@geekity/cms 0.3.0 → 0.4.0

package/dist/webmention/service.js

@@ -0,0 +1,207 @@
+import { readSiteSettings } from '../admin/settings.js';
+import { isFederatedDocument } from '../federation/article.js';
+import { absoluteUrl } from '../web/negotiate.js';
+import { discoverEndpoint, WEBMENTION_USER_AGENT } from './discovery.js';
+import { externalLinks } from './links.js';
+import { verifyWebmention } from './receive.js';
+/**
+ * Telling the pages a post links to that it links to them.
+ *
+ * The other half of the same conversation the fediverse carries: a post is
+ * published, and everything it points at is asked whether it takes webmentions
+ * and told if it does. It is driven by the same index changes delivery is —
+ * a post saved in the editor and a post edited on disk are one thing here —
+ * and, like delivery, it ignores a full scan: the boot scan reports a cold
+ * index as a directory full of creations, and notifying every page the archive
+ * has ever linked to every time somebody deleted the database would be a
+ * denial of service with this site's name on it.
+ *
+ * What is recorded is a cache of outcomes, one row per (post, target), exactly
+ * as `ap_deliveries` is (decision-9): the links themselves are in the post's
+ * file, so a database thrown away costs the record of how it went and nothing
+ * else — and {@link WebmentionSender.send} reads the file again rather than
+ * replaying anything.
+ */
+/** How long one webmention POST is given before it is abandoned. */
+export const SEND_TIMEOUT_MS = 10_000;
+/** Build the webmention service for one site. */
+export function createWebmentionService(options) {
+    const { admin, store, config } = options;
+    const logger = options.logger ?? console;
+    /** The comment files an incoming webmention is written into. */
+    const records = { admin, contentDir: config.contentDir };
+    // Incoming checks run one after another too, and on a chain of their own: a
+    // page of this site's own that is slow to answer must not hold up the check
+    // on a webmention somebody is waiting to see appear.
+    let checking = Promise.resolve();
+    // Sends are chained rather than run at once, and the chain never rejects:
+    // one page that hangs delays the next and nothing else.
+    let chain = Promise.resolve();
+    function enqueue(task) {
+        const result = chain.then(task);
+        chain = result.then(ignore, ignore);
+        return result;
+    }
+    /** Whether the site is sending webmentions at all, as the file says now. */
+    function sending() {
+        return readSiteSettings(config.contentDir).webmentionsSend;
+    }
+    /** Tell one page about one post, and answer with what happened. */
+    async function tell(slug, source, target) {
+        const endpoint = await discoverEndpoint(target);
+        if (endpoint === undefined) {
+            // Not a failure: most of the web takes no webmentions, and recording it
+            // is what tells a person why nothing went.
+            return record(slug, source, target, null, 'none', null);
+        }
+        try {
+            const response = await fetch(endpoint, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/x-www-form-urlencoded',
+                    accept: 'text/html, application/json;q=0.9, */*;q=0.8',
+                    'user-agent': WEBMENTION_USER_AGENT,
+                },
+                body: new URLSearchParams({ source, target }).toString(),
+                signal: AbortSignal.timeout(SEND_TIMEOUT_MS),
+            });
+            if (!response.ok) {
+                const error = `${endpoint} answered ${String(response.status)}`;
+                logger.warn(`Could not send a webmention for ${source}: ${error}`);
+                return record(slug, source, target, endpoint, 'failed', error);
+            }
+            return record(slug, source, target, endpoint, 'sent', null);
+        }
+        catch (thrown) {
+            const error = messageOf(thrown);
+            logger.warn(`Could not send a webmention for ${source}: ${error}`);
+            return record(slug, source, target, endpoint, 'failed', error);
+        }
+    }
+    /** Write one outcome down. */
+    function record(slug, source, target, endpoint, status, error) {
+        return admin.recordSentWebmention({ slug, source, target, endpoint, status, error });
+    }
+    /** Tell every one of a post's targets, one after another. */
+    async function tellAll(slug, source, targets) {
+        const outcomes = [];
+        for (const target of targets)
+            outcomes.push(await tell(slug, source, target));
+        return outcomes;
+    }
+    return {
+        handle(change) {
+            // A full scan is a rebuild of the index, not news about the site.
+            if (change.origin === 'scan')
+                return;
+            if (!sending())
+                return;
+            const now = config.now();
+            const document = change.next ?? change.previous;
+            if (document === undefined)
+                return;
+            // Nothing goes out about a post the outside world has never been able to
+            // read: a draft edited into another draft is not news.
+            const wasPublic = isPublic(change.previous, now);
+            const isNowPublic = isPublic(change.next, now);
+            if (!wasPublic && !isNowPublic)
+                return;
+            // Both versions' links, because a page that has just been unlinked has
+            // to be told too: it goes and looks, finds the link gone, and drops what
+            // it was showing. That is how a webmention is withdrawn — there is no
+            // other way to say it.
+            const source = absoluteUrl(document.permalink, config.baseUrl);
+            const targets = targetsOf([change.previous, change.next], config.baseUrl);
+            if (targets.length === 0)
+                return;
+            enqueue(() => tellAll(document.slug, source, targets)).catch((thrown) => {
+                logger.warn(`A webmention failed: ${messageOf(thrown)}`);
+            });
+        },
+        async send(slug) {
+            const document = postBySlug(store, slug);
+            if (document === undefined)
+                return undefined;
+            const source = absoluteUrl(document.permalink, config.baseUrl);
+            if (!sending())
+                return { slug, source, sent: [] };
+            const targets = targetsOf([document], config.baseUrl);
+            return await enqueue(async () => ({
+                slug,
+                source,
+                sent: await tellAll(slug, source, targets),
+            }));
+        },
+        receive(incoming) {
+            const checked = checking.then(async () => {
+                try {
+                    const outcome = await verifyWebmention({
+                        incoming,
+                        records,
+                        dataDir: config.dataDir,
+                        baseUrl: config.baseUrl,
+                        checker: config.commentChecker,
+                        // The intake decides whether this one is news: a page that is
+                        // edited and re-sent updates the entry it made, and putting the
+                        // moderators through a message every time would make the notice
+                        // worth ignoring.
+                        notices: options.notifications,
+                        now: config.now(),
+                        logger,
+                    });
+                    return outcome;
+                }
+                catch (thrown) {
+                    // Nothing is waiting for this: the sender has had its 202, so a
+                    // failure has nowhere to go but the log, and it must not become an
+                    // unhandled rejection that takes the process down.
+                    const reason = messageOf(thrown);
+                    logger.warn(`A webmention from ${incoming.source} could not be checked: ${reason}`);
+                    return { kind: 'unreachable', reason };
+                }
+            });
+            checking = checked;
+            return checked;
+        },
+        settled() {
+            return Promise.all([chain, checking]).then(ignore);
+        },
+    };
+}
+/** Every external page any of these versions of a post links to, in order. */
+function targetsOf(documents, baseUrl) {
+    const targets = new Set();
+    for (const document of documents) {
+        if (document === undefined)
+            continue;
+        for (const target of externalLinks(document.html, baseUrl))
+            targets.add(target);
+    }
+    return [...targets];
+}
+/** Whether a version of a document was one a stranger could read. */
+function isPublic(document, now) {
+    return document !== undefined && isFederatedDocument(document, now);
+}
+/**
+ * The post a slug names, the trash included, or `undefined`.
+ *
+ * The same lookup a resend of an ActivityPub delivery does, and for the same
+ * reason: the newest document of that name is the post nine times out of ten,
+ * and the federated list is the fallback for a trashed one standing behind a
+ * live page.
+ */
+function postBySlug(store, slug) {
+    const direct = store.getBySlug(slug);
+    if (direct !== undefined)
+        return direct;
+    return store.listFederated().find((document) => document.slug === slug);
+}
+function messageOf(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function ignore() {
+    // Deliberately empty: the chain must not reject, and every failure is
+    // already recorded against the target it happened to.
+}
+//# sourceMappingURL=service.js.map

package/dist/webmention/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/webmention/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAOxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGhD;;;;;;;;;;;;;;;;;GAiBG;AAEH,oEAAoE;AACpE,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AAuEtC,iDAAiD;AACjD,MAAM,UAAU,uBAAuB,CACrC,OAAuC;IAEvC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC;IAEzC,gEAAgE;IAChE,MAAM,OAAO,GAAmB,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;IAEzE,4EAA4E;IAC5E,4EAA4E;IAC5E,qDAAqD;IACrD,IAAI,QAAQ,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEnD,0EAA0E;IAC1E,wDAAwD;IACxD,IAAI,KAAK,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEhD,SAAS,OAAO,CAAI,IAAsB;QACxC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACpC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,4EAA4E;IAC5E,SAAS,OAAO;QACd,OAAO,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,eAAe,CAAC;IAC7D,CAAC;IAED,mEAAmE;IACnE,KAAK,UAAU,IAAI,CAAC,IAAY,EAAE,MAAc,EAAE,MAAc;QAC9D,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,wEAAwE;YACxE,2CAA2C;YAC3C,OAAO,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;gBACrC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,MAAM,EAAE,8CAA8C;oBACtD,YAAY,EAAE,qBAAqB;iBACpC;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;gBACxD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC;aAC7C,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,KAAK,GAAG,GAAG,QAAQ,aAAa,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChE,MAAM,CAAC,IAAI,CAAC,mCAAmC,MAAM,KAAK,KAAK,EAAE,CAAC,CAAC;gBACnE,OAAO,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YACjE,CAAC;YAED,OAAO,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,mCAAmC,MAAM,KAAK,KAAK,EAAE,CAAC,CAAC;YACnE,OAAO,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,SAAS,MAAM,CACb,IAAY,EACZ,MAAc,EACd,MAAc,EACd,QAAuB,EACvB,MAA4B,EAC5B,KAAoB;QAEpB,OAAO,KAAK,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,6DAA6D;IAC7D,KAAK,UAAU,OAAO,CACpB,IAAY,EACZ,MAAc,EACd,OAA0B;QAE1B,MAAM,QAAQ,GAAqB,EAAE,CAAC;QACtC,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9E,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO;QACL,MAAM,CAAC,MAAM;YACX,kEAAkE;YAClE,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO;YACrC,IAAI,CAAC,OAAO,EAAE;gBAAE,OAAO;YAEvB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC;YAChD,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO;YAEnC,yEAAyE;YACzE,uDAAuD;YACvD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACjD,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC/C,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW;gBAAE,OAAO;YAEvC,uEAAuE;YACvE,yEAAyE;YACzE,sEAAsE;YACtE,uBAAuB;YACvB,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAC/D,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAEjC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAe,EAAE,EAAE;gBAC/E,MAAM,CAAC,IAAI,CAAC,wBAAwB,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC3D,CAAC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,IAAI;YACb,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACzC,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAE7C,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAC/D,IAAI,CAAC,OAAO,EAAE;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;YAElD,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAEtD,OAAO,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;gBAChC,IAAI;gBACJ,MAAM;gBACN,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC;aAC3C,CAAC,CAAC,CAAC;QACN,CAAC;QAED,OAAO,CAAC,QAAQ;YACd,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAgC,EAAE;gBACnE,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC;wBACrC,QAAQ;wBACR,OAAO;wBACP,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,OAAO,EAAE,MAAM,CAAC,cAAc;wBAC9B,8DAA8D;wBAC9D,gEAAgE;wBAChE,gEAAgE;wBAChE,kBAAkB;wBAClB,OAAO,EAAE,OAAO,CAAC,aAAa;wBAC9B,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE;wBACjB,MAAM;qBACP,CAAC,CAAC;oBAEH,OAAO,OAAO,CAAC;gBACjB,CAAC;gBAAC,OAAO,MAAM,EAAE,CAAC;oBAChB,gEAAgE;oBAChE,mEAAmE;oBACnE,mDAAmD;oBACnD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;oBACjC,MAAM,CAAC,IAAI,CAAC,qBAAqB,QAAQ,CAAC,MAAM,0BAA0B,MAAM,EAAE,CAAC,CAAC;oBACpF,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;gBACzC,CAAC;YACH,CAAC,CAAC,CAAC;YACH,QAAQ,GAAG,OAAO,CAAC;YACnB,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,OAAO;YACL,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,SAAS,CAAC,SAA4C,EAAE,OAAe;IAC9E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAS;QACrC,KAAK,MAAM,MAAM,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAED,qEAAqE;AACrE,SAAS,QAAQ,CAAC,QAA8B,EAAE,GAAS;IACzD,OAAO,QAAQ,KAAK,SAAS,IAAI,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,KAAmB,EAAE,IAAY;IACnD,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,OAAO,KAAK,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,MAAM;IACb,sEAAsE;IACtE,sDAAsD;AACxD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geekity/cms",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "type": "module",
   "description": "A file-first CMS: Markdown content, a SQLite index, a Hono server that is both the editor and the public site.",
   "license": "MIT",
@@ -35,27 +35,32 @@
     "@js-temporal/polyfill": "^0.5.1",
     "chokidar": "^5.0.0",
     "gray-matter": "^4.0.3",
-    "hono": "^4.13.5",
-    "js-yaml": "^5.4.1",
-    "markdown-it": "^15.0.1",
+    "hono": "^4.13.7",
+    "js-yaml": "^5.4.2",
+    "markdown-it": "^15.0.2",
     "markdown-it-footnote": "^4.0.0",
-    "nunjucks": "^3.2.4"
+    "nodemailer": "^10.0.9",
+    "nunjucks": "^3.2.4",
+    "sharp": "^0.35.4"
   },
   "devDependencies": {
     "@11ty/eleventy": "^3.1.6",
     "@codemirror/lang-markdown": "^6.5.2",
     "@fedify/cli": "2.3.6",
     "@types/markdown-it-footnote": "^3.0.4",
-    "@types/node": "^24.13.3",
+    "@types/node": "^26.4.1",
+    "@types/nodemailer": "^8.0.1",
     "@types/nunjucks": "^3.2.6",
     "codemirror": "^6.0.2",
     "esbuild": "^0.28.2",
+    "highlight.js": "11.12.0",
     "tsx": "^4.23.13",
     "typescript": "^7.0.2"
   },
   "scripts": {
     "build": "tsc -p tsconfig.build.json && node scripts/build-editor.js",
     "build:editor": "node scripts/build-editor.js",
+    "build:highlight": "node scripts/build-highlight.js",
     "dev": "tsc -p tsconfig.build.json --watch",
     "test": "tsx --test \"src/**/*.test.ts\"",
     "test:11ty": "tsx --test \"test/*.test.ts\"",

package/templates/site/content/_data/site.json

@@ -3,6 +3,7 @@
   "tagline": "Markdown on disk, served straight",
   "url": "http://localhost:3000",
   "author": "You",
+  "language": "en",
   "postsPerPage": 10,
   "feedSize": 20
 }

package/templates/site/content/posts/2026-01-01-hello-world.md

@@ -17,13 +17,15 @@ deleting it is safe and the next boot rebuilds it.
   `content/` is left alone.
 - `content/_data/site.json` is the site title, tagline, author and how many
   posts a listing page holds. It is the `site` global in every template.
-- `theme/` does not exist yet. Create it to override one template at a time;
-  anything you do not override still comes from the package.
+- `themes/` does not exist yet. A theme is a directory in there with a
+  `theme.json` in it, overriding one template at a time; anything it does not
+  override still comes from the package. `theme` in `site.json` says which one
+  the site wears, and no theme at all is the one the package ships.
 - `geekity.config.ts` is the port, the directories and the public base URL.
 
 ## Two things to try
 
-Add a tag to the front matter above and reload `/tags/introductions/`. Then ask
+Add a tag to the front matter above and reload `/tag/introductions/`. Then ask
 this page for its other representations:
 
 ```sh

package/templates/site/geekity.config.ts

@@ -4,8 +4,18 @@ export default defineConfig({
   port: 3000,
   contentDir: 'content',
   dataDir: 'data',
-  themeDir: 'theme',
+  // Where your own themes go: one folder each, `themes/<name>/`, holding a
+  // `theme.json` and only the templates and assets that theme changes. This
+  // directory is not scaffolded, because a site has one once it writes a theme
+  // and not before. Which theme the site wears is a setting rather than a
+  // path — `theme` in `content/_data/site.json`, and Appearance > Themes in
+  // the admin — and with no theme chosen every page comes from the theme
+  // inside @geekity/cms.
+  themesDir: 'themes',
   baseUrl: 'http://localhost:3000',
   watch: true,
   sessionLifetime: 60 * 60 * 24 * 14,
+  loginAttempts: 5,
+  loginLockout: 15 * 60,
+  trustProxy: false,
 });

package/templates/site/tsconfig.json

@@ -14,5 +14,5 @@
     "esModuleInterop": true,
     "noEmit": true
   },
-  "include": ["*.ts", "theme/**/*.ts"]
+  "include": ["*.ts", "themes/**/*.ts"]
 }