@geekity/cms 0.14.0 → 0.16.0

package/README.md

@@ -1185,6 +1185,113 @@ answers 404 or 410 — takes it away. Closing rules do not apply: a post that
 stopped taking comments still hears about a page that links to it, exactly as it
 still hears a fediverse reply.
 
+### Syndication targets
+
+Some services copy a post when it links to them and sends them a webmention,
+and answer with the address of the copy. IndieNews lists posts about the
+IndieWeb; Bridgy Publish posts to Mastodon, Bluesky, GitHub and Flickr. The
+CMS knows none of them by name. A site lists the ones it uses on the admin's
+**Posts > Syndication** screen (`/admin/syndication`), which reads
+and writes `content/_data/syndicationTargets.json`. The file stays the source of
+truth, so it can still be edited by hand, and it looks like this:
+
+```json
+[
+  {
+    "id": "indienews",
+    "name": "IndieNews",
+    "url": "https://news.indieweb.org/en",
+    "tag": "indienews"
+  },
+  {
+    "id": "mastodon",
+    "name": "Mastodon",
+    "url": "https://brid.gy/publish/mastodon"
+  }
+]
+```
+
+| Key         | What it is                                                                                    |
+| ----------- | --------------------------------------------------------------------------------------------- |
+| `id`        | What a post's `syndicate-to` lists. Letters, digits, `.`, `-` and `_`.                        |
+| `name`      | What the editor's checkbox and the post's link say.                                           |
+| `url`       | The page the post links to and sends its webmention to. May hold `{lang}`.                    |
+| `tag`       | Optional. A post carrying this tag is sent to the target without listing it.                  |
+| `languages` | Optional. The language tags the target takes posts in. A post in any other language skips it. |
+
+An entry missing any of the first three, repeating an id, or with a `languages`
+value that is not a list of language tags, is ignored. It is reported in the log
+when the site starts, and the Syndication screen shows it with its problem so it
+can be fixed or removed there. No file means no targets.
+
+The screen has a panel for each entry, in file order, and an **Add a target**
+form. A save is checked by the same rules the file is read by: a field that
+breaks one is marked on the form and the file is left as it was. A save that
+passes is written atomically, and the editor's **Syndicate to** checkboxes and
+Micropub's `q=syndicate-to` offer the change on the next request. A save or
+remove is refused when the entry changed in the file since the page was drawn.
+A file that is not a JSON list is shown with its problem and never saved over.
+To keep the default theme's old IndieNews link, add a target with the id
+`indienews`, the url `https://news.indieweb.org/{lang}` and the tag `indienews`.
+
+Some targets have a page per language. IndieNews has `news.indieweb.org/en`,
+`/de`, `/fr` and more. Declare one target and put `{lang}` where the language
+goes:
+
+```json
+{
+  "id": "indienews",
+  "name": "IndieNews",
+  "url": "https://news.indieweb.org/{lang}",
+  "tag": "indienews",
+  "languages": ["en", "de", "fr"]
+}
+```
+
+The CMS fills `{lang}` with the post's language: its `lang` front matter, or the
+site's language when the post names none. With `languages`, a post in a
+language the list does not name neither links to the target nor notifies it. A
+regional tag counts as its language, so a `de-AT` post goes to
+`news.indieweb.org/de`, and `{lang}` takes the tag from the list. Without
+`languages`, `{lang}` takes the post's own tag as written, region and all.
+
+A post selects targets in one of two ways:
+
+- **By listing them.** The post editor has a **Syndicate to** checkbox for each
+  target, and saving writes the ticked ids into the front matter as
+  `syndicate-to: [indienews, mastodon]`. An id no target declares is kept as
+  written.
+- **By its tags.** A post tagged `indienews` is sent to the target whose `tag`
+  is `indienews`, as the WordPress IndieNews plugin did.
+
+The default theme links to each selected target at the start of the Published
+line, inside the post's `h-entry`, as `<a class="u-syndication"
+href="https://news.indieweb.org/en">IndieNews</a>`. That link is what IndieNews
+and Bridgy Publish check for when they fetch the post. When the post is
+published or updated, the sender adds each selected target to the pages it
+notifies, the same way it adds the post a reply answers. Nothing is sent while a
+page is served.
+
+A target that answers `201` or `202` with a `Location` header has made a copy.
+The address is kept in `content/_data/syndication.json`, keyed by the post's
+permalink (decision-26), and the theme prints it after the dates as **Also on**
+with a `u-syndication` link. A copy made by hand goes in the post's own front
+matter, and is printed the same way:
+
+```yaml
+syndication:
+  - https://mastodon.social/@me/113000000000000000
+```
+
+Removing a target from `syndicate-to`, or removing its tag, removes the link.
+The sender then tells the target, as it tells any page a post stops linking to,
+and the copy is dropped from `syndication.json`. IndieNews takes the post down
+when it finds the link gone. Drafting or trashing the post does the same.
+
+The posts table on `/admin/federation` lists each selected target with how its
+last webmention went and a link to its copy, and **Resend** sends to the targets
+again.
+
 ## Email
 
 The CMS sends its mail through one service and one seam. Everything that will
@@ -1671,53 +1778,53 @@ that ship inside the package, deliberately outside the theme search path: a
 site's theme may override any public template, and must not be able to
 shadow the login form.
 
-| Route                                            | What it does                                                                        |
-| ------------------------------------------------ | ----------------------------------------------------------------------------------- |
-| `/admin`                                         | The dashboard: counts, the five most recent posts, the follower count.              |
-| `/admin/posts`, `/admin/pages`                   | The listings and the editors.                                                       |
-| `/admin/tags`, `/admin/categories`               | Every term in use, with rename, merge and delete.                                   |
-| `/admin/tags/rename`, `/admin/categories/rename` | `POST` only. Renames a term, or merges it into one that exists.                     |
-| `/admin/tags/delete`, `/admin/categories/delete` | `POST` only. Takes a term out of every file.                                        |
-| `/admin/navigation`                              | Navigation > Menus: every menu the site holds. `POST` saves one menu's items.       |
-| `/admin/navigation/add`                          | `POST` only. Adds an empty menu under the name the form gives.                      |
-| `/admin/navigation/delete`                       | `POST` only. Deletes one menu the active theme renders nowhere.                     |
-| `/admin/media`                                   | Everything under `content/uploads`, with the URL, the Markdown and what uses it.    |
-| `/admin/media/upload`                            | `POST` only. Stores one file by the rules the editor's upload enforces.             |
-| `/admin/media/delete`                            | `POST` only. Deletes one upload, asking first when a document points at it.         |
-| `/admin/media/alt`                               | `POST` only. Sets a picture's alt text, or marks it decorative, in `media.json`.    |
-| `/admin/comments`                                | Pending, approved and spam, with approve, spam, delete and reply.                   |
-| `/admin/comments/moderate`                       | `POST` only. Approves one comment, files it as spam, or deletes it.                 |
-| `/admin/comments/reply`                          | `POST` only. Posts an approved reply under the comment it answers.                  |
-| `/admin/messages`                                | The contact form's inbox, with a Spam list beside it.                               |
-| `/admin/messages/read`                           | `POST` only. Marks one message read, or unread again.                               |
-| `/admin/messages/delete`                         | `POST` only. Deletes one message, and its file with it.                             |
-| `/admin/appearance/themes`                       | Appearance > Themes: the themes on disk. `POST` activates the one named.            |
-| `/admin/tools`                                   | Tools > Content index: what the index holds, and the button that rebuilds it.       |
-| `/admin/tools/rebuild-index`                     | `POST` only. Offers the rebuild, then reads every file again on the live site.      |
-| `/admin/settings`                                | Settings > General: title, tagline, author, base URL, time zone, language, locale.  |
-| `/admin/settings/reading`                        | What the homepage displays, posts per page, the notify server.                      |
-| `/admin/settings/permalinks`                     | The tag and category bases, and the archive redirects already recorded.             |
-| `/admin/settings/discussion`                     | Comments and the closing window, webmentions, and the Akismet key.                  |
-| `/admin/settings/akismet`                        | `POST` only. Saves the Akismet key, or forgets it.                                  |
-| `/admin/settings/email`                          | The mail provider, the From line, the reply-to and the contact address.             |
-| `/admin/settings/mail`                           | `POST` only. Saves a mail credential, or forgets every one of them.                 |
-| `/admin/settings/mail/test`                      | `POST` only. Sends the theme's test message through the whole chain.                |
-| `/admin/users`                                   | Who may sign in: a row each, with Edit and Delete. Nothing on it edits anybody.     |
-| `/admin/users/new`                               | Users > Add new: the add form. `POST` adds one.                                     |
-| `/admin/users/<id>`                              | One user: the account, the profile, the notices, your password, and the delete.     |
-| `/admin/users/password`                          | `POST` only. Changes the signed-in admin's own password.                            |
-| `/admin/users/email`                             | `POST` only. Sets or clears the email address on the user the form names.           |
-| `/admin/users/profile`                           | `POST` only. Saves the whole public profile of the user the form names.             |
-| `/admin/users/notifications`                     | `POST` only. Turns one notice on or off for the user the form names.                |
-| `/admin/users/notifications/mode`                | `POST` only. Sets how often that notice arrives: as they arrive, hourly or daily.   |
-| `/admin/users/delete`                            | `POST` only. Deletes the user the form names.                                       |
-| `/admin/federation`                              | The actors, their followers, the inbox log, and per-post delivery.                  |
-| `/admin/federation/settings`                     | Federation > Settings: the relays the site subscribes to, and the WordPress switch. |
-| `/admin/federation/resend`                       | `POST` only. Sends one post to the followers again, as its file now reads.          |
-| `/admin/setup`                                   | First run: creates the first admin. Closed once a user exists.                      |
-| `/admin/login`                                   | Username and password.                                                              |
-| `/admin/logout`                                  | `POST` only. Deletes the session row and sends `Clear-Site-Data`.                   |
-| `/admin/_static/*`                               | The admin's own stylesheet and scripts, cached for an hour.                         |
+| Route                                            | What it does                                                                                  |
+| ------------------------------------------------ | --------------------------------------------------------------------------------------------- |
+| `/admin`                                         | The dashboard: counts, the five most recent posts, the follower count.                        |
+| `/admin/posts`, `/admin/pages`                   | The listings and the editors.                                                                 |
+| `/admin/tags`, `/admin/categories`               | Every term in use, with rename, merge and delete.                                             |
+| `/admin/tags/rename`, `/admin/categories/rename` | `POST` only. Renames a term, or merges it into one that exists.                               |
+| `/admin/tags/delete`, `/admin/categories/delete` | `POST` only. Takes a term out of every file.                                                  |
+| `/admin/navigation`                              | Navigation > Menus: every menu the site holds. `POST` saves one menu's items.                 |
+| `/admin/navigation/add`                          | `POST` only. Adds an empty menu under the name the form gives.                                |
+| `/admin/navigation/delete`                       | `POST` only. Deletes one menu the active theme renders nowhere.                               |
+| `/admin/media`                                   | Everything under `content/uploads`, with the URL, the Markdown and what uses it.              |
+| `/admin/media/upload`                            | `POST` only. Stores one file by the rules the editor's upload enforces.                       |
+| `/admin/media/delete`                            | `POST` only. Deletes one upload, asking first when a document points at it.                   |
+| `/admin/media/alt`                               | `POST` only. Sets a picture's alt text, or marks it decorative, in `media.json`.              |
+| `/admin/comments`                                | Pending, approved and spam, with approve, spam, delete and reply.                             |
+| `/admin/comments/moderate`                       | `POST` only. Approves one comment, files it as spam, or deletes it.                           |
+| `/admin/comments/reply`                          | `POST` only. Posts an approved reply under the comment it answers.                            |
+| `/admin/messages`                                | The contact form's inbox, with a Spam list beside it.                                         |
+| `/admin/messages/read`                           | `POST` only. Marks one message read, or unread again.                                         |
+| `/admin/messages/delete`                         | `POST` only. Deletes one message, and its file with it.                                       |
+| `/admin/appearance/themes`                       | Appearance > Themes: the themes on disk. `POST` activates the one named.                      |
+| `/admin/tools`                                   | Tools > Content index: what the index holds, and the button that rebuilds it.                 |
+| `/admin/tools/rebuild-index`                     | `POST` only. Offers the rebuild, then reads every file again on the live site.                |
+| `/admin/settings`                                | Settings > General: title, tagline, author, base URL, time zone, language, locale, site icon. |
+| `/admin/settings/reading`                        | What the homepage displays, posts per page, the notify server.                                |
+| `/admin/settings/permalinks`                     | The tag and category bases, and the archive redirects already recorded.                       |
+| `/admin/settings/discussion`                     | Comments and the closing window, webmentions, and the Akismet key.                            |
+| `/admin/settings/akismet`                        | `POST` only. Saves the Akismet key, or forgets it.                                            |
+| `/admin/settings/email`                          | The mail provider, the From line, the reply-to and the contact address.                       |
+| `/admin/settings/mail`                           | `POST` only. Saves a mail credential, or forgets every one of them.                           |
+| `/admin/settings/mail/test`                      | `POST` only. Sends the theme's test message through the whole chain.                          |
+| `/admin/users`                                   | Who may sign in: a row each, with Edit and Delete. Nothing on it edits anybody.               |
+| `/admin/users/new`                               | Users > Add new: the add form. `POST` adds one.                                               |
+| `/admin/users/<id>`                              | One user: the account, the profile, the notices, your password, and the delete.               |
+| `/admin/users/password`                          | `POST` only. Changes the signed-in admin's own password.                                      |
+| `/admin/users/email`                             | `POST` only. Sets or clears the email address on the user the form names.                     |
+| `/admin/users/profile`                           | `POST` only. Saves the whole public profile of the user the form names.                       |
+| `/admin/users/notifications`                     | `POST` only. Turns one notice on or off for the user the form names.                          |
+| `/admin/users/notifications/mode`                | `POST` only. Sets how often that notice arrives: as they arrive, hourly or daily.             |
+| `/admin/users/delete`                            | `POST` only. Deletes the user the form names.                                                 |
+| `/admin/federation`                              | The actors, their followers, the inbox log, and per-post delivery.                            |
+| `/admin/federation/settings`                     | Federation > Settings: the relays the site subscribes to, and the WordPress switch.           |
+| `/admin/federation/resend`                       | `POST` only. Sends one post to the followers again, as its file now reads.                    |
+| `/admin/setup`                                   | First run: creates the first admin. Closed once a user exists.                                |
+| `/admin/login`                                   | Username and password.                                                                        |
+| `/admin/logout`                                  | `POST` only. Deletes the session row and sends `Clear-Site-Data`.                             |
+| `/admin/_static/*`                               | The admin's own stylesheet and scripts, cached for an hour.                                   |
 
 The screens behind the login share one layout: a bar across the top with the
 site name and a link to the public site, the menu down the left, and a place for
@@ -1846,7 +1953,8 @@ at once cannot each keep half of what the other kept.
 
 The file carries `title`, `tagline`, `url`, `author` (a username, when the
 site has one author), `postsPerPage`, `homepage`, `postsPage`,
-`timezone`, `language`, `locale` (when it is set), `tagBase`,
+`timezone`, `language`, `locale` (when it is set), `icon` (when it is set),
+`license` and `licenseName` (when a license is chosen; see below), `tagBase`,
 `categoryBase`, `notifyServer`, `feedUpdatePeriod`, `feedUpdateFrequency`,
 `webmentionsSend`, `webmentionsReceive`,
 `mailProvider`, `mailFromName`, `mailFromAddress`, `mailReplyTo`,
@@ -1999,7 +2107,7 @@ would have done anyway.
 | `removeImageVariants`              | Take a source's derived directory away.                                              |
 | `responsiveImages(html, describe)` | Rewrite `<img src="/uploads/…">` as `<picture>`. Pure: hand it any lookup.           |
 | `siteImageMarkup(config, html)`    | The same, over one site's own records, deriving in the background for a record miss. |
-| `siteIcons(config, avatar)`        | The head's icon links for a site's avatar: `{ rel, sizes, href }`, or none at all.   |
+| `siteIcons(config, setting)`       | The head's icon links for a site's icon setting: `{ rel, sizes, href }`, or none.    |
 
 `describeImage` is synchronous and cached because it is called once per image
 while a page renders, and decision-10 forbids probing an image file at render
@@ -2009,10 +2117,11 @@ markup that asks for them back, and the first request for each one rebuilds it.
 
 The site's icons are derived copies of the same kind, and `siteIcons` is how a
 head gets at them: three square PNGs, `icon` at 32 and 16 pixels and
-`apple-touch-icon` at 180, cropped from the middle of the site's avatar and
+`apple-touch-icon` at 180, cropped from the middle of the site's icon (the
+`icon` that Settings > General writes, else a hand-set `avatar`) and
 encoded the first time a browser asks for one. It answers an empty list — and
-the packaged theme then links no icon at all — when the site has no avatar, when
-its avatar is a file no icon can be made of, or when `imageOptimization` is off,
+the packaged theme then links no icon at all — when the site has no icon, when
+its icon is a file no icon can be made of, or when `imageOptimization` is off,
 so a head never advertises a URL this server would answer 404 for.
 
 `documentContext(document, images)` is where the rewrite is applied. Passing the
@@ -2869,8 +2978,22 @@ to read them on, `wfw:commentRss` (the [Well-Formed Web][wfw-ns] comment API) is
 the feed to poll, and `source:comments` is that same feed with a `count`
 attribute, so a reader can say "3 comments" without fetching anything.
 
+When the site has a license (Settings > General, or `license` in `site.json`),
+the channel carries a `creativeCommons:license` holding its URL, and every item
+carries one for its own license: the post's `license` front matter, else the
+site's. A post whose front matter says `license: none` carries none. The
+element is the [Creative Commons RSS module][cc-rss], declared as
+`xmlns:creativeCommons` only when some license is printed. It names a license
+by URL, Creative Commons or not, which a reader can act on; `dc:rights` would be
+free text. Nothing about a license is printed on a site and posts without one.
+RSS has no element that says "no license", so a post saying `license: none`
+on a licensed site carries no item license while the channel still names the
+site's; a reader that applies the channel's license to every item reads that
+post as under it.
+
 [source-ns]: https://source.scripting.com/
 [wfw-ns]: http://wellformedweb.org/CommentAPI/
+[cc-rss]: https://cyber.harvard.edu/rss/creativeCommonsRssModule.html
 
 ### Comments
 
@@ -2925,6 +3048,14 @@ post as `content type="html"`. The feed itself carries `id`, `title`,
 `xml:lang` from the `language` setting, and — when the site names a notify
 server — a `source:cloud` and a `link rel="hub"`.
 
+With a license, the feed carries an [RFC 4946][rfc4946] `link rel="license"`
+to the site's license, its name as the `title`, and every entry carries one for
+its own license, the post's `license` front matter else the site's. An entry
+states its own because RFC 4946 does not let an entry inherit the feed's. JSON
+Feed has no field for a license and says nothing about one.
+
+[rfc4946]: https://www.rfc-editor.org/rfc/rfc4946
+
 A JSON Feed item carries `id` (the object id), `url` (the permalink), `title`,
 `content_html`, `summary`, `date_published`, `date_modified`, `tags` (the
 terms) and `authors`; the feed carries `version`, `title`, `home_page_url`,
@@ -2935,6 +3066,93 @@ The XML is written by this package rather than by a library. Text is escaped;
 `content:encoded` and `source:markdown` are CDATA sections, with any `]]>` in
 the text split across two sections so it cannot end one early.
 
+### A recording on a post
+
+A post can carry one recording: a spoken version of an article, or an episode
+now and then. The site is a blog that sometimes has audio, not a podcast host,
+so the feeds carry what a podcast app needs to play, describe and caption an
+item, and leave the podcast directory tags out. The front matter spells it the
+way RSS does:
+
+```yaml
+enclosure:
+  url: /uploads/2026/10/episode-12.mp3 # an upload; written by the editor
+  type: audio/mpeg # from the upload table; written by the editor
+  length: 23456789 # bytes, from the file on disk; written by the editor
+  duration: 1834 # seconds, optional
+  transcript: # optional
+    url: /uploads/2026/10/episode-12.vtt # an upload or an http(s) URL
+    type: text/vtt # text/vtt, application/x-subrip, text/html or text/plain
+  alternates: # optional, any number
+    - url: /uploads/2026/10/episode-12.mp4
+      type: video/mp4
+      length: 98765432
+      title: Video # optional, at most 32 characters
+      height: 720 # optional, for video
+      lang: en # optional
+    - url: https://cdn.example.com/episode-12-low.mp3
+      type: audio/mpeg # required for a link
+      title: Low bandwidth # a link's length is optional
+```
+
+**The main file is always an upload** under `/uploads/`, because RSS requires
+its `url`, `length` and `type`, and an upload is the only file whose length the
+site knows. A main file without all three is no recording at all. A bad
+alternate version or transcript is dropped on its own, so one wrong line in a
+hand-edited file costs that line and not the episode. `enclosureOf(extra)` is
+the one reading of the key, and the feeds, the theme and the federation read
+only what it returns.
+
+**The post editor** has a Recording section on posts. The main file is a select
+of the audio and video in the media library, and None removes the whole key,
+transcript and alternate versions included. The duration takes seconds, `30:34`
+or `1:02:03`. The transcript is an upload (`.vtt`, `.srt` or `.txt`) or an
+`https` address with its type. Alternate versions are numbered rows with one
+blank row at the end, so a plain form can add, edit and remove them; emptying a
+row's address removes it. On save, the type and length of every upload are read
+from the upload table and from the file on disk, never from the form. A main
+file that is not an audio or video upload, a linked version without an `http`
+or `https` address or a media type, or a title over 32 characters is refused
+with a message, and nothing is written.
+
+**What the feeds print, and when.** A post with no recording prints none of
+this, and a feed with no recording in it declares neither namespace, so its
+bytes and its ETag are what they were before recordings existed.
+
+| Element                                                     | Format      | Printed when                                                                                                                                                                            |
+| ----------------------------------------------------------- | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `<enclosure url length type/>`                              | RSS item    | The post has a main file. `url` is absolute.                                                                                                                                            |
+| `<podcast:alternateEnclosure>` with `<podcast:source uri/>` | RSS item    | Once per alternate version, with `type`, and `length`, `title`, `height` and `lang` when known.                                                                                         |
+| `<podcast:transcript url type/>`                            | RSS item    | The post has a transcript, with `rel="captions"` for WebVTT or SubRip.                                                                                                                  |
+| `<itunes:duration>`                                         | RSS item    | The duration is known, in whole seconds.                                                                                                                                                |
+| `<podcast:medium>blog</podcast:medium>`                     | RSS channel | Any item in the feed has a recording. Without it an app assumes `podcast`; `blog` is the spec's word for articles that sometimes have audio.                                            |
+| `<link rel="enclosure" type length href/>`                  | Atom entry  | The post has a main file. Atom has no way to say the others are versions of it.                                                                                                         |
+| `attachments`                                               | JSON Feed   | The main file and then each alternate version, with `url`, `mime_type`, `size_in_bytes` and `title` when known, and `duration_in_seconds` on audio or video when the duration is known. |
+
+`xmlns:podcast="https://podcastindex.org/namespace/1.0"` is declared only on a
+feed that prints a podcast element, and
+`xmlns:itunes="http://www.itunes.com/dtds/podcast-1.0.dtd"` only on one that
+prints `itunes:duration`.
+
+**Left out on purpose:** the Apple directory tags (`itunes:image`,
+`itunes:category`, `itunes:explicit`, `itunes:owner`), and `podcast:guid`,
+`podcast:locked`, `podcast:person`, `podcast:season`, `podcast:episode`,
+`podcast:value` and `podcast:chapters`. Each one matters only to a podcast
+directory or a dedicated show. Adding them is a follow-up for a site that wants
+to be listed in Apple Podcasts, and so is `podcast:license`, which could reuse
+the [content license](#rss-20).
+
+**The fediverse** gets the main file as an `Audio` or `Video` attachment with
+its absolute `url`, its `mediaType`, and the post's title, or a note's first
+words, as its `name`. It goes before the post's `Image` attachments, because
+Mastodon shows a player or a gallery by the type of the first attachment and
+keeps only four. Alternate versions and linked files stay out: a remote server
+fetches and re-encodes what it is given, and a link to another host is a type
+this site cannot check. `playsAsVideo(type)` decides `Video` against `Audio`,
+and the default theme's `<video>` against `<audio>`, so the two never disagree.
+
+The default theme plays the main file on the post page; see its README.
+
 ### Real-time notification
 
 A feed reader that polls hears about a post when it next polls. An [rssCloud][]

package/admin/pages/documents/editor.njk

@@ -62,6 +62,97 @@
           formnovalidate
         >Preview</button>
       </div>
+
+      {% if kind.type == "post" %}
+        <fieldset class="admin-editor-enclosure admin-editor-photos">
+          <legend>Photos</legend>
+          <p class="admin-hint">
+            Each is an image in the media library or an address starting https://. Leave the alt text
+            empty to use the media library’s. Empty an address to remove that photo.
+          </p>
+          {% for row in photoRows %}
+            {% set n = loop.index0 %}
+            <fieldset class="admin-editor-alternate">
+              <legend>{% if row.url %}Photo {{ loop.index }}{% else %}Add a photo{% endif %}</legend>
+              <label for="editor-photo-url-{{ n }}">Address</label>
+              <input id="editor-photo-url-{{ n }}" name="{{ photoFields.url }}{{ n }}" type="text" value="{{ row.url }}" list="editor-photo-uploads" autocomplete="off" />
+              <label for="editor-photo-alt-{{ n }}">Alt text</label>
+              <input id="editor-photo-alt-{{ n }}" name="{{ photoFields.alt }}{{ n }}" type="text" value="{{ row.alt }}"{% if row.libraryAlt %} placeholder="{{ row.libraryAlt }}"{% endif %} />
+            </fieldset>
+          {% endfor %}
+          <datalist id="editor-photo-uploads">
+            {% for url in photoChoices %}
+              <option value="{{ url }}"></option>
+            {% endfor %}
+          </datalist>
+        </fieldset>
+        <fieldset class="admin-editor-enclosure">
+          <legend>Recording</legend>
+
+          <label for="editor-enclosure-url">Audio or video file</label>
+          <select id="editor-enclosure-url" name="{{ enclosureFields.url }}" aria-describedby="editor-enclosure-url-hint">
+            <option value=""{% if form.enclosure.url == "" %} selected{% endif %}>None</option>
+            {% for choice in enclosureChoices.media %}
+              <option value="{{ choice.url }}"{% if choice.url == form.enclosure.url %} selected{% endif %}>{{ choice.label }}</option>
+            {% endfor %}
+          </select>
+          <p class="admin-hint" id="editor-enclosure-url-hint">
+            Upload the file to the media library first. Feeds carry it as the post’s enclosure and the
+            post page plays it. None removes the recording, its transcript and its other versions.
+          </p>
+
+          <label for="editor-enclosure-duration">Duration</label>
+          <input id="editor-enclosure-duration" name="{{ enclosureFields.duration }}" type="text" inputmode="numeric" value="{{ form.enclosure.duration }}" autocomplete="off" aria-describedby="editor-enclosure-duration-hint" />
+          <p class="admin-hint" id="editor-enclosure-duration-hint">Seconds, or 30:34, or 1:02:03. Leave it empty if you do not know.</p>
+
+          <label for="editor-enclosure-transcript">Transcript or captions</label>
+          <input id="editor-enclosure-transcript" name="{{ enclosureFields.transcriptUrl }}" type="text" value="{{ form.enclosure.transcriptUrl }}" list="editor-transcript-uploads" autocomplete="off" aria-describedby="editor-enclosure-transcript-hint" />
+          <datalist id="editor-transcript-uploads">
+            {% for url in enclosureChoices.transcripts %}
+              <option value="{{ url }}"></option>
+            {% endfor %}
+          </datalist>
+          <label for="editor-enclosure-transcript-type">Transcript type</label>
+          <select id="editor-enclosure-transcript-type" name="{{ enclosureFields.transcriptType }}" aria-describedby="editor-enclosure-transcript-hint">
+            <option value=""{% if form.enclosure.transcriptType == "" %} selected{% endif %}>From the file</option>
+            {% for type in transcriptTypes %}
+              <option value="{{ type }}"{% if type == form.enclosure.transcriptType %} selected{% endif %}>{{ type }}</option>
+            {% endfor %}
+          </select>
+          <p class="admin-hint" id="editor-enclosure-transcript-hint">
+            A .vtt, .srt or .txt file in the media library, or an address starting https://. A linked
+            transcript needs its type.
+          </p>
+
+          <h2 class="admin-editor-enclosure-heading">Other versions</h2>
+          <p class="admin-hint">
+            A video of an audio episode, a smaller file, another language. Each is a file in the media
+            library or an address starting https://, which needs its type. Empty an address to remove
+            that version.
+          </p>
+          {% for row in alternateRows %}
+            {% set n = loop.index0 %}
+            <fieldset class="admin-editor-alternate">
+              <legend>{% if row.url %}Version {{ loop.index }}{% else %}Add a version{% endif %}</legend>
+              <label for="editor-alternate-url-{{ n }}">Address</label>
+              <input id="editor-alternate-url-{{ n }}" name="{{ enclosureFields.alternate.url }}{{ n }}" type="text" value="{{ row.url }}" list="editor-media-uploads" autocomplete="off" />
+              <label for="editor-alternate-type-{{ n }}">Type</label>
+              <input id="editor-alternate-type-{{ n }}" name="{{ enclosureFields.alternate.type }}{{ n }}" type="text" value="{{ row.type }}" placeholder="video/mp4" autocomplete="off" spellcheck="false" />
+              <label for="editor-alternate-title-{{ n }}">Title</label>
+              <input id="editor-alternate-title-{{ n }}" name="{{ enclosureFields.alternate.title }}{{ n }}" type="text" value="{{ row.title }}" maxlength="32" />
+              <label for="editor-alternate-height-{{ n }}">Height</label>
+              <input id="editor-alternate-height-{{ n }}" name="{{ enclosureFields.alternate.height }}{{ n }}" type="text" inputmode="numeric" value="{{ row.height }}" autocomplete="off" />
+              <label for="editor-alternate-lang-{{ n }}">Language</label>
+              <input id="editor-alternate-lang-{{ n }}" name="{{ enclosureFields.alternate.lang }}{{ n }}" type="text" value="{{ row.lang }}" autocomplete="off" spellcheck="false" />
+            </fieldset>
+          {% endfor %}
+          <datalist id="editor-media-uploads">
+            {% for choice in enclosureChoices.media %}
+              <option value="{{ choice.url }}"></option>
+            {% endfor %}
+          </datalist>
+        </fieldset>
+      {% endif %}
     </div>
 
     <div class="admin-editor-side">
@@ -98,6 +189,16 @@
         <label for="editor-in-reply-to">In reply to</label>
         <input id="editor-in-reply-to" name="in-reply-to" type="url" value="{{ form.inReplyTo }}" />
         <p class="admin-hint">The address of the post this one answers. Leave it empty for a post that answers nobody.</p>
+
+        {#- The mf2 `like-of`, `repost-of` and `bookmark-of` (TASK-169): each
+            cites a page the way a reply does, and sends it a webmention. -#}
+        <label for="editor-like-of">Like of</label>
+        <input id="editor-like-of" name="like-of" type="url" value="{{ form.likeOf }}" />
+        <label for="editor-repost-of">Repost of</label>
+        <input id="editor-repost-of" name="repost-of" type="url" value="{{ form.repostOf }}" />
+        <label for="editor-bookmark-of">Bookmark of</label>
+        <input id="editor-bookmark-of" name="bookmark-of" type="url" value="{{ form.bookmarkOf }}" />
+        <p class="admin-hint">The address of a post this one likes, reposts or bookmarks. Leave them empty for a post that cites nothing.</p>
       {% endif %}
 
       <label for="editor-description">Description</label>
@@ -141,6 +242,25 @@
         </p>
       {% endif %}
 
+      {% if kind.type == "post" and syndicationTargets.length %}
+        {# TASK-155: the targets content/_data/syndicationTargets.json declares.
+           A target whose tag the post carries is selected without a tick. #}
+        <fieldset class="admin-editor-syndication">
+          <legend>Syndicate to</legend>
+          {% for target in syndicationTargets %}
+            <p class="admin-check">
+              <input id="editor-{{ target.field }}" name="{{ target.field }}" type="checkbox" value="1"{% if target.checked %} checked{% endif %} />
+              <label for="editor-{{ target.field }}">{{ target.name }}</label>
+            </p>
+          {% endfor %}
+          <p class="admin-hint">
+            Writes <code>syndicate-to:</code> into the front matter. The post links to each target and
+            sends it a webmention when it is published or updated. A post tagged with a target’s tag is
+            sent there without a tick.
+          </p>
+        </fieldset>
+      {% endif %}
+
       {# What this document says about comments, if anything. Three answers
          rather than two: the site's own rules, always open, always closed. #}
       <label for="editor-comments">Comments</label>