domma-cms 1.8.32 → 1.8.34

package/plugins/garage/tests/garage.test.js

@@ -0,0 +1,106 @@
+/** The pure part of Garage - admin/lib/garage.js. */
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {arrangeVehicles, badgeFor, checkState, daysUntil, displayReg, normaliseReg, settingsWithKey, shortDay, vehicleAlert, vehicleRow, vehicleNotices}
+    from '../admin/lib/garage.js';
+
+const TODAY = '2026-09-25';
+const car = (reg, extra = {}) => ({id: reg, registrationNumber: reg, make: 'FORD', yearOfManufacture: 2019,
+    motStatus: 'Valid', motExpiryDate: '2027-06-01', taxStatus: 'Taxed', taxDueDate: '2027-03-01', isSaved: true, ...extra});
+
+test('registrations: normalised for matching, spaced for reading', () => {
+    assert.equal(normaliseReg(' ab12 cde '), 'AB12CDE');
+    assert.equal(displayReg('ab12cde'), 'AB12 CDE');
+    assert.equal(displayReg('A123BCD'), 'A123BCD');
+});
+
+test('days between calendar days, ignoring time and bad input', () => {
+    assert.equal(daysUntil('2026-09-26', TODAY), 1);
+    assert.equal(daysUntil('2026-09-20T10:00:00Z', TODAY), -5);
+    assert.equal(daysUntil(null, TODAY), null);
+    assert.equal(daysUntil('soon', TODAY), null);
+});
+
+test('a check: expired is danger, due soon is warn, SORN is warn, comfortably ahead is ok, unknown is muted', () => {
+    assert.equal(checkState('mot', 'Valid', '2026-09-20', TODAY).tone, 'danger');
+    assert.match(checkState('mot', 'Valid', '2026-09-20', TODAY).text, /expired 5 days ago/);
+    assert.equal(checkState('mot', 'Not valid', null, TODAY).tone, 'danger');
+    assert.equal(checkState('tax', 'Untaxed', null, TODAY).tone, 'danger');
+    const soon = checkState('mot', 'Valid', '2026-10-05', TODAY);
+    assert.equal(soon.tone, 'warn');
+    assert.equal(soon.text, 'MOT due in 10 days');
+    assert.equal(checkState('tax', 'SORN', null, TODAY).tone, 'warn');
+    assert.equal(checkState('mot', 'Valid', '2027-06-01', TODAY).tone, 'ok');
+    assert.equal(checkState('tax', 'Taxed', '2027-01-23', TODAY).text, 'Tax to 23/01/2027');
+    assert.equal(shortDay('2027-01-23'), '23/01/2027');
+    assert.equal(checkState('mot', '', null, TODAY).tone, 'muted');
+    assert.equal(checkState('mot', 'No details held by DVLA', null, TODAY).tone, 'muted');
+    assert.equal(checkState('tax', 'Taxed', '2026-09-25', TODAY).text, 'Tax due today');
+});
+
+test('a vehicle goes by the worse of its two checks', () => {
+    const a = vehicleAlert(car('X', {taxDueDate: '2026-10-01'}), TODAY);
+    assert.equal(a.tone, 'warn');
+    assert.equal(a.needsAttention, true);
+    assert.equal(vehicleAlert(car('Y'), TODAY).needsAttention, false);
+    const row = vehicleRow(car('AB12CDE', {colour: 'BLUE', fuelType: 'PETROL', engineCapacity: 1600, motExpiryDate: '2026-01-01'}), TODAY);
+    assert.equal(row.reg, 'AB12 CDE');
+    assert.equal(row.title, 'FORD · 2019');
+    assert.equal(row.meta, 'BLUE · PETROL · 1600cc');
+    assert.equal(row.motTone, 'is-danger');
+    assert.equal(row.rowCls, 'is-danger');
+});
+
+test('arrange: attention first (worst, then soonest), filter and search', () => {
+    const list = [car('BB22BBB'), car('AA11AAA', {taxDueDate: '2026-10-20'}), car('CC33CCC', {motExpiryDate: '2026-09-01'}), car('DD44DDD', {taxDueDate: '2026-10-01'})];
+    assert.deepEqual(arrangeVehicles(list, {today: TODAY}).map(v => v.id), ['CC33CCC', 'DD44DDD', 'AA11AAA', 'BB22BBB']);
+    assert.deepEqual(arrangeVehicles(list, {today: TODAY, filter: 'attention'}).map(v => v.id), ['CC33CCC', 'DD44DDD', 'AA11AAA']);
+    assert.deepEqual(arrangeVehicles(list, {today: TODAY, query: 'bb22 b'}).map(v => v.id), ['BB22BBB']);
+    const hist = [car('A', {lookupDate: '2026-09-01'}), car('B', {lookupDate: '2026-09-20'})];
+    assert.deepEqual(arrangeVehicles(hist, {today: TODAY, order: 'recent'}).map(v => v.id), ['B', 'A']);
+});
+
+test('badge: what needs doing; red once anything has run out; nothing due = no badge', () => {
+    const b = badgeFor([car('AA11AAA', {motExpiryDate: '2026-09-01'}), car('BB22BBB', {taxDueDate: '2026-10-10'}), car('CC33CCC')], TODAY);
+    assert.equal(b.count, 2);
+    assert.equal(b.tone, 'danger');
+    assert.equal(b.label, '2 vehicles need attention (1 expired)');
+    assert.equal(b.details.items[0].text, 'AA11 AAA · FORD');
+    assert.equal(b.details.items[0].tone, 'danger');
+    assert.match(b.details.items[1].meta, /Tax due in 15 days/);
+    const calm = badgeFor([car('CC33CCC')], TODAY);
+    assert.equal(calm.count, 0);
+    assert.equal(calm.tone, 'info');
+    assert.equal(calm.label, '1 saved vehicle, nothing due');
+});
+
+test('notices: expired is critical, due soon a warning, SORN and fine nothing - each to its owner', () => {
+    const vs = [
+        car('EXP1', {userId: 'u1', motExpiryDate: '2026-09-01'}),
+        car('DUE1', {userId: 'u2', taxDueDate: '2026-10-05'}),
+        car('SORN1', {userId: 'u3', taxStatus: 'SORN', taxDueDate: null}),
+        car('OK1', {userId: 'u4'}),
+        car('NOBODY', {motExpiryDate: '2026-09-01'})
+    ];
+    const {raise, resolve} = vehicleNotices(vs, TODAY);
+    assert.equal(raise.length, 2);
+    const [exp, due] = raise;
+    assert.equal(exp.severity, 'critical');
+    assert.match(exp.title, /^EXP1 \(FORD\): MOT expired/);
+    assert.deepEqual(exp.audience, {userIds: ['u1']});
+    assert.equal(exp.dedupeKey, 'vehicle:EXP1:expired');
+    assert.equal(due.severity, 'warning');
+    assert.match(due.title, /Tax due in 10 days/);
+    assert.deepEqual(due.audience, {userIds: ['u2']});
+    assert.ok(resolve.includes('vehicle:EXP1:due'), 'moving to expired ends the due notice');
+    assert.ok(resolve.includes('vehicle:OK1:due') && resolve.includes('vehicle:OK1:expired'), 'renewed: both go');
+    assert.ok(resolve.includes('vehicle:SORN1:due'), 'SORN is declared on purpose - nothing raised');
+});
+
+test('a saved key keeps every other stored setting', () => {
+    const stored = {dvlaApiKey: '••••••••', maxHistoryItems: 40, rateLimit: {max: 5, windowSeconds: 60}};
+    assert.deepEqual(settingsWithKey(stored, '  new-key '), {dvlaApiKey: 'new-key', maxHistoryItems: 40, rateLimit: {max: 5, windowSeconds: 60}});
+    assert.equal(stored.dvlaApiKey.length, 8, 'the stored object is not changed');
+    assert.deepEqual(settingsWithKey(null, 'k'), {dvlaApiKey: 'k'});
+    assert.deepEqual(settingsWithKey(['x'], 'k'), {dvlaApiKey: 'k'});
+});

package/plugins/messages/CLAUDE.md

@@ -0,0 +1,230 @@
+# messages — AI Assistant Guide
+
+## Purpose
+
+Internal user-to-user and group messaging for any authenticated CMS user. Supports 1:1 DMs, ad-hoc group chats, and admin-managed groups. Real-time delivery via SSE. Attachments via the existing `/api/media` pipeline. Per-thread retention with an admin-set global ceiling.
+
+## Files
+
+- `plugin.json`, `plugin.js`, `config.js`
+- `collections/user-message-threads/schema.json` — thread metadata
+- `collections/user-messages/schema.json` — individual messages
+- `admin/views/messages.js` — Domma SPA view (`messagesView`), on the Tool upgrade path (1.1.0): domma-reactive
+  state, conversation + message context menus (right-click / ⋮ / Shift+F10), slideover forms (new
+  conversation, Call…, edit message, rename, retention, managed groups) with a discard guard, banner actions,
+  help popovers, viewLifetime teardown (closes the SSE stream)
+- `admin/templates/messages.html`, `admin/css/messages.css` (--dm-* tokens only)
+- `lib/call.js` (1.4) — calls: the link secret (`data/call-secret`, made once), `joinLink`/`checkJoin` (HMAC
+  links), `whoIsCalling` (the engine's resolve rule), `endedText`. `plugin.public.js` + `templates/call.html` —
+  the call page `/messages-call/:thread`. Tests: `tests/call.test.js`
+- `admin/lib/messages.js` — PURE, shared with plugin.js: titles, filters, rights, bubbles, drafts,
+  `cleanAttachments`, `unreadBadge`. Tests: `tests/messages.test.js`, `tests/api.test.js` (snapshots and
+  restores the CMS checkout's tracked user-messages / user-message-threads data files)
+
+## Routes
+
+All routes are under `/api/plugins/messages` and require authentication - except the call engine's `/call/*`, where the per-user link is the credential.
+
+| Method | Path | Purpose | Location |
+|---|---|---|---|
+| GET | `/stream` | SSE stream; accepts `?token=` for native EventSource | plugin.js |
+| GET | `/threads` | List threads for current user (includes unread counts) | plugin.js |
+| POST | `/threads` | Create DM or ad-hoc group; deduplicates DMs | plugin.js |
+| PUT | `/threads/:id` | Rename thread or change `retentionDays` | plugin.js |
+| DELETE | `/threads/:id` | Leave thread; purges when last participant leaves | plugin.js |
+| GET | `/threads/:id/messages` | Paginated messages; runs lazy retention pruning | plugin.js |
+| POST | `/threads/:id/messages` | Send a message; broadcasts SSE `message:new` | plugin.js |
+| PUT | `/threads/:id/messages/:msgId` | Edit within 15-min window; broadcasts `message:edited` | plugin.js |
+| DELETE | `/threads/:id/messages/:msgId` | Soft-delete (tombstone); broadcasts `message:deleted` | plugin.js |
+| POST | `/threads/:id/call` | Start the conversation's call (or join the running one); answers `{url, call}` - the caller's own 2 h link | plugin.js |
+| * | `/call/:room/{join,poll,signal,chat,answer,recording,leave}` | The call engine's routes (`_lib/call`), room = thread id | plugin.js |
+| POST | `/threads/:id/read` | Mark all messages as read for current user | plugin.js |
+| POST | `/threads/:id/unread` | The newest message from someone else counts as unread again | plugin.js |
+| POST | `/threads/:id/archive` | `{archived}` - per-user (`archivedBy[]`); a new message clears it for all | plugin.js |
+| GET | `/me` | `{id, name, isAdmin, editWindowMinutes, …}` - the screen's rights come from here | plugin.js |
+| GET | `/people` | `{id, name}` of every active user - the picker (/api/users needs a permission most lack) | plugin.js |
+| GET | `/count` | Sidebar badge: unread in conversations not archived | plugin.js |
+| GET | `/managed-groups` | Admin-only list of `group-managed` threads | plugin.js |
+| POST | `/managed-groups` | Admin-only: create a managed group | plugin.js |
+
+## Data & Storage
+
+- **`user-message-threads`** — `kind` (`dm`|`group-adhoc`|`group-managed`), `participants[]`, `createdBy`, `retentionDays` (null = default), `lastMessageAt`, `lastMessagePreview`
+- **`user-messages`** — `threadId`, `senderId`, `body`, `attachments[]` (denormalised: mediaId/filename/mime/size), `createdAt`, `editedAt`, `deletedAt`, `readBy[]`
+
+Both go through `server/services/collections.js` — FileAdapter by default, MongoAdapter if configured.
+
+## Config keys (`config.js`)
+
+| Key | Default | Purpose |
+|---|---|---|
+| `globalRetentionCeilingDays` | 365 | Hard ceiling; PUT /threads clamps to this |
+| `defaultRetentionDays` | 90 | Used when thread has no per-thread override |
+| `editWindowMinutes` | 15 | Minutes after send during which the sender can edit |
+
+There is no `scope` key (the participant list is the scope) and no `storage` key: until 1.3.1 `config.js`
+listed `scope: 'user'` and `storage: {}`, and nothing read either. The collection schemas declare no adapter,
+so both collections are on the FILE adapter unless moved to MongoDB (the collection editor's Storage tab,
+`migrate-storage`). (Older notes here said `storage.adapter` defaulted to `'mongodb'` - it never did.)
+
+## SSE bus
+
+Module-level `Map<userId, Set<res>>`. The `broadcast(userIds, eventName, payload)` helper writes to every active connection for each user ID. Evicts broken sockets silently. **Single-process only** — horizontal scaling would need a Redis pub/sub layer.
+
+Client connects via `new EventSource('/api/plugins/messages/stream?token=<jwt>')` since native `EventSource` cannot set headers. The `authenticateSSE` shim in `plugin.js` moves the query-param token into `request.headers.authorization` before calling the standard `authenticate` handler.
+
+## Retention pruning
+
+Runs lazily on `GET /threads/:id/messages`. Deletes any message whose `createdAt` is older than `min(thread.retentionDays ?? defaultRetentionDays, globalRetentionCeilingDays)` days. No background scheduler needed.
+
+## Gotchas
+
+- **Admin is by effective level** (`getEffectiveLevel` from userRoles.js). The JWT user has no `level`; 1.0
+  read `request.user.level`, so admins could not create managed groups or delete others' messages, and the
+  screen never showed Managed groups.
+- **Bulk writes are sequential.** The file adapter rewrites the whole collection per call; 1.0's
+  `Promise.all` in mark-read, prune and purge kept only one of the writes - mark-read left all but one
+  message unread (tests/api.test.js fails on the old loop).
+- **Attachments are media NAMES.** `POST /api/media` answers `{name, url}`; 1.0 stored `media.id`
+  (undefined) and linked `/api/media/<id>/file` (no such route), so no attachment ever showed.
+  `cleanAttachments` keeps only a safe name and rebuilds `url` as `/media/<name>` - a client-sent url is
+  never stored or rendered.
+- **Message cache.** `allMessages()` keeps the whole collection 30 s for the badge poll; every write goes
+  through the wrapped create/update/delete, which drop it.
+- **Drafts** are per signed-in person and per conversation in `S` (`messages.drafts.<user id>`, `draftKey()`) and
+  include uploaded-but-unsent attachments; a half-made new conversation is `messages.newDraft.<user id>`. No user =
+  no draft; the unscoped keys of older builds are removed on mount, never read. A reply draft comes back silently
+  (same person, its own conversation); a new-conversation draft is ASKED about: "Throw away the changes you left
+  unsaved to a new conversation?" - OK throws it away, Cancel / Escape opens it again; removed only once answered.
+  Message edits keep no draft - the window is minutes.
+- **Menu items that ask** (Leave conversation…, Delete…) run a task later (`later()`): run inside the menu's Enter
+  keydown, the confirm caught that same Enter and Leave left the conversation unasked.
+
+- **DM deduplication**: `POST /threads` with `kind:'dm'` normalises participants to a sorted pair and returns the existing thread if one already exists — safe to call repeatedly.
+- **Soft deletes**: deleted messages set `body:''`, `attachments:[]`, `deletedAt:<iso>` — the row is never removed until retention pruning sweeps it. Clients should render these as "message deleted".
+- **Attachment rendering**: the attachment record is denormalised at send time (filename/mime/size copied from the media entry). Deleting the media file does not break display, but the download link will 404.
+- **Edit window**: enforced server-side at `config.editWindowMinutes * 60 000ms`. The admin UI also hides the Edit button client-side once the window passes, but the server check is authoritative.
+- **Admin-only routes**: `GET/POST /managed-groups` use `requireAdmin`. `POST /threads` with `kind:'group-managed'` checks `isAdminUser()` - effective level ≤ 1 via `getEffectiveLevel`, never `request.user.level` (the JWT has none; see above).
+
+## Access (1.2.0)
+
+- **Permission `messages` (read = use)**, declared in plugin.json, granted once to `admin` and `user`; the sidebar
+  entry needs it. Every route checks it (a local `authenticate` = core's + `requirePermission('messages','read')`).
+  Take it from a role under Roles and that role has no Messages.
+- **Who you can message is enforced on the server** (`reachable()`, shared with `/people`): an admin reaches
+  every active account; anyone else staff, people sharing one of their roles, and people they already talk to.
+  POST /threads refuses anything else (403) and non-string ids (400). Until 1.2 it took any id.
+- **Retention is the starter's (or an admin's)**, a whole number of days >= 1 (or null for the default). Until 1.2
+  any participant could set it, and a negative number put the cut-off in the future, so the next read hard-
+  deleted every message in the conversation. `pruneOldMessages` reads a stored value below 1 as the default.
+- **A conversation's starter may remove others' messages only in a group**, never in a DM.
+- **Notifications (1.3.0):** `messages:unread`, every 15m: `unreadNotices()` (admin/lib/messages.js, pure) - a message unread for 10+ minutes (under 2 days old), one notice per conversation per recipient, to THEM (userIds). Key `unread:<thread>:<user>`; POST /threads/:id/read and archiving resolve it.
+
+## Calls (1.4.0)
+
+- **Engine:** core's `_lib/call` (0.103+), mounted at the end of plugin.js by dynamic import (`ns: 'messages'`,
+  prefix `/call`); an older core logs a warning and POST /threads/:id/call answers 501. Room = thread id.
+- **Page:** `plugin.public.js` serves `/messages-call/:thread?u=&x=&s=` in the site shell (renderBlogPage;
+  `{{}}` values are not escaped - `escHtml`, and `'` too since `data-dm-call` is single-quoted). Public, so it
+  cannot see the admin JWT: the link is a per-user HMAC (`thread|user|expiry`, 2 h) with the secret in
+  `data/call-secret` (`options.dataDir` in tests). resolve() re-checks it, the account (active) and that the
+  person is STILL a participant. Everyone is `host: false, autoAdmit: true` (no waiting room; the engine's host
+  only admits, records and is captioned "(host)"), `max: 6`,
+  `recordingAllowed: false`, identity `<thread>:<user>` (a reload replaces the old place).
+- **State** is in memory (`live` Map, like the engine's rooms): `startCall` sets it before its first await, so
+  two presses make one call. It posts a `kind: 'call'` message (`call: {event: 'started'|'ended'}`) READ BY
+  EVERYONE (no badge, no unread reminders - the live notice and the `messages:calls` notification tell people),
+  broadcasts `call:started`, and notifies the others (`dedupeKey call:<thread>`). A 5 s sweep on `countRoom`
+  broadcasts `call:updated` (numbers in) and ends a call that emptied - or that nobody joined within
+  `RING_MS` (5 min) - with "Call ended (N min)" / "Call ended - nobody joined", `call:ended`, and resolves the
+  notice. Joining with a valid link when no call is running starts one. The last member leaving closes the room.
+- Call lines cannot be edited (PUT 403). GET /threads carries `call` ({by, byName, startedAt, in, messageId} or null).
+- **Screen:** Call / Join call (N) in the header (tooltip warns past 6 members); a Join button on the running
+  call's "started" line; "X is calling - Join" notices bottom right (`ringingCalls`, put aside per call).
+  The tab is opened ON the click before any await (pop-up blocker); if blocked, an "Open the call" link shows.
+
+## The call's chat (1.6.0)
+
+- Typed in the call = posted INTO the conversation: the engine's `chat.save(threadId, item, {identity})` (core with
+  `_lib/call` chat storage; `identity` is `<thread>:<user>` from `whoIsCalling`, server side only) creates an ordinary
+  message from that user (`senderId`, body = the text) plus `callChat: {id, seq, who}` (the engine item's), updates
+  the thread preview, un-archives, and broadcasts `message:new` to EVERY participant (the sender's screen did not send
+  it). Only if the user is still a participant. System items are not posted; joined/left lines only keep `present`
+  (threadId -> Set of users in the call now), and `readBy` = the sender + everyone present, so people in the call get
+  no unread badge and the rest do. The screen skips its local unread +1 for a message whose `readBy` holds me.
+- `chat.load(threadId)` gives the engine the thread's `callChat` messages (not deleted, oldest first, last 500) as
+  items with the original id/seq/who (so "mine" and colours hold in the call) and the current body - a call started
+  again later shows the earlier call lines; never posted again (the engine does not save seeded history).
+- Bubbles: `buildBubbles` adds "in the call" to the meta of a `callChat` message. Tests: tests/call.test.js (1.6),
+  tests/messages.test.js.
+
+## Add people (1.7.0)
+
+- **Ring another team member** into a conversation's call (core with `server/services/callInvites.js`, dynamic import
+  beside `mountCallRoutes`; an older core has no button). `whoIsCalling` gives every MEMBER `mayInvite: true,
+  inviteExternal: false` (team only: no contacts, typed emails or copied link). `invite.search`: `searchInvitees`
+  with `contacts: false`, excluding the conversation's participants, `teamFilter` = `reachableFor(inviter)` (the
+  same rule as /people, now callable without a request). `invite.send`: `resolveInvitees(..., {contacts: false,
+  emails: false, teamFilter})`, each target added to the live call's `st.invited` (Set, gone with the call), links
+  `inviteLink()` = `?u=&x=&i=1&s=` signed over `thread|user|expiry|invite` (checkInvite; a member link is not an
+  invitation and the other way round), core sends the notification / DM / email. Answers `{results}` (no link).
+- resolve: an invitation link joins ONLY while `live.get(thread).invited` has the user (else 404 - never a way into a
+  later call, never starts one); `whoIsCalling(..., {invited: true})` lets a non-participant in (`autoAdmit`,
+  `mayInvite: false`) and `history: false` (the engine gives them the call's chat only from their own joined line on -
+  never the conversation's earlier call messages). They are NOT added to the conversation; what they type in the call
+  is not posted (not a participant). The public page accepts `i=1` too (checks the signature only; the join checks the invitation).
+- **Core's direct messenger**: `hooks.registerDirectMessenger(sendDirect)` - `{fromUserId, toUserId, text}` -> the
+  pair's DM (made, `thread:created` to the other, when there is none), a message from `fromUserId` (read by the
+  sender), thread touched + un-archived, `message:new` to both. Both accounts must be active AND the recipient must
+  be in `reachableFor(sender)` (Messages' own rule), else `{sent: false, reason}` - the host's results say why. Used by every Tool's
+  Add people (Booking, Calendar, core instant calls) for team members. `onCalls` exposes `sendDirect` for tests.
+- Tests: tests/call.test.js "1.7" (links, invited user joins, others cannot, ends with the call).
+
+## Call… (1.5.0)
+
+- **Banner action "Call…"** (and a button on the empty screen) opens the SAME people picker as New conversation
+  (`PEOPLE_LIST` / `peopleModel` / `wirePeople`), 1 to `CALL_PICK_MAX` (5) others - a call holds `CALL_MAX` (6).
+- **Where the call goes is decided on the client, from GET /threads** - no new route: `callTarget(threads, myId,
+  picked)` (admin/lib/messages.js, pure). One person: the DM (archived or not - one per pair; POST /threads kind
+  `dm` dedupes too). Several: a `group-adhoc` with EXACTLY those people plus you, not archived by you, latest used
+  first; managed groups are never taken. Else `{create}` -> POST /threads; a group's name defaults to
+  `callGroupName` of everyone ("Alex, Priya and Sam") - why `/me` now carries `name`.
+- **The tab is opened in the Call method itself, before any await** (the IIFE after it does the work);
+  `joinCall(id, tab)` takes the pre-opened tab (undefined = open one). Order: create -> loadThreads -> joinCall ->
+  openThread, so the fetched messages already hold the "started a call" line.
+- The conversation menu (right-click / ⋮) also has **Call** / **Join call**.
+- Tests: `callTarget`/`callGroupName`/`callTargetText` in tests/messages.test.js; the server round trip in
+  tests/call.test.js.
+
+## 1.7.2 (2026-10-13 Tool sweep)
+- `MAX_BODY` 10000 / `MAX_NAME` 80 (plugin.js): POST and edit bodies and a conversation's name are sliced server-side.
+  Before, only Fastify's 1 MB body limit stood, and every 1 MB message sat in `allMessages()`' cache, was re-read on
+  every `/count` poll and pushed over SSE to everyone in the conversation.
+- `resolveUsers` answers `{id, name, avatar}` - no `email` (the screen never showed it; `/people` already hid it).
+  `/threads` and `/count` were handing a member every participant's address.
+
+## 1.7.3 (2026-10-13 Tool sweep, upgrades)
+- `allMessages()` now fills `messagesCache.byThread` (a Map from `indexByThread`, admin/lib/messages.js) in the same
+  30 s fill; `messagesByThread()` / `threadMessages(id)` read it. Thread list unread counts, GET messages, mark read /
+  unread, prune, leave-and-purge and the call chat's `load()` no longer filter the whole site's messages per call.
+  Any write still drops the cache (and so the index). `/count` and the unread notice already made one pass over all.
+- The slideovers (New conversation, Edit, Keep for, Managed groups) were already M templates via `openPanel`; the
+  screen's `esc` now covers `'` too.
+
+## 1.8.0 (2026-10-15 Tool Upgrade, second pass)
+
+- **A send never loses or misplaces typing**: `afterSend()` (admin/lib/messages.js, tests/after-send.test.js) decides
+  what stays in the box after the POST - typed on after the sent text keeps just the new part, edited otherwise keeps
+  everything, unsent attachments stay. If the person moved to another conversation meanwhile, the sent one's draft is
+  cleaned instead and the new conversation's box and bubbles are left alone (it used to append the message there and
+  empty its box). The sent text never survives as a draft (no double send).
+- Uploads land on the conversation they were started on (`tid`), as a draft if the person moved on.
+- The unfinished new-conversation draft is removed only once the question is answered.
+- Skeletons for the conversation list (first load) and a conversation's messages (`.msx-loading`,
+  `.msx-thread-loading`, block elements; core `loading.js` at run time).
+
+## 1.9.0 (2026-10-21): free
+
+`tier: free`, no `closedSource` - no licence is needed or checked any more (the engine only checks a
+`closedSource` plugin). Included in every hosted plan and free to self-host; not `bundle: false`, so the next
+`make sync-free-tier` ships it in the engine.

package/plugins/messages/admin/css/messages.css

@@ -0,0 +1,117 @@
+/* Messages admin screen - see admin/views/messages.js. --dm-* tokens only. */
+.msx { display: grid; grid-template-columns: minmax(16rem, 22rem) 1fr; gap: .75rem; min-height: 32rem; height: calc(100vh - 13rem); }
+.msx [hidden], .msx-form [hidden] { display: none !important; }
+.msx-card { border: 1px solid var(--dm-border); border-radius: var(--dm-radius-md); background: var(--dm-surface); display: flex; flex-direction: column; min-height: 0; }
+.msx-side { padding: .6rem; gap: .5rem; }
+.msx-side-head { display: flex; align-items: center; gap: .35rem; }
+.msx-search { width: 100%; }
+.msx-note { margin: 0; padding: .4rem .2rem; color: var(--dm-text-muted); font-size: var(--dm-text-sm); }
+.msx-note.is-bad { color: var(--dm-danger); }
+.msx-seg { display: inline-flex; border: 1px solid var(--dm-border); border-radius: var(--dm-radius-md); overflow: hidden; flex: 1; }
+.msx-seg button { flex: 1; border: 0; background: none; color: var(--dm-text); padding: .3rem .45rem; cursor: pointer; font: inherit; font-size: var(--dm-text-sm); white-space: nowrap; }
+.msx-seg button + button { border-left: 1px solid var(--dm-border); }
+.msx-seg button b { font-weight: 500; opacity: .65; margin-left: .15rem; }
+.msx-seg button:hover { background: var(--dm-table-hover-bg, color-mix(in srgb, var(--dm-text) 6%, transparent)); }
+.msx-seg button.is-on { background: var(--dm-primary); color: var(--dm-primary-text); }
+
+/* Conversation rows */
+.msx-threads { flex: 1; overflow-y: auto; display: flex; flex-direction: column; min-height: 0; }
+.msx-row { display: flex; align-items: center; gap: .6rem; padding: .5rem .4rem; border-radius: var(--dm-radius-sm); cursor: pointer; }
+.msx-row:hover, .msx-row:focus-visible { background: var(--dm-table-hover-bg, color-mix(in srgb, var(--dm-text) 6%, transparent)); outline: none; }
+.msx-row.is-active { background: color-mix(in srgb, var(--dm-primary) 12%, transparent); box-shadow: inset 3px 0 0 var(--dm-primary); }
+.msx-row.is-unread .msx-row-title { font-weight: 700; }
+.msx-avatar { display: inline-flex; align-items: center; justify-content: center; flex-shrink: 0; width: 2.1rem; height: 2.1rem; border-radius: 50%;
+    font-size: var(--dm-text-xs); font-weight: 700; color: var(--dm-primary); background: color-mix(in srgb, var(--dm-primary) 14%, transparent); }
+.msx-avatar.is-group { border-radius: var(--dm-radius-md); color: var(--dm-success); background: color-mix(in srgb, var(--dm-success) 14%, transparent); }
+.msx-avatar.is-lg { width: 2.5rem; height: 2.5rem; font-size: var(--dm-text-sm); }
+.msx-row-main { flex: 1; min-width: 0; display: flex; flex-direction: column; }
+.msx-row-top { display: flex; align-items: baseline; gap: .4rem; }
+.msx-row-title { flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; font-weight: 500; }
+.msx-row-when { color: var(--dm-text-muted); font-size: var(--dm-text-xs); white-space: nowrap; }
+.msx-row-preview { color: var(--dm-text-muted); font-size: var(--dm-text-xs); overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.msx-row-preview .msx-draft { color: var(--dm-warning); font-weight: 600; }
+.msx-chip { display: inline-flex; align-items: center; font-size: var(--dm-text-xs); font-weight: 600; padding: .05rem .45rem; border-radius: 999px; white-space: nowrap;
+    background: color-mix(in srgb, var(--dm-text) 10%, transparent); color: var(--dm-text-muted); }
+.msx-chip.is-unread { background: var(--dm-primary); color: var(--dm-primary-text); }
+.msx-kebab { border: 0; background: none; cursor: pointer; font-size: var(--dm-text-lg); line-height: 1; color: var(--dm-text-muted); border-radius: var(--dm-radius-sm); padding: 0 .3rem; }
+.msx-kebab:hover { color: var(--dm-primary); }
+
+/* The open conversation */
+.msx-main { min-width: 0; }
+.msx-main-head { display: flex; align-items: center; gap: .6rem; padding: .6rem .8rem; border-bottom: 1px solid var(--dm-border); }
+.msx-main-title { flex: 1; min-width: 0; display: flex; flex-direction: column; }
+.msx-main-title strong, .msx-main-title small { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.msx-main-title small { color: var(--dm-text-muted); font-size: var(--dm-text-xs); }
+.msx-empty-main { flex: 1; display: flex; flex-direction: column; align-items: center; justify-content: center; gap: .5rem; color: var(--dm-text-muted); padding: 2rem; text-align: center; }
+.msx-empty-actions { display: flex; gap: .5rem; flex-wrap: wrap; justify-content: center; }
+.msx-scroll { flex: 1; overflow-y: auto; padding: .75rem .9rem; min-height: 0; }
+.msx-bubbles { display: flex; flex-direction: column; gap: .35rem; }
+.msx-item { display: flex; flex-direction: column; }
+.msx-day { align-self: center; margin: .5rem 0 .2rem; font-size: var(--dm-text-xs); color: var(--dm-text-muted); }
+.msx-msg { display: flex; align-items: flex-end; gap: .35rem; max-width: 78%; align-self: flex-start; }
+.msx-msg.is-mine { align-self: flex-end; flex-direction: row-reverse; }
+.msx-bubble { padding: .45rem .7rem; border-radius: 1rem; border-bottom-left-radius: .3rem; background: var(--dm-surface-raised, color-mix(in srgb, var(--dm-text) 7%, transparent)); color: var(--dm-text); min-width: 0; }
+.msx-msg.is-mine .msx-bubble { background: var(--dm-primary); color: var(--dm-primary-text); border-bottom-left-radius: 1rem; border-bottom-right-radius: .3rem; }
+.msx-msg.is-deleted .msx-bubble { background: none; border: 1px dashed var(--dm-border); color: var(--dm-text-muted); font-style: italic; }
+.msx-sender { display: block; font-size: var(--dm-text-xs); font-weight: 700; color: var(--dm-primary); margin-bottom: .1rem; }
+.msx-body { white-space: pre-wrap; overflow-wrap: anywhere; }
+.msx-meta { display: block; font-size: 10px; opacity: .7; margin-top: .15rem; text-align: right; }
+.msx-atts { display: flex; flex-direction: column; gap: .3rem; margin-top: .35rem; }
+.msx-att-img img { display: block; max-width: 16rem; max-height: 12rem; border-radius: var(--dm-radius-sm); }
+.msx-att-file { display: inline-flex; align-items: center; gap: .3rem; color: inherit; text-decoration: underline; }
+.msx-msg .msx-kebab { opacity: 0; transition: opacity .15s; }
+.msx-msg:hover .msx-kebab, .msx-msg:focus-within .msx-kebab, .msx-msg:focus .msx-kebab { opacity: 1; }
+.msx-msg:focus-visible { outline: 2px solid var(--dm-primary); outline-offset: 2px; border-radius: 1rem; }
+
+/* Composer */
+.msx-composer { border-top: 1px solid var(--dm-border); padding: .6rem .8rem; display: flex; flex-direction: column; gap: .35rem; }
+.msx-compose-row { display: flex; gap: .5rem; align-items: flex-end; }
+.msx-input { flex: 1; resize: vertical; min-height: 2.6rem; max-height: 12rem; }
+.msx-compose-actions { display: flex; gap: .3rem; }
+.msx-compose-actions .btn { display: inline-flex; align-items: center; gap: .3rem; }
+.msx-hint { color: var(--dm-text-muted); font-size: var(--dm-text-xs); display: flex; align-items: center; gap: .3rem; }
+.msx-attach-list { display: flex; flex-wrap: wrap; gap: .3rem; }
+.msx-att-chip { display: inline-flex; align-items: center; gap: .3rem; font-size: var(--dm-text-xs); padding: .15rem .5rem; border-radius: 999px;
+    background: color-mix(in srgb, var(--dm-primary) 12%, transparent); }
+.msx-att-chip button { border: 0; background: none; cursor: pointer; color: var(--dm-text-muted); padding: 0; font-size: var(--dm-text-sm); }
+
+/* Slideover forms */
+.msx-form { display: flex; flex-direction: column; gap: .85rem; }
+.msx-form .form-label { display: flex; align-items: center; gap: .3rem; }
+.msx-people { max-height: 45vh; overflow-y: auto; border: 1px solid var(--dm-border); border-radius: var(--dm-radius-md); padding: .25rem; }
+.msx-person { display: flex; align-items: center; gap: .5rem; padding: .3rem .35rem; border-radius: var(--dm-radius-sm); cursor: pointer; }
+.msx-person:hover { background: var(--dm-table-hover-bg, color-mix(in srgb, var(--dm-text) 6%, transparent)); }
+.msx-err { color: var(--dm-danger); font-size: var(--dm-text-xs); }
+.msx-hint-block { display: block; color: var(--dm-text-muted); font-size: var(--dm-text-xs); margin-top: .25rem; }
+.msx-actions { display: flex; align-items: center; gap: .4rem; padding-top: .6rem; border-top: 1px solid var(--dm-border); }
+.msx-actions .btn { display: inline-flex; align-items: center; gap: .3rem; }
+.msx-spacer { flex: 1; }
+.msx-group-row { display: flex; align-items: center; gap: .6rem; padding: .45rem .3rem; border-bottom: 1px solid var(--dm-border); }
+.msx-group-row:last-child { border-bottom: 0; }
+
+@media (max-width: 820px) {
+    .msx { grid-template-columns: 1fr; height: auto; }
+    .msx-side { max-height: 40vh; }
+    .msx-main { min-height: 30rem; }
+}
+
+/* Calls (1.4) */
+.msx-call-btn { display: inline-flex; align-items: center; gap: .3rem; white-space: nowrap; }
+.msx-callline { align-self: center; display: inline-flex; align-items: center; gap: .5rem; margin: .35rem 0; padding: .25rem .75rem;
+    border: 1px solid var(--dm-border); border-radius: 999px; font-size: var(--dm-text-xs); color: var(--dm-text-muted); }
+.msx-rings-dock { position: fixed; right: 1rem; bottom: 1rem; z-index: 1050; display: flex; flex-direction: column; gap: .5rem; width: min(22rem, calc(100vw - 2rem)); pointer-events: none; }
+.msx-rings { display: flex; flex-direction: column; gap: .5rem; }
+.msx-ring { pointer-events: auto; display: flex; align-items: center; gap: .6rem; padding: .6rem .7rem; border-radius: var(--dm-radius-md);
+    border: 1px solid var(--dm-border); border-left: 4px solid var(--dm-success); background: var(--dm-surface); color: var(--dm-text);
+    box-shadow: 0 6px 24px color-mix(in srgb, var(--dm-text) 18%, transparent); }
+.msx-ring-dot { width: .7rem; height: .7rem; border-radius: 50%; background: var(--dm-success); flex-shrink: 0; animation: msx-ring 1.4s ease-in-out infinite; }
+.msx-ring-main { flex: 1; min-width: 0; display: flex; flex-direction: column; }
+.msx-ring-main strong, .msx-ring-main small { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.msx-ring-main small { color: var(--dm-text-muted); font-size: var(--dm-text-xs); }
+.msx-ring .btn { display: inline-flex; align-items: center; }
+@keyframes msx-ring { 0%, 100% { opacity: 1; transform: scale(1); } 50% { opacity: .45; transform: scale(.8); } }
+@media (prefers-reduced-motion: reduce) { .msx-ring-dot { animation: none; } }
+.dm-plugin-banner-action[data-banner-action="messages-call"] { display: inline-flex; align-items: center; gap: .3rem; }
+
+/* Skeleton slots (1.8): blocks, so core skeleton rows get the full width. */
+.msx-loading, .msx-thread-loading { display: block; }