@geekity/cms 0.11.0 → 0.13.0

package/README.md

@@ -370,6 +370,7 @@ the same directory reads all of it, and everything in it is meant to be public:
 | `data/mail.json`                  | The mail credential: a Brevo API key, an SMTP connection, or both. Mode `0600`.                                                 |
 | `data/notification-secret`        | What signs the one-click links in a notification. Mode `0600`. Losing it kills every link already in an inbox and nothing else. |
 | `data/comment-optouts.json`       | The addresses that have unsubscribed from reply notices. Mode `0600`.                                                           |
+| `data/indieauth-tokens.json`      | A SHA-256 hash of each IndieAuth access and refresh token, with its user, app, scopes and expiry (decision-24). Mode `0600`.    |
 | `data/notification-digests.json`  | When each user was last sent a digest. Mode `0600`. Losing it sends one digest early and nothing worse.                         |
 | `data/wordpress-activitypub.json` | When each WordPress compatibility path was last asked for. Losing it resets the answer the switch is watched by.                |
 
@@ -535,6 +536,12 @@ arrives as its title, its excerpt and a link, so it sends `name` and a
 would show a `summary` as a content warning, so a note sends neither and puts a
 title its text does not open with at the top of its content.
 
+Both carry their text twice: `content` as it always was, and `contentMap` keyed
+by the post's language, with `summaryMap` beside an `Article`'s `summary`. The
+language is the post's `lang` front matter when it names one, and the site's
+`language` otherwise, so a client can filter and translate by it. Mastodon
+reads a status's language from that key.
+
 An author can choose the type for one post in its front matter:
 
 ```yaml
@@ -1417,6 +1424,7 @@ says otherwise.
 | Other actors who liked, boosted, answered or quoted: handle, display name, avatar URL, profile URL                   | `data/geekity.db`, fetched from their actor document          | A cache. Refetched weekly while the inbox log names them.                      |
 | Remote avatars, shrunk                                                                                               | `data/avatars/`                                               | Deleted by the avatar sweep once nothing shown names them.                     |
 | Users: username, email, argon2id password hash, profile                                                              | `data/users.json`, mode `0600`                                | Until the user is deleted.                                                     |
+| The apps a user signed in to with IndieAuth: app, scopes, hashes of its tokens, when they expire                     | `data/indieauth-tokens.json`, mode `0600`                     | Until the user is deleted, or 60 days after the app last refreshed.            |
 | An index of all of the above, and sessions, reset tokens and spent link tokens                                       | `data/geekity.db`                                             | A cache of the files. Sessions and tokens are pruned when they expire.         |
 | Client addresses in the rate limits                                                                                  | Memory                                                        | Until the window passes or the site restarts.                                  |
 | Client addresses in the access log                                                                                   | stdout, and whatever collects it                              | Only with `accessLogAddress` on. The collector keeps them.                     |
@@ -1686,7 +1694,7 @@ shadow the login form.
 | `/admin/appearance/themes`                       | Appearance > Themes: the themes on disk. `POST` activates the one named.            |
 | `/admin/tools`                                   | Tools > Content index: what the index holds, and the button that rebuilds it.       |
 | `/admin/tools/rebuild-index`                     | `POST` only. Offers the rebuild, then reads every file again on the live site.      |
-| `/admin/settings`                                | Settings > General: title, tagline, author, base URL, time zone, language.          |
+| `/admin/settings`                                | Settings > General: title, tagline, author, base URL, time zone, language, locale.  |
 | `/admin/settings/reading`                        | What the homepage displays, posts per page, the notify server.                      |
 | `/admin/settings/permalinks`                     | The tag and category bases, and the archive redirects already recorded.             |
 | `/admin/settings/discussion`                     | Comments and the closing window, webmentions, and the Akismet key.                  |
@@ -1838,8 +1846,9 @@ at once cannot each keep half of what the other kept.
 
 The file carries `title`, `tagline`, `url`, `author`, `postsPerPage`,
 `homepage`, `postsPage`,
-`timezone`, `language`, `tagBase`,
-`categoryBase`, `notifyServer`, `webmentionsSend`, `webmentionsReceive`,
+`timezone`, `language`, `locale` (when it is set), `tagBase`,
+`categoryBase`, `notifyServer`, `feedUpdatePeriod`, `feedUpdateFrequency`,
+`webmentionsSend`, `webmentionsReceive`,
 `mailProvider`, `mailFromName`, `mailFromAddress`, `mailReplyTo`,
 `contactEmail`, `securityContacts`, `securityPolicy`, `securityLanguages`,
 `relays`, `menus` and `taxonomyRedirects`,
@@ -2354,6 +2363,8 @@ Booting mounts the public site on the app. The routes are:
 | `/sitemap.xml`                          | Every public URL, for a search engine.                                                                                 |
 | `/sitemap-{n}.xml`                      | One file of a sitemap too big to be a single one.                                                                      |
 | `/robots.txt`                           | What a crawler may have, and where the sitemap is.                                                                     |
+| `/llms.txt`                             | The site's pages and recent posts for a language model, each linked to its Markdown. See [below](#llmstxt).            |
+| `/{key}.txt`                            | The IndexNow key, while the site has IndexNow on. See [below](#indexnow).                                              |
 | `/.well-known/security.txt`             | Where to report a vulnerability; a 404 until a security contact is set. See [above](#securitytxt-and-change-password). |
 | `/.well-known/change-password`          | A redirect to the signed-in user's change-password form, or to the login form.                                         |
 | `/_geekity/comments`                    | `POST` only. Where the comment form under a post submits.                                                              |
@@ -2705,6 +2716,10 @@ without changing the document, so a development server would otherwise answer
 `304` with a page that had already moved on. The `.md` and `.json`
 representations are validated either way.
 
+Every representation but the HTML carries `X-Robots-Tag: noindex`, whether it
+was asked for by extension or by `Accept`. They say what the page says, and a
+search engine that indexed them would list one page two or three times.
+
 Adding a representation — an ActivityStreams object, say — means adding it to
 `Representation` in `src/web/negotiate.ts` with its media type and, if it wants
 one, its extension. The selection, the `Link` alternates, the `ETag` and the
@@ -2748,6 +2763,16 @@ post on a site that publishes several.
 { "title": "My Site", "tagline": "Notes", "author": "Me", "feedSize": 20 }
 ```
 
+Every RSS feed, the comments feeds included, tells a reader how often to poll
+it with the Syndication module's `sy:updatePeriod` and `sy:updateFrequency`.
+Settings → Reading sets both, as `feedUpdatePeriod` (`hourly`, `daily`,
+`weekly`, `monthly` or `yearly`) and `feedUpdateFrequency` (a whole number, 1 or
+more) in `site.json`. The default is `hourly` and `1`, which is what WordPress
+declares, so the subscribers of a migrated site keep polling as they did. A
+reader may back off from a feed that stays quiet much longer than it says, so
+a site that posts weekly does better to say `weekly`. Atom and JSON Feed have no
+element for it.
+
 ### What every format says about a post
 
 The three formats render one **feed item**, derived once per post, rather than
@@ -2802,6 +2827,13 @@ post that is not a reply, or whose `in-reply-to` is not such a URL, carries
 neither. RSS 2.0 has no equivalent element, so an RSS item for a reply is
 written the same as any other.
 
+**Languages.** Every feed declares the site's `language` once: RSS as the
+channel's `language`, Atom as the feed's `xml:lang` and JSON Feed as its
+`language`. A post whose `lang` front matter names another language says so on
+its own item: RSS as `dc:language`, Atom as `xml:lang` on the `entry` and JSON
+Feed as the item's `language`. A post in the site's language, or whose `lang`
+is not a language tag, adds nothing.
+
 ### RSS 2.0
 
 The channel carries `title`, `link`, `description` (the tagline), `language`
@@ -3096,7 +3128,7 @@ holding its own slice and dated by the newest URL in it. The address a search
 engine holds does not change, which is the point of the index living there.
 While the whole sitemap fits in one file the children name nothing and 404.
 
-`/robots.txt` is short:
+`/robots.txt` starts short:
 
 ```
 User-agent: *
@@ -3111,6 +3143,44 @@ fetched, they carry the same
 content as the pages that link to them, and a crawler that follows one gets
 JSON it will ignore.
 
+The Crawlers section of Settings → Reading adds to it, and writes what it sets
+to `site.json`:
+
+| Setting               | `site.json` key                                                       | What the file gains                                                                                                                                                                                                                                                                                                                                                                                             |
+| --------------------- | --------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| AI crawlers           | `aiCrawlers`                                                          | `allow` (the default) adds nothing. `block-training` adds a `Disallow: /` group for each training crawler: GPTBot, ClaudeBot, anthropic-ai, Google-Extended, Applebot-Extended, Bytespider, CCBot and meta-externalagent. `block-all` also blocks the retrieval crawlers: OAI-SearchBot, ChatGPT-User, PerplexityBot, Perplexity-User, Claude-SearchBot, Claude-User, meta-webindexer and meta-externalfetcher. |
+| Content signals       | `contentSignalSearch`, `contentSignalAiInput`, `contentSignalAiTrain` | Each `yes`, `no` or empty. The ones set become one line, such as `Content-Signal: search=yes, ai-input=yes, ai-train=no`.                                                                                                                                                                                                                                                                                       |
+| More robots.txt rules | `robotsRules`                                                         | Groups of the site's own, one line per array entry: `User-agent`, then `Allow`, `Disallow`, `Crawl-delay`, `Content-Signal` or `Sitemap` lines.                                                                                                                                                                                                                                                                 |
+
+A crawler obeys only the one group that names it (RFC 9309), so the CMS puts
+`Disallow: /admin/` and the content signal into every group, its own and the
+site's, unless the group already disallows everything or carries a signal of
+its own. The form refuses a line that is not a robots.txt field, a rule with no
+`User-agent` above it, and an `Allow` under `/admin/`; a hand edit of
+`site.json` that does any of these loses that line. The site's own `Sitemap:`
+line is always there.
+
+For example, `block-training`, `ai-train` set to `no` and a rule of
+`User-agent: SlowBot` / `Crawl-delay: 10` serve:
+
+```
+User-agent: *
+Disallow: /admin/
+Content-Signal: ai-train=no
+
+User-agent: GPTBot
+Disallow: /
+
+…one group per training crawler…
+
+User-agent: SlowBot
+Disallow: /admin/
+Crawl-delay: 10
+Content-Signal: ai-train=no
+
+Sitemap: https://example.com/sitemap.xml
+```
+
 Both are registered routes rather than anything resolved from the content
 index, so a document permalinked at `/sitemap.xml` cannot take the URL a
 search engine polls, and both carry an `ETag` and answer a conditional request
@@ -3120,6 +3190,102 @@ robots without one, because nothing dates it.
 Nothing links the sitemap from a page: `robots.txt` names it, which is where a
 crawler looks.
 
+## llms.txt
+
+`/llms.txt` describes the site for a language model, in the
+[llms.txt](https://llmstxt.org/) format. It holds the site's title as a heading
+and its tagline as a quote. Then it lists every public page by title and the
+posts the feeds carry, newest first. Each entry links to the document's
+Markdown, which is what a model reads best:
+
+```markdown
+# Field Notes
+
+> Notes from the field.
+
+## Pages
+
+- [About](https://example.com/about/index.md): Who writes this.
+
+## Recent posts
+
+- [Third post](https://example.com/third/index.md)
+```
+
+A document's `description` follows its link. A static homepage is listed at
+`/index.md`, because `/` is where it is published. The file is served as
+`text/markdown` and carries an `ETag` and a `Last-Modified`, the newest date
+among its entries. It answers a conditional request with 304, as the sitemap
+does.
+
+The home page advertises the file twice. The response carries
+`Link: </llms.txt>; rel="describedby"; type="text/markdown"`, for a tool that
+reads no HTML. The default theme's head carries
+`<link rel="describedby" type="text/markdown" href="/llms.txt">`. A theme
+gets the path as `llmsTxt` while the site serves the file.
+
+To write the file yourself, put it at `content/llms.txt`. The CMS serves it
+exactly as written in place of the generated one, dated by the file. To serve
+no file at all, clear **Serve /llms.txt** under Settings → Reading. This
+writes `"llmsTxt": false` to `site.json`. `/llms.txt` then answers 404, even
+when `content/llms.txt` exists, and the home page stops advertising it.
+
+## IndexNow
+
+[IndexNow](https://www.indexnow.org/) gets a changed URL recrawled by Bing,
+Yandex, Naver, Seznam and the other engines that share it within minutes,
+instead of on their next visit. It is off by default, because it sends the
+site's URLs to a third party. To turn it on, select **Submit changes to
+IndexNow** under Settings → Reading.
+
+The first time you turn it on, the CMS generates a key of 32 hex digits and
+writes it to `site.json` as `indexNowKey`, beside `"indexNow": true`. The site
+then serves the key at `/{key}.txt` as plain text, which is how an engine
+checks that the submissions are yours. Turning IndexNow off takes the file away
+and keeps the key, so turning it back on reuses the key the engines already
+checked. To change the key, write a new one of 8 to 128 letters, digits or
+dashes to `indexNowKey`. A key that does not fit that pattern counts as none,
+and the site sends nothing.
+
+When a post or a page is published, changed, moved or deleted, the CMS submits
+its URL. A move submits the old URL and the new one. Unpublishing, trashing and
+deleting submit the URL that went away. The changes of the next ten seconds go
+out together as one `POST` to `https://api.indexnow.org/indexnow`:
+
+```json
+{
+  "host": "example.com",
+  "key": "0123456789abcdef0123456789abcdef",
+  "keyLocation": "https://example.com/0123456789abcdef0123456789abcdef.txt",
+  "urlList": ["https://example.com/hello/"]
+}
+```
+
+A network failure, a 429 or a 5xx answer is tried again after ten seconds, then
+after forty. Any other refusal, such as a 403 for a key the engine could not
+fetch, is not. A batch that still fails is logged as a warning, and the post
+stays published.
+
+Nothing is sent for a draft or a scheduled post, for the boot scan, or while
+the base URL's host is local: `localhost`, a `.local` name, or a private IP
+address.
+
+A site can change how the CMS sends with `indexNow` in its config. Every field
+is optional:
+
+```ts
+export default defineConfig({
+  indexNow: {
+    fetch, // what submits the URLs; a test names one
+    endpoint: 'https://www.bing.com/indexnow',
+    batchMs: 10_000,
+    attempts: 3,
+    backoffMs: (attempt) => attempt * attempt * 10_000,
+    logger: console,
+  },
+});
+```
+
 ## Theme overrides
 
 A site's themes live one directory per theme under `themesDir` (`themes/` by
@@ -3190,8 +3356,13 @@ The admin is not themed. Its templates and its static files live in a tree of
 their own with a loader of their own, deliberately off this search path, so no
 theme can shadow the login form or the CSRF field inside it.
 
-The packaged theme is the andrewshell.org design (decision-16). `base.njk` is
-its shell: a skip link, a `.global-wrapper` carrying `data-is-root-path="true"`
+The packaged theme is the Paper design (doc-9) on the andrewshell.org shell
+(decision-16). Its stylesheet is written in Tailwind v4 in
+`themes/default/src/style.css` and compiled to `themes/default/static/style.css`
+when the package is built (decision-22), so what ships is one plain CSS file; a
+site theme's own `static/style.css` replaces it wholesale and needs no
+Tailwind. Every colour is a `--color-*` custom property a site can override.
+`base.njk` is its shell: a skip link, a `.global-wrapper` carrying `data-is-root-path="true"`
 at `/` only, a header that is the site title and tagline on the front page and a
 small link home on every other — with `menus.primary` inside it on every page
 — `<main id="main">`, and a footer with the copyright year, the site author,

package/admin/pages/account/login.njk

@@ -12,6 +12,9 @@
 
   <form method="post" action="{{ loginUrl }}">
     <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+    {% if returnTo %}
+      <input type="hidden" name="return_to" value="{{ returnTo }}" />
+    {% endif %}
 
     {{ field.text('username', 'username', 'Username', username,
          autocomplete='username', required=true, autofocus=true) }}

package/admin/pages/documents/editor.njk

@@ -103,6 +103,13 @@
       <label for="editor-description">Description</label>
       <input id="editor-description" name="description" type="text" value="{{ form.description }}" />
 
+      {#- The `lang` front matter (TASK-154): a post or page written in another
+          language than the site's says so, for screen readers, translation
+          and fediverse language filters. -#}
+      <label for="editor-lang">Language</label>
+      <input id="editor-lang" name="lang" type="text" value="{{ form.lang }}" autocomplete="off" spellcheck="false" aria-describedby="editor-lang-hint" />
+      <p class="admin-hint" id="editor-lang-hint">A language tag, such as fr or pt-BR. Leave it empty for the site’s language, {{ siteLanguage }}.</p>
+
       {# Who the front matter says wrote this (TASK-67). A select of the site's
          users rather than a free box, because after decision-14 the value is a
          person rather than a string: it decides whose archive the post is on

package/admin/pages/indieauth/consent.njk

@@ -0,0 +1,51 @@
+{# The IndieAuth consent screen (TASK-158): an app wants to know who the
+   signed-in person is. A bare page like the login form, because the person
+   arrived from another site and has one thing to decide here. #}
+{% extends "layouts/base.njk" %}
+{% import "components/fields.njk" as field %}
+
+{% block title %}Sign in to {{ client.name }}{% endblock %}
+
+{% block content %}
+  {# A data: URI the server fetched, never the client's URL (TASK-190). #}
+  {% if client.logo %}
+    <img class="admin-consent-logo" src="{{ client.logo }}" alt="" width="64" height="64" />
+  {% endif %}
+  <h1>Sign in to {{ client.name }}?</h1>
+
+  <dl class="admin-consent">
+    <dt>App</dt>
+    <dd>{{ client.name }}{% if client.named %} <span class="admin-hint">({{ client.id }})</span>{% endif %}</dd>
+    <dt>Sends you back to</dt>
+    <dd>{{ redirectHost }}</dd>
+    <dt>Signs you in as</dt>
+    <dd>{{ identity }}</dd>
+    {% if resource %}
+      <dt>For use at</dt>
+      <dd>{{ resource }}</dd>
+    {% endif %}
+  </dl>
+
+  {% if loopback %}
+    <p class="admin-hint">This app runs on your own computer or network. Approve only if you started this sign-in yourself.</p>
+  {% endif %}
+
+  <form method="post" action="{{ consentUrl }}">
+    <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+    <input type="hidden" name="request" value="{{ pending }}" />
+
+    {% if scopes | length %}
+      <fieldset>
+        <legend>It also asks for</legend>
+        {% for scope in scopes %}
+          {{ field.checkbox('scope-' ~ scope.name, 'scope', scope.label, checked=true, value=scope.name) }}
+        {% endfor %}
+      </fieldset>
+    {% else %}
+      <p>It asks only who you are.</p>
+    {% endif %}
+
+    <button type="submit" name="decision" value="approve">Approve</button>
+    <button type="submit" name="decision" value="deny">Deny</button>
+  </form>
+{% endblock %}

package/admin/pages/indieauth/refused.njk

@@ -0,0 +1,11 @@
+{# A sign-in request that cannot go ahead (TASK-158). Shown rather than
+   redirected, because the fault is in the address it would redirect to. #}
+{% extends "layouts/base.njk" %}
+
+{% block title %}Sign-in refused{% endblock %}
+
+{% block content %}
+  <h1>This sign-in cannot go ahead</h1>
+  <p>{{ message }}</p>
+  <p>Go back to the app and try again. If it keeps happening, the app may be set up wrongly.</p>
+{% endblock %}

package/admin/pages/settings/general.njk

@@ -7,6 +7,7 @@
   {{ field.problem('settings-base-url', problems.baseUrl) }}
   {{ field.problem('settings-timezone', problems.timezone) }}
   {{ field.problem('settings-language', problems.language) }}
+  {{ field.problem('settings-locale', problems.locale) }}
 {% endblock %}
 
 {% block settingsFields %}
@@ -19,6 +20,10 @@
   {{ field.text('settings-author', fields.author, 'Author', form.author,
        hint='The name on the feeds.') }}
 
+  {% set soloAuthorHint %}The homepage speaks for the author: it shows their bio and links, and claims their author archive and profiles with <code>rel="me"</code>. Leave it off for a site with more than one author.{% endset %}
+  {{ field.checkbox('settings-solo-author', fields.soloAuthor, 'Solo author blog',
+       checked=form.soloAuthor, hint=soloAuthorHint) }}
+
   {% set baseUrlHint %}In effect: <code>{{ baseUrlInEffect }}</code>. {{ baseUrlNote }}{% endset %}
   {{ field.text('settings-base-url', fields.baseUrl, 'Base URL', form.baseUrl,
        error=problems.baseUrl, hint=baseUrlHint, inputmode='url',
@@ -31,6 +36,10 @@
   {% set languageHint %}A BCP 47 tag, such as <code>en</code> or <code>en-GB</code>. It is the page's <code>lang</code> and the feeds' language.{% endset %}
   {{ field.text('settings-language', fields.language, 'Language', form.language,
        error=problems.language, hint=languageHint, required=true) }}
+
+  {% set localeHint %}How the public site writes dates and counts, such as <code>en-US</code> for <code>September 2, 2026</code>. Leave it empty to follow the language.{% endset %}
+  {{ field.text('settings-locale', fields.locale, 'Locale', form.locale,
+       error=problems.locale, hint=localeHint) }}
 {% endblock %}
 
 {% block settingsPanels %}{% endblock %}

package/admin/pages/settings/reading.njk

@@ -9,6 +9,13 @@
   {{ field.problem('settings-posts-page', problems.postsPage) }}
   {{ field.problem('settings-posts-per-page', problems.postsPerPage) }}
   {{ field.problem('settings-notify-server', problems.notifyServer) }}
+  {{ field.problem('settings-feed-update-period', problems.feedUpdatePeriod) }}
+  {{ field.problem('settings-feed-update-frequency', problems.feedUpdateFrequency) }}
+  {{ field.problem('settings-ai-crawlers', problems.aiCrawlers) }}
+  {{ field.problem('settings-content-signal-search', problems.contentSignalSearch) }}
+  {{ field.problem('settings-content-signal-ai-input', problems.contentSignalAiInput) }}
+  {{ field.problem('settings-content-signal-ai-train', problems.contentSignalAiTrain) }}
+  {{ field.problem('settings-robots-rules', problems.robotsRules) }}
 {% endblock %}
 
 {% block settingsFields %}
@@ -68,4 +75,90 @@
   {% endset %}
   {{ field.text('settings-notify-server', fields.notifyServer, 'Notify server', form.notifyServer,
        error=problems.notifyServer, hint=notifyHint, inputmode='url') }}
+
+  {# TASK-152. The Syndication module's polling hint, which only RSS has an
+     element for. #}
+  {% set periodHint %}
+    How often RSS readers should check the feeds. Readers that see no new post
+    for much longer than this may check less often, so pick a pace the site keeps.
+  {% endset %}
+  {% call field.select('settings-feed-update-period', fields.feedUpdatePeriod, 'Feed update period',
+       error=problems.feedUpdatePeriod, hint=periodHint) %}
+    {% for option in [
+         ['hourly', 'Hourly'],
+         ['daily', 'Daily'],
+         ['weekly', 'Weekly'],
+         ['monthly', 'Monthly'],
+         ['yearly', 'Yearly']] %}
+      <option value="{{ option[0] }}"{% if option[0] == form.feedUpdatePeriod %} selected{% endif %}>{{ option[1] }}</option>
+    {% endfor %}
+  {% endcall %}
+
+  {{ field.text('settings-feed-update-frequency', fields.feedUpdateFrequency, 'Checks per period',
+       form.feedUpdateFrequency, error=problems.feedUpdateFrequency, inputmode='numeric', required=true,
+       hint='How many times in each period. Daily and 2 means twice a day.') }}
+
+  {# TASK-148. What /robots.txt tells crawlers beyond keeping them out of the
+     admin, which it does whatever is set here. #}
+  <h2>Crawlers</h2>
+
+  {% set aiHint %}
+    Training crawlers gather pages to train AI models. Retrieval crawlers fetch a
+    page when somebody asks an assistant about it, so blocking them also stops the
+    site being cited. Each choice writes its own groups into
+    <a href="/robots.txt"><code>/robots.txt</code></a>.
+  {% endset %}
+  {% call field.select('settings-ai-crawlers', fields.aiCrawlers, 'AI crawlers',
+       error=problems.aiCrawlers, hint=aiHint) %}
+    {% for option in [
+         ['allow', 'Allow all'],
+         ['block-training', 'Block training crawlers'],
+         ['block-all', 'Block all AI crawlers']] %}
+      <option value="{{ option[0] }}"{% if option[0] == form.aiCrawlers %} selected{% endif %}>{{ option[1] }}</option>
+    {% endfor %}
+  {% endcall %}
+
+  {% for signal in [
+       ['contentSignalSearch', 'settings-content-signal-search', 'Content signal: search',
+        'Whether pages may be indexed and shown as search results.'],
+       ['contentSignalAiInput', 'settings-content-signal-ai-input', 'Content signal: AI input',
+        'Whether pages may be fed to an AI model to answer a question.'],
+       ['contentSignalAiTrain', 'settings-content-signal-ai-train', 'Content signal: AI training',
+        'Whether pages may be used to train or fine-tune an AI model.']] %}
+    {% call field.select(signal[1], fields[signal[0]], signal[2],
+         error=problems[signal[0]], hint=signal[3]) %}
+      {% for option in [['', 'Not said'], ['yes', 'Yes'], ['no', 'No']] %}
+        <option value="{{ option[0] }}"{% if option[0] == form[signal[0]] %} selected{% endif %}>{{ option[1] }}</option>
+      {% endfor %}
+    {% endcall %}
+  {% endfor %}
+
+  {% set rulesHint %}
+    More <code>robots.txt</code> groups, written as they would be in the file: one or
+    more <code>User-agent</code> lines, then <code>Allow</code>, <code>Disallow</code>,
+    <code>Crawl-delay</code> or <code>Content-Signal</code> lines. Every group still
+    keeps crawlers out of <code>/admin/</code>, and the sitemap is always named.
+  {% endset %}
+  {{ field.textarea('settings-robots-rules', fields.robotsRules, 'More robots.txt rules',
+       form.robotsRules, error=problems.robotsRules, hint=rulesHint,
+       rows='5', spellcheck='false') }}
+
+  {# TASK-149. The index for language models, beside the file for crawlers. #}
+  {% set llmsHint %}
+    <a href="/llms.txt"><code>/llms.txt</code></a> lists the site's pages and recent
+    posts, each linked to its Markdown, for AI tools to read. The home page points
+    to it. To write it yourself, put your own file at <code>content/llms.txt</code>.
+  {% endset %}
+  {{ field.checkbox('settings-llms-txt', fields.llmsTxt, 'Serve /llms.txt',
+       checked=form.llmsTxt, hint=llmsHint) }}
+
+  {# TASK-151. Telling the search engines, beside the files they read. #}
+  {% set indexNowHint %}
+    Tells Bing, Yandex, Naver, Seznam and the other IndexNow search engines about
+    every post or page you publish, change or delete, so they recrawl it within
+    minutes. Turning it on creates a key the site serves at
+    <code>/{key}.txt</code>. Nothing is sent while the site's URL is local.
+  {% endset %}
+  {{ field.checkbox('settings-index-now', fields.indexNow, 'Submit changes to IndexNow',
+       checked=form.indexNow, hint=indexNowHint) }}
 {% endblock %}

package/admin/pages/users/apps.njk

@@ -0,0 +1,74 @@
+{# /admin/users/apps: the apps that can act as whoever is signed in (TASK-162).
+
+   Only your own connections, each with a Revoke button that names the app,
+   so a screen reader moving between buttons hears which one it is on. #}
+{% extends "layouts/shell.njk" %}
+
+{% block title %}Connected apps{% endblock %}
+
+{% block content %}
+  <h1>Connected apps</h1>
+
+  {% if connections | length %}
+    <p class="admin-hint">
+      These apps signed in as you and can act as you, within the permissions
+      listed. An app that keeps using its connection stays connected; one left
+      unused is disconnected on the date shown. Revoking disconnects it now:
+      its next request is refused, and it has to ask you again.
+    </p>
+
+    <table class="admin-list">
+      <caption class="admin-visually-hidden">Connected apps</caption>
+      <thead>
+        <tr>
+          <th scope="col">App</th>
+          <th scope="col">Can</th>
+          <th scope="col">Connected</th>
+          <th scope="col">Last used</th>
+          <th scope="col">Expires</th>
+          <th scope="col">Actions</th>
+        </tr>
+      </thead>
+      <tbody>
+        {% for connection in connections %}
+          <tr>
+            <td><a href="{{ connection.url }}">{{ connection.name }}</a></td>
+            <td>
+              <ul>
+                {% for scope in connection.scopes %}
+                  <li>{{ scope }}</li>
+                {% else %}
+                  <li>Confirm who you are</li>
+                {% endfor %}
+              </ul>
+            </td>
+            <td><time datetime="{{ connection.issued.iso }}">{{ connection.issued.text }}</time></td>
+            <td>
+              {% if connection.lastUsed %}
+                <time datetime="{{ connection.lastUsed.iso }}">{{ connection.lastUsed.text }}</time>
+              {% else %}
+                <span class="admin-status">Not yet</span>
+              {% endif %}
+            </td>
+            <td><time datetime="{{ connection.expires.iso }}">{{ connection.expires.text }}</time></td>
+            <td class="admin-actions">
+              <form method="post" action="{{ revokeUrl }}">
+                <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+                <input type="hidden" name="{{ connectionField }}" value="{{ connection.id }}" />
+                <button type="submit">Revoke {{ connection.name }}</button>
+              </form>
+            </td>
+          </tr>
+        {% endfor %}
+      </tbody>
+    </table>
+  {% else %}
+    <p>No apps are connected to your account.</p>
+    <p class="admin-hint">
+      An app connects here when you sign in to it with your site's address and
+      approve what it asks for: a Micropub app such as Quill that posts to
+      your site, or an MCP client such as an AI assistant. Each one you approve
+      is listed here, with a button to disconnect it.
+    </p>
+  {% endif %}
+{% endblock %}

package/admin/pages/users/edit.njk

@@ -211,6 +211,18 @@
      whoever is signed in and means nothing on somebody else's screen.
      Resetting a colleague's password from under them is deliberately not
      offered — a fresh account is what that is for. #}
+  {# Only on your own page, as the screen it links to only ever lists your
+     own connections (TASK-162). #}
+  {% if account.you %}
+    <section class="admin-settings">
+      <h2>Connected apps</h2>
+      <p class="admin-hint">
+        Apps you signed in to with your site's address can act as you.
+        <a href="{{ connectedAppsUrl }}">Review or revoke them</a>.
+      </p>
+    </section>
+  {% endif %}
+
   {% if account.you %}
     <form class="admin-settings" id="change-password" method="post" action="{{ changePasswordUrl }}">
       <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />

package/admin/static/admin.css

@@ -1347,3 +1347,30 @@ button[type='submit']:hover,
   background: var(--admin-surface);
   border: 1px solid var(--admin-border);
 }
+
+/* The IndieAuth consent screen (TASK-158): who is asking, where the answer
+   goes and who it names, as label and value pairs a person reads down. */
+
+.admin-consent {
+  display: grid;
+  margin: 0 0 1.5rem;
+  gap: 0.4rem 1.5rem;
+  grid-template-columns: max-content 1fr;
+}
+
+.admin-consent dt {
+  color: var(--admin-muted);
+}
+
+.admin-consent dd {
+  margin: 0;
+  overflow-wrap: anywhere;
+}
+
+.admin-consent-logo {
+  display: block;
+  width: 4rem;
+  height: 4rem;
+  margin: 0 0 1rem;
+  object-fit: contain;
+}

package/dist/admin/accounts.d.ts

@@ -382,6 +382,9 @@ export declare class UnknownUserError extends Error {
 /**
  * Take a user out of the file. Returns `false` when there was nothing to take.
  *
+ * Their IndieAuth tokens go with them (TASK-160): a token is a file in
+ * `data/` too, so it is revoked here, where every caller deletes a user.
+ *
  * Their sessions are not ended here: sessions are in the database, and the
  * screen that deletes a user ends them itself. A session that outlives this —
  * one in a database restored from a backup, say — names a user the file no