domma-cms 1.8.39 → 1.8.41

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [1.8.41] - 2026-10-23
+
+- **A page can show images from another site.** `csp.imgHosts` in `config/server.json` adds hosts to the Content-Security-Policy's `img-src` (`imageSources()` in `server/services/embedCsp.js`, beside `connectSources()`; bare hostnames, https only). The policy allowed only the site's own images, so an `<img>` from anywhere else - a "Featured on" badge, say - was blocked.
+
+## [1.8.40] - 2026-10-22
+
+- **Every collection entry is in the page for robots.** An interactive collection or view now puts every entry in the page HTML for robots that run no JavaScript, also when it loads its pages from the server, up to 1,000 (was 200, and only the first page in server mode). A collection past 1,000 shows as a warning in the SEO audit.
+
 ## [1.8.39] - 2026-10-22
 
 - **Google Analytics, with consent.** Paste your GA4 measurement ID at **Site Settings > Analytics** and Google Analytics runs on every page - but only for visitors who accept Analytics cookies in the cookie banner, which is shown whenever an ID is set. Visitors who reject them, or have not answered, are never sent to Google, and withdrawing consent switches it off and removes its cookies. Adding an ID asks every visitor again, since an earlier answer was not consent to Google. GA's cookies stay on your site's own address, never one shared with other sites. The site's security policy lets Google in only while an ID is set.

package/admin/js/lib/seo-analyse.js

@@ -1 +1 @@
-export const LIMITS={titleMin:30,titleMax:60,descMin:70,descMax:160,minWords:300};const A={amp:"&",lt:"<",gt:">",quot:'"',apos:"'",nbsp:" ",ndash:"\u2013",mdash:"\u2014",hellip:"\u2026",lsquo:"\u2018",rsquo:"\u2019",ldquo:"\u201C",rdquo:"\u201D",pound:"\xA3",euro:"\u20AC",copy:"\xA9"};export function decode(e){return String(e??"").replace(/&(#x[0-9a-f]+|#\d+|[a-z]+);/gi,(s,n)=>{if(n[0]==="#"){const r=n[1]==="x"||n[1]==="X"?parseInt(n.slice(2),16):parseInt(n.slice(1),10);return Number.isFinite(r)&&r>0&&r<1114112?String.fromCodePoint(r):s}return A[n.toLowerCase()]??s})}const M=e=>decode(String(e??"").replace(/<[^>]*>/g," ")).replace(/\s+/g," ").trim();export function attrs(e){const s={},n=String(e).replace(/^<\s*[a-z0-9-]+/i,"").replace(/\/?>$/,""),r=/([^\s"'=<>`/]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+)))?/g;let i;for(;i=r.exec(n);)s[i[1].toLowerCase()]=decode(i[2]??i[3]??i[4]??"");return s}export function scanHtml(e){const s=String(e??""),n=s.search(/<\/head\s*>/i),r=n>=0?s.slice(0,n):s,i=[];for(const l of s.matchAll(/<script\b[^>]*type\s*=\s*["']?application\/ld\+json["']?[^>]*>([\s\S]*?)<\/script>/gi))try{const c=JSON.parse(l[1]);for(const h of[c,...Array.isArray(c)?c:[],...Array.isArray(c?.["@graph"])?c["@graph"]:[]]){const o=h?.["@type"];o&&i.push(...(Array.isArray(o)?o:[o]).map(String))}}catch{i.push("(invalid)")}const a=s.replace(/<!--[\s\S]*?-->/g," ").replace(/<(script|style|template|noscript|svg)\b[\s\S]*?<\/\1\s*>/gi," ").replace(/<div\b[^>]*\bclass\s*=\s*["'][^"']*\b(?:cms-nojs-links|cms-form-embed-summary)\b[^>]*>[\s\S]*?<\/div\s*>/gi," "),p=[...r.matchAll(/<meta\b[^>]*>/gi)].map(l=>attrs(l[0])),t=(l,c)=>p.find(h=>(h[l]||"").toLowerCase()===c)?.content,$=[...r.matchAll(/<link\b[^>]*>/gi)].map(l=>attrs(l[0])),d=a.search(/<body\b/i),u=d>=0?a.slice(d):a,m=[...u.matchAll(/<h([1-6])\b[^>]*>([\s\S]*?)<\/h\1\s*>/gi)].map(l=>({level:Number(l[1]),text:M(l[2])})),w=[...u.matchAll(/<img\b[^>]*>/gi)].map(l=>{const c=attrs(l[0]);return{src:c.src||c["data-src"]||"",alt:"alt"in c?c.alt:null,role:c.role||""}}),g=[...u.matchAll(/<a\b([^>]*)>([\s\S]*?)<\/a\s*>/gi)].map(l=>{const c=attrs(`<a ${l[1]}>`);return{href:c.href||"",text:M(l[2]),rel:c.rel||"",title:c.title||""}}),y=M(u),x=M(u.match(/<p\b[^>]*>([\s\S]*?)<\/p\s*>/i)?.[1]||"");return{title:M(r.match(/<title\b[^>]*>([\s\S]*?)<\/title\s*>/i)?.[1]||""),description:t("name","description")??null,robots:t("name","robots")||"",viewport:!!t("name","viewport"),canonical:$.find(l=>(l.rel||"").toLowerCase()==="canonical")?.href||"",lang:attrs(s.match(/<html\b[^>]*>/i)?.[0]||"<html>").lang||"",og:{title:t("property","og:title")||"",description:t("property","og:description")||"",image:t("property","og:image")||"",type:t("property","og:type")||""},twitter:{card:t("name","twitter:card")||"",image:t("name","twitter:image")||""},headings:m,images:w,links:g,words:y?y.split(/\s+/).filter(l=>/[\p{L}\p{N}]/u.test(l)).length:0,text:y.slice(0,2e4),firstPara:x.slice(0,1e3),jsonLdTypes:[...new Set(i)]}}const f=(e,s,n=`${s}s`)=>`${e} ${e===1?s:n}`,v=(e,s)=>!!s&&String(e||"").toLowerCase().includes(s),T=e=>String(e||"").toLowerCase().normalize("NFKD").replace(/[̀-ͯ]/g,"").replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,"");export function analyse(e,{urlPath:s="/",focus:n="",limits:r={},origin:i=""}={}){const a={...LIMITS,...r},p=[],t=(o,b,k,L,S,C="")=>p.push({id:o,group:b,status:k,title:L,detail:S,fix:C}),$=/noindex/i.test(e.robots),d=e.title.length;d?d<a.titleMin?t("title","Search result","warn","Title",`${d} characters - short. Search engines may write their own.`,`Aim for ${a.titleMin}-${a.titleMax} characters that say what the page is about.`):d>a.titleMax?t("title","Search result","warn","Title",`${d} characters - it will be cut off after about ${a.titleMax}.`,"Put the words that matter first, or shorten it."):t("title","Search result","pass","Title",`${d} characters.`):t("title","Search result","fail","Title","The page has no title.","Give it one: it is the blue link people click in the results.");const u=e.description,m=(u||"").length;m?m<a.descMin?t("description","Search result","warn","Description",`${m} characters - short.`,`Aim for ${a.descMin}-${a.descMax} characters.`):m>a.descMax?t("description","Search result","warn","Description",`${m} characters - it will be cut off after about ${a.descMax}.`,"Shorten it, keeping the point in the first half."):t("description","Search result","pass","Description",`${m} characters.`):t("description","Search result","fail","Description","No description: search engines pick any sentence from the page.","Write one or two sentences that make someone want to click.");const w=s.split("/").filter(Boolean).pop()||"";s!=="/"&&(w.length>60||/[A-Z_ %]/.test(w)||/\d{5,}/.test(w))?t("url","Search result","warn","Address",`"${w}" is long or hard to read.`,"Short, lower-case words joined by hyphens read best - rename the page (a redirect is added for you)."):t("url","Search result","pass","Address",s==="/"?"The home page.":`"${w}" reads well.`);const g=e.headings.filter(o=>o.level===1);g.length?g.length>1?t("h1","Content","warn","Main heading",`${g.length} H1 headings: "${g.slice(0,3).map(o=>o.text).join('", "')}".`,"Keep one H1; make the others H2."):g[0].text?t("h1","Content","pass","Main heading",`"${g[0].text.slice(0,80)}".`):t("h1","Content","warn","Main heading","The H1 heading is empty.","Give it words."):t("h1","Content","fail","Main heading","There is no H1 heading.","Start the page with one main heading (# in Markdown) saying what it is about.");const y=[];for(let o=1;o<e.headings.length;o++)e.headings[o].level>e.headings[o-1].level+1&&y.push(`H${e.headings[o-1].level} \u2192 H${e.headings[o].level}`);y.length?t("headings","Content","warn","Heading order",`Levels are skipped: ${[...new Set(y)].slice(0,3).join(", ")}.`,"Go down one level at a time (H2, then H3) - screen readers and search engines read them as an outline."):e.headings.length>1&&t("headings","Content","pass","Heading order",`${f(e.headings.length,"heading")}, in order.`),e.words<Math.round(a.minWords/3)?t("words","Content","warn","Length",`${f(e.words,"word")}. Very little for a search engine to go on.`,`Pages that rank usually have ${a.minWords}+ words - unless the page is a form or a contact page.`):e.words<a.minWords?t("words","Content","info","Length",`${f(e.words,"word")}.`,`Pages that rank usually have ${a.minWords}+ words.`):t("words","Content","pass","Length",`${e.words.toLocaleString("en-GB")} words.`);const x=e.images.filter(o=>o.role!=="presentation"),l=x.filter(o=>o.alt===null);l.length?t("alt","Content","fail","Image descriptions",`${f(l.length,"image")} of ${x.length} ${l.length===1?"has":"have"} no alt text.`,'Describe each image in a few words (empty alt="" only for decoration). It is how search and screen readers see them.'):x.length&&t("alt","Content","pass","Image descriptions",`All ${f(x.length,"image")} described.`);const c=e.links.filter(o=>j(o.href,i));!c.length&&e.links.length<50?t("links","Content","warn","Links to your other pages","None in the page itself.","Link to related pages: it helps visitors, and search engines find pages through links."):t("links","Content","pass","Links to your other pages",`${f(c.length,"link")}.`);const h=String(n||"").trim().toLowerCase();if(h){const b=[["title",v(e.title,h)],["description",v(u,h)],["main heading",g.some(S=>v(S.text,h))],["address",T(s).includes(T(h))],["first paragraph",v(e.firstPara,h)]].filter(([,S])=>!S).map(([S])=>S),k=N(e.text,h),L=e.words?k*h.split(/\s+/).length*100/e.words:0;b.length>=3?t("focus","Keyphrase","fail",`"${n}"`,`Missing from the ${b.join(", ")}.`,"Use the phrase people search for where they look first: the title, the heading and the opening."):b.length?t("focus","Keyphrase","warn",`"${n}"`,`Missing from the ${b.join(", ")}.`,"Work it in naturally - never at the cost of reading well."):t("focus","Keyphrase","pass",`"${n}"`,"In the title, description, heading, address and opening."),e.words<100||(L>3?t("density","Keyphrase","warn","Repetition",`The phrase is ${L.toFixed(1)}% of the words (${f(k,"time")}).`,"Over about 3% reads as stuffing - use other words for the same thing."):k&&t("density","Keyphrase","pass","Repetition",`Used ${f(k,"time")} (${L.toFixed(1)}%).`))}else t("focus","Keyphrase","info","Focus keyphrase","None set.","Say which search this page should be found for, and the checks will look for it.");return $?t("index","Technical","info","Search engines","Hidden from search engines (noindex).","On purpose for thank-you pages and the like; otherwise switch it off."):t("index","Technical","pass","Search engines","May be indexed."),e.canonical?e.canonical.replace(/\/$/,"").endsWith(s==="/"?"":s)?t("canonical","Technical","pass","Canonical address",e.canonical):t("canonical","Technical","info","Canonical address",`Points elsewhere: ${e.canonical}.`,"Right when this page is a copy of that one; otherwise it hides this page."):t("canonical","Technical","warn","Canonical address","No canonical link.","Set the site address in Settings so every page names its one true address."),e.og.image?t("share-image","Sharing","pass","Share image",e.og.image):t("share-image","Sharing","warn","Share image","No image when the page is shared.","Choose an image (1200 \xD7 630 is ideal), or set a default one for the site."),e.jsonLdTypes.includes("(invalid)")?t("schema","Technical","fail","Structured data","A JSON-LD block is not valid JSON.","Fix or remove it - search engines ignore the lot."):e.jsonLdTypes.length?t("schema","Technical","pass","Structured data",e.jsonLdTypes.join(", ")):t("schema","Technical","info","Structured data","None.","Structured data lets search engines show rich results."),e.lang||t("lang","Technical","warn","Language","The page does not say what language it is in.",'The site template sets <html lang="\u2026">.'),{...score(p),checks:p}}function j(e,s){const n=String(e||"").trim();if(!n||n.startsWith("#")||/^(mailto|tel|javascript|data):/i.test(n))return!1;if(n.startsWith("/")&&!n.startsWith("//"))return!0;if(!s)return!1;try{return new URL(n).origin===new URL(s).origin}catch{return!1}}function N(e,s){if(!s)return 0;const n=s.replace(/[.*+?^${}()|[\]\\]/g,"\\$&").replace(/\s+/g,"\\s+");return(String(e).match(new RegExp(`(^|[^\\p{L}\\p{N}])${n}(?=$|[^\\p{L}\\p{N}])`,"giu"))||[]).length}export function score(e){const s=e.filter(r=>r.status!=="info"),n=s.reduce((r,i)=>r+(i.status==="pass"?1:i.status==="warn"?.5:0),0);return{score:s.length?Math.round(n/s.length*100):100,failing:e.filter(r=>r.status==="fail").length,warnings:e.filter(r=>r.status==="warn").length}}export function siteIssues(e){const s=n=>{const r=new Map;for(const i of e){const a=String(i[n]||"").trim().toLowerCase();!a||i.noindex||i.error||(r.has(a)||r.set(a,{text:i[n],paths:[]}),r.get(a).paths.push(i.urlPath))}return[...r.values()].filter(i=>i.paths.length>1).sort((i,a)=>a.paths.length-i.paths.length)};return{duplicateTitles:s("title"),duplicateDescriptions:s("description")}}export function snippet({title:e="",description:s="",url:n="",limits:r={}}={}){const i={...LIMITS,...r},a=(t,$)=>t.length>$?`${t.slice(0,$-1).replace(/\s+\S*$/,"")} \u2026`:t;let p=n;try{const t=new URL(n);p=[t.hostname,...t.pathname.split("/").filter(Boolean)].join(" \u203A ")}catch{}return{title:a(String(e),i.titleMax),description:a(String(s),i.descMax),crumbs:p,titleCut:String(e).length>i.titleMax,descriptionCut:String(s).length>i.descMax}}
+export const LIMITS={titleMin:30,titleMax:60,descMin:70,descMax:160,minWords:300};const A={amp:"&",lt:"<",gt:">",quot:'"',apos:"'",nbsp:" ",ndash:"\u2013",mdash:"\u2014",hellip:"\u2026",lsquo:"\u2018",rsquo:"\u2019",ldquo:"\u201C",rdquo:"\u201D",pound:"\xA3",euro:"\u20AC",copy:"\xA9"};export function decode(e){return String(e??"").replace(/&(#x[0-9a-f]+|#\d+|[a-z]+);/gi,(s,n)=>{if(n[0]==="#"){const r=n[1]==="x"||n[1]==="X"?parseInt(n.slice(2),16):parseInt(n.slice(1),10);return Number.isFinite(r)&&r>0&&r<1114112?String.fromCodePoint(r):s}return A[n.toLowerCase()]??s})}const M=e=>decode(String(e??"").replace(/<[^>]*>/g," ")).replace(/\s+/g," ").trim();export function attrs(e){const s={},n=String(e).replace(/^<\s*[a-z0-9-]+/i,"").replace(/\/?>$/,""),r=/([^\s"'=<>`/]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+)))?/g;let i;for(;i=r.exec(n);)s[i[1].toLowerCase()]=decode(i[2]??i[3]??i[4]??"");return s}export function scanHtml(e){const s=String(e??""),n=s.search(/<\/head\s*>/i),r=n>=0?s.slice(0,n):s,i=[];for(const o of s.matchAll(/<script\b[^>]*type\s*=\s*["']?application\/ld\+json["']?[^>]*>([\s\S]*?)<\/script>/gi))try{const c=JSON.parse(o[1]);for(const h of[c,...Array.isArray(c)?c:[],...Array.isArray(c?.["@graph"])?c["@graph"]:[]]){const l=h?.["@type"];l&&i.push(...(Array.isArray(l)?l:[l]).map(String))}}catch{i.push("(invalid)")}const a=s.replace(/<!--[\s\S]*?-->/g," ").replace(/<(script|style|template|noscript|svg)\b[\s\S]*?<\/\1\s*>/gi," ").replace(/<div\b[^>]*\bclass\s*=\s*["'][^"']*\b(?:cms-nojs-links|cms-form-embed-summary)\b[^>]*>[\s\S]*?<\/div\s*>/gi," "),u=[...r.matchAll(/<meta\b[^>]*>/gi)].map(o=>attrs(o[0])),t=(o,c)=>u.find(h=>(h[o]||"").toLowerCase()===c)?.content,$=[...r.matchAll(/<link\b[^>]*>/gi)].map(o=>attrs(o[0])),d=a.search(/<body\b/i),f=d>=0?a.slice(d):a,m=[...f.matchAll(/<h([1-6])\b[^>]*>([\s\S]*?)<\/h\1\s*>/gi)].map(o=>({level:Number(o[1]),text:M(o[2])})),w=[...f.matchAll(/<img\b[^>]*>/gi)].map(o=>{const c=attrs(o[0]);return{src:c.src||c["data-src"]||"",alt:"alt"in c?c.alt:null,role:c.role||""}}),g=[...f.matchAll(/<a\b([^>]*)>([\s\S]*?)<\/a\s*>/gi)].map(o=>{const c=attrs(`<a ${o[1]}>`);return{href:c.href||"",text:M(o[2]),rel:c.rel||"",title:c.title||""}}),y=M(f),b=M(f.match(/<p\b[^>]*>([\s\S]*?)<\/p\s*>/i)?.[1]||"");return{title:M(r.match(/<title\b[^>]*>([\s\S]*?)<\/title\s*>/i)?.[1]||""),description:t("name","description")??null,robots:t("name","robots")||"",viewport:!!t("name","viewport"),canonical:$.find(o=>(o.rel||"").toLowerCase()==="canonical")?.href||"",lang:attrs(s.match(/<html\b[^>]*>/i)?.[0]||"<html>").lang||"",og:{title:t("property","og:title")||"",description:t("property","og:description")||"",image:t("property","og:image")||"",type:t("property","og:type")||""},twitter:{card:t("name","twitter:card")||"",image:t("name","twitter:image")||""},headings:m,images:w,links:g,words:y?y.split(/\s+/).filter(o=>/[\p{L}\p{N}]/u.test(o)).length:0,text:y.slice(0,2e4),firstPara:b.slice(0,1e3),jsonLdTypes:[...new Set(i)],entriesLeftOut:[...s.matchAll(/\bdata-cb-more="(\d+)"/g)].reduce((o,c)=>o+Number(c[1]),0)}}const p=(e,s,n=`${s}s`)=>`${e} ${e===1?s:n}`,v=(e,s)=>!!s&&String(e||"").toLowerCase().includes(s),C=e=>String(e||"").toLowerCase().normalize("NFKD").replace(/[̀-ͯ]/g,"").replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,"");export function analyse(e,{urlPath:s="/",focus:n="",limits:r={},origin:i=""}={}){const a={...LIMITS,...r},u=[],t=(l,x,L,k,S,T="")=>u.push({id:l,group:x,status:L,title:k,detail:S,fix:T}),$=/noindex/i.test(e.robots),d=e.title.length;d?d<a.titleMin?t("title","Search result","warn","Title",`${d} characters - short. Search engines may write their own.`,`Aim for ${a.titleMin}-${a.titleMax} characters that say what the page is about.`):d>a.titleMax?t("title","Search result","warn","Title",`${d} characters - it will be cut off after about ${a.titleMax}.`,"Put the words that matter first, or shorten it."):t("title","Search result","pass","Title",`${d} characters.`):t("title","Search result","fail","Title","The page has no title.","Give it one: it is the blue link people click in the results.");const f=e.description,m=(f||"").length;m?m<a.descMin?t("description","Search result","warn","Description",`${m} characters - short.`,`Aim for ${a.descMin}-${a.descMax} characters.`):m>a.descMax?t("description","Search result","warn","Description",`${m} characters - it will be cut off after about ${a.descMax}.`,"Shorten it, keeping the point in the first half."):t("description","Search result","pass","Description",`${m} characters.`):t("description","Search result","fail","Description","No description: search engines pick any sentence from the page.","Write one or two sentences that make someone want to click.");const w=s.split("/").filter(Boolean).pop()||"";s!=="/"&&(w.length>60||/[A-Z_ %]/.test(w)||/\d{5,}/.test(w))?t("url","Search result","warn","Address",`"${w}" is long or hard to read.`,"Short, lower-case words joined by hyphens read best - rename the page (a redirect is added for you)."):t("url","Search result","pass","Address",s==="/"?"The home page.":`"${w}" reads well.`);const g=e.headings.filter(l=>l.level===1);g.length?g.length>1?t("h1","Content","warn","Main heading",`${g.length} H1 headings: "${g.slice(0,3).map(l=>l.text).join('", "')}".`,"Keep one H1; make the others H2."):g[0].text?t("h1","Content","pass","Main heading",`"${g[0].text.slice(0,80)}".`):t("h1","Content","warn","Main heading","The H1 heading is empty.","Give it words."):t("h1","Content","fail","Main heading","There is no H1 heading.","Start the page with one main heading (# in Markdown) saying what it is about.");const y=[];for(let l=1;l<e.headings.length;l++)e.headings[l].level>e.headings[l-1].level+1&&y.push(`H${e.headings[l-1].level} \u2192 H${e.headings[l].level}`);y.length?t("headings","Content","warn","Heading order",`Levels are skipped: ${[...new Set(y)].slice(0,3).join(", ")}.`,"Go down one level at a time (H2, then H3) - screen readers and search engines read them as an outline."):e.headings.length>1&&t("headings","Content","pass","Heading order",`${p(e.headings.length,"heading")}, in order.`),e.words<Math.round(a.minWords/3)?t("words","Content","warn","Length",`${p(e.words,"word")}. Very little for a search engine to go on.`,`Pages that rank usually have ${a.minWords}+ words - unless the page is a form or a contact page.`):e.words<a.minWords?t("words","Content","info","Length",`${p(e.words,"word")}.`,`Pages that rank usually have ${a.minWords}+ words.`):t("words","Content","pass","Length",`${e.words.toLocaleString("en-GB")} words.`);const b=e.images.filter(l=>l.role!=="presentation"),o=b.filter(l=>l.alt===null);o.length?t("alt","Content","fail","Image descriptions",`${p(o.length,"image")} of ${b.length} ${o.length===1?"has":"have"} no alt text.`,'Describe each image in a few words (empty alt="" only for decoration). It is how search and screen readers see them.'):b.length&&t("alt","Content","pass","Image descriptions",`All ${p(b.length,"image")} described.`);const c=e.links.filter(l=>N(l.href,i));!c.length&&e.links.length<50&&t("links","Content","warn","Links to your other pages","None in the page itself.","Link to related pages: it helps visitors, and search engines find pages through links."),e.entriesLeftOut>0?t("collection-cap","Content","warn","Collections",`${p(e.entriesLeftOut,"entry","entries")} left out of the page HTML.`,"Robots that run no JavaScript read the first 1,000 entries of a collection. Split it across pages, or filter each listing."):t("links","Content","pass","Links to your other pages",`${p(c.length,"link")}.`);const h=String(n||"").trim().toLowerCase();if(h){const x=[["title",v(e.title,h)],["description",v(f,h)],["main heading",g.some(S=>v(S.text,h))],["address",C(s).includes(C(h))],["first paragraph",v(e.firstPara,h)]].filter(([,S])=>!S).map(([S])=>S),L=j(e.text,h),k=e.words?L*h.split(/\s+/).length*100/e.words:0;x.length>=3?t("focus","Keyphrase","fail",`"${n}"`,`Missing from the ${x.join(", ")}.`,"Use the phrase people search for where they look first: the title, the heading and the opening."):x.length?t("focus","Keyphrase","warn",`"${n}"`,`Missing from the ${x.join(", ")}.`,"Work it in naturally - never at the cost of reading well."):t("focus","Keyphrase","pass",`"${n}"`,"In the title, description, heading, address and opening."),e.words<100||(k>3?t("density","Keyphrase","warn","Repetition",`The phrase is ${k.toFixed(1)}% of the words (${p(L,"time")}).`,"Over about 3% reads as stuffing - use other words for the same thing."):L&&t("density","Keyphrase","pass","Repetition",`Used ${p(L,"time")} (${k.toFixed(1)}%).`))}else t("focus","Keyphrase","info","Focus keyphrase","None set.","Say which search this page should be found for, and the checks will look for it.");return $?t("index","Technical","info","Search engines","Hidden from search engines (noindex).","On purpose for thank-you pages and the like; otherwise switch it off."):t("index","Technical","pass","Search engines","May be indexed."),e.canonical?e.canonical.replace(/\/$/,"").endsWith(s==="/"?"":s)?t("canonical","Technical","pass","Canonical address",e.canonical):t("canonical","Technical","info","Canonical address",`Points elsewhere: ${e.canonical}.`,"Right when this page is a copy of that one; otherwise it hides this page."):t("canonical","Technical","warn","Canonical address","No canonical link.","Set the site address in Settings so every page names its one true address."),e.og.image?t("share-image","Sharing","pass","Share image",e.og.image):t("share-image","Sharing","warn","Share image","No image when the page is shared.","Choose an image (1200 \xD7 630 is ideal), or set a default one for the site."),e.jsonLdTypes.includes("(invalid)")?t("schema","Technical","fail","Structured data","A JSON-LD block is not valid JSON.","Fix or remove it - search engines ignore the lot."):e.jsonLdTypes.length?t("schema","Technical","pass","Structured data",e.jsonLdTypes.join(", ")):t("schema","Technical","info","Structured data","None.","Structured data lets search engines show rich results."),e.lang||t("lang","Technical","warn","Language","The page does not say what language it is in.",'The site template sets <html lang="\u2026">.'),{...score(u),checks:u}}function N(e,s){const n=String(e||"").trim();if(!n||n.startsWith("#")||/^(mailto|tel|javascript|data):/i.test(n))return!1;if(n.startsWith("/")&&!n.startsWith("//"))return!0;if(!s)return!1;try{return new URL(n).origin===new URL(s).origin}catch{return!1}}function j(e,s){if(!s)return 0;const n=s.replace(/[.*+?^${}()|[\]\\]/g,"\\$&").replace(/\s+/g,"\\s+");return(String(e).match(new RegExp(`(^|[^\\p{L}\\p{N}])${n}(?=$|[^\\p{L}\\p{N}])`,"giu"))||[]).length}export function score(e){const s=e.filter(r=>r.status!=="info"),n=s.reduce((r,i)=>r+(i.status==="pass"?1:i.status==="warn"?.5:0),0);return{score:s.length?Math.round(n/s.length*100):100,failing:e.filter(r=>r.status==="fail").length,warnings:e.filter(r=>r.status==="warn").length}}export function siteIssues(e){const s=n=>{const r=new Map;for(const i of e){const a=String(i[n]||"").trim().toLowerCase();!a||i.noindex||i.error||(r.has(a)||r.set(a,{text:i[n],paths:[]}),r.get(a).paths.push(i.urlPath))}return[...r.values()].filter(i=>i.paths.length>1).sort((i,a)=>a.paths.length-i.paths.length)};return{duplicateTitles:s("title"),duplicateDescriptions:s("description")}}export function snippet({title:e="",description:s="",url:n="",limits:r={}}={}){const i={...LIMITS,...r},a=(t,$)=>t.length>$?`${t.slice(0,$-1).replace(/\s+\S*$/,"")} \u2026`:t;let u=n;try{const t=new URL(n);u=[t.hostname,...t.pathname.split("/").filter(Boolean)].join(" \u203A ")}catch{}return{title:a(String(e),i.titleMax),description:a(String(s),i.descMax),crumbs:u,titleCut:String(e).length>i.titleMax,descriptionCut:String(s).length>i.descMax}}

package/admin/js/templates/docs/usage-search-engines.html

@@ -60,9 +60,9 @@
                       <li><strong>Form questions</strong> - the form's title and description are in the page, but the
                           questions appear once the page has loaded. Say what the form is for in the text around it
                           too.</li>
-                      <li><strong>Large interactive collections</strong> - a collection set to load its pages from the
-                          server (<code>mode="server"</code>, or one too big to send whole) sends its first page of
-                          entries; the rest arrive as the visitor pages through.</li>
+                      <li><strong>Very large collections</strong> - every entry of an interactive collection is in
+                          the page, up to 1,000. Past that, the SEO audit warns about the page: split the collection
+                          across pages, or filter each listing.</li>
                       <li><strong>Site search results</strong>, <strong>the Calendar's month view</strong> and other
                           Tool screens that load live data.</li>
                   </ul>

package/docs/DommaFeatures.md

@@ -386,7 +386,7 @@ headings (Layouts → Page contents settings, and `[contents]` per page).
 - **llms.txt** - an automatic `/llms.txt` (the llmstxt.org format) for AI assistants: `# Site title`, `> description` (Settings > SEO default description), then `## Pages` and one section per plugin sitemap source (blog posts and so on), each line `- [Title](absolute url): description`. Built from the same published, public, indexable set as the sitemap (SEO exclusions included), with absolute links from the site address in Site Settings (else the request's origin). Cached and invalidated with the sitemap and with Site Settings saves. On by default with its own switch in SEO settings; answers 404 while "Ask every search engine to stay away" is on. With the SEO Tool switched off it is still served, as the sitemap is.
   - Where: `/llms.txt`; **Tools > SEO > Settings** ("Publish /llms.txt for AI assistants"); `config/seo.json` `llms.enabled`; `buildLlmsTxt()` in `server/services/sitemap.js`
   - Since: 1.8.36
-- **Readable without JavaScript** - pages are rendered on the server, so robots that run no JavaScript (GPTBot, ClaudeBot and most AI crawlers) read the words, headings, body links, meta tags and JSON-LD. The navbar and footer (menus with their nested items, copyright, social links) are also written as plain links inside `#site-navbar` and `#site-footer`, built from the same per-viewer menu data the browser gets and visually hidden (`.sr-only.cms-nojs-links`, so nothing flashes or shifts); site.js removes them once it has drawn the real ones. An interactive `[collection]` in client mode lists every entry in its no-JS fallback (or its `limit`, at most 200; the rest stay in the browser's payload), an interactive `[view]` has the same fallback, and a `[form]` embed carries the form's title and description as hidden text. Scripts load at the end of the body; the ones nothing needs mid-parse carry `defer` (collection-browser, form-logic-engine, effects, search, analytics, back-to-top, cookie consent - the first two sit above site.js because deferred and module scripts run in one queue in document order). DOMPurify ships in `public/js/vendor/dompurify/` at a pinned version (admin and public pages), so no public page script comes from a CDN. Still built in the browser: form fields, a server-mode collection browser beyond its first page (no page links without JavaScript), search results and the Calendar month view.
+- **Readable without JavaScript** - pages are rendered on the server, so robots that run no JavaScript (GPTBot, ClaudeBot and most AI crawlers) read the words, headings, body links, meta tags and JSON-LD. The navbar and footer (menus with their nested items, copyright, social links) are also written as plain links inside `#site-navbar` and `#site-footer`, built from the same per-viewer menu data the browser gets and visually hidden (`.sr-only.cms-nojs-links`, so nothing flashes or shifts); site.js removes them once it has drawn the real ones. An interactive `[collection]` or `[view]` lists every entry in its no-JS fallback, in client and server mode alike (or its `limit`; at most 1,000 - `FALLBACK_MAX` - with the count left out in `data-cb-more`, which the SEO audit warns about; server mode runs one extra query for it, kept by the page cache), and a `[form]` embed carries the form's title and description as hidden text. Scripts load at the end of the body; the ones nothing needs mid-parse carry `defer` (collection-browser, form-logic-engine, effects, search, analytics, back-to-top, cookie consent - the first two sit above site.js because deferred and module scripts run in one queue in document order). DOMPurify ships in `public/js/vendor/dompurify/` at a pinned version (admin and public pages), so no public page script comes from a CDN. Still built in the browser: form fields, search results and the Calendar month view.
   - Where: `server/templates/page.html`, `server/services/renderer.js`, `server/services/nojsLinks.js`, `server/services/markdown.js`; checked by `tests/services/page-template-scripts.test.js`, `tests/services/nojs-links.test.js`, `tests/markdown/nojs-fallbacks.test.js`; admin **Documentation > Usage > Search Engines & AI**
   - Since: 1.8.36
 - **SEO tool** - an audit of every sitemap URL, fetched in-process and scored (title and description length, single H1, heading order, word count, image alt text, internal links, focus keyphrase placement and density, noindex, canonical, share image, structured data, language), with site-wide duplicate title/description detection and a scheduled re-audit. Open a page to see its search result and share card as they will look and edit its fields. **Redirects** tab (301, 302, 307, 308, 410; CSV import; hit counts; automatic redirect on page rename). **Sitemap** tab shows what is listed and left out, plus robots.txt. Organisation / LocalBusiness / Person structured data for the home page and BlogPosting for blog posts. Can be switched off as a Tool; SEO Pro plugs into its registry.
@@ -1334,6 +1334,7 @@ The four Tools below were plugins until 0.67.0 and are now part of the CMS. They
 - **`TRUST_PROXY`** - Takes Fastify's own values: `loopback` (recommended behind Apache or the manager, and the default for new sites the manager creates), a list of addresses or CIDR ranges, or a hop count. `1` or `true` trusts every hop, which lets a visitor spoof their IP address.
   Where: `server/services/network.js` - Since: 0.83.0.
 - **Reading other sites from a page** - `csp.connectHosts` in `config/server.json` lets public pages fetch from the listed hosts (added to the CSP's `connect-src`, https only); domma-cms.com's Pricing page reads the Pro Tool prices from dcm this way.
+- **Showing images from other sites** - `csp.imgHosts` in `config/server.json` lets public pages show images from the listed hosts (added to the CSP's `img-src`, https only); without it only the site's own images load.
 - **Public asset CORS** - `cors.publicPrefixes` in `config/server.json` adds `Access-Control-Allow-Origin: *` to GET and HEAD requests under the listed paths only, so other sites can import scripts or assets from them.
   Where: `server/services/publicCors.js`.
 - **Email service** - A Nodemailer transport built from the SMTP settings in `site.json`, used for form emails, password resets and notices. With no SMTP host set, mail goes to a throwaway Ethereal test inbox, which reports success but delivers to nobody. The CMS makes this visible in Settings, in health checks and with an "Email not set up" notification. New sites ship with an SMTP host, defaulting to a local mail server on port 25 or taken from the environment.

package/docs/configuration.md

@@ -27,6 +27,7 @@ Controls the HTTP server.
 | `cors.origin` | boolean / string / string[] | `false` | Passed directly to `@fastify/cors`. `false` disables CORS. Set to `"*"` or a domain to allow cross-origin requests |
 | `cors.publicPrefixes` | string[] | `[]` | Absolute path prefixes whose **GET and HEAD** responses carry `Access-Control-Allow-Origin: *`, so other origins can hot-link those assets. A module script is fetched in CORS mode, so this is what makes e.g. `/public/demos/` importable from elsewhere. `@fastify/cors` decides per origin and cannot express a path, hence the separate key. Reads only - it never widens a write, and it applies to listed prefixes only. A value that is not an absolute path is ignored |
 | `csp.connectHosts` | string[] | `[]` | Other sites a public page may read from in the browser (`fetch`), added to the Content-Security-Policy's `connect-src` as `https://<host>`. The site itself and cdn.jsdelivr.net are always allowed. Bare hostnames only (`dcm.dommajs.org`); a scheme, path, port or wildcard is ignored. Read at boot, so restart after changing it |
+| `csp.imgHosts` | string[] | `[]` | Other sites a public page may show images from (an `<img>` hosted elsewhere, such as a badge or partner logo), added to the Content-Security-Policy's `img-src` as `https://<host>`. The site itself, `data:` and `blob:` are always allowed; without this an image from another site is blocked - upload it to Media instead if you can. Bare hostnames only (`statics.startupbase.io`); a scheme, path, port or wildcard is ignored. Read at boot, so restart after changing it |
 | `uploads.maxFileSize` | number | `10485760` (10 MB) | Maximum allowed upload size in bytes |
 | `logging.level` | string | Log verbosity: `fatal`, `error`, `warn`, `info`, `debug`, `trace`, `silent`. Defaults to `info` in development, `warn` otherwise. `warn` hides 4xx responses and plugin `log.info` output, so a failed admin action leaves no trace - raise it to `info` if you need to diagnose one. Overridden by the `LOG_LEVEL` env var. |
 | `restartOnPluginToggle` | boolean | `true` | Restart the server automatically when an admin enables or disables a plugin. See **Plugin toggles restart the server** below |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "1.8.39",
+  "version": "1.8.41",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/server/server.js

@@ -33,7 +33,7 @@ import * as cache from './services/cache/index.js';
 import {parseTrustProxy} from './services/network.js';
 import {requestSerializer} from './services/request-log.js';
 import {rateLimitOptions} from './services/rate-limit.js';
-import {connectSources, frameSources} from './services/embedCsp.js';
+import {connectSources, frameSources, imageSources} from './services/embedCsp.js';
 import {cspSources as gaSources} from './services/googleAnalytics.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -128,7 +128,8 @@ await app.register(helmet, {
             // (services/googleAnalytics.js) - a site without one keeps exactly this policy.
             scriptSrc: ["'self'", "'unsafe-inline'", "'wasm-unsafe-eval'", 'https://cdn.jsdelivr.net', gaSources('script')],
             styleSrc: ["'self'", "'unsafe-inline'", 'https://cdn.jsdelivr.net', 'https://fonts.googleapis.com'],
-            imgSrc: ["'self'", 'data:', 'blob:', gaSources('img')],
+            // config/server.json csp.imgHosts: other sites a page may show images from (services/embedCsp.js).
+            imgSrc: [...imageSources(serverConfig.csp?.imgHosts), gaSources('img')],
             fontSrc: ["'self'", 'data:', 'https://fonts.gstatic.com'],
             // config/server.json csp.connectHosts: other sites a page may read from (services/embedCsp.js).
             connectSrc: [...connectSources(serverConfig.csp?.connectHosts), gaSources('connect')],

package/server/services/embedCsp.js

@@ -50,3 +50,22 @@ export function connectSources(connectHosts = []) {
         .map(h => `https://${h}`);
     return [...new Set([...ALWAYS_CONNECTED, ...extra])];
 }
+
+/** What a page may always show images from: the site itself, and inline/data and blob images. */
+export const ALWAYS_IMAGED = ["'self'", 'data:', 'blob:'];
+
+/**
+ * The img-src: the site, data: and blob:, and every host in config/server.json `csp.imgHosts` - for a page
+ * that shows an image hosted elsewhere (a badge, a partner logo). Bare hostnames only, served over https;
+ * anything else is dropped. Read at boot, like connect-src.
+ *
+ * @param {string[]} imgHosts - config/server.json csp.imgHosts
+ * @returns {string[]} img-src sources
+ */
+export function imageSources(imgHosts = []) {
+    const extra = (Array.isArray(imgHosts) ? imgHosts : [])
+        .map(h => String(h).trim().toLowerCase())
+        .filter(h => HOST_RE.test(h))
+        .map(h => `https://${h}`);
+    return [...new Set([...ALWAYS_IMAGED, ...extra])];
+}

package/server/services/markdown.js

@@ -1363,6 +1363,7 @@ async function renderCollectionBrowserShell(attrs, {extraFilter = null, scope =
     let entries = [];
     let total   = 0;
     let mode    = declaredMode;
+    let fallbackEntries = [];
 
     try {
         schema = await getCollection(slug);
@@ -1405,11 +1406,21 @@ async function renderCollectionBrowserShell(attrs, {extraFilter = null, scope =
             entries = r.entries;
             total   = r.total;
         }
+
+        // No-JS fallback: every entry, whatever the mode, up to the author's
+        // `limit` and FALLBACK_MAX. Client mode already holds them; server
+        // mode (one page) asks once more. The page cache keeps the cost to
+        // one query per render.
+        const want = fallbackWant(attrs, total);
+        fallbackEntries = want > entries.length
+            ? (await listEntries(slug, {...seedOpts, page: 1, limit: want})).entries
+            : entries.slice(0, want);
     } catch {
         // Slug unknown / read error - emit an empty shell so the page still renders.
         schema  = {fields: [], title: attrs.slug};
         entries = [];
         total   = 0;
+        fallbackEntries = [];
     }
 
     const config = {
@@ -1451,16 +1462,14 @@ async function renderCollectionBrowserShell(attrs, {extraFilter = null, scope =
         syncUrl: !isTruthyAttr(attrs['no-url-sync'])               // default ON
     };
 
-    // No-JS fallback, drawn by the static renderer in the browser's display
-    // from the entries already fetched for the payload (no second query).
-    // Client mode ships every entry in data-cb-data, so the fallback lists
-    // them too, up to the author's `limit` and FALLBACK_MAX - a robot that
-    // runs no JavaScript reads the collection, not just page one, and a huge
-    // one does not double the page. Server mode ships one page: that page.
+    // No-JS fallback, drawn by the static renderer in the browser's display,
+    // so a robot that runs no JavaScript reads the whole collection, not just
+    // page one. Entries past FALLBACK_MAX are counted in data-cb-more for the
+    // SEO audit to report.
     const fallback = await renderCollectionFragment({...attrs, display: config.display}, {
-        extraFilter, scope,
-        entries: entries.slice(0, fallbackLimit(attrs, entries.length))
+        extraFilter, scope, entries: fallbackEntries
     });
+    const more = fallbackOwed(attrs, total) - fallbackEntries.length;
 
     // Encode payloads. Schema can be modest; data can be large in client mode,
     // so we base64 once each and let the browser decode.
@@ -1473,7 +1482,7 @@ async function renderCollectionBrowserShell(attrs, {extraFilter = null, scope =
         `data-cb-config="${enc(config)}" ` +
         `data-cb-schema="${enc({fields: schema?.fields || [], title: schema?.title || ''})}" ` +
         `data-cb-data="${enc({entries, total, page: 1, pageSize})}">` +
-        `<div class="dm-cb-fallback">${fallback}</div>` +
+        fallbackDiv(fallback, more) +
         `</div>`;
 }
 
@@ -1505,6 +1514,7 @@ async function renderViewBrowserShell(attrs, {viewConfig = null, allowed = false
 
     let entries = [];
     let total   = 0;
+    let fallbackEntries = [];
 
     if (viewConfig && allowed) {
         try {
@@ -1514,6 +1524,14 @@ async function renderViewBrowserShell(attrs, {viewConfig = null, allowed = false
             const r = await executeViewConfig(viewConfig, {page: 1, limit, user});
             entries = (r.results || []).map(doc => ({id: doc.id || '', data: doc.data || doc}));
             total   = r.total ?? entries.length;
+            // No-JS fallback: every row up to FALLBACK_MAX, as for collections.
+            const want = fallbackWant(attrs, total);
+            if (want > entries.length) {
+                const all = await executeViewConfig(viewConfig, {page: 1, limit: want, user});
+                fallbackEntries = (all.results || []).map(doc => ({id: doc.id || '', data: doc.data || doc}));
+            } else {
+                fallbackEntries = entries.slice(0, want);
+            }
         } catch {
             // Pipeline error - emit empty shell.
         }
@@ -1570,14 +1588,13 @@ async function renderViewBrowserShell(attrs, {viewConfig = null, allowed = false
         sourceKind: 'view'       // hint for client-side: server-mode would need a different fetch endpoint
     };
 
-    // No-JS fallback: the rows the browser was handed (all of them in client
-    // mode, the first page in server mode), drawn by the static [view]
-    // renderer. A refused viewer has no rows and gets the empty state.
+    // No-JS fallback: every row (up to FALLBACK_MAX), drawn by the static
+    // [view] renderer. A refused viewer has no rows and gets the empty state.
     let fallback = '';
     try {
         fallback = viewConfig && allowed
             ? await renderViewEntries(slug, {...attrs, display: config.display},
-                viewConfig, entries.slice(0, fallbackLimit(attrs, entries.length)))
+                viewConfig, fallbackEntries)
             : `<div class="dm-collection-display dm-collection-empty"><p>${escapeHtmlText(config.emptyMsg)}</p></div>`;
     } catch {
         // A fallback that cannot be drawn must not take the browser with it.
@@ -1591,26 +1608,35 @@ async function renderViewBrowserShell(attrs, {viewConfig = null, allowed = false
         `data-cb-config="${enc(config)}" ` +
         `data-cb-schema="${enc({fields: schemaFields, title: viewConfig?.title || slug})}" ` +
         `data-cb-data="${enc({entries, total, page: 1, pageSize})}">` +
-        `<div class="dm-cb-fallback">${fallback}</div>` +
+        fallbackDiv(fallback, fallbackOwed(attrs, total) - fallbackEntries.length) +
         `</div>`;
 }
 
 /**
- * How many entries an interactive browser's no-JS fallback draws: the
- * author's `limit` when set, never more than the browser itself holds, and
- * never more than FALLBACK_MAX.
+ * How many entries an interactive browser's no-JS fallback owes a robot: all
+ * of them, or the author's `limit` when set.
  *
  * @param {Record<string, string>} attrs
- * @param {number} held - entries the browser ships (all of them in client mode, one page in server mode)
+ * @param {number} total - entries matching the listing
  * @returns {number}
  */
-function fallbackLimit(attrs, held) {
+function fallbackOwed(attrs, total) {
     const limit = parseInt(attrs.limit, 10);
-    return Math.min(limit > 0 ? limit : held, held, FALLBACK_MAX);
+    return Math.min(limit > 0 ? limit : total, total);
+}
+
+/** How many of those it draws: never more than FALLBACK_MAX. */
+function fallbackWant(attrs, total) {
+    return Math.min(fallbackOwed(attrs, total), FALLBACK_MAX);
+}
+
+/** The fallback wrapper; `more` (entries left out) feeds the SEO audit. */
+function fallbackDiv(inner, more) {
+    return `<div class="dm-cb-fallback"${more > 0 ? ` data-cb-more="${more}"` : ''}>${inner}</div>`;
 }
 
-/** The most entries a browser's no-JS fallback draws; the rest stay in the payload for the browser. */
-export const FALLBACK_MAX = 200;
+/** The most entries a browser's no-JS fallback draws; past it, the SEO audit warns. */
+export const FALLBACK_MAX = 1000;
 
 /**
  * Render a `[collection]` block's HTML fragment from parsed attributes.