abqari 1.1.0

data/lib/abqari/taxonomy_page.rb

@@ -0,0 +1,129 @@
+# frozen_string_literal: true
+
+require 'fileutils'
+
+module Abqari
+  class TaxonomyPage
+    DEFAULT_PERMALINK = '/:taxonomy/:slug/'
+    DEFAULT_LAYOUT = 'taxonomy'
+
+    attr_reader :taxonomy, :term, :posts, :site
+
+    def initialize(taxonomy, term, posts, site)
+      @taxonomy = taxonomy
+      @term = term
+      @posts = posts
+      @site = site
+      @config = site.taxonomy_config(taxonomy)
+    end
+
+    def title
+      # Series taxonomies (configured with `field: series`) get a
+      # cleaner h1 / <title> — just the series name, e.g. "Damascus
+      # 2026" rather than "Posts tagged 'Damascus 2026'". Other
+      # taxonomies (tags, countries, etc.) keep the historical
+      # "tagged" framing.
+      return term.to_s if @config['field'] == 'series'
+
+      "Posts tagged ‘#{term}’"
+    end
+
+    def description
+      return "#{posts.size} item#{'s' if posts.size != 1} in this series." if @config['field'] == 'series'
+
+      "All posts tagged #{term}."
+    end
+
+    def content
+      ''
+    end
+
+    def frontmatter
+      {}
+    end
+
+    def url
+      permalink = @config['permalink'] || DEFAULT_PERMALINK
+      '/' + permalink
+        .gsub(':taxonomy', taxonomy)
+        .gsub(':slug', term_slug)
+        .sub(%r{\A/}, '')
+        .sub(%r{/?\z}, '/')
+    end
+
+    # The term's URL segment, refusing to be empty.
+    #
+    # `slugify` strips to URL-safe ASCII, so a term with no Latin
+    # characters — a CJK or Arabic tag — produces "". That collapsed
+    # `/tags/:slug/` to `/tags/`, and the page then wrote over the
+    # taxonomy index at `_site/tags/index.html`. With two such terms the
+    # build did fail, via `detect_output_collisions!`, but the message
+    # named colliding paths rather than the tag that caused them.
+    #
+    # `Page#render_permalink` has had this guard for page slugs; this is
+    # the same failure one level up, so it fails the same way and names
+    # the term.
+    def term_slug
+      slug = Helpers.slugify(term)
+      return slug unless slug.empty?
+
+      # The term is interpolated raw rather than via `inspect`: when the
+      # process's default encoding isn't UTF-8, `inspect` renders it as
+      # `日本語`, and a user staring at escape sequences
+      # can't tell which of their tags is at fault.
+      raise PathSafe::Error,
+            %(the #{taxonomy} term "#{term}" produced an empty slug — it has no ) +
+            'URL-safe characters, so its page would overwrite the taxonomy index. ' \
+            'Rename the term, or add a Latin-character alias.'
+    end
+
+    def output_path
+      File.join(@site.output_dir, url.sub(%r{\A/}, '').chomp('/'), 'index.html')
+    end
+
+    # Reflect the latest update across the posts this taxonomy collects.
+    def lastmod
+      posts.map(&:lastmod).compact.max
+    end
+
+    # Bundle images aren't sitemap-relevant for tag pages — they live on the posts.
+    def bundle_images
+      []
+    end
+
+    # Incremental rendering — re-render when shared deps change or any post
+    # in this taxonomy was modified more recently than this page's output.
+    # The layout this page renders through. Shared by `render` and
+    # `needs_render?` so the staleness check can't drift from what's
+    # actually rendered.
+    def layout_name
+      @config['layout'] || DEFAULT_LAYOUT
+    end
+
+    def needs_render?
+      return true unless File.exist?(output_path)
+
+      output_mtime = File.mtime(output_path)
+      return true if @site.shared_deps_mtime > output_mtime
+      # Layouts are deliberately excluded from GLOBAL_DEP_GLOBS and
+      # tracked per-page instead (see Renderer::GLOBAL_DEP_GLOBS). Only
+      # Page consulted them, so editing `taxonomy.html.erb` with the dev
+      # server running rebuilt nothing and the browser reloaded to stale
+      # HTML.
+      return true if @site.layout_deps_mtime(layout_name) > output_mtime
+
+      posts.any? { |post| (post.lastmod || Time.now) > output_mtime }
+    end
+
+    def write
+      FileUtils.mkdir_p(File.dirname(output_path))
+      File.write(output_path, @site.post_process(render, page: self))
+    end
+
+    private
+
+    def render
+      RenderContext.new(self, @site).render_layout(layout_name)
+    end
+  end
+end

data/lib/abqari/templates/site_skeleton/.github/dependabot.yml

@@ -0,0 +1,53 @@
+# Dependabot configuration.
+#
+# Controls how/when Dependabot opens version-update PRs. (Security-
+# update PRs run independently of this file — they fire whenever a
+# CVE is disclosed for one of your deps, regardless of cadence.)
+#
+# Cadence is weekly + grouped: one PR per ecosystem per week with all
+# eligible bumps, instead of a separate PR per dep per day. For a
+# small Ruby site with a handful of deps and Actions, this keeps the
+# inbox sane without missing meaningful updates.
+#
+# Edit the timezone/day below to match your working week.
+
+version: 2
+updates:
+  # ----- Ruby gems --------------------------------------------------
+  - package-ecosystem: bundler
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "08:00"
+    open-pull-requests-limit: 5
+    groups:
+      # One PR per week with all eligible gem bumps. Easier to review
+      # together than separate PRs per gem; one CI run instead of N.
+      ruby-deps:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+    ignore:
+      # Major bumps on the engine + runtime-critical gems gated behind
+      # manual upgrade — these change behaviour, not just API surface.
+      # Edit the list to fit the gems you actually depend on.
+      - dependency-name: "abqari"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "commonmarker"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "ruby-vips"
+        update-types: ["version-update:semver-major"]
+
+  # ----- GitHub Actions --------------------------------------------
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: monthly
+    open-pull-requests-limit: 3
+    groups:
+      actions:
+        patterns:
+          - "*"

data/lib/abqari/templates/site_skeleton/.github/workflows/deploy-cloudflare.yml

@@ -0,0 +1,107 @@
+# Deploy to Cloudflare Pages on every push to main.
+#
+# OPT IN — this workflow is GATED. Until you enable it, it runs as a
+# no-op even on push. To enable:
+#
+#   1. Create a Cloudflare Pages project (Direct Upload, no Git integration).
+#   2. Generate an API token with the "Cloudflare Pages: Edit" scope:
+#      https://dash.cloudflare.com/profile/api-tokens
+#   3. GitHub repo → Settings → Secrets and variables → Actions:
+#      - Secrets (tab): add `CLOUDFLARE_API_TOKEN`, `CLOUDFLARE_ACCOUNT_ID`
+#      - Variables (tab): add `ENABLE_CLOUDFLARE = true`
+#                          add `CLOUDFLARE_PROJECT_NAME = your-project-name`
+#
+# Three deploy options ship in this repo — Cloudflare Pages (this file),
+# Render (`deploy-render.yml`), and GitHub Pages (`deploy-github-pages.yml`).
+# Each one is independently gated on its own `ENABLE_*` repo variable so
+# you can enable multiple, none, or any subset.
+#
+# What this does:
+#   - Installs Ruby + libvips, restores bundle cache
+#   - Installs Pagefind (used only if `search: true` in site.yml)
+#   - Builds the site in production mode
+#   - Runs the audit, uploads report as artifact (audit failures don't block deploy)
+#   - Deploys _site/ to Cloudflare Pages via Wrangler
+
+name: Deploy → Cloudflare Pages
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  deployments: write
+
+jobs:
+  build-and-deploy:
+    if: vars.ENABLE_CLOUDFLARE == 'true'
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+
+      - name: Install libvips with AVIF support
+        # libvips powers the image pipeline. On Ubuntu 24.04 (the
+        # `ubuntu-latest` runner) the apt package `libvips42` doesn't
+        # include HEIF/AVIF — that's split into libheif1 + per-codec
+        # plugins. Without them, the pipeline raises "Unsupported
+        # compression" the first time it tries to emit an AVIF variant.
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libvips42 libheif1 \
+                                   libheif-plugin-aomenc \
+                                   libheif-plugin-libde265 \
+                                   libheif-plugin-dav1d
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
+        with:
+          bundler-cache: true   # caches Gemfile.lock-pinned gems between runs
+
+      - name: Install Pagefind (optional — for static search)
+        run: |
+          curl -LSf https://pagefind.app/install.sh | bash
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
+        # Skips silently if pagefind is unused; bin/build only runs it when
+        # `search: true` is set in config/site.yml.
+
+      - name: Build site
+        env:
+          ABQARI_ENV: production
+        run: bundle exec bin/build
+
+      - name: Run audit
+        env:
+          ABQARI_ENV: production
+        run: bundle exec bin/audit
+        continue-on-error: true
+
+      - name: Upload audit report
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        if: always()
+        with:
+          name: audit-report
+          path: audit/*.md
+          retention-days: 30
+          if-no-files-found: ignore
+
+      # Fail here with a sentence rather than inside wrangler with a
+      # cryptic one: an unset variable makes the deploy command read
+      # `--project-name=` and the error doesn't say which knob is missing.
+      - name: Check deploy configuration
+        env:
+          PROJECT_NAME: ${{ vars.CLOUDFLARE_PROJECT_NAME }}
+        run: |
+          if [ -z "$PROJECT_NAME" ]; then
+            echo "::error::CLOUDFLARE_PROJECT_NAME variable is not set. Add it under Settings → Secrets and variables → Actions → Variables."
+            exit 1
+          fi
+
+      - name: Deploy to Cloudflare Pages
+        uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          command: pages deploy _site --project-name=${{ vars.CLOUDFLARE_PROJECT_NAME }}

data/lib/abqari/templates/site_skeleton/.github/workflows/deploy-github-pages.yml

@@ -0,0 +1,107 @@
+# Deploy to GitHub Pages on every push to main.
+#
+# OPT IN — this workflow is GATED. Until you enable it, it runs as a
+# no-op even on push. To enable:
+#
+#   1. GitHub repo → Settings → Pages → Source: "GitHub Actions"
+#      (NOT "Deploy from a branch"). This grants the workflow the
+#      `pages` and `id-token` permissions it needs to publish.
+#   2. GitHub repo → Settings → Secrets and variables → Actions →
+#      Variables (tab): add `ENABLE_GITHUB_PAGES = true`
+#
+# Unlike Cloudflare and Render, no secrets are required — GitHub
+# Pages auth is handled by the runner via OIDC. The free tier covers
+# unlimited public projects; private projects need a paid plan.
+#
+# Custom domain: add a `CNAME` file with your domain to the repo root
+# (committed) and set the domain in Settings → Pages → Custom domain.
+# GitHub serves HTTPS via Let's Encrypt automatically.
+#
+# Three deploy options ship in this repo. Each is independently gated
+# on its own `ENABLE_*` repo variable; enable any subset.
+
+name: Deploy → GitHub Pages
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+# Concurrency: only one Pages deploy can run at a time. Newer pushes
+# cancel older still-running ones so the live site reflects the most
+# recent main.
+concurrency:
+  group: pages
+  cancel-in-progress: true
+
+jobs:
+  build:
+    if: vars.ENABLE_GITHUB_PAGES == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+
+      - name: Install libvips with AVIF support
+        # libheif1 + plugin packages are required for AVIF encoding —
+        # libvips42 alone doesn't include them on Ubuntu 24.04.
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libvips42 libheif1 \
+                                   libheif-plugin-aomenc \
+                                   libheif-plugin-libde265 \
+                                   libheif-plugin-dav1d
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
+        with:
+          bundler-cache: true
+
+      - name: Configure Pages
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
+
+      - name: Install Pagefind (optional — for static search)
+        run: |
+          curl -LSf https://pagefind.app/install.sh | bash
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
+
+      - name: Build site
+        env:
+          ABQARI_ENV: production
+        run: bundle exec bin/build
+
+      - name: Run audit
+        env:
+          ABQARI_ENV: production
+        run: bundle exec bin/audit
+        continue-on-error: true
+
+      - name: Upload audit report
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        if: always()
+        with:
+          name: audit-report
+          path: audit/*.md
+          retention-days: 30
+          if-no-files-found: ignore
+
+      - name: Upload Pages artifact
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
+        with:
+          path: _site
+
+  deploy:
+    if: vars.ENABLE_GITHUB_PAGES == 'true'
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4

data/lib/abqari/templates/site_skeleton/.github/workflows/deploy-render.yml

@@ -0,0 +1,87 @@
+# Deploy to Render on every push to main.
+#
+# OPT IN — this workflow is GATED. Until you enable it, it runs as a
+# no-op even on push. Two ways to deploy to Render — pick one:
+#
+# (A) Render's own GitHub integration (simplest — no workflow needed):
+#     In the Render dashboard, create a Static Site, connect this repo,
+#     set build command `bundle exec bin/build`, publish directory
+#     `_site`, environment variable `ABQARI_ENV=production`. Render
+#     polls GitHub and rebuilds on push.
+#
+# (B) GitHub Actions → Render deploy hook (this workflow). Use when:
+#     - You want CI gates (audit, tests) to block deploys.
+#     - You want builds in your own runners, not Render's.
+#     - You're already standardised on Actions for everything else.
+#
+# To enable Option B:
+#
+#   1. In the Render dashboard, open your Static Site → Settings →
+#      Deploy Hook. Copy the URL.
+#   2. GitHub repo → Settings → Secrets and variables → Actions:
+#      - Secrets (tab): add `RENDER_DEPLOY_HOOK_URL`
+#      - Variables (tab): add `ENABLE_RENDER = true`
+#
+# When triggered, Render fetches the latest commit and builds in its
+# own environment. This workflow only pings the deploy hook — it
+# doesn't push artifacts. If you need Actions-built artifacts shipped
+# to Render, use Render's REST API directly (more setup; not covered).
+#
+# Three deploy options ship in this repo. Each is independently gated
+# on its own `ENABLE_*` repo variable; enable any subset.
+
+name: Deploy → Render
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build-and-trigger:
+    if: vars.ENABLE_RENDER == 'true'
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+
+      - name: Install libvips with AVIF support
+        # libheif1 + plugin packages are required for AVIF encoding —
+        # libvips42 alone doesn't include them on Ubuntu 24.04.
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libvips42 libheif1 \
+                                   libheif-plugin-aomenc \
+                                   libheif-plugin-libde265 \
+                                   libheif-plugin-dav1d
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
+        with:
+          bundler-cache: true
+
+      - name: Build site (CI verification)
+        # Build locally as a smoke test so Render's build won't run
+        # against code that fails at our own gates. Doesn't ship the
+        # artifact — Render builds its own copy after the hook fires.
+        env:
+          ABQARI_ENV: production
+        run: bundle exec bin/build
+
+      - name: Trigger Render deploy
+        env:
+          DEPLOY_HOOK: ${{ secrets.RENDER_DEPLOY_HOOK_URL }}
+        run: |
+          if [ -z "$DEPLOY_HOOK" ]; then
+            echo "::error::RENDER_DEPLOY_HOOK_URL secret is empty. Add it under Settings → Secrets."
+            exit 1
+          fi
+          response=$(curl -sS -X POST "$DEPLOY_HOOK" -w "\n%{http_code}")
+          code=$(echo "$response" | tail -n1)
+          body=$(echo "$response" | head -n -1)
+          echo "Render response ($code): $body"
+          # 200/201 = accepted (Render queues the build). Any other code is a failure.
+          [ "$code" -ge 200 ] && [ "$code" -lt 300 ]

data/lib/abqari/templates/site_skeleton/.gitignore

@@ -0,0 +1,24 @@
+_site/
+_import_report.md
+vendor/fonts/*
+!vendor/fonts/.gitkeep
+vendor/folio/*
+!vendor/folio/.gitkeep
+# Webmention/POSSE caches are ignored, but the `sent.yml` dedup logs
+# MUST be committed. They're the only record of what's already been
+# posted/pinged; a fresh CI checkout without them re-syndicates every
+# post in the window on each deploy (duplicate toots/skeets).
+vendor/webmentions/*
+!vendor/webmentions/sent.yml
+vendor/syndication/*
+!vendor/syndication/sent.yml
+audit/*.md
+.DS_Store
+*.swp
+*.swo
+*~
+node_modules/
+.bundle/
+.env
+.env.*
+!.env.example

data/lib/abqari/templates/site_skeleton/.ruby-version.tt

@@ -0,0 +1 @@
+<%= ruby_version %>

data/lib/abqari/templates/site_skeleton/Gemfile.tt

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+source 'https://rubygems.org'
+
+# Abqari is the static site generator. The engine ships content
+# pipelines, layouts, helpers, themes, and the build orchestrator.
+# Its runtime deps (commonmarker, erubi, rouge, ruby-vips, webrick,
+# and friends) come in transitively via abqari.gemspec. To track a
+# fork or a local checkout instead of the released gem, swap this
+# line for a `git:` or `path:` source.
+<%= gemfile_line %>
+
+group :development do
+  gem 'listen', '~> 3.8'    # FS events for the dev-server watcher (optional)
+
+  # Uncomment to import content from Substack / Ghost / Jekyll with
+  # `bin/import`. Kept optional because it pulls in nokogiri, which most
+  # sites never need — `bin/import` tells you if it's missing.
+  # gem 'reverse_markdown', '~> 2.1'
+end

data/lib/abqari/templates/site_skeleton/README.md.tt

@@ -0,0 +1,60 @@
+# <%= title %>
+
+Built with [Abqari](https://github.com/grantrayner/abqari) — a Ruby static
+site generator. The engine handles content pipelines, layouts, helpers,
+themes, and the build orchestrator; everything in this repo is YOUR
+site's content, configuration, and assets.
+
+## Quick start
+
+```bash
+bundle install
+bin/serve              # dev server on http://localhost:4000
+```
+
+When you're ready to ship:
+
+```bash
+bin/build              # production build → _site/
+bin/audit              # link / SEO / a11y / privacy checks
+```
+
+## Day-to-day
+
+```bash
+bin/new post "Title"   # scaffold a new post bundle in content/posts/
+bin/new page "Title"   # scaffold a top-level page in content/
+```
+
+To enable another collection (photos, publications, workshops) after
+the fact: flip its `enabled:` flag in `config/site.yml` and create
+`content/<name>/index.md` — the comments in the config show the shape.
+(`abqari new --with <name>` does both for fresh sites.)
+
+## Where to edit
+
+| Path | What lives here |
+|---|---|
+| `config/site.yml` | Site identity, theme, collections, home modules, env overrides |
+| `content/` | Markdown — posts, pages, photos, publications, workshops |
+| `app/assets/css/site.css` | Your custom CSS (loads after the theme; never overwritten by upgrades) |
+| `data/` | YAML/JSON data files exposed to templates as `site.data['name']` |
+| `public/` | Static passthrough — favicons, robots overrides, etc. |
+
+## Upgrading the engine
+
+Bundler reads the Gemfile each time it runs. To pull engine updates:
+
+```bash
+bundle update abqari
+bin/build              # confirm the build still passes
+bin/audit              # confirm content audit still passes
+```
+
+See the engine's [CHANGELOG](https://github.com/grantrayner/abqari/blob/main/CHANGELOG.md)
+for what changed between versions and whether any of your config or
+content needs a migration.
+
+## License
+
+<%= year %> <%= author %>. All rights reserved unless stated otherwise.

data/lib/abqari/templates/site_skeleton/app/assets/css/site.css

@@ -0,0 +1,9 @@
+/* Site-local CSS overrides.
+ *
+ * Loaded AFTER the theme's app.css, so anything in here wins on equal
+ * specificity. Use this for site-specific brand colours, font swaps,
+ * or one-off component tweaks — without forking the engine's themes.
+ *
+ * The file is yours; the engine never touches it on upgrade. Empty by
+ * default (no overrides) so the theme's defaults are what you see.
+ */

data/lib/abqari/templates/site_skeleton/bin/audit

@@ -0,0 +1,46 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# Build (side-effect-free — no syndication, no webmention sends), then
+# walk _site/ for link/SEO/a11y/privacy/dependency issues. Writes a
+# markdown report to audit/<timestamp>.md.
+#
+# Flags:
+#   --strict        — exit non-zero on any error-severity finding (CI).
+#   --strict=warn   — exit non-zero on errors AND warnings.
+#   --verbose / -v  — set ABQARI_LOG=debug for extra build output.
+
+require 'optparse'
+
+options = { strict: nil, log: nil }
+OptionParser.new do |opts|
+  opts.banner = 'Usage: bin/audit [--strict[=warn]] [--verbose]'
+  opts.on('--strict[=LEVEL]', %w[error warn],
+          'Exit non-zero when findings exist at LEVEL or above (default: error)') do |level|
+    options[:strict] = level || 'error'
+  end
+  opts.on('-v', '--verbose', 'Verbose output (ABQARI_LOG=debug)') { options[:log] = 'debug' }
+end.parse!(ARGV)
+
+ENV['ABQARI_LOG']         = options[:log] if options[:log]
+ENV['ABQARI_ENV']       ||= 'production'
+ENV['ABQARI_SITE_ROOT'] ||= File.expand_path('..', __dir__)
+# Resolve the bundle from this site, not from cwd — `bundler/setup`
+# finds its Gemfile relative to the current directory, so running this
+# from elsewhere would load an unrelated bundle (or none) and fail.
+ENV['BUNDLE_GEMFILE']   ||= File.expand_path('../Gemfile', __dir__)
+
+require 'bundler/setup'
+require 'abqari'
+
+Abqari.run_cli do
+  audit = Abqari::Audit.new(Abqari::Site.new).run
+
+  if options[:strict]
+    count = audit.count(at_least: options[:strict])
+    if count.positive?
+      Abqari::Log.error "Audit failed: #{count} finding(s) at severity >= #{options[:strict]}"
+      exit 1
+    end
+  end
+end

data/lib/abqari/templates/site_skeleton/bin/build

@@ -0,0 +1,32 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# Build the site. Flags:
+#   --verbose / -v   — set ABQARI_LOG=debug for extra build-time output
+#                      (incremental decisions, parallel slice info,
+#                      cache hits, etc.).
+#   --quiet   / -q   — set ABQARI_LOG=warn to suppress info-level lines.
+
+require 'optparse'
+
+options = {}
+OptionParser.new do |opts|
+  opts.banner = 'Usage: bin/build [--verbose|--quiet]'
+  opts.on('-v', '--verbose', 'Verbose build output (ABQARI_LOG=debug)') { options[:log] = 'debug' }
+  opts.on('-q', '--quiet',   'Suppress info-level output (ABQARI_LOG=warn)') { options[:log] = 'warn' }
+end.parse!(ARGV)
+
+ENV['ABQARI_LOG']         = options[:log] if options[:log]
+ENV['ABQARI_ENV']       ||= 'production'
+ENV['ABQARI_SITE_ROOT'] ||= File.expand_path('..', __dir__)
+# Resolve the bundle from this site, not from cwd — `bundler/setup`
+# finds its Gemfile relative to the current directory, so running this
+# from elsewhere would load an unrelated bundle (or none) and fail.
+ENV['BUNDLE_GEMFILE']   ||= File.expand_path('../Gemfile', __dir__)
+
+require 'bundler/setup'
+require 'abqari'
+
+Abqari.run_cli do
+  Abqari::Site.new.build
+end