fb1a3ab4150917",
+        "admin/lib/versions.js": "5affab802d1539b754427222afc8e232961cc3208e00251b033ee48ad5d02174",
+        "admin/templates/docs.html": "4a621859200e6c2731db8f0924e6b76b03660dc01ae637d19de5ca2bbe92a33d",
+        "admin/templates/editor.html": "cd937141373deeb8f3d204e47d11fe297a9b863499a95e19d62dbe1b2b05213a",
+        "admin/views/docs.js": "52de890d32b63d522f8ae12b40e2525cf67b34584a62a745799e95ff352b0679",
+        "admin/views/editor.js": "ded2998b0ef19f22874410363b6667b718219e0057ff3b1c8c3292693206b932",
+        "config.js": "4435664c2d96088ad21d68241a2a6998b12c80592270deba77710b8c014de0a3",
+        "docs/guide.md": "75f05f0665bd3b5a9ac00131df21c98c86fa71ad8fafdb8331d25b1adc0a61dd",
+        "lib/extensions.js": "a449f10e309bcb16bb7d426315e85b2efe9be6d3420313c0e30315f146820d99",
+        "lib/importer.js": "2bbe9c9d37d6c627fa9ad445171c01b349a14582a882fe8cf9a33c42045e03dc",
+        "lib/pdf-worker.js": "c256c32520a37a6579a528f16d5965951cfb65d7984a246168c1b33fd36d72eb",
+        "lib/pdf.js": "83abc3aba0c322c50b528b8a037466a294303f55d7c30f3cd1445f811b78ae28",
+        "lib/store.js": "bd2f629bfdc74e10a3ab56f37291eb8b09fb6479c04facdff9514c6298b0ba29",
+        "plugin.js": "c9228fc20524fe43a1a05495d20be33a0723fa3d4ffb0c853844d45b58b8b216",
+        "plugin.json": "35024c51c478b72b6aa0070a4ed18b9eb32d0334b120199c788b8d95ca4dbaf1",
+        "plugin.public.js": "a9cd7a9211f5b0006832054a15055a3c36afa9f9b284600cdc5fce19e892c178",
+        "templates/public-doc.html": "7360cbeec5cba8a2b1b1d074730972bb4b90cfe913a799a06522b2e1a0f566d8",
+        "tests/_env.js": "2daf6b0dd3211498298db79e5da80c17e2be98e380f777bc9c555c3eb99d128a",
+        "tests/_pdf.js": "69274f267546b139d2f1b8a159f0a0cf25dbc9b589d966398c2b7ae93f85186e",
+        "tests/convert.test.js": "27dc072e3a5f6fd482560e547048723bc7884aa8f53a3bc2f547758a28c535a4",
+        "tests/drafts.test.js": "209c1691aa321e07c0ab24f747920b15d7bd56c2b3f5a581b116aad73c157d8f",
+        "tests/pdf.test.js": "316c7b32fb4562f42fd59da1df9c8a3bccacb8286db6540b36e10f85c510d68e",
+        "tests/plugin.test.js": "a76c3a5bab6e525bc201f73f4ed76b604b41331cbeba0c6155253b88b40b5bb0",
+        "tests/shortcuts.test.js": "7f96b63e91150e7670eb349a81034ce354f64ea42503d6a8ffcdae4867d7bba1"
+      }
+    },
     "feedback": {
       "version": "1.2.0",
       "files": {
@@ -153,6 +217,23 @@
         "tests/shape.test.js": "2e2e5e17ce059fbaa4dad8170ae45382d6c7e74bacf3b301814bb81a60ba98ba"
       }
     },
+    "garage": {
+      "version": "1.6.0",
+      "files": {
+        "CLAUDE.md": "43ab4680cc730deb17b2505afea6bfdddee0cb5ddcc1af20dddc2b76bc33851a",
+        "admin/css/garage.css": "79a10a2ed7f5f39f14ec1a2be9c83c3837758248c1601a8bf30eb15915a7d5fa",
+        "admin/lib/garage.js": "bcad98c3f12247a148ec86d19da0c0bb680c7f5abf2cf20e9ec107395fd79f96",
+        "admin/templates/garage.html": "eca088e11a562a6a2bd6af2d335b409d18f3dd0decbe96c5bb83cc5c9d4cd450",
+        "admin/views/garage.js": "f425f451b84172ea550391ac05c696324bac7a18db104df53eba0195fa59a891",
+        "collections/garage-vehicles/schema.json": "800faeee49f6aca76c3bddef4d7863a52f9de7786f76a299258d04b919f15e4d",
+        "config.js": "058a5ad42a4900728abc0e18d9260ae6baea638bdb7f177a4ac5b029eef4799f",
+        "docs/guide.md": "d228030133355cf827719a356e306b2d9b73bd4c73a8d0d1029afe8205753ab1",
+        "plugin.js": "2e4fd339ffdb98cf834be4e0967d0cfd6756646d7cee1ba00b6706f356fdbbc0",
+        "plugin.json": "e9b7a7a8ce12a7a0b16c0eaa0361f827873341854057a08cb1dcffdd378a5bf5",
+        "tests/access.test.js": "ef23a077746f22082ccd07a4fb82a92b5692aa63cd021843d32f5ffacfc29957",
+        "tests/garage.test.js": "3d8ce8ad5ab484601eb9826ea259121ec4bf16fe22469be4000e382823bb85bb"
+      }
+    },
     "mail-reader": {
       "version": "1.2.8",
       "files": {
@@ -164,6 +245,51 @@
         "plugin.json": "e5ac7f3496d9a535fa4899d1de87a514535084d13acecd6a5897744b6174807a"
       }
     },
+    "messages": {
+      "version": "1.9.0",
+      "files": {
+        "CLAUDE.md": "b2be02f68229bcc345b1798b5669a90e6c0c0261780f131ce70f8220365db569",
+        "admin/css/messages.css": "5e81a3a48413749be7d1dddb3259ab885200a0ca2d8e028f217f1849e56deb66",
+        "admin/lib/messages.js": "7e52d4d2f5edc8ea6a1a752e301e3bfaefff0b2dcdfc32de37d153649485f0ae",
+        "admin/templates/messages.html": "5b11840d5d9554506fb34ca0e600548cdaea32c917a0afa51cecc276b3809343",
+        "admin/views/messages.js": "4c2445d7ae238131ef5fb948bf7cad7c9baac2c3f08a20af04dd570a4ccfa72b",
+        "collections/user-message-threads/schema.json": "d735c28ccf11bc1aaca4a3b3707ea2b4188df326e28921db307ba0358bd1658f",
+        "collections/user-messages/schema.json": "b246e141871bdca51bbc05ca4bd0f7726c8e6084b2cbfedab62409af1805109f",
+        "config.js": "496b32d1683c575c0bf4623f4bbff35cd4e6b00c9d895e3e602e28891fa9f6e2",
+        "docs/guide.md": "b5757d47d129d095d3d2a77bed3524e5c68d8ba55bbf1b581b6cc487ace6d6bd",
+        "lib/call.js": "a04df3674b17fb68db96fc3278b20e3bcc17c2729a550ac7a79add1cce9234c8",
+        "plugin.js": "c83e16e9e58946b112ae1feae48346222c0b553e3407f443a518f84cfa1c6232",
+        "plugin.json": "6fec1355862053b31e45cd3f90de0d8d63b69115851fa461a5be57e905be5e48",
+        "plugin.public.js": "82fa4df6ab4d8a68a0de7a10a7fd30f9e041ede2ab803eb7709de7312af25f51",
+        "templates/call.html": "9e2eabbf0379f8ee0b8114f4d6f84b7d996448a6eb10934a7d7529f9eca4041c",
+        "tests/after-send.test.js": "43a866573cfe8b8c8de63b6bf12066b2030844da6fa9d4614561e2d92681bd88",
+        "tests/api.test.js": "d0cc206b6d20d593c8a8abf9dfb0ebc577c8676139d77bd2820ee13fceb57412",
+        "tests/call.test.js": "7656d1a75f6ed40058677b85db5de727df00c6aff6b07868a79e5ba0f565a93e",
+        "tests/drafts.test.js": "362d01511b950bd7c7ac115e1677ffbc67f7f2b8ac241cd19df2acc73f652b8c",
+        "tests/messages.test.js": "5b724e53fcf7f3b5a035c47c0a4ca98dcd7de42b65f4a4ea195a9409fd53e8af"
+      }
+    },
+    "quiz": {
+      "version": "1.1.0",
+      "files": {
+        "CLAUDE.md": "9d037c11b0de115bf17a6c53387116be037c0d4dcd1b6bf3dafa373539143e16",
+        "admin/css/index.css": "6598225cfb8b58c486eb390ac41c7f359c78f48e0c97bc8b354d3832f618afa8",
+        "admin/templates/quiz.html": "f0b65c406b0b6325a815906ca8da7d884d5d24f2504e05631e46c34a5ca0edb9",
+        "admin/views/quiz.js": "c58ba86ec989df8f29e8acff2266fb3463e301c5516bf9281193de539b7c1f44",
+        "collections/quiz-plays.json": "331d665a90b6dddf069245a2faf8dd454a36d387702343a7e36d1fe6dd5015f8",
+        "collections/quiz-quizzes.json": "ce9bacf6c05fb5c22f9a5c5105f624c7a9c6d78c2bd343072d9cb7587e920b1d",
+        "config.js": "24db3727a804678ef12290ae258c7cf52afbc7a425bb452d87b7b2467ff7c559",
+        "docs/guide.md": "a7f8f449b94ecc726dc82fc7a0ae7c335431fa757f9493859bdf16e633689c3f",
+        "inject/body.html": "07727ead4a04fdeb2759a19e8cc358ba2692b807fb741a6daafaf02463fe8233",
+        "lib/engine.js": "a554c7abfa357288bbd73f47c9bcbf8eab7d8222ff63b1fd119a3ca5f9fb79f4",
+        "lib/quiz.js": "d697bbd1af41575a9ecee49781695f2dfb4a585bf0230cc39ac5d174dc9c2762",
+        "lib/store.js": "a740d879185e20c036ac17ab5cbca74d1f71097f4af3bc121fcddc826d8686c6",
+        "plugin.js": "0ec6f96fc4922c7ef41b36bd757c02926ee99d50e78fe85f7f30b9fbd9605b25",
+        "plugin.json": "788960b6a31c7c1c2d525fb7cae9ab9b7c9310def5d778c275f22302ecaadf78",
+        "public/quiz.css": "e8869fb30e22763357464e9aa7a353306b6631b8a7418ba4e483331e66aada67",
+        "public/quiz.js": "dedc96469e440c979b20d7d95655fbb25062b00b27be569b2a55ec5a8ec0cbb5"
+      }
+    },
     "security": {
       "version": "1.2.1",
       "files": {
@@ -289,6 +415,26 @@
         "tests/settings.test.js": "434acbfd940eef800b1166a9aaf36363351af5652fcfb06527b8498866b7b964",
         "tests/shape.test.js": "7866c6c1d140716bf0817449937d6d711d7c3b97be1db1e1eb33bde341e36296"
       }
+    },
+    "theme-roller": {
+      "version": "1.3.0",
+      "files": {
+        "CLAUDE.md": "c396bf316dcfe62bdfeee59d6973309aa267ac7a6b20c626f6404b18e4809e64",
+        "admin/css/theme-roller.css": "dfb2059fb6da0e5cfaf5bd4c1e1d5da7b1918f0edbeb2a2df8a2333094bc8149",
+        "admin/lib/prompt.js": "36ccd3f1536fbcfa57d69470157df633609ed7f1af41b7e351e4df13db210faf",
+        "admin/lib/themes.js": "eb521dcd999db513e17d124591bbd4509c756756b8cc80c259bc5b502c63a344",
+        "admin/lib/view.js": "16105e216465bfb0a7a9fe838af6deb5384904327906b98099abbad898b96cdf",
+        "admin/templates/theme-roller.html": "66fabd3819eeb08544c3ee9fd065a458c9e18d415385f9bba0c92527f96eaa0c",
+        "admin/views/theme-roller-view.js": "be3d628901b91fd44e12981d06c5a1eb06df0c327a43f86850828cf90b332fb0",
+        "config.js": "450f0af4f4c1ecc4c7180f2e364c8a59bfed69dd350fb6b47bce8641c2a37786",
+        "docs/guide.md": "ced47c67e49b3c02e1f85ab5b6da8e0dc7055fcf2688fc9994cf7b52b03881c9",
+        "plugin.js": "e685064cb17b879d41428c71a3a2b072501acaa964088c322964f27f622deff2",
+        "plugin.json": "cd19ab0a17c40b6305cc3dcd3f60f70d67ab1acd1926eda31957153bbf413b74",
+        "tests/api.test.js": "8ad5a76a1feebde7ad6dc3867ee49b25d4a33c3579e2149b955cd8333ab73ef0",
+        "tests/prompt-values.test.js": "8cedaecea858dd76bbb92923ad49f8a7b579a368e681265b095dbe13060edc24",
+        "tests/themes.test.js": "23071a019db49e3161956517c8bb5bb6e41312ca453819baa761ae613b1cfb67",
+        "tests/view.test.js": "24adb2c3e4f9d84dbcd8450addb134f75e2fec25667cda106ec8c80618247e94"
+      }
     }
   }
 }

package/plugins/garage/CLAUDE.md

@@ -0,0 +1,51 @@
+# Garage
+
+UK vehicle lookups through the DVLA Vehicle Enquiry Service, a per-user history of them, and "My Garage" -
+the saved ones, with their MOT and road tax at a glance and on the sidebar badge.
+
+## Files
+
+- `plugin.js` - API (lookup proxy, history, save toggle, delete, `GET /count` badge) and the
+  `[garage-vehicles /]` shortcode. Entries live in the `garage-vehicles` collection, one per user + reg,
+  and EVERY read - routes, notification check and shortcode - goes through `listEntries`/`getEntry`
+  (collections service -> the slug's storage adapter), so file and MongoDB storage behave the same.
+- `admin/lib/garage.js` - PURE, shared by server and browser: registration normalising/display,
+  `checkState` (an MOT or tax check -> tone + words), `vehicleAlert`, `vehicleRow`, `arrangeVehicles`,
+  `badgeFor`. Dates are calendar days; `today` is the reader's (the sidebar sends `?today=`).
+- `admin/views/garage.js`, `admin/templates/garage.html`, `admin/css/garage.css`; `tests/garage.test.js`,
+  `tests/access.test.js`.
+
+## Gotchas
+
+- The DVLA API key is read at LOOKUP time (`getPluginSettings`), so one saved from the settings panel works
+  without a restart; `DVLA_API_KEY` in the environment wins. It is a secret: the settings form guards a
+  typed key but never keeps it as a draft.
+- The number plate is black on yellow whatever the theme (a UK plate is, by law) - the two `--gx-plate-*`
+  properties are the screen's only non-token colours.
+- The badge counts saved vehicles needing attention (expired/overdue = danger; due within 30 days or SORN);
+  nothing due = no badge. It is cached a minute per user and day, and cleared by any write from that user.
+- `/count` is per user; so is everything else - a user never sees another's vehicles.
+- **Access (1.3.0):** permission `garage` (read / create = look up and save / delete), plugin.json, granted once to
+  `admin` and `user`; every route checks it; the sidebar entry needs it. `[garage-vehicles user="..." /]` needs a
+  user - the bare form put every user's saved vehicles on a public page.
+- **Notifications (1.4.0):** `garage:due`, daily + at boot: `vehicleNotices()` (pure, admin/lib/garage.js) - MOT/tax run out = critical, due within DUE_SOON_DAYS (30) = warning, SORN never; to the vehicle's OWNER (userIds). Keys `vehicle:<id>:expired|due`; the other state and passing checks are resolved.
+- **Storage (1.4.1):** the shortcode is async and reads through `listEntries`, like the routes. Until 1.4.1 it read
+  `content/collections/garage-vehicles/data.json` directly and rendered nothing when the collection was on MongoDB.
+  Never read the data file directly; same access as before (a named `user`, saved vehicles only).
+
+## 1.5.0 (2026-10-15 Tool Upgrade, second pass)
+
+- Save: `PATCH /vehicles/:id/save` takes `{isSaved: true|false}` and sets it; no body toggles (old callers); any
+  other body is 400. The screen always sends the state it wants, so a stale screen can't flip a vehicle back, and
+  every way in (result button, details, menu) greys while that vehicle's save is in flight (an observable list).
+- Settings save re-reads `/api/plugins` and PUTs `settingsWithKey(stored, key)` (admin/lib/garage.js): the PUT
+  replaces the whole settings object, so never send just `{dvlaApiKey}` (it used to wipe the other settings). The key
+  is never drafted or echoed; closing with a typed key asks "Discard what you have typed?" (OK discards, Escape keeps).
+- One panel per thing (claim released, and its effect stopped, if building throws); the details panel follows the
+  list; skeleton slots on both lists; here() after every await; someone without plugin rights is told so.
+
+## 1.6.0 (2026-10-21): free
+
+`tier: free`, no `closedSource` - no licence is needed or checked any more (the engine only checks a
+`closedSource` plugin). Included in every hosted plan and free to self-host; not `bundle: false`, so the next
+`make sync-free-tier` ships it in the engine.

package/plugins/garage/admin/css/garage.css

@@ -0,0 +1,73 @@
+/* Garage admin screen - see admin/views/garage.js. --dm-* tokens only, except the number plate below. */
+.gx {
+    /* A UK rear number plate is black on yellow by law (DVLA INF104), whatever the admin's theme -
+       the one place this screen is not themed. */
+    --gx-plate-bg: #ffd900;
+    --gx-plate-fg: #000;
+    display: flex; flex-direction: column; gap: .75rem;
+}
+.gx [hidden], .gx-panel [hidden] { display: none !important; }
+.gx-card { border: 1px solid var(--dm-border); border-radius: var(--dm-radius-md); padding: .75rem .9rem; display: flex; flex-direction: column; gap: .6rem; }
+.gx-card-title { display: flex; align-items: center; gap: .4rem; font-weight: 600; }
+.gx-spacer { flex: 1; }
+.gx-note { margin: 0; color: var(--dm-text-muted); font-size: var(--dm-text-sm); }
+.gx-note.is-bad { color: var(--dm-danger); }
+.gx-alert { margin: 0; display: flex; gap: .5rem; align-items: center; flex-wrap: wrap; padding: .55rem .8rem; border-radius: var(--dm-radius-md);
+    background: color-mix(in srgb, var(--dm-warning) 16%, transparent); color: var(--dm-text); font-size: var(--dm-text-sm); }
+.gx-lookup-bar { display: flex; gap: .6rem; align-items: center; flex-wrap: wrap; }
+.gx-lookup-bar .btn, .gx-card-title .btn, .gx-actions .btn, .gx-bar .btn { display: inline-flex; align-items: center; gap: .3rem; }
+.gx-plate-input { width: 11rem; background: var(--gx-plate-bg); color: var(--gx-plate-fg); border: 3px solid var(--gx-plate-fg);
+    border-radius: var(--dm-radius-md); font-family: 'Arial Black', Arial, sans-serif; font-weight: 900; font-size: 1.2rem;
+    letter-spacing: 3px; text-align: center; text-transform: uppercase; padding: .35rem .5rem; }
+.gx-plate-input::placeholder { color: color-mix(in srgb, var(--gx-plate-fg) 35%, transparent); }
+.gx-plate { display: inline-block; flex-shrink: 0; background: var(--gx-plate-bg); color: var(--gx-plate-fg); border: 2px solid var(--gx-plate-fg);
+    border-radius: var(--dm-radius-sm); font-family: 'Arial Black', Arial, sans-serif; font-weight: 900; font-size: .85rem;
+    letter-spacing: 2px; padding: .1rem .45rem; white-space: nowrap; min-width: 6.5rem; text-align: center; }
+.gx-plate.is-big { font-size: 1.15rem; padding: .2rem .6rem; letter-spacing: 3px; }
+
+/* Result and details */
+.gx-result { display: flex; flex-direction: column; gap: .5rem; border-top: 1px solid var(--dm-border); padding-top: .6rem; }
+.gx-result-head { display: flex; align-items: center; gap: .75rem; flex-wrap: wrap; }
+.gx-facts { display: grid; grid-template-columns: repeat(auto-fill, minmax(10rem, 1fr)); gap: .35rem 1rem; font-size: var(--dm-text-sm); margin: 0; }
+.gx-facts dt { color: var(--dm-text-muted); font-size: var(--dm-text-xs); }
+.gx-facts dd { margin: 0; font-weight: 600; }
+.gx-actions { display: flex; gap: .4rem; flex-wrap: wrap; align-items: center; }
+
+/* Tabs, bars, rows */
+.gx-count { opacity: .65; font-size: var(--dm-text-xs); margin-left: .2rem; }
+.gx-bar { display: flex; gap: .5rem; align-items: center; flex-wrap: wrap; }
+.gx-search { flex: 1; min-width: 10rem; max-width: 20rem; }
+.gx-seg { display: inline-flex; border: 1px solid var(--dm-border); border-radius: var(--dm-radius-md); overflow: hidden; }
+.gx-seg button { border: 0; background: none; color: var(--dm-text); padding: .3rem .7rem; cursor: pointer; font: inherit; font-size: var(--dm-text-sm); }
+.gx-seg button + button { border-left: 1px solid var(--dm-border); }
+.gx-seg button b { font-weight: 500; opacity: .65; margin-left: .2rem; }
+.gx-seg button.is-on { background: var(--dm-primary); color: var(--dm-primary-text); }
+.gx-list { display: flex; flex-direction: column; }
+.gx-row { display: flex; align-items: center; gap: .75rem; padding: .55rem .35rem; border-bottom: 1px solid var(--dm-border); cursor: pointer; }
+.gx-row:last-child { border-bottom: 0; }
+.gx-row:hover, .gx-row:focus-visible { background: var(--dm-table-hover-bg, color-mix(in srgb, var(--dm-text) 6%, transparent)); outline: none; }
+.gx-row.is-danger { box-shadow: inset 3px 0 0 var(--dm-danger); }
+.gx-row.is-warn { box-shadow: inset 3px 0 0 var(--dm-warning); }
+.gx-main { flex: 1; min-width: 0; display: flex; flex-direction: column; }
+.gx-main strong, .gx-main small { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.gx-main small { color: var(--dm-text-muted); font-size: var(--dm-text-xs); }
+.gx-chips { display: inline-flex; gap: .3rem; flex-wrap: wrap; justify-content: flex-end; }
+.gx-chip { display: inline-flex; align-items: center; font-size: var(--dm-text-xs); font-weight: 600; padding: .1rem .5rem; border-radius: 999px; white-space: nowrap;
+    background: color-mix(in srgb, var(--dm-text) 10%, transparent); color: var(--dm-text-muted); }
+.gx-chip.is-ok { background: color-mix(in srgb, var(--dm-success) 16%, transparent); color: var(--dm-success); }
+.gx-chip.is-warn { background: color-mix(in srgb, var(--dm-warning) 18%, transparent); color: var(--dm-warning); }
+.gx-chip.is-danger { background: color-mix(in srgb, var(--dm-danger) 16%, transparent); color: var(--dm-danger); }
+.gx-chip.is-saved { background: color-mix(in srgb, var(--dm-primary) 14%, transparent); color: var(--dm-primary); }
+.gx-kebab { border: 0; background: none; cursor: pointer; font-size: var(--dm-text-lg); color: var(--dm-text-muted); border-radius: var(--dm-radius-sm); padding: 0 .3rem; }
+.gx-kebab:hover { color: var(--dm-primary); }
+
+/* Slideover panels */
+.gx-panel { display: flex; flex-direction: column; gap: .85rem; }
+.gx-panel .form-label { display: flex; align-items: center; gap: .3rem; }
+.gx-panel-actions { display: flex; align-items: center; gap: .4rem; padding-top: .6rem; border-top: 1px solid var(--dm-border); }
+.gx-panel-actions .btn { display: inline-flex; align-items: center; gap: .3rem; }
+.gx-hint { display: block; color: var(--dm-text-muted); font-size: var(--dm-text-xs); margin-top: .25rem; }
+@media (max-width: 640px) { .gx-main small { white-space: normal; } .gx-chips { max-width: 45%; } }
+.gx-chips.gx-chips-start { justify-content: flex-start; }
+/* Skeleton slots: block elements, shown only while the first load runs. */
+.gx-loading { display: block; min-height: 1.25rem; }

package/plugins/garage/admin/lib/garage.js

@@ -0,0 +1,236 @@
+/**
+ * Garage - the pure part, shared by the server (plugin.js: the sidebar badge)
+ * and the admin screen. No I/O, no DOM. Tested in tests/garage.test.js.
+ *
+ * Dates from the DVLA are calendar days ("2026-07-01"); `today` is the
+ * READER's calendar day (the sidebar sends ?today=), so a car is not "due
+ * tomorrow" for someone in a different evening.
+ */
+
+import {fmtDate} from '../../../_lib/admin/ui/dates.js';
+
+/** How far ahead an MOT or tax date counts as "due soon". */
+export const DUE_SOON_DAYS = 30;
+
+/** "ab12 cde" -> "AB12CDE" - how the server stores and matches a registration. */
+export function normaliseReg(reg) {
+    return String(reg ?? '').toUpperCase().replace(/\s+/g, '');
+}
+
+/**
+ * A registration shown the way a plate reads: current-style marks get their
+ * space back ("AB12CDE" -> "AB12 CDE"); anything else is left as it is.
+ */
+export function displayReg(reg) {
+    const r = normaliseReg(reg);
+    return /^[A-Z]{2}\d{2}[A-Z]{3}$/.test(r) ? `${r.slice(0, 4)} ${r.slice(4)}` : r;
+}
+
+/** YYYY-MM-DD of a Date, local. */
+export function isoDay(d = new Date()) {
+    const pad = (n) => String(n).padStart(2, '0');
+    return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}`;
+}
+
+/** Whole days from `today` to `day` (negative = past), or null when either is not a date. */
+export function daysUntil(day, today) {
+    const a = /^(\d{4}-\d{2}-\d{2})/.exec(String(day ?? ''))?.[1];
+    const b = /^(\d{4}-\d{2}-\d{2})/.exec(String(today ?? ''))?.[1];
+    if (!a || !b) return null;
+    const ms = Date.parse(`${a}T00:00:00Z`) - Date.parse(`${b}T00:00:00Z`);
+    return Number.isFinite(ms) ? Math.round(ms / 86_400_000) : null;
+}
+
+/** "2027-01-23" -> "23/01/2027"; anything else as it came. */
+export function shortDay(day) {
+    const m = /^(\d{4}-\d{2}-\d{2})/.exec(String(day ?? ''));
+    return m ? fmtDate(m[1]) : String(day ?? '');
+}
+
+const when = (d) => (d < -1 ? `${-d} days ago` : d === -1 ? 'yesterday' : d === 0 ? 'today' : d === 1 ? 'tomorrow' : `in ${d} days`);
+
+/**
+ * One check (MOT or road tax) as a chip: its tone and words.
+ *
+ *   danger - expired / not valid / untaxed, or its date has passed
+ *   warn   - SORN, or due within DUE_SOON_DAYS
+ *   ok     - valid / taxed, date comfortably ahead
+ *   muted  - unknown (the DVLA did not say)
+ *
+ * @param {'mot'|'tax'} kind
+ * @param {string} status - as the DVLA gives it ("Valid", "Taxed", "SORN", "Not valid", "No details held by DVLA"…)
+ * @param {string|null} date - motExpiryDate / taxDueDate
+ * @param {string} today - YYYY-MM-DD
+ * @returns {{tone: 'danger'|'warn'|'ok'|'muted', text: string, days: number|null, due: boolean, bad: boolean}}
+ */
+export function checkState(kind, status, date, today) {
+    const label = kind === 'mot' ? 'MOT' : 'Tax';
+    const s = String(status ?? '').trim();
+    const ls = s.toLowerCase();
+    const days = daysUntil(date, today);
+    const out = (tone, text) => ({tone, text, days, due: tone === 'warn' && days !== null, bad: tone === 'danger'});
+
+    if (kind === 'tax' && ls === 'sorn') return out('warn', 'SORN');
+    if (!s || ls.includes('no details') || ls.includes('no results')) {
+        return days === null ? out('muted', `${label} unknown`) : fromDate();
+    }
+    if (ls.includes('not valid') || ls === 'untaxed' || ls.includes('expired')) {
+        return out('danger', days !== null && days < 0 ? `${label} expired ${when(days)}` : `${label}: ${s}`);
+    }
+    return fromDate();
+
+    function fromDate() {
+        if (days === null) return out(ls === 'valid' || ls === 'taxed' ? 'ok' : 'muted', `${label}: ${s || 'unknown'}`);
+        if (days < 0) return out('danger', `${label} ${kind === 'mot' ? 'expired' : 'overdue'} ${when(days)}`);
+        if (days <= DUE_SOON_DAYS) return out('warn', `${label} due ${when(days)}`);
+        return out('ok', `${label} to ${shortDay(date)}`);
+    }
+}
+
+/** The worse of a vehicle's two checks - what the row and the badge go by. */
+export function vehicleAlert(v, today) {
+    const mot = checkState('mot', v?.motStatus, v?.motExpiryDate, today);
+    const tax = checkState('tax', v?.taxStatus, v?.taxDueDate, today);
+    const rank = {danger: 0, warn: 1, ok: 2, muted: 3};
+    const worst = rank[mot.tone] <= rank[tax.tone] ? mot : tax;
+    return {mot, tax, tone: worst.tone, needsAttention: mot.tone === 'danger' || tax.tone === 'danger' || mot.due || tax.due || tax.text === 'SORN'};
+}
+
+/**
+ * A vehicle as the screen lists it.
+ *
+ * @param {object} v - {id, registrationNumber, make, colour, yearOfManufacture, fuelType, engineCapacity, co2Emissions, motStatus, motExpiryDate, taxStatus, taxDueDate, isSaved, lookupDate}
+ * @param {string} today
+ */
+export function vehicleRow(v, today) {
+    const a = vehicleAlert(v, today);
+    return {
+        id: v.id,
+        reg: displayReg(v.registrationNumber),
+        title: [v.make, v.yearOfManufacture].filter(Boolean).join(' · ') || 'Unknown vehicle',
+        meta: [v.colour, v.fuelType, v.engineCapacity ? `${v.engineCapacity}cc` : '', v.co2Emissions ? `${v.co2Emissions}g/km CO₂` : '']
+            .filter(Boolean).join(' · '),
+        motText: a.mot.text,
+        motTone: `is-${a.mot.tone}`,
+        taxText: a.tax.text,
+        taxTone: `is-${a.tax.tone}`,
+        saved: v.isSaved === true,
+        attention: a.needsAttention,
+        rowCls: a.tone === 'danger' ? 'is-danger' : a.needsAttention ? 'is-warn' : ''
+    };
+}
+
+/**
+ * The vehicles a tab shows: search, the "needs attention" filter, and order -
+ * attention first (worst, then soonest), then by registration.
+ *
+ * @param {object[]} vehicles
+ * @param {{query?: string, filter?: 'all'|'attention', today: string, order?: 'attention'|'recent'}} opts
+ */
+export function arrangeVehicles(vehicles, {query = '', filter = 'all', today, order = 'attention'} = {}) {
+    const q = String(query).trim().toLowerCase().replace(/\s+/g, '');
+    const withAlert = (vehicles || []).map(v => ({v, a: vehicleAlert(v, today)}))
+        .filter(({v, a}) => filter !== 'attention' || a.needsAttention)
+        .filter(({v}) => !q || [v.registrationNumber, v.make, v.colour, v.yearOfManufacture, v.fuelType, v.motStatus, v.taxStatus]
+            .some(x => String(x ?? '').toLowerCase().replace(/\s+/g, '').includes(q)));
+    const rank = {danger: 0, warn: 1, ok: 2, muted: 3};
+    const soonest = ({a}) => Math.min(a.mot.days ?? 1e9, a.tax.days ?? 1e9);
+    if (order === 'recent') {
+        withAlert.sort((x, y) => String(y.v.lookupDate || '').localeCompare(String(x.v.lookupDate || '')));
+    } else {
+        withAlert.sort((x, y) => rank[x.a.tone] - rank[y.a.tone] || soonest(x) - soonest(y)
+            || normaliseReg(x.v.registrationNumber).localeCompare(normaliseReg(y.v.registrationNumber)));
+    }
+    return withAlert.map(({v}) => v);
+}
+
+/**
+ * The sidebar badge (countUrl GET /api/plugins/garage/count): the saved
+ * vehicles whose MOT or tax has run out or is due within DUE_SOON_DAYS - red
+ * once any has run out. Nothing to do = no badge. Plain text throughout.
+ *
+ * @param {object[]} saved - the reader's saved vehicles
+ * @param {string} today
+ */
+export function badgeFor(saved = [], today) {
+    const rows = saved.map(v => ({v, a: vehicleAlert(v, today)}));
+    const attention = rows.filter(r => r.a.needsAttention)
+        .sort((x, y) => ({danger: 0, warn: 1}[x.a.tone] ?? 2) - ({danger: 0, warn: 1}[y.a.tone] ?? 2));
+    const expired = attention.filter(r => r.a.tone === 'danger').length;
+    const n = attention.length;
+    return {
+        count: n,
+        label: n ? `${n} vehicle${n === 1 ? '' : 's'} need${n === 1 ? 's' : ''} attention${expired ? ` (${expired} expired)` : ''}`
+            : `${saved.length} saved vehicle${saved.length === 1 ? '' : 's'}, nothing due`,
+        tone: expired ? 'danger' : 'info',
+        details: {
+            title: 'Garage',
+            rows: [
+                {label: 'Saved vehicles', value: String(saved.length)},
+                {label: 'Expired or overdue', value: String(expired), ...(expired && {tone: 'danger'})},
+                {label: `Due within ${DUE_SOON_DAYS} days, or SORN`, value: String(n - expired)}
+            ],
+            items: attention.slice(0, 8).map(({v, a}) => ({
+                text: `${displayReg(v.registrationNumber)}${v.make ? ` · ${v.make}` : ''}`,
+                meta: [a.mot, a.tax].filter(c => c.tone === 'danger' || c.tone === 'warn').map(c => c.text).join(' · '),
+                ...(a.tone === 'danger' && {tone: 'danger'})
+            })),
+            empty: 'Every saved vehicle is taxed and has a valid MOT.'
+        }
+    };
+}
+
+/**
+ * The plugin settings to PUT when a new DVLA key is saved: the settings as
+ * stored now (other secrets arrive masked, and the server keeps a masked value
+ * as it was), with the key replaced. Never just {dvlaApiKey} - the PUT replaces
+ * the whole settings object, so anything left out would be lost.
+ *
+ * @param {object} stored - the plugin's settings from GET /api/plugins
+ * @param {string} key
+ * @returns {object}
+ */
+export function settingsWithKey(stored, key) {
+    const base = stored && typeof stored === 'object' && !Array.isArray(stored) ? stored : {};
+    return {...base, dvlaApiKey: String(key ?? '').trim()};
+}
+
+// ---- Notifications (1.4, Notifications Phase 4) -------------------------------
+
+/**
+ * The daily notices for saved vehicles - each to its OWNER (a garage is
+ * personal). An MOT or tax check that has run out is critical; one due within
+ * DUE_SOON_DAYS is a warning. SORN is not notified: it is declared on purpose.
+ * One key per vehicle and state, so moving from due to expired is a new,
+ * worse notice (the due one is resolved), and renewing resolves both.
+ *
+ * @param {object[]} saved - saved vehicles, each with userId
+ * @param {string} today - YYYY-MM-DD
+ * @returns {{raise: object[], resolve: string[]}}
+ */
+export function vehicleNotices(saved = [], today) {
+    const raise = [];
+    const resolve = [];
+    for (const v of saved) {
+        if (!v?.id || !v.userId) continue;
+        const a = vehicleAlert(v, today);
+        const checks = [a.mot, a.tax];
+        const expired = checks.filter(c => c.tone === 'danger');
+        const due = checks.filter(c => c.tone === 'warn' && c.due);
+        const key = (state) => `vehicle:${v.id}:${state}`;
+        const reg = displayReg(v.registrationNumber);
+        const name = `${reg}${v.make ? ` (${v.make})` : ''}`;
+        if (expired.length) {
+            raise.push({title: `${name}: ${expired.map(c => c.text).join(' and ')}`, body: 'It should not be on the road until this is sorted.',
+                severity: 'critical', link: '#/plugins/garage', source: 'due', dedupeKey: key('expired'), audience: {userIds: [String(v.userId)]}});
+            resolve.push(key('due'));
+        } else if (due.length) {
+            raise.push({title: `${name}: ${due.map(c => c.text).join(' and ')}`, body: 'Book it in before the date passes.',
+                severity: 'warning', link: '#/plugins/garage', source: 'due', dedupeKey: key('due'), audience: {userIds: [String(v.userId)]}});
+            resolve.push(key('expired'));
+        } else {
+            resolve.push(key('due'), key('expired'));
+        }
+    }
+    return {raise, resolve};
+}