@geekity/cms 0.17.0 → 0.18.0

package/README.md

@@ -94,12 +94,13 @@ site (or `npx geekity`, or a `package.json` script, which is how the generated
 | `geekity rebuild`                         | Delete `data/geekity.db` and build it again from the files.                                                                                                           |
 | `geekity resend --all`, `<slug>...`       | Send announced posts to every follower and relay again, as they now read. See [Quote posts](#quote-posts).                                                            |
 | `geekity maintenance on`, `off`, `status` | Take the public site down on purpose with a 503 and `Retry-After`, or bring it back, without a restart. `on --until <time>` names when it should be back.             |
+| `geekity strip-metadata`                  | Remove location and camera metadata from files already in `content/uploads`. See [The media library](#the-media-library).                                             |
 | `geekity user add <name>`                 | Create an admin account, so a site can get its first login without the setup screen.                                                                                  |
 | `geekity import wordpress-actor <name>`   | Bring one person across from the WordPress ActivityPub plugin: their key pair, the actor id their followers hold, the plugin's numeric actor id, and their followers. |
 | `geekity --help`, `-h`                    | The same table, on the terminal.                                                                                                                                      |
 | `geekity --version`                       | The installed version.                                                                                                                                                |
 
-`serve`, `sync`, `rebuild`, `resend`, `maintenance`, `user add` and `import wordpress-actor` take
+`serve`, `sync`, `rebuild`, `resend`, `maintenance`, `strip-metadata`, `user add` and `import wordpress-actor` take
 `--config <file>`; without it they look for `geekity.config.ts`, then
 `geekity.config.js`, then `geekity.config.mjs` in the working directory, and run
 on defaults if there is none.
@@ -267,29 +268,29 @@ export default defineConfig({
 Every field is optional. Relative directories resolve against the working
 directory; absolute ones are used as given.
 
-| Field              | Default                               | Environment override         | Meaning                                                                                                                                                                                   |
-| ------------------ | ------------------------------------- | ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `port`             | `3000`                                | `GEEKITY_PORT`, then `PORT`  | Port the HTTP server listens on. `0` picks a free one.                                                                                                                                    |
-| `contentDir`       | `<cwd>/content`                       | `GEEKITY_CONTENT_DIR`        | Markdown content.                                                                                                                                                                         |
-| `dataDir`          | `<cwd>/data`                          | `GEEKITY_DATA_DIR`           | Derived state — the SQLite index, the image variants — and the two things in it that are not derived and must be backed up: `users.json` and, under `keys/`, each user's actor key pairs. |
-| `themesDir`        | `<cwd>/themes`                        | `GEEKITY_THEMES_DIR`         | The site's themes, one directory per theme, each with a `theme.json`. Which one is in use is the `theme` setting in `site.json`, not a path. Need not exist.                              |
-| `baseUrl`          | `http://localhost:<port>`             | `GEEKITY_BASE_URL`           | Public origin for canonical URLs, feeds and ActivityPub ids. A trailing slash is stripped.                                                                                                |
-| `watch`            | `true`                                | `GEEKITY_WATCH`              | Watch `contentDir` while serving and keep the index in step.                                                                                                                              |
-| `sessionLifetime`  | `1209600` (14 days)                   | `GEEKITY_SESSION_LIFETIME`   | How long an admin login lasts, in seconds.                                                                                                                                                |
-| `loginAttempts`    | `5`                                   | `GEEKITY_LOGIN_ATTEMPTS`     | Failed sign-ins a username or an address may make before it is locked out.                                                                                                                |
-| `loginLockout`     | `900` (15 minutes)                    | `GEEKITY_LOGIN_LOCKOUT`      | How long the first lockout lasts, in seconds. See [Login hardening](#login-hardening).                                                                                                    |
-| `trustProxy`       | `false`                               | `GEEKITY_TRUST_PROXY`        | Believe `X-Forwarded-For` when deciding which address a sign-in came from.                                                                                                                |
-| `accessLog`        | `false`; `true` under `geekity serve` | `GEEKITY_ACCESS_LOG`         | One line per request on stdout: method, path with query, status, duration. See [The access log](#the-access-log).                                                                         |
-| `accessLogAddress` | `false`                               | `GEEKITY_ACCESS_LOG_ADDRESS` | Put the client address on the end of each access-log line. `trustProxy` decides which address that is.                                                                                    |
-| `accessLogWriter`  | stdout                                | —                            | Where the lines go instead. See [The access log](#the-access-log).                                                                                                                        |
-| `maintenance`      | `false`                               | `GEEKITY_MAINTENANCE`        | Keep the site in maintenance mode, answering 503, until a restart without it.                                                                                                             |
-| `compression`      | `true`                                | `GEEKITY_COMPRESSION`        | Compress text responses with brotli or gzip. Turn it off behind a proxy that compresses. See [Compression](#compression).                                                                 |
-| `securityHeaders`  | [see below](#security-headers)        | —                            | Headers every response carries. A string replaces a default or adds a header, `false` removes one.                                                                                        |
-| `onDocumentChange` | none                                  | —                            | Hook run for every change to the index. See [Hooks](#hooks).                                                                                                                              |
-| `onPublish`        | none                                  | —                            | Hook run when a document becomes visible. See [Hooks](#hooks).                                                                                                                            |
-| `federation`       | `{}`                                  | —                            | Federation stores and guards. See [Federation](#federation).                                                                                                                              |
-| `commentChecker`   | Akismet                               | —                            | A spam checker of the site's own, which wins over the key in `data/akismet.json`. See [Akismet](#akismet).                                                                                |
-| `mail`             | `{}`                                  | —                            | Mail provider, retries, backoff and logger. See [Email](#email).                                                                                                                          |
+| Field              | Default                               | Environment override         | Meaning                                                                                                                                                                                                                                                         |
+| ------------------ | ------------------------------------- | ---------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `port`             | `3000`                                | `GEEKITY_PORT`, then `PORT`  | Port the HTTP server listens on. `0` picks a free one.                                                                                                                                                                                                          |
+| `contentDir`       | `<cwd>/content`                       | `GEEKITY_CONTENT_DIR`        | Markdown content.                                                                                                                                                                                                                                               |
+| `dataDir`          | `<cwd>/data`                          | `GEEKITY_DATA_DIR`           | Derived state — the SQLite index, the image variants — and the files that are not derived and must be backed up, such as `users.json`, the actor key pairs under `keys/` and `locations.json`. [Two directories](#two-directories-content-and-data) lists them. |
+| `themesDir`        | `<cwd>/themes`                        | `GEEKITY_THEMES_DIR`         | The site's themes, one directory per theme, each with a `theme.json`. Which one is in use is the `theme` setting in `site.json`, not a path. Need not exist.                                                                                                    |
+| `baseUrl`          | `http://localhost:<port>`             | `GEEKITY_BASE_URL`           | Public origin for canonical URLs, feeds and ActivityPub ids. A trailing slash is stripped.                                                                                                                                                                      |
+| `watch`            | `true`                                | `GEEKITY_WATCH`              | Watch `contentDir` while serving and keep the index in step.                                                                                                                                                                                                    |
+| `sessionLifetime`  | `1209600` (14 days)                   | `GEEKITY_SESSION_LIFETIME`   | How long an admin login lasts, in seconds.                                                                                                                                                                                                                      |
+| `loginAttempts`    | `5`                                   | `GEEKITY_LOGIN_ATTEMPTS`     | Failed sign-ins a username or an address may make before it is locked out.                                                                                                                                                                                      |
+| `loginLockout`     | `900` (15 minutes)                    | `GEEKITY_LOGIN_LOCKOUT`      | How long the first lockout lasts, in seconds. See [Login hardening](#login-hardening).                                                                                                                                                                          |
+| `trustProxy`       | `false`                               | `GEEKITY_TRUST_PROXY`        | Believe `X-Forwarded-For` when deciding which address a sign-in came from.                                                                                                                                                                                      |
+| `accessLog`        | `false`; `true` under `geekity serve` | `GEEKITY_ACCESS_LOG`         | One line per request on stdout: method, path with query, status, duration. See [The access log](#the-access-log).                                                                                                                                               |
+| `accessLogAddress` | `false`                               | `GEEKITY_ACCESS_LOG_ADDRESS` | Put the client address on the end of each access-log line. `trustProxy` decides which address that is.                                                                                                                                                          |
+| `accessLogWriter`  | stdout                                | —                            | Where the lines go instead. See [The access log](#the-access-log).                                                                                                                                                                                              |
+| `maintenance`      | `false`                               | `GEEKITY_MAINTENANCE`        | Keep the site in maintenance mode, answering 503, until a restart without it.                                                                                                                                                                                   |
+| `compression`      | `true`                                | `GEEKITY_COMPRESSION`        | Compress text responses with brotli or gzip. Turn it off behind a proxy that compresses. See [Compression](#compression).                                                                                                                                       |
+| `securityHeaders`  | [see below](#security-headers)        | —                            | Headers every response carries. A string replaces a default or adds a header, `false` removes one.                                                                                                                                                              |
+| `onDocumentChange` | none                                  | —                            | Hook run for every change to the index. See [Hooks](#hooks).                                                                                                                                                                                                    |
+| `onPublish`        | none                                  | —                            | Hook run when a document becomes visible. See [Hooks](#hooks).                                                                                                                                                                                                  |
+| `federation`       | `{}`                                  | —                            | Federation stores and guards. See [Federation](#federation).                                                                                                                                                                                                    |
+| `commentChecker`   | Akismet                               | —                            | A spam checker of the site's own, which wins over the key in `data/akismet.json`. See [Akismet](#akismet).                                                                                                                                                      |
+| `mail`             | `{}`                                  | —                            | Mail provider, retries, backoff and logger. See [Email](#email).                                                                                                                                                                                                |
 
 Precedence is environment variable, then config file, then default, so a host
 can override anything without editing the site. A boolean environment variable
@@ -352,7 +353,7 @@ the same directory reads all of it, and everything in it is meant to be public:
 | Path                                               | What it holds                                                            |
 | -------------------------------------------------- | ------------------------------------------------------------------------ |
 | `content/posts/`, `content/pages/`                 | The Markdown documents, `_trash/` included.                              |
-| `content/uploads/`                                 | Uploaded files exactly as they arrived.                                  |
+| `content/uploads/`                                 | Uploaded files, with their location and camera metadata removed.         |
 | `content/_data/site.json`                          | Every site setting.                                                      |
 | `content/_data/federation/followers.json`          | Who follows the site.                                                    |
 | `content/_data/federation/inbox/{yyyy}-{mm}.jsonl` | Every activity the inbox was handed, one per line.                       |
@@ -364,6 +365,7 @@ the same directory reads all of it, and everything in it is meant to be public:
 | --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
 | `data/users.json`                 | Usernames and argon2id password hashes. Mode `0600`.                                                                            |
 | `data/keys/`                      | Each user's actor key pairs as JWK files. Mode `0600`. **Losing these breaks federation.**                                      |
+| `data/locations.json`             | Where each post was written, keyed by permalink (decision-29). Mode `0600`.                                                     |
 | `data/comment-salt`               | What hides commenters' addresses in the published comment files. Mode `0600`.                                                   |
 | `data/comments/{slug}.json`       | The emails of that post's commenters, and whether each asked to hear about replies, keyed by comment id. Mode `0600`.           |
 | `data/akismet.json`               | The Akismet key, and what `verify-key` last said about it. Mode `0600`.                                                         |
@@ -1517,25 +1519,27 @@ This is every piece of personal data the CMS stores, where it is, and how long
 it stays. "Kept" means until somebody deletes it, unless a retention period
 says otherwise.
 
-| What                                                                                                                 | Where                                                         | How long                                                                       |
-| -------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- | ------------------------------------------------------------------------------ |
-| A commenter's name, website and words                                                                                | `content/_data/comments/{slug}.json`, public and in git       | Kept. Erasing on request replaces the name and drops the website.              |
-| A commenter's email, and whether they asked to be told about replies                                                 | `data/comments/{slug}.json`, mode `0600`, keyed by comment id | `commentEmailRetentionDays`: forever unless set, 180 on a new site.            |
-| A salted hash of the address a comment, webmention or contact message came from (the address itself is never stored) | The comment file, or the contact message file                 | `addressHashRetentionDays`: forever unless set, 30 on a new site.              |
-| A webmention's author name, website, avatar URL and the source page's words                                          | `content/_data/comments/{slug}.json`                          | Kept, as a copy of a page that is public already.                              |
-| A contact message: the sender's name, email, subject and message                                                     | `data/contact/{id}.json`, mode `0600`                         | `contactMessageRetentionDays`: forever unless set, 365 on a new site.          |
-| The addresses that unsubscribed from reply notices                                                                   | `data/comment-optouts.json`, mode `0600`                      | Kept, so the site goes on not writing to them. Erasing on request removes one. |
-| Followers: actor id, handle, display name, avatar URL, profile URL                                                   | `content/_data/federation/{username}/followers.json`, in git  | Until they unfollow.                                                           |
-| Inbound likes, boosts, replies and quotes, with the actor who sent them                                              | `content/_data/federation/inbox/{yyyy}-{mm}.jsonl`, in git    | Kept.                                                                          |
-| What a reply shows of the post it answers: its title, words and author                                               | `content/_data/replyContexts.json`, in git                    | Kept.                                                                          |
-| Other actors who liked, boosted, answered or quoted: handle, display name, avatar URL, profile URL                   | `data/geekity.db`, fetched from their actor document          | A cache. Refetched weekly while the inbox log names them.                      |
-| Remote avatars, shrunk                                                                                               | `data/avatars/`                                               | Deleted by the avatar sweep once nothing shown names them.                     |
-| Users: username, email, argon2id password hash, profile                                                              | `data/users.json`, mode `0600`                                | Until the user is deleted.                                                     |
-| The apps a user signed in to with IndieAuth: app, scopes, hashes of its tokens, when they expire                     | `data/indieauth-tokens.json`, mode `0600`                     | Until the user is deleted, or 60 days after the app last refreshed.            |
-| Recent IndieAuth and Micropub requests: app, username, what it sent (no secrets, values cut short), the answer       | `data/indieauth-activity.json`, mode `0600`                   | The last 100 requests, none older than 14 days.                                |
-| An index of all of the above, and sessions, reset tokens and spent link tokens                                       | `data/geekity.db`                                             | A cache of the files. Sessions and tokens are pruned when they expire.         |
-| Client addresses in the rate limits                                                                                  | Memory                                                        | Until the window passes or the site restarts.                                  |
-| Client addresses in the access log                                                                                   | stdout, and whatever collects it                              | Only with `accessLogAddress` on. The collector keeps them.                     |
+| What                                                                                                                 | Where                                                         | How long                                                                                                             |
+| -------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |
+| A commenter's name, website and words                                                                                | `content/_data/comments/{slug}.json`, public and in git       | Kept. Erasing on request replaces the name and drops the website.                                                    |
+| A commenter's email, and whether they asked to be told about replies                                                 | `data/comments/{slug}.json`, mode `0600`, keyed by comment id | `commentEmailRetentionDays`: forever unless set, 180 on a new site.                                                  |
+| A salted hash of the address a comment, webmention or contact message came from (the address itself is never stored) | The comment file, or the contact message file                 | `addressHashRetentionDays`: forever unless set, 30 on a new site.                                                    |
+| A webmention's author name, website, avatar URL and the source page's words                                          | `content/_data/comments/{slug}.json`                          | Kept, as a copy of a page that is public already.                                                                    |
+| A contact message: the sender's name, email, subject and message                                                     | `data/contact/{id}.json`, mode `0600`                         | `contactMessageRetentionDays`: forever unless set, 365 on a new site.                                                |
+| The addresses that unsubscribed from reply notices                                                                   | `data/comment-optouts.json`, mode `0600`                      | Kept, so the site goes on not writing to them. Erasing on request removes one.                                       |
+| Followers: actor id, handle, display name, avatar URL, profile URL                                                   | `content/_data/federation/{username}/followers.json`, in git  | Until they unfollow.                                                                                                 |
+| Inbound likes, boosts, replies and quotes, with the actor who sent them                                              | `content/_data/federation/inbox/{yyyy}-{mm}.jsonl`, in git    | Kept.                                                                                                                |
+| What a reply shows of the post it answers: its title, words and author                                               | `content/_data/replyContexts.json`, in git                    | Kept.                                                                                                                |
+| Other actors who liked, boosted, answered or quoted: handle, display name, avatar URL, profile URL                   | `data/geekity.db`, fetched from their actor document          | A cache. Refetched weekly while the inbox log names them.                                                            |
+| Remote avatars, shrunk                                                                                               | `data/avatars/`                                               | Deleted by the avatar sweep once nothing shown names them.                                                           |
+| Users: username, email, argon2id password hash, profile                                                              | `data/users.json`, mode `0600`                                | Until the user is deleted.                                                                                           |
+| The apps a user signed in to with IndieAuth: app, scopes, hashes of its tokens, when they expire                     | `data/indieauth-tokens.json`, mode `0600`                     | Until the user is deleted, or 60 days after the app last refreshed.                                                  |
+| Recent IndieAuth and Micropub requests: app, username, what it sent (no secrets, values cut short), the answer       | `data/indieauth-activity.json`, mode `0600`                   | The last 100 requests, none older than 14 days.                                                                      |
+| An index of all of the above, and sessions, reset tokens and spent link tokens                                       | `data/geekity.db`                                             | A cache of the files. Sessions and tokens are pruned when they expire.                                               |
+| Client addresses in the rate limits                                                                                  | Memory                                                        | Until the window passes or the site restarts.                                                                        |
+| Where and when a photo or video was taken, and the camera or phone (EXIF, XMP, IPTC, a video's `©xyz`)               | Removed from `content/uploads/` on upload                     | Never stored. Older uploads keep it until `geekity strip-metadata`; git history keeps the old bytes until rewritten. |
+| Where the author wrote a post: coordinates, accuracy, and the place's name, locality, region and country             | `data/locations.json`, mode `0600`, keyed by permalink        | Kept until the author clears it. Published only as far as **Settings > Privacy** allows, nothing by default.         |
+| Client addresses in the access log                                                                                   | stdout, and whatever collects it                              | Only with `accessLogAddress` on. The collector keeps them.                                                           |
 
 Two services outside the site see personal data when a site turns them on.
 Akismet is sent a commenter's or sender's address, user agent, referrer, name,
@@ -1704,6 +1708,48 @@ cacheable, and a URL that answered differently for one viewer would be cached
 and served to the rest. Use the editor's Preview button, which renders the post
 through the theme's own layout at an admin URL.
 
+## Unlisted posts
+
+An unlisted post is published at its URL and left off every list. Choose
+Unlisted in the editor's Visibility field, send `visibility=unlisted` from a
+Micropub app, or write it into the front matter:
+
+```yaml
+visibility: unlisted
+```
+
+Public is the key's absence, and the editor removes the key when you choose
+Public again. The site has no private posts. A value other than `public` or
+`unlisted`, such as a hand-typed `visibility: private`, hides the post the way
+`draft: true` does: its URL answers 404, it is on no list, and a post the
+followers already hold is withdrawn with a `Delete`. The editor shows the value
+as it is stored, marks the post Hidden in the list, and keeps the value through
+a save until you choose Public or Unlisted.
+
+The rule works for pages too.
+
+| Where                                                                      | An unlisted post                                                                                                                             |
+| -------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
+| Its permalink, in every representation                                     | 200, with `X-Robots-Tag: noindex`. The default theme also prints `<meta name="robots" content="noindex">`.                                   |
+| The home page, tag, category and author archives, the `archive: true` page | Absent, and not counted in a pager or a tag count.                                                                                           |
+| Previous and next links under other posts, the front page's recent posts   | Absent.                                                                                                                                      |
+| Every RSS, Atom and JSON feed, and the site-wide comments feed             | Absent. Saving one pings no notify server.                                                                                                   |
+| The sitemap, search (HTML and JSON) and `llms.txt`                         | Absent.                                                                                                                                      |
+| IndexNow                                                                   | Not submitted. A public post that becomes unlisted is submitted once, so a search engine reads the `noindex`.                                |
+| The ActivityPub outbox and featured collection                             | Absent.                                                                                                                                      |
+| Followers                                                                  | Get the `Create` and every `Update`, addressed `to` the followers with Public in `cc`, which Mastodon shows as unlisted. Relays get nothing. |
+| Webmentions                                                                | Sent as for any post: the page is public.                                                                                                    |
+
+Changing a published post between public and unlisted sends its followers an
+`Update` with the new addressing.
+
+In code, `isServed(document)` says whether the site serves a document at its
+URL and `isListed(document)` whether it also lists it. The index answers the
+same two rules in SQL. An Eleventy build with the example config reads the key
+too: an unlisted post gets its page, `noindex`, and no place in any collection,
+and an unrecognized value builds no page. See
+[Building the same content with Eleventy](#building-the-same-content-with-eleventy).
+
 ## Hooks
 
 Two hooks let a site do something of its own when content changes. Both are
@@ -1868,8 +1914,8 @@ email address, notification preferences, a public profile and the
 [stored actor id](#a-users-stored-actor-id) they were published under
 elsewhere. Written atomically with `0600` permissions and serialised against
 itself, so two admins adding the same name at once cannot both succeed. It is in `data/` rather than `content/` because
-`content/` is published with the site, and it is one of the two things under
-`dataDir` that must be backed up — the users' actor keys are the other.
+`content/` is published with the site, and it is one of the files under
+`dataDir` that must be backed up.
 
 Sessions stay in SQLite, where the rest of the cache lives. They name a user by
 id and are joined against the file on every admin request, so a session whose
@@ -2088,6 +2134,60 @@ shows up without a restart. `readAltTexts(contentDir)` and
 `undescribedImages(html, library)` in `src/images/alt-text.ts` are what the
 editor's publish check and the federated `Image` attachments read.
 
+#### Location and camera metadata
+
+A phone photo carries where it was taken, when, and on what camera, and the
+original under `content/uploads` is what the site serves at `/uploads/…`, puts
+in every `<picture>` as the fallback, and federates as a photo post's
+attachment. So `storeUpload` removes that metadata before the file is written,
+for every upload: the editor's control, the media library, the Micropub media
+endpoint and Micropub photos. It is not a setting.
+
+| Format   | What goes                                                                                                                                       | What stays                                                    |
+| -------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- |
+| JPEG     | EXIF (GPS, camera, lens, serial, time), XMP, IPTC, comments, other APPn segments, data after the image                                          | JFIF, the ICC profile, Adobe's colour flag, the orientation   |
+| PNG      | `eXIf`, `tEXt`, `zTXt`, `iTXt` (XMP), `tIME` and private chunks                                                                                 | Image and colour chunks, APNG animation, the orientation      |
+| WebP     | `EXIF`, `XMP ` and unknown chunks                                                                                                               | The bitstream, alpha, animation, ICC profile, the orientation |
+| AVIF     | The contents of the Exif and XMP items, overwritten with an empty EXIF block and an empty XMP packet                                            | The picture, and its `irot`/`imir` orientation                |
+| GIF      | Comment extensions and application extensions other than looping and ICC (XMP lives in one)                                                     | Frames, timing, looping                                       |
+| MP4, M4V | `udta` (the `©xyz` location, camera), `meta` (the QuickTime location key) and `uuid` (XMP) boxes, in the movie, its tracks and at the top level | Every other box                                               |
+
+Nothing is re-encoded. Segments, chunks and blocks are cut out and the pixel
+data is copied byte for byte, so a stored JPEG or PNG decodes to the same
+pixels as the upload. A picture taken sideways keeps a minimal EXIF block
+holding its orientation and nothing else, so it still shows the right way up.
+AVIF and MP4 keep their layout exactly: the metadata is overwritten in place
+and a removed box becomes a zero-filled `free` box of the same size, so no
+offset inside the file moves. A file whose structure cannot be followed far
+enough to find its metadata is refused with a 415 rather than stored as it is.
+
+Audio (MP3, M4A, Ogg), WebM, PDF and the text formats are stored as they
+arrive. An episode's tags are its title and artwork, not where it was
+recorded.
+
+Files uploaded before this version still carry their metadata. Strip them
+with
+
+```sh
+geekity strip-metadata
+```
+
+which rewrites each file under `content/uploads` that has something to remove,
+prints what it removed, keeps the file's modification time (the library sorts
+by it), and leaves alone, and names, a file it cannot read, exiting `1`. It is
+safe to run again: a clean file is left as it is, and a second run reports
+every file already clean. The derived variants under `data/images` never
+carried metadata.
+
+A site that keeps `content/` in git still has the old bytes in its history,
+and so does every clone and fork of it. Removing them means rewriting that
+history. One way: run `geekity strip-metadata`, copy `content/uploads`
+somewhere outside the repository, remove it from every commit with
+[`git filter-repo`](https://github.com/newren/git-filter-repo)
+`--path content/uploads --invert-paths`, copy the stripped files back, commit
+them, and force-push. That changes every commit hash, so anybody else with a
+clone has to clone again.
+
 ### Image variants
 
 `generateImageVariants(config, uploadPath)` derives one upload's copies with
@@ -2956,6 +3056,16 @@ its own item: RSS as `dc:language`, Atom as `xml:lang` on the `entry` and JSON
 Feed as the item's `language`. A post in the site's language, or whose `lang`
 is not a language tag, adds nothing.
 
+**Photos.** A post's `photo` front matter prints in every format's content,
+before the body, which is where the page prints it too. Each photo is a plain
+`<figure><img src alt></figure>` of the original upload, never the responsive
+variants, which a reader cannot resolve (decision-10). Its `src` is absolute on
+the site's base URL. Its `alt` is the post's own text, else the media library's,
+else empty. So a photo-only post reads in a feed reader as its photos. JSON Feed
+also names the item's main image as `image`: the post's `image` front matter,
+else its first photo. A photo is never an RSS `enclosure`, an Atom
+`rel="enclosure"` link or a JSON Feed attachment. Those carry a recording only.
+
 ### RSS 2.0
 
 The channel carries `title`, `link`, `description` (the tagline), `language`
@@ -3058,7 +3168,7 @@ Feed has no field for a license and says nothing about one.
 [rfc4946]: https://www.rfc-editor.org/rfc/rfc4946
 
 A JSON Feed item carries `id` (the object id), `url` (the permalink), `title`,
-`content_html`, `summary`, `date_published`, `date_modified`, `tags` (the
+`content_html`, `image` (see Photos above), `summary`, `date_published`, `date_modified`, `tags` (the
 terms) and `authors`; the feed carries `version`, `title`, `home_page_url`,
 `feed_url`, `description`, `authors` and `hubs`. Keys with nothing behind them
 are left out rather than sent empty.
@@ -3349,9 +3459,10 @@ dates — a page with no date in its front matter — carries no `<lastmod>`
 rather than an invented one.
 
 Nothing hidden reaches it. The sitemap is drawn from the same queries the
-listings are and checked against the same `isPublicDocument`, so drafts, the
-trash and posts whose date has not arrived are absent for the same reason
-their permalinks 404.
+listings are and checked against the same `isListed`, so drafts, the trash and
+posts whose date has not arrived are absent for the same reason their
+permalinks 404, and an [unlisted post](#unlisted-posts) is absent for the same
+reason it is off the home page.
 
 The protocol caps one file at 50,000 URLs. Past that, `/sitemap.xml` becomes a
 `<sitemapindex>` naming `/sitemap-1.xml`, `/sitemap-2.xml` and so on, each
@@ -3684,6 +3795,7 @@ the rules the CMS follows that Eleventy does not know about on its own:
 | Rule                                            | How the config does it                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `draft: true` hides a document                  | An `addPreprocessor` that returns `false` for it. `BUILD_DRAFTS=1` builds drafts anyway, for a local preview.                                                                                                                                                                                                                                                                                                                                                                                                       |
+| `visibility: unlisted` is listed nowhere        | An `addPreprocessor` that sets `eleventyExcludeFromCollections` on the document, so a feed, sitemap or archive drawn from collections leaves it out, and sets `noindex` for the layout to print as `<meta name="robots" content="noindex">`. Any value other than `public` or `unlisted` returns `false`, as a draft does.                                                                                                                                                                                          |
 | A file with no `permalink` gets the CMS default | An `addPreprocessor` that fills in `/{yyyy}/{mm}/{slug}/` for a post and `/{slug}/` for a page, slugifying the title exactly as the CMS does. Front matter always wins; the CMS writes `permalink` into every file it saves, so this only matters for hand-authored files.                                                                                                                                                                                                                                          |
 | `content/uploads/` is served at `/uploads/`     | `addPassthroughCopy({ 'content/uploads': 'uploads' })`, plus an `ignores` entry for the same path. Without the ignore, an upload that happens to be Markdown would be copied _and_ rendered as a page; the CMS only ever indexes `posts/` and `pages/`.                                                                                                                                                                                                                                                             |
 | `content/_data/federation/` is data             | `followers.json` is an ordinary data file in a namespaced `_data` subdirectory, so Eleventy hands it over as `federation.followers` without being told. The monthly inbox logs are JSON Lines, which Eleventy has no reader for, so the config registers one with `addDataExtension('jsonl', …)`: each month becomes an entry of `federation.inbox`, keyed by its `{yyyy}-{mm}` name.                                                                                                                               |

package/admin/pages/documents/editor.njk

@@ -86,6 +86,27 @@
             {% endfor %}
           </datalist>
         </fieldset>
+        <fieldset class="admin-editor-enclosure admin-editor-location">
+          <legend>Location</legend>
+          <p class="admin-hint">
+            Kept in <code>data/locations.json</code>, not in the post’s file. What readers see of it
+            is chosen on Settings &gt; Privacy. Empty every box to remove it.
+          </p>
+          <label for="editor-location-geo">Coordinates</label>
+          <input id="editor-location-geo" name="{{ locationFields.geo }}" type="text" value="{{ form.location.geo }}" placeholder="48.85837, 2.29448" autocomplete="off" spellcheck="false" aria-describedby="editor-location-geo-hint" />
+          <p class="admin-hint" id="editor-location-geo-hint">Latitude, longitude, as decimal degrees. A <code>geo:</code> URI works too.</p>
+          <label for="editor-location-accuracy">Accuracy</label>
+          <input id="editor-location-accuracy" name="{{ locationFields.accuracy }}" type="text" inputmode="numeric" value="{{ form.location.accuracy }}" autocomplete="off" aria-describedby="editor-location-accuracy-hint" />
+          <p class="admin-hint" id="editor-location-accuracy-hint">Metres. Leave it empty if you do not know.</p>
+          <label for="editor-location-name">Place</label>
+          <input id="editor-location-name" name="{{ locationFields.name }}" type="text" value="{{ form.location.name }}" />
+          <label for="editor-location-locality">Locality</label>
+          <input id="editor-location-locality" name="{{ locationFields.locality }}" type="text" value="{{ form.location.locality }}" />
+          <label for="editor-location-region">Region</label>
+          <input id="editor-location-region" name="{{ locationFields.region }}" type="text" value="{{ form.location.region }}" />
+          <label for="editor-location-country">Country</label>
+          <input id="editor-location-country" name="{{ locationFields.country }}" type="text" value="{{ form.location.country }}" />
+        </fieldset>
         <fieldset class="admin-editor-enclosure">
           <legend>Recording</legend>
 
@@ -199,6 +220,29 @@
         <label for="editor-bookmark-of">Bookmark of</label>
         <input id="editor-bookmark-of" name="bookmark-of" type="url" value="{{ form.bookmarkOf }}" />
         <p class="admin-hint">The address of a post this one likes, reposts or bookmarks. Leave them empty for a post that cites nothing.</p>
+
+        <fieldset class="admin-editor-enclosure admin-editor-read">
+          <legend>Read</legend>
+          <label for="editor-read-status">Read status</label>
+          <select id="editor-read-status" name="{{ readFields.status }}">
+            <option value=""{% if form.readStatus == "" %} selected{% endif %}>Not a read</option>
+            {% for status in readStatuses %}
+              <option value="{{ status.value }}"{% if form.readStatus == status.value %} selected{% endif %}>{{ status.label }}</option>
+            {% endfor %}
+            {% if unrecognizedReadStatus %}
+              <option value="{{ unrecognizedReadStatus }}" selected>{{ unrecognizedReadStatus }} (not recognized)</option>
+            {% endif %}
+          </select>
+          <label for="editor-read-of-name">Title</label>
+          <input id="editor-read-of-name" name="{{ readFields.name }}" type="text" value="{{ form.readOf.name }}" />
+          <label for="editor-read-of-author">Author</label>
+          <input id="editor-read-of-author" name="{{ readFields.author }}" type="text" value="{{ form.readOf.author }}" />
+          <label for="editor-read-of-uid">Identifier</label>
+          <input id="editor-read-of-uid" name="{{ readFields.uid }}" type="text" value="{{ form.readOf.uid }}" placeholder="isbn:9780441478125" autocomplete="off" spellcheck="false" />
+          <label for="editor-read-of-url">Address</label>
+          <input id="editor-read-of-url" name="{{ readFields.url }}" type="url" value="{{ form.readOf.url }}" />
+          <p class="admin-hint">A book or paper this post says its author read. An identifier is an ISBN or a DOI, written isbn:… or doi:…. Choose Not a read and empty every box to remove it. A read is described by what it says, so leave its Description empty.</p>
+        </fieldset>
       {% endif %}
 
       <label for="editor-description">Description</label>
@@ -229,6 +273,25 @@
         <label for="editor-draft">Draft</label>
       </p>
 
+      <label for="editor-visibility">Visibility</label>
+      <select id="editor-visibility" name="visibility" aria-describedby="editor-visibility-hint">
+        {% if form.visibility.unrecognized is defined %}
+          <option value="{{ form.visibility.unrecognized }}" selected>{{ form.visibility.unrecognized }} (not recognized)</option>
+        {% endif %}
+        <option value="public"{% if form.visibility == "public" %} selected{% endif %}>Public</option>
+        <option value="unlisted"{% if form.visibility == "unlisted" %} selected{% endif %}>Unlisted</option>
+      </select>
+      <p class="admin-hint" id="editor-visibility-hint">
+        {% if form.visibility.unrecognized is defined %}
+          The front matter says <code>visibility: {{ form.visibility.unrecognized }}</code>, which this
+          site does not recognize. The {{ kind.singular }} is hidden until you choose Public or Unlisted:
+          its page answers 404 and it is not listed or sent to your followers.
+        {% endif %}
+        Unlisted writes <code>visibility: unlisted</code> into the front matter. The {{ kind.singular }}
+        keeps its page and still goes to your followers, but is left off the home page, archives,
+        feeds, the sitemap, search and llms.txt, and asks search engines not to index it.
+      </p>
+
       {% if kind.type == "post" %}
         {# TASK-207: shown at the top of the author's fediverse profile, from
            the featured collection their actor links. #}

package/admin/pages/documents/list.njk

@@ -69,6 +69,8 @@
                 <span class="admin-status admin-status-draft">Draft</span>
               {% elif document.scheduled %}
                 <span class="admin-status admin-status-scheduled">Scheduled</span>
+              {% elif document.hidden %}
+                <span class="admin-status admin-status-draft">Hidden</span>
               {% else %}
                 <span class="admin-status">Published</span>
               {% endif %}

package/admin/pages/indieauth/consent.njk

@@ -26,6 +26,10 @@
     {% endif %}
   </dl>
 
+  {% if withoutPkce %}
+    <p class="admin-hint">This app does not use PKCE, which protects a sign-in if the code it is handed is intercepted. It is let in only because it is on your list of apps allowed without PKCE, under Users &gt; Connected apps.</p>
+  {% endif %}
+
   {% if loopback %}
     <p class="admin-hint">This app runs on your own computer or network. Approve only if you started this sign-in yourself.</p>
   {% endif %}

package/admin/pages/settings/privacy.njk

@@ -0,0 +1,37 @@
+{% extends "layouts/settings-page.njk" %}
+{% import "components/fields.njk" as field %}
+
+{% block settingsProblems %}
+  {{ field.problem('settings-location-sharing', problems.locationSharing) }}
+{% endblock %}
+
+{% block settingsFields %}
+  <h2>Location</h2>
+
+  {% set locationHint %}
+    A Micropub app such as Quill can send where a post was written, and the
+    editor has fields for it. The site keeps it in <code>data/locations.json</code>,
+    never in the post's file, so it stays out of <code>content/</code> and its git
+    history whatever is chosen here. Exact coordinates can say where you live or
+    are right now. Changing this changes every post at once, and nothing is
+    rewritten.
+  {% endset %}
+  {% call field.select('settings-location-sharing', fields.locationSharing, 'Location on posts',
+       error=problems.locationSharing, hint=locationHint, autofocus=true) %}
+    {% for option in [
+         ['none', 'Keep it, publish nothing'],
+         ['place', 'Publish the place only: its name, locality, region and country'],
+         ['exact', 'Publish the exact coordinates too']] %}
+      <option value="{{ option[0] }}"{% if option[0] == form.locationSharing %} selected{% endif %}>{{ option[1] }}</option>
+    {% endfor %}
+  {% endcall %}
+
+  <h2>Uploads</h2>
+
+  <p class="admin-hint">
+    Location and camera metadata is always removed from pictures and videos as
+    they are uploaded, whatever is chosen above. Files uploaded before this
+    version keep theirs until <code>geekity strip-metadata</code> is run over
+    <code>content/uploads/</code>; the package README describes the command.
+  </p>
+{% endblock %}