domma-cms 1.8.45 → 1.9.0

package/docs/DommaFeatures.md

@@ -23,7 +23,7 @@ Code was treated as the truth. Where docs disagree with it, the disagreement is
 - **Operations** - Node 24, `npx` scaffolder and CLI, an updater that merges config, fleet management through
   domma-cms-manager, response cache, built-in security hardening.
 - **Marketplace** - signed `.dcmsplugin` packages, licensed paid plugins, safe upgrades with rollback,
-  `minCmsVersion` checks, user guides in the admin's Documentation folder, and the 25 plugins below.
+  `minCmsVersion` checks, user guides in the admin's Documentation folder, and the plugins below.
 
 ## Marketplace catalogue
 
@@ -38,7 +38,8 @@ Code was treated as the truth. Where docs disagree with it, the disagreement is
 | `calendar` | paid | 1.15.4 | Events calendar - month, day and list views, online meetings as a video call on your site (with the call's chat kept, and Add people during the call), call anyone now from a contact or an email, all-day and recurring events, sharing with people and roles, RSVPs and an iCal feed. |
 | `campaigns-pro` | paid | 1.0.2 | Marketing campaigns, one paid Tool: compose a message, send it to an audience imported from Contacts (shared with Surveys), schedule sends, attach an offer that closes by a date or a claim limit. Opens and clicks (cookieless), links tagged for Analytics, a linked Shop discount code, send a survey as a campaign, follow-up sequences, resend to non-openers, A/B subject tests, and a version-1 stats feed other Tools read. |
 | `contacts-pro` | paid | 0.12.0 | Contacts, with more to them: your own custom fields, birthdays and ages with the ones coming up and a reminder in the sidebar, and groups with their own emblem and colours. Share a contact, several, or a whole group with people or roles - to view, or to edit. Call a contact now on a video call on your site. Works over the same contacts as the built-in Tool, so nothing moves and nothing is lost. |
-| `crossword` | free | 1.1.0 | Crosswords on your site: type the answers and clues and the grid lays itself out (live preview, Another layout). Players type a name and race the server's clock, checks and wrong guesses cost time, fastest solvers on a leaderboard. Test it from the Tool - a test go never reaches the board. |
+| `crossword` | paid (giftable) | 1.4.0 | Crosswords on your site: type the answers and clues and the grid lays itself out (live preview, Another layout). Players type a name and race the server's clock, checks and wrong guesses cost time, fastest solvers on a leaderboard. Hints for a time penalty, personal best and Share, animations, export and import. Test it from the Tool - a test go never reaches the board. |
+| `daily-word` | paid (giftable) | 1.2.0 | One hidden word a day, the same for everyone: six guesses, each letter marked right place, in the word or not; real words only (a bundled dictionary, switchable), an archive of past days, streaks, Share as coloured squares, a calendar of what is coming. Fewest guesses tops the day's board, then the fastest. |
 | `data-transfer` | paid | 1.3.3 | Move collections between file and MongoDB storage, back them up and restore them (all or some, merged or replaced) - keeping every entry's id - and clone them (cloned entries get new ids, so references stay unambiguous). Every restore and transfer takes a safety snapshot first. |
 | `docs` | paid | 2.13.1 | Document editor: Home and editor screens, sharing with Viewers/Editors, public links, import/export, send to page/blog/email, edit lock, Trash, version history, templates. PDF documents (2.13): a PDF kept as it is, shown in the browser's viewer, searchable inside, versioned on replace. |
 | `docs-pro` | paid | 0.11.0 | Domma Spaces (publish a Docs folder at `/spaces` with a Kindle-style reader), Cloud copies (Google Drive, OneDrive, Dropbox, S3), Signatures (emailed signing links, typed or drawn, signed copy with a certificate page; 0.10: boxes placed on a PDF document's pages, the signed PDF stamped with pdf-lib), PDF tools (0.11: fill the PDF's own form, annotate, pages) and protected public links (expiry date, password). Adds to Docs. |
@@ -51,7 +52,7 @@ Code was treated as the truth. Where docs disagree with it, the disagreement is
 | `messages` | paid | 1.7.2 | Internal user-to-user and group messaging with real-time delivery and video calls (what is typed in a call lands in the conversation; ring another team member into a call) - conversations you can archive, mark unread and search, drafts kept per conversation, attachments, and an unread badge in the sidebar. |
 | `mongodb-adapter` | paid | 1.0.2 | Provision a dedicated MongoDB database per site. Credentials are managed centrally by the manager. |
 | `onboard-pro` | paid | 1.0.1 | Onboarding journeys, one paid Tool: read/form/details/manual steps, a personal link per person, signature steps through Docs Pro, admin-approved account steps (never an administrator), due dates, automatic nudges and auto-enrolment from a contact group, countersigned steps, waive-with-a-reason, and a funnel showing where people stop. |
-| `quiz` | free | 1.1.0 | Timed quizzes on your site: one or several right answers, true or false, or a typed answer, marked by the server so answers never reach the browser early. Name-only players, leaderboards by day, week, month and all time. Test it from the Tool - a test go never reaches the board. |
+| `quiz` | paid (giftable) | 1.4.0 | Timed quizzes on your site: one or several right answers, true or false, or a typed answer, marked by the server so answers never reach the browser early. Name-only players, leaderboards by day, week, month and all time. Hints for a time penalty, personal best and Share, animations, export and import. Test it from the Tool - a test go never reaches the board. |
 | `security` | free | 1.1.3 | Keeps a Domma CMS site safe: a health check of what is weak and how to fix it, sign-in lockout after repeated wrong passwords, password rules, a log of every sign-in, and blocking of the scanners that probe every site for WordPress, .env files and the like. |
 | `security-pro` | paid | 1.3.2 | Everything in Security, plus two-factor sign-in (authenticator apps, recovery codes, required per role), a firewall that bans scanners for longer each time they return, per-route rate limits, country rules for the admin, breached-password checks and every signed-in session in one place. |
 | `seo-pro` | paid | 0.6.2 | More for SEO: Google Search Console in the admin (with your own Google client) - searches, clicks, positions and where to win more; structured data for rich results (FAQ, how-to, product, event, local business); links worth adding between pages, pages competing for one search, readability, near duplicates and image checks; every title and description in one grid, and moving an old site's addresses across as redirects; a not-found log with one-click redirects; a scheduled check of every link; SEO history and notices. Adds to SEO, which is built into Domma CMS (0.90 and later). |
@@ -62,6 +63,7 @@ Code was treated as the truth. Where docs disagree with it, the disagreement is
 | `surveys` | paid | 1.5.1 | Targeted surveys over the Forms engine: shared audiences, tokenised invites, reminders, and per-survey statistics. |
 | `theme-roller` | paid | 1.1.3 | Make your own themes: start from any built-in theme, change its colours, fonts, spacing and borders with a live preview, and save it. Saved themes join the built-in ones everywhere a theme is chosen - the site, the admin, day and night, a region of a page. Needs Domma CMS 0.73 or later to use them. |
 | `waypoint-pro` | paid | 1.3.1 | Plan and track work: projects with their own workflows, issues on a board or in a list, a backlog planned into sprints with a burndown, and comments, mentions and watchers that tell the right people. |
+| `word-search` | paid (giftable) | 1.1.0 | Word searches on your site: type up to 40 words and the server lays out the letter grid (across, down, diagonal, backwards too if you like). Players drag, tap or use the keyboard to mark each word against the clock; wrong marks cost time, fastest full solve wins. Hints, personal best, Share, animations, export and import. |
 
 Versions are read from `dcms-marketplace/plugins/*/plugin.json` (every plugin folder except `_lib`).
 
@@ -1211,6 +1213,8 @@ The four Tools below were plugins until 0.67.0 and are now part of the CMS. They
   Where: Role editor > Admin area; `normaliseAdminScope` / `getAdminScope` in `roles.js`; `admin/js/lib/admin-scope.js` - Since: 0.71.0.
 - **Plugin roles and permissions** - Plugins declare `permissions[]` in `plugin.json`, with `grant` to give them to existing roles, and ship `roles/*.json`. They can also create and remove roles from code with `hooks.registerRole()` and `unregisterRole()`. A plugin role is created once and then belongs to the admin. Disabling the plugin keeps the role, so user assignments survive, and uninstalling removes it.
   Since: 0.71.0.
+- **Plugin collections in the generic Collections API** - A collection a plugin created is reachable through `/api/collections/<slug>/...` only by someone with full use of one of the plugin's permissions: the action that permission names as `collectionAction` in `plugin.json` (Quiz, Crossword, Word Search and Daily Word name `manage`), or every action it has. A read-only holder is refused, so answers, solutions and play tokens are not readable through the Collections API, a form's submissions, Views or API Builder. A switched-off plugin's collections keep the gate its `plugin.json` declares. Super Admin keeps everything; a plugin with no permissions needs only `collections`.
+  Where: `pluginCollectionGates` / `pluginDenial` / `pluginDenialFor` in `server/services/collectionAccess.js`; forms, views and api-endpoints routes - Since: Unreleased.
 - **Role-aware public site** - A signed-in visitor sees the navbar, footer and menu items meant for their role. Visibility supports both "this role and above" and `=role` ("this role only").
   Since: 0.71.0.
 
@@ -1316,7 +1320,7 @@ The four Tools below were plugins until 0.67.0 and are now part of the CMS. They
 
 - **Managed sites** - A site forked by the manager gets `MANAGER_URL`, `SITE_SLUG` and a per-fork `FLEET_TOKEN` in its environment. It then:
   - browses the fleet catalogue under Marketplace > Browse, with prices, licence state and updates;
-  - installs paid plugins with an entitlement issued for that site;
+  - installs paid plugins with an entitlement issued for that site, sold or gifted (a giftable Tool can be gifted for good or for a number of days - see [Tiers, licences and entitlements](#tiers-licences-and-entitlements));
   - receives pushed notifications (`MANAGER_SECRET`).
   
   The manager also writes `tools.json` and `plugins.json` directly to set switches and locks. Every call to the manager fails gracefully, so a manager that is down never stops the site serving pages. Unmanaged sites install plugins from a `.dcmsplugin` file instead.
@@ -1413,6 +1417,7 @@ Domma CMS is extended by plugins: self-contained folders under `plugins/<slug>/`
 - **Current register (marketplace, 24 plugins)** - versions in the [catalogue table](#marketplace-catalogue).
   - Free (6, shipped with the engine): `blog`, `booking`, `feedback`, `mail-reader`, `security`, `shopping-cart`.
   - Paid (21): `analytics-pro`, `blog-pro`, `booking-pro`, `calendar`, `contacts-pro`, `data-transfer`, `docs`, `docs-pro`, `email-pro`, `garage`, `invoice`, `job-board`, `messages`, `mongodb-adapter`, `security-pro`, `seo-pro`, `shopping-cart-pro`, `social-media-pro`, `surveys`, `theme-roller`, `waypoint-pro`.
+  - Paid and giftable (4, the Games): `quiz`, `crossword`, `word-search`, `daily-word`.
 - **Free-and-Pro pairs** - A Pro edition declares `supersedes` on its free sibling, so only one runs: Blog Pro → Blog, Email Pro → Mail Reader, Security Pro → Security, Contacts Pro → Contacts (built-in Tool takeover). Shopping Cart Pro and SEO Pro instead `requires` their free base (`shopping-cart`, the `seo` Tool).
 - **MongoDB-dependent plugins** - Email Pro ("Requires MongoDB" in its description), Data Transfer (moves collections between file and MongoDB storage) and MongoDB Adapter (managed-only: reads a `config/connections.json` the manager writes during provisioning). There is no manifest field for a Mongo requirement - it is stated only in the description text. Core already supports Mongo storage for free via `storage: {adapter: "mongodb"}` in a schema.
   - Where: design spec "Managed-only plugins"
@@ -1421,6 +1426,8 @@ Domma CMS is extended by plugins: self-contained folders under `plugins/<slug>/`
   - `perpetual` (self-hosted, bought outright): never stops. After `supportExpiresAt` it is `support-ended` - still runs, updates lapse.
   - Absent, wrong slug, unknown key or bad signature → `unlicensed` - does not load.
   - Where: `server/services/pluginEntitlement.js` · Since: 0.68.0
+- **Giftable Tools and gifts** - A paid manifest may add `giftable: true` (the catalogue carries it; refused on a free Tool). The Manager can then gift that Tool to a site at no charge, from the site's Plugins tab or the Plugin Store, **for good** or **for a number of days**. A gift is an ordinary licence with `type: 'gift'`, `giftedBy` and `giftedAt`, no grace: for good is minted perpetual (no expiry), a timed gift is a rental that tells the site's admins three days before and switches the Tool off on its last day. **Extend gift** adds days or makes it for good without a restart; **End gift** is the rescind (disable only, files and data stay). A gift is refused over a live paid licence and never shortens one; buying a gifted Tool later grants over it (the licence becomes `generated`). Only a gift can be for good - a sale's licence edited to no expiry is refused. The Licences ledger has a Gifts filter; the licence expiry check runs hourly.
+  - Where: domma-cms-manager `plugins/site-manager/services/entitlements.js`, `licenceManager.js`; `dcms-marketplace/scripts/build-catalogue.js` (`giftable`) · Since: Manager 2026-10-23 (Games)
 - **Only our paid plugins are ever checked** - The gate keys on `closedSource: true`; a plugin you wrote yourself is never asked for an entitlement.
 - **Where entitlements live** - `plugins/<slug>/.entitlement.json` (arrives in the envelope, survives upgrades), or instance-wide in `config/entitlements/*.json` (e.g. an owner wildcard `slug: "*"` covering every plugin, used by the manager and cms.dommajs.org). Per-plugin wins.
 - **Offline, no phone-home** - Verification is Ed25519 over canonical JSON (keys sorted, no whitespace) against keys compiled into the CMS release.
@@ -1517,7 +1524,7 @@ plugins/my-plugin/
 | `admin.routes[]`, `admin.views{}` | SPA routes and view modules `{entry, exportName}`. |
 | `admin.css[]` | Admin stylesheets (may include `../_lib/admin/ui/help.css`). |
 | `inject.head`, `inject.headLate`, `inject.bodyEnd` | HTML snippets added to every public page (paths confined to the plugin folder). |
-| `permissions[]` | Permission resources `{key, label, actions?, group?, icon?, grant?: ["admin"]}` - `grant` given once. |
+| `permissions[]` | Permission resources `{key, label, actions?, group?, icon?, grant?: ["admin"], collectionAction?}` - `grant` given once; `collectionAction` is the action the generic Collections API needs on the plugin's collections (default: every action). |
 | `settingsSchema[]` | Configure form: `{key, label, type: text|number|select|boolean, options?, min?, max?, help?, secret?}`. |
 | `requires[]` / `uses{}` | Hard / soft dependencies on Tools or plugins (0.88.0). |
 | `supersedes[]` | Plugins or built-in Tools this one replaces. |
@@ -2410,16 +2417,47 @@ Tier: paid (closed source) · Version: 0.4.0 · Requires: nothing; no MongoDB (w
 
 **Where:** Admin sidebar "Sheets" (`#/plugins/sheets`).
 
-### Quiz (`quiz`) and Crossword (`crossword`)
+### Games: Quiz (`quiz`), Crossword (`crossword`), Word Search (`word-search`) and Daily Word (`daily-word`)
 
-Tier: free, bundled in the engine, off on arrival · Version: 1.1.0 each (needs Domma CMS 1.8.33 for the games library) · Sidebar: Tools > Games
+Tier: paid and giftable (the Manager can gift them for good or for a number of days) · Versions: Quiz 1.4.0, Crossword 1.4.0, Word Search 1.1.0, Daily Word 1.2.0 (need Domma CMS 1.9.0 for the shared games library and its motion files) · Sidebar: Tools > Games · Permissions: a Games group in the role editor
+
+All four share the engine's games library (`plugins/_lib/games`: plays, tokens, names, ranking, timing; `plugins/_lib/public/games`: player parts and motion; `plugins/_lib/admin/games/kit.js`: list, editor, test and plays screens). The server keeps the clock and marks every move; nothing that gives an answer reaches the browser before the play is finished. Name-only players, honeypot and rate limits, test plays from the Tool, a sidebar badge, notifications. The generic Collections API reaches a game's collections only with the game's `manage` action (`collectionAction` in plugin.json).
+
+#### Quiz and Crossword
 
 **1.0.0 (CMS 1.8.32)** - see the 1.8.32 changelog: server-kept time and marking, name-only players with a play token, leaderboards by period (best go per name), Plays screen (hide, delete, reset), sidebar badge, top-spot notifications, `[quiz]`/`[crossword]` and `-leaderboard` shortcodes.
 
 **1.1.0 - Test from the Tool, domma-reactive admin.** **Test** (editor, list rows, Plays screen; `#/plugins/quiz/test/<id>`, `#/plugins/crossword/test/<id>`) mounts the real public player in the admin and plays the SAVED game whatever its status or dates ("Save and test" when there are unsaved changes). The play is stored with `test: true` and played through the ordinary `/public/play` routes, but `PlayStore` leaves it out of boards, places, goes-per-name, the admin's plays list and counts and the sidebar badge; it never notifies; the next test of the game clears it. The result says where it would have come (`wouldPlace`). Routes: `GET/POST /api/plugins/quiz/quizzes/:id/test`, `GET/POST /api/plugins/crossword/puzzles/:id/test` (manage permission). Both admin screens are rebuilt on domma-reactive through the shared kit (`plugins/_lib/admin/games/kit.js`: `mountScreen`, `wireRows`, `sortableRows`, `saveKey`, `playsScreen`, `testScreen`): list rows with a context menu (right-click, ⋮, Shift+F10), questions dragged by a grip to reorder, Ctrl+S, help popovers; the crossword preview grid uses fixed ink and paper colours.
 
+**1.2.0 - export and import.** `GET /export` (all) and `GET /quizzes/:id/export` / `GET /puzzles/:id/export` (one) give a file `{format: 'domma-quiz'|'domma-crossword', version: 1, exportedAt, quizzes|puzzles}` - games without ids, timestamps or crossword layouts, never plays. `POST /import` (manage, 8 MB, 50 a file) cleans each item as on save and adds it as a draft with a unique short name; invalid items are skipped with their reason; a file of the other game or a newer version is refused by name. Crossword grids are re-laid from words + seed, so they match. Admin: Import… and Export all on the list, Export in each row's menu and the editor's banner.
+
+**1.3.0 - paid and giftable.** `tier: paid`, `closedSource`, `giftable`: they reach a site through the catalogue and a licence, or a gift from the Manager (for good or for a number of days), no longer inside the engine (`plugins/free-tier.lock.json` no longer lists them). The engine update removes a site's old free copy (`bin/lib/left-free-tier.js`): never a copy with `.entitlement.json` beside it, never one whose plugin.json says paid, never `data/` or `backups/`. Their permissions sit in a Games group in the role editor. Their tests live with them in dcms-marketplace; the shared `_lib/games` tests stay in `tests/plugins/games-pure.test.js`.
+
+**1.4.0 - hints, boards, personal best, share, animations.** See "Shared by all four" below.
+
 **Where:** Tools > Games > Quiz (`#/plugins/quiz`) and Crossword (`#/plugins/crossword`).
 
+#### Word Search (`word-search`)
+
+**1.0.0** - The admin types up to 40 words (3-15 letters; spaces and hyphens dropped, accents folded) and an optional theme; the server lays out the grid (`public/lib/layout.js`, pure and seeded: 8x8 to 20x20 or Auto; across, down, diagonal, each a switch, plus "backwards too"; Shuffle for another layout; words that would not fit come back as `unplaced`). The fill never makes a second copy of a listed word or a blocked word (`BLOCKED_WORDS` from `_lib/games/names.js`, exported for this) in any direction. Players mark a word by its first and last letter - drag, tap-tap or the keyboard; the server reads the letters along the line and accepts an unfound word either way round; a wrong mark costs seconds (default 5); the last word finishes the play, fastest full solve wins. The word list can be shown or hidden. Word positions never reach the browser before the play finishes. Changing the words of an open word search ends plays in progress. Shortcodes `[word-search id="..." /]`, `[word-search-leaderboard id="..." /]`; notification source `fastest`. **1.1.0** - the extras below.
+
+**Where:** Tools > Games > Word Search (`#/plugins/word-search`).
+
+#### Daily Word (`daily-word`)
+
+**1.0.0** - One hidden word a day, the same for everyone. A site makes word sets (length 4-8, guesses 4-8, default 6, a start date, answers in a seeded order fixed at save, Shuffle order); day N uses answer N; a Calendar view shows what is coming (manage permission only); a set running out warns a week ahead (notification `running-low`) and the public side shows "No word today" (`no-word`). Guesses must be real words (a bundled public-domain English list, server side only, switchable per set to "any letters") or one of the set's answers, else "Not in the word list" and no guess is used. Marking follows the duplicate-letter rule (`mark()`, pure). The site's day decides the word; one go per name per day by default. An **Archive** of past days is playable but never on a board, in a streak or counted for goes. Score = guesses allowed + 1 - guesses used, then the fastest time. Share copies the coloured squares only. Changing today's or a past day's answer is refused once played. Export holds future answers, so it needs manage. **1.1.0 - streaks**: the finished screen shows the name's streak (days in a row with a solved real play) or that a spent day ended it; `order="streak"` on `[daily-word-leaderboard]` ranks current streaks; the goes check and the new play are one turn per set, day and name (no double go in a race). **1.2.0** - the extras below. Shortcodes `[daily-word id="..." /]`, `[daily-word-leaderboard id="..." period="today" /]`.
+
+**Where:** Tools > Games > Daily Word (`#/plugins/daily-word`).
+
+#### Shared by all four
+
+- **Giftable** - paid Tools that reach a site through the catalogue and a licence, or a gift from the Manager for good or for a number of days ([Tiers, licences and entitlements](#tiers-licences-and-entitlements)). Quiz and Crossword left the free tier at 1.3.0; the engine update (1.9.0) removes a site's old free copy unless it is licensed, keeping `data/` and `backups/`.
+- **Export and import** - every game exports one or all as a file and imports a file as drafts beside what is there, with no plays; layouts and schedules are worked out afresh on the server.
+- **Hints** - per game: on or off, hints a play, seconds each. Quiz takes two wrong answers away or gives a typed answer's first letter; Crossword fills one letter of the chosen word; Word Search shows where one unfound word starts; Daily Word shows one letter in its place. The server decides and records each (`POST /public/play/:id/hint`); results, the Plays screen and boards (an "H2" chip) show hints used.
+- **Boards** - `board="show|hide|only"` on every game shortcode; a per-game **Leaderboard shows** period (`boardPeriod`) used when no period is asked for; `[games-leaderboards games="..." period="..." limit="..."]` puts every Game's boards on one page (each game registers the same handler, so it works with any of them installed). Board shortcodes on the page refresh when a game finishes.
+- **Personal best** on every finished screen; **Share** (no answers) on Quiz, Crossword and Word Search, coloured squares on Daily Word.
+- **Animations** - a per-game setting, on unless switched off: answers, letters and tiles pop or flip in, right and wrong answers pulse, found words pop along their line, finished screens and board rows pop in. Never under `prefers-reduced-motion` or `html.dm-reduced-motion`. Shared CSS and helpers: `plugins/_lib/public/games/motion.css` and `motion.js` (engine 1.9.0).
+
 ### Other plugin directories
 
 No other directories exist in `dcms-marketplace/plugins/` beyond the plugins above and `_lib`. `_lib` is not a plugin (skipped by plugin discovery): it holds the shared mail core used by Mail Reader and Email Pro, plus shared `dataStore.js` and `schemaSync.js`.
@@ -2516,6 +2554,8 @@ Later changes to these features are in the CHANGELOG (for example 0.92.1: row-le
 
 ### Plugins & the Marketplace platform
 
+- A games page: a Daily Word set with a month of answers, a Word Search and a Quiz on one page, with `[games-leaderboards]` below them; hints with a penalty, and moving a game to another site with Export and Import.
+- Gifting a Tool from the Manager: gift a Game for 30 days, extend it, make it for good, and end it.
 - Build your first plugin in 10 minutes: New plugin in the Marketplace, add a route and a screen in the code editor, restart, see it in the sidebar.
 - Add a custom shortcode and let its HTML through the sanitiser (`registerShortcode` + `registerSanitizeRules`).
 - Give your plugin a Configure form with `settingsSchema`, including a masked secret read at request time.

package/docs/configuration.md

@@ -1544,10 +1544,21 @@ step Ctrl+Z undoes. The toolbar's format button does the same.
   code keeps its own shape within that. The renderer takes the indent off before
   anything else (`unindentShortTags()` in `markdown.js`: a tag line loses all of
   it, a container's content the indent its lines share), so it never reaches the
-  page - and a page written flat is read exactly as before.
-- **Block and component HTML, JS**: re-indented by nesting only; the code itself
-  is never rewritten. `<pre>` and `<textarea>` keep their lines; a `<script>` or
-  `<style>` inside HTML is indented as JS or CSS.
+  page - and a page written flat is read exactly as before. HTML blocks in the
+  body (a run of lines starting with a block tag such as `<div>` or `<p>`, up to
+  the next blank line or short tag line) are laid out as block HTML is, below; a
+  run holding `<pre>`, `<textarea>`, a script, a style or a fence is left as written.
+- **Block and component HTML**: every block element (`div`, `p`, `li`, `h2`,
+  `section`, a custom element…) on a line of its own, its content one level in,
+  and `{{#if}}` / `{{else}}` / `{{/if}}` written on their own lines the same.
+  Inline content - text, `<a>`, `<strong>`, `<span>` - is never split or joined:
+  it keeps the lines it was written on (a line inside an open inline tag goes one
+  deeper), so no space appears or goes where the page would show it. An element
+  holding only inline content stays on one line if it was written on one. Tags get
+  one space between attributes, and a tag wider than 120 columns an attribute a line.
+  `<pre>` and `<textarea>` keep every character; a `<script>` or `<style>` is
+  formatted as JS or CSS. A stray closing tag stays where it was; nothing is dropped.
+- **JS**: re-indented by nesting only; the code itself is never rewritten.
 - **CSS** (blocks, components, the page's custom CSS): one declaration a line,
   `prop: value;`, a blank line between rules.
 - **JSON** (component props): parsed and printed; invalid JSON is reported, not changed.
@@ -1557,14 +1568,15 @@ browser with the rest of the editor's settings: indent with spaces or tabs, the
 indent size (2, 4 or 8 - also how wide a tab shows), *Keep a file's own
 indentation* (on: a block, component or CSS already in tabs or fours keeps them;
 the page body always takes the setting), *Auto-indent*, *Carry lists and quotes
-on*, *Indent inside short tags*, *Line up tables when formatting*, and
-*Format on save* (off by default: Save formats the tab on show first; text that
+on*, *Indent inside short tags*, *Line up tables when formatting*,
+*Lay out HTML in the page body*, and *Format on save* (off by default: Save formats the tab on show first; text that
 cannot be formatted is saved as it is).
 
 While typing, **Enter** keeps the line's indentation. In the body it carries a
 list or quote on (numbers count up, a task box comes back empty) and Enter on an
 empty item ends the list; Shift+Enter is a plain new line. After an opening short
-tag the next line goes one deeper; after a closing one it stays level. In code it goes one
+tag the next line goes one deeper; after a closing one it stays level; after an opening
+block HTML tag (`<div>`, `<ul>`…) one deeper too. In code it goes one
 deeper after `{`, `(`, `[`, an opening tag or `{{#if}}`, and with the caret
 between a pair the closer moves to its own line. **Tab / Shift+Tab** indent or
 outdent every selected line when the selection spans lines.

package/docs/plugin-development.md

@@ -211,6 +211,13 @@ each role sees.
 - `group` (default `Plugins`) and `icon` place it in the role editor.
 - `grant` gives those existing roles the permission **once**. The grant is recorded on the role, so if the admin later
   removes it, it stays removed. The super-admin (level 0) holds every plugin permission without a grant.
+- `collectionAction` names the action someone needs to reach your plugin's collections through core's generic
+  routes - the Collections API and screen, a form's submissions, Views and API Builder endpoints - `"manage"`, say.
+  It must be one of the resource's `actions` or it is ignored. Without it, every action of the resource is needed.
+  Holding the gate of ANY one of your resources opens all your collections, so if a resource's only action is
+  `read`, give the others a `collectionAction` and keep row secrets (answers, solutions, tokens) in a plugin whose
+  every resource is gated. A plugin with no permissions at all leaves its collections to `collections` holders.
+  Switched off, your collections keep the gate your `plugin.json` and role files declare.
 
 Guard your routes with them:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "1.8.45",
+  "version": "1.9.0",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/plugins/_lib/games/names.js

@@ -16,6 +16,12 @@ export const NAME_MAX = 24;
 /** Folded to a-z first, so leetspeak and accents do not slip past. Kept short on purpose. */
 const BLOCKED = ['fuck', 'shit', 'cunt', 'wank', 'twat', 'bitch', 'bastard', 'nigg', 'fag', 'slut', 'whore', 'rape', 'nazi', 'hitler', 'penis', 'vagina', 'dick', 'cock', 'pussy', 'arse', 'asshole', 'admin', 'moderator'];
 
+/**
+ * The same list, for games that put letters in front of the public (Word Search fills its grid with
+ * random letters and rerolls any fill that spells one of these). Read-only.
+ */
+export const BLOCKED_WORDS = Object.freeze([...BLOCKED]);
+
 const LEET = {0: 'o', 1: 'i', 3: 'e', 4: 'a', 5: 's', 7: 't', '@': 'a', $: 's'};
 
 /** Lower case, accents gone, spacing collapsed - the identity of a name. */

package/plugins/_lib/public/games/motion.css

@@ -0,0 +1 @@
+.gm-motion{--gm-step: 60ms;--gm-dur: .4s}.gm-motion :is(.gm-pop,.gm-pop-list>*,.gm-flip,.gm-bounce){animation-duration:var(--gm-dur);animation-timing-function:cubic-bezier(.22,.61,.36,1);animation-fill-mode:backwards;animation-delay:calc(var(--gm-i, 0) * var(--gm-step))}.gm-motion :is(.gm-pop,.gm-pop-list>*){animation-name:dm-game-pop}.gm-motion .gm-flip{animation-name:dm-game-flip}.gm-motion .gm-bounce{animation-name:dm-game-bounce;animation-fill-mode:none}.gm-motion .gm-shake{animation:dm-game-shake .45s ease}.gm-motion .gm-pulse-good{animation:dm-game-pulse-good .5s ease}.gm-motion .gm-pulse-bad{animation:dm-game-pulse-bad .5s ease}.gm-motion .gm-hint-pop{animation:dm-game-hint .5s cubic-bezier(.22,.61,.36,1)}.gm-motion .gm-pop-list>:nth-child(2){--gm-i: 1}.gm-motion .gm-pop-list>:nth-child(3){--gm-i: 2}.gm-motion .gm-pop-list>:nth-child(4){--gm-i: 3}.gm-motion .gm-pop-list>:nth-child(5){--gm-i: 4}.gm-motion .gm-pop-list>:nth-child(6){--gm-i: 5}.gm-motion .gm-pop-list>:nth-child(7){--gm-i: 6}.gm-motion .gm-pop-list>:nth-child(8){--gm-i: 7}.gm-motion .gm-pop-list>:nth-child(9){--gm-i: 8}.gm-motion .gm-pop-list>:nth-child(10){--gm-i: 9}.gm-motion .gm-pop-list>:nth-child(11){--gm-i: 10}.gm-motion .gm-pop-list>:nth-child(12){--gm-i: 11}.gm-motion .gm-pop-list>:nth-child(13){--gm-i: 12}.gm-motion .gm-pop-list>:nth-child(14){--gm-i: 13}.gm-motion .gm-pop-list>:nth-child(15){--gm-i: 14}.gm-motion .gm-pop-list>:nth-child(16){--gm-i: 15}.gm-motion .gm-pop-list>:nth-child(17){--gm-i: 16}.gm-motion .gm-pop-list>:nth-child(18){--gm-i: 17}.gm-motion .gm-pop-list>:nth-child(19){--gm-i: 18}.gm-motion .gm-pop-list>:nth-child(20){--gm-i: 19}.gm-motion .gm-pop-list>:nth-child(n+21){--gm-i: 20}@keyframes dm-game-pop{0%{opacity:0;transform:scale(.5)}70%{opacity:1;transform:scale(1.08)}to{opacity:1;transform:scale(1)}}@keyframes dm-game-flip{0%{transform:perspective(300px) rotateX(-90deg)}to{transform:perspective(300px) rotateX(0)}}@keyframes dm-game-bounce{0%,to{transform:translateY(0)}40%{transform:translateY(-22%)}70%{transform:translateY(4%)}}@keyframes dm-game-shake{0%,to{translate:0}20%,60%{translate:-6px}40%,80%{translate:6px}}@keyframes dm-game-pulse-good{0%{transform:scale(1)}40%{transform:scale(1.06);box-shadow:0 0 0 6px color-mix(in srgb,#2f7d32 35%,transparent)}to{transform:scale(1)}}@keyframes dm-game-pulse-bad{0%{transform:scale(1)}40%{transform:scale(.97);box-shadow:0 0 0 6px color-mix(in srgb,#b3261e 35%,transparent)}to{transform:scale(1)}}@keyframes dm-game-hint{0%{transform:scale(.6)}60%{transform:scale(1.2)}to{transform:scale(1)}}@media(prefers-reduced-motion:reduce){.gm-motion,.gm-motion *{animation:none!important}}html.dm-reduced-motion .gm-motion,html.dm-reduced-motion .gm-motion *{animation:none!important}

package/plugins/_lib/public/games/motion.js

@@ -0,0 +1,28 @@
+/**
+ * Games - motion helpers for the public players (the stylesheet is motion.css
+ * beside this file; see its header for the classes).
+ *
+ *   MOTION_CSS            the stylesheet, for addStyles([...])
+ *   motionOff()           true when the visitor asked for less motion (OS setting or the footer switch)
+ *   replay(el, cls)       run a one-shot animation class again on an element already drawn
+ *
+ * Decoration only: none of these waits for an animation before anything else happens.
+ *
+ * @module _lib/public/games/motion
+ */
+
+export const MOTION_CSS = '/plugins/_lib/public/games/motion.css';
+
+export function motionOff() {
+    if (document.documentElement.classList.contains('dm-reduced-motion')) return true;
+    try { return window.matchMedia('(prefers-reduced-motion: reduce)').matches; } catch { return false; }
+}
+
+/** Run `cls` again on `el` (removed, a reflow, added back); cleared once it ends. */
+export function replay(el, cls) {
+    if (!el || motionOff()) return;
+    el.classList.remove(cls);
+    void el.offsetWidth;
+    el.classList.add(cls);
+    el.addEventListener('animationend', () => el.classList.remove(cls), {once: true});
+}

package/plugins/free-tier.lock.json

@@ -1,6 +1,6 @@
 {
   "note": "Written by `make sync-free-tier` in dcms-marketplace. Do not edit these plugins here - edit them there and sync.",
-  "source": "dcms-marketplace@b9f41e5",
+  "source": "dcms-marketplace@4201b7a",
   "plugins": {
     "blog": {
       "version": "1.10.1",
@@ -126,27 +126,6 @@
         "tests/seo.test.js": "8d935319eb21fbb81feb663220384b3a4d52d0fe8597047994652daa8c981489"
       }
     },
-    "crossword": {
-      "version": "1.1.0",
-      "files": {
-        "CLAUDE.md": "598736eec2dfa833f7bb84ca9376071d1143d98a5c01106d0ff453749af18e43",
-        "admin/css/index.css": "d8d32268504d5aefa9c5fbf48a0c67b978cdd01d3be0bc747205a001972e05db",
-        "admin/templates/crossword.html": "336b4a3b7efff1ab8004c0516d55f11ae2efdc98cb3b18133ea00ca07311e2aa",
-        "admin/views/crossword.js": "42f3aabd09483eddf34d25dae243a853c562a13348eafe4fc1977361c1b03f4e",
-        "collections/crossword-plays.json": "20577250f00ebe0f6503cc2aae83dba93d88381b76b0b1dbc76c7b856d4295ff",
-        "collections/crossword-puzzles.json": "1b70950c96e50ede4d6a0c8e59ca7767b3c684c1a7c68588dc6462e69dad596e",
-        "config.js": "7a15db33506a432f5c43a095366c2e82a3bd20ceded585fb4fb78b93ad6dff29",
-        "docs/guide.md": "1189300bbe20f032e9040fe027e84a6137ab560e2fe9b88219aba66ea336ec4d",
-        "inject/body.html": "9dad7927d5afbd5e53f1edaa4a420403cd2325ce908624f9643a087388c090ab",
-        "lib/crossword.js": "f8149db65fb3a7f82b2fbae6a9f8d3ceeeec95730e426cf6fc36ea058527df34",
-        "lib/store.js": "284b3b8abe9fdaa64a660d5ab0120856b893d166b28e8bda6cf0ef038baa74bc",
-        "plugin.js": "5c1885955d122200c7ff9629d7fb9fcb54c232edb4cec4658574ca90d73730e5",
-        "plugin.json": "c5f9e3d934423161af6ef5fbf52c0c3394e737245a4de21da72da6d75a790f44",
-        "public/crossword.css": "656f369ea6587b000ff56b8ab80010f4f76af10966537c180950074ec5169f61",
-        "public/crossword.js": "8418a2c52a3d351a95e271d3c9f564b7336243ccde75106a9998995575802173",
-        "public/lib/layout.js": "0026afd8b42277838c55e1c031fa07cfea1c640c47aaf385e461cc998c4619c0"
-      }
-    },
     "docs": {
       "version": "2.14.0",
       "files": {
@@ -270,27 +249,6 @@
         "tests/messages.test.js": "5b724e53fcf7f3b5a035c47c0a4ca98dcd7de42b65f4a4ea195a9409fd53e8af"
       }
     },
-    "quiz": {
-      "version": "1.1.0",
-      "files": {
-        "CLAUDE.md": "9d037c11b0de115bf17a6c53387116be037c0d4dcd1b6bf3dafa373539143e16",
-        "admin/css/index.css": "6598225cfb8b58c486eb390ac41c7f359c78f48e0c97bc8b354d3832f618afa8",
-        "admin/templates/quiz.html": "f0b65c406b0b6325a815906ca8da7d884d5d24f2504e05631e46c34a5ca0edb9",
-        "admin/views/quiz.js": "c58ba86ec989df8f29e8acff2266fb3463e301c5516bf9281193de539b7c1f44",
-        "collections/quiz-plays.json": "331d665a90b6dddf069245a2faf8dd454a36d387702343a7e36d1fe6dd5015f8",
-        "collections/quiz-quizzes.json": "ce9bacf6c05fb5c22f9a5c5105f624c7a9c6d78c2bd343072d9cb7587e920b1d",
-        "config.js": "24db3727a804678ef12290ae258c7cf52afbc7a425bb452d87b7b2467ff7c559",
-        "docs/guide.md": "a7f8f449b94ecc726dc82fc7a0ae7c335431fa757f9493859bdf16e633689c3f",
-        "inject/body.html": "07727ead4a04fdeb2759a19e8cc358ba2692b807fb741a6daafaf02463fe8233",
-        "lib/engine.js": "a554c7abfa357288bbd73f47c9bcbf8eab7d8222ff63b1fd119a3ca5f9fb79f4",
-        "lib/quiz.js": "d697bbd1af41575a9ecee49781695f2dfb4a585bf0230cc39ac5d174dc9c2762",
-        "lib/store.js": "a740d879185e20c036ac17ab5cbca74d1f71097f4af3bc121fcddc826d8686c6",
-        "plugin.js": "0ec6f96fc4922c7ef41b36bd757c02926ee99d50e78fe85f7f30b9fbd9605b25",
-        "plugin.json": "788960b6a31c7c1c2d525fb7cae9ab9b7c9310def5d778c275f22302ecaadf78",
-        "public/quiz.css": "e8869fb30e22763357464e9aa7a353306b6631b8a7418ba4e483331e66aada67",
-        "public/quiz.js": "dedc96469e440c979b20d7d95655fbb25062b00b27be569b2a55ec5a8ec0cbb5"
-      }
-    },
     "security": {
       "version": "1.2.1",
       "files": {

package/server/routes/api/api-endpoints.js

@@ -25,6 +25,7 @@ import {
 } from '../../services/apiEndpoints.js';
 import {canSeeArtefact} from '../../services/projects.js';
 import {getCollection} from '../../services/collections.js';
+import {pluginDenial} from '../../services/collectionAccess.js';
 
 /**
  * Scoped users must not expose data they cannot see: the collection an
@@ -40,7 +41,10 @@ async function canUseCollection(user, slug) {
     if (!slug) return true;
     const schema = await getCollection(slug).catch(() => null);
     if (!schema) return true;
-    return canSeeArtefact(user, schema);
+    // A plugin's collection needs what the Collections API asks for it - an
+    // endpoint would otherwise publish rows (a game's answers) its author
+    // could not read.
+    return canSeeArtefact(user, schema) && !pluginDenial(schema, user);
 }
 
 /**

package/server/routes/api/collections.js

@@ -81,9 +81,10 @@ const ALL_PRESET_SLUGS = new Set(['roles', 'user-profiles', ...PRESET_COLLECTION
 /**
  * The generic routes are open to anyone holding `collections`, which every
  * level-1 admin does. Two kinds of collection need more than that (see
- * services/collectionAccess.js): a plugin's collection needs that plugin's own
- * permission, and the Tools' user-data presets (notes, tasks, contacts) are
- * kept to the caller's own rows. Answers the schema, or sends 404/403 and
+ * services/collectionAccess.js): a plugin's collection needs full use of one of
+ * the plugin's own permissions (its declared `collectionAction`, or every
+ * action), and the Tools' user-data presets (notes, tasks, contacts) are kept
+ * to the caller's own rows. Answers the schema, or sends 404/403 and
  * answers null - the caller returns at once.
  *
  * @param {object} request

package/server/routes/api/forms.js

@@ -42,6 +42,7 @@ import {
 import {getConfig} from '../../config.js';
 import {authenticate, requireAdmin, requirePermission} from '../../middleware/auth.js';
 import {hooks} from '../../services/hooks.js';
+import {pluginDenialFor} from '../../services/collectionAccess.js';
 import {saveMedia} from '../../services/content.js';
 import {v4 as uuidv4} from 'uuid';
 import {ago, clip, plural} from '../../services/sidebarBadges.js';
@@ -265,6 +266,19 @@ export function isSubmissionOf(form, entry) {
     return entry?.meta?.source === `form:${form?.slug}`;
 }
 
+/**
+ * Sends 403 and answers true when the form's submissions collection belongs
+ * to a plugin the caller may not read through the Collections API
+ * (collectionAccess.js) - otherwise a form named after a game's collection,
+ * or pointing its collection action at one, would list the game's answers.
+ */
+async function refusedPluginTarget(request, reply, form) {
+    const denial = await pluginDenialFor([submissionsCollectionFor(form)], request.user);
+    if (!denial) return false;
+    reply.status(403).send({error: denial});
+    return true;
+}
+
 async function canSeeForm(user, form) {
     const {canSeeArtefact} = await import('../../services/projects.js');
     return canSeeArtefact(user, form);
@@ -460,6 +474,7 @@ export async function formsRoutes(fastify) {
             updatedAt: now
         };
 
+        if (await refusedPluginTarget(request, reply, form)) return;
         await writeForm(slug, form);
 
         // Auto-create a matching collection for this form (skip if one already exists)
@@ -543,6 +558,7 @@ export async function formsRoutes(fastify) {
             createdAt: existing.createdAt,
             updatedAt: new Date().toISOString()
         };
+        if (await refusedPluginTarget(request, reply, updated)) return;
         await writeForm(slug, updated);
 
         // Non-blocking warnings: check the form's fields against its target
@@ -581,6 +597,7 @@ export async function formsRoutes(fastify) {
         // The form's project scope, as the form routes check it: a user confined to
         // other projects must not read or change this form's submissions.
         if (!(await canSeeForm(request.user, form))) return reply.status(404).send({ error: 'Form not found.' });
+        if (await refusedPluginTarget(request, reply, form)) return;
         const targetSlug = submissionsCollectionFor(form);
 
         // A form whose backing collection has not been provisioned yet simply
@@ -609,6 +626,7 @@ export async function formsRoutes(fastify) {
         // The form's project scope, as the form routes check it: a user confined to
         // other projects must not read or change this form's submissions.
         if (!(await canSeeForm(request.user, form))) return reply.status(404).send({ error: 'Form not found.' });
+        if (await refusedPluginTarget(request, reply, form)) return;
         // Where the list reads them: a form whose collection action writes elsewhere
         // exported (and cleared, and deleted from) its own-slug collection instead.
         let entries = [];
@@ -637,6 +655,7 @@ export async function formsRoutes(fastify) {
         // The form's project scope, as the form routes check it: a user confined to
         // other projects must not read or change this form's submissions.
         if (!(await canSeeForm(request.user, form))) return reply.status(404).send({ error: 'Form not found.' });
+        if (await refusedPluginTarget(request, reply, form)) return;
         let entries = [];
         try {
             entries = await submissionsOf(form);
@@ -662,6 +681,7 @@ export async function formsRoutes(fastify) {
         // The form's project scope, as the form routes check it: a user confined to
         // other projects must not read or change this form's submissions.
         if (!(await canSeeForm(request.user, form))) return reply.status(404).send({ error: 'Form not found.' });
+        if (await refusedPluginTarget(request, reply, form)) return;
         const target = submissionsCollectionFor(form);
         try {
             // Its own collection: clear it. A shared one: delete only this form's
@@ -692,6 +712,7 @@ export async function formsRoutes(fastify) {
         // The form's project scope, as the form routes check it: a user confined to
         // other projects must not read or change this form's submissions.
         if (!(await canSeeForm(request.user, form))) return reply.status(404).send({ error: 'Form not found.' });
+        if (await refusedPluginTarget(request, reply, form)) return;
         const target = submissionsCollectionFor(form);
         try {
             if (!isSubmissionOf(form, await getEntry(target, id))) return reply.status(404).send({ error: 'Submission not found.' });
@@ -719,6 +740,7 @@ export async function formsRoutes(fastify) {
         // The form's project scope, as the form routes check it: a user confined to
         // other projects must not read or change this form's submissions.
         if (!(await canSeeForm(request.user, form))) return reply.status(404).send({ error: 'Form not found.' });
+        if (await refusedPluginTarget(request, reply, form)) return;
         const target = submissionsCollectionFor(form);
         const value = request.body?.spam !== false;
         try {

package/server/routes/api/views.js

@@ -17,6 +17,19 @@
  */
 import {canReadView, createView, deleteView, executeView, executeViewConfig, getView, listViews, updateView, viewsBadge} from '../../services/views.js';
 import {authenticate, requirePermission} from '../../middleware/auth.js';
+import {pluginDenialFor} from '../../services/collectionAccess.js';
+
+/**
+ * Sends 403 and answers true when a pipeline reads (as its source or through a
+ * $lookup) a plugin's collection the caller may not read through the
+ * Collections API (collectionAccess.js).
+ */
+async function refusedPluginSources(request, reply, pipeline) {
+    const denial = await pluginDenialFor([pipeline?.source, ...lookupSources(pipeline?.stages || [])], request.user);
+    if (!denial) return false;
+    reply.status(403).send({error: denial});
+    return true;
+}
 
 /**
  * Every collection a pipeline's $lookup stages read, as slugs (`cms_` stripped - Mongo-authored views
@@ -78,6 +91,7 @@ export async function viewsRoutes(fastify) {
     });
 
     fastify.post('/views', canCreate, async (request, reply) => {
+        if (await refusedPluginSources(request, reply, request.body?.pipeline)) return;
         try {
             const view = await createView(request.body || {}, request.user?.id || null);
             return reply.status(201).send(view);
@@ -119,6 +133,7 @@ export async function viewsRoutes(fastify) {
     });
 
     fastify.put('/views/:slug', canUpdate, async (request, reply) => {
+        if (await refusedPluginSources(request, reply, request.body?.pipeline)) return;
         try {
             return await updateView(request.params.slug, request.body || {});
         } catch (err) {
@@ -143,6 +158,8 @@ export async function viewsRoutes(fastify) {
 
     fastify.get('/views/:slug/execute', canRead, async (request, reply) => {
         const { page, limit } = request.query;
+        const view = await getView(request.params.slug).catch(() => null);
+        if (view && await refusedPluginSources(request, reply, view.pipeline)) return;
         try {
             return await executeView(request.params.slug, {
                 page:  parseInt(page,  10) || 1,
@@ -178,6 +195,7 @@ export async function viewsRoutes(fastify) {
             const joined = await getCollection(from).catch(() => null);
             if (joined && !canSeeArtefact(request.user, joined)) return reply.status(403).send({error: 'Forbidden'});
         }
+        if (await refusedPluginSources(request, reply, {source, stages})) return;
         const n = Math.min(Math.max(parseInt(limit, 10) || 10, 1), 50);
         try {
             return await executeViewConfig({connection, pipeline: {source, stages}, access: {rowLevel: null}},