@geekity/cms 0.3.0 → 0.5.0

package/dist/admin/settings.js

@@ -1,38 +1,41 @@
-import { readFileSync } from 'node:fs';
-import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { statSync } from 'node:fs';
 import path from 'node:path';
+import { DEFAULT_COMMENTS_CLOSE_AFTER_DAYS } from '../comments/policy.js';
+import { readFileIfPresentSync, updateFileAtomically, writeFileAtomicallySync, } from '../files/atomic.js';
+import { MAIL_PROVIDERS } from '../mail/provider.js';
 import { SITE_DATA_FILE } from '../web/context.js';
-import { flash } from './flash.js';
+import { DEFAULT_NOTIFY_SERVER } from '../web/feeds.js';
+import { DEFAULT_MENU_NAME, menuItemsFromText, menusOf } from '../web/navigation.js';
+import { DEFAULT_TAXONOMY_BASES, taxonomyBaseProblems, taxonomyRedirectsOf, } from '../web/taxonomy.js';
+import { readTheme, themeNameProblem } from '../web/themes.js';
 import { ADMIN_PREFIX } from './session.js';
-import { ADMIN_TEMPLATES } from './templates.js';
-import { refusedUpload, storeUpload } from './uploads.js';
-/** Where the settings screen lives. */
+/**
+ * Where the settings live: the General page, and the root every other settings
+ * page hangs off ({@link settingsPagePath}).
+ */
 export const SETTINGS_PATH = `${ADMIN_PREFIX}/settings`;
-/** Where the avatar's upload form and its Remove button post. */
-export const AVATAR_PATH = `${SETTINGS_PATH}/avatar`;
-/** The fields those two forms submit. */
-export const AVATAR_FIELDS = { file: 'avatar', action: 'action' };
-/** The {@link AVATAR_FIELDS.action} that takes the avatar down again. */
-export const AVATAR_REMOVE = 'remove';
 /**
- * The ActivityPub actor types doc-4 allows a site to be.
+ * What a language tag may look like: BCP 47's shape rather than its registry —
+ * a two or three letter primary subtag followed by dash-separated subtags of
+ * letters and digits.
  *
- * `Person` is first because it is the default: some clients hide `Service`
- * actors from timelines, which is the wrong thing for a personal blog.
+ * Checking the shape and not the registry is deliberate. The value ends up in
+ * `<html lang>`, an RSS `<language>` and an Atom `xml:lang`, where a
+ * well-formed tag a reader has never heard of is harmless and a malformed one
+ * is not; refusing a valid tag because this CMS shipped before it was
+ * registered would be worse than accepting one nobody uses.
  */
-export const ACTOR_TYPES = [
-    'Person',
-    'Organization',
-    'Service',
-    'Group',
-    'Application',
-];
+export const LANGUAGE_TAG_PATTERN = /^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8}){0,4}$/;
 /**
- * What an actor handle may be made of. Tighter than a username: the handle
- * becomes the local part of `@handle@host` in WebFinger and in every mention
- * somebody types, so it holds no punctuation that would need escaping there.
+ * What an email address has to look like before the settings screen will keep
+ * it: something, an `@`, and a dotted host.
+ *
+ * Deliberately loose. The grammar in RFC 5321 allows addresses nobody has ever
+ * typed, and the only test that settles whether an address works is sending to
+ * it — which is what the Send test email button is for. This catches the
+ * typo where a whole field was pasted into the wrong box.
  */
-export const ACTOR_HANDLE_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
+export const EMAIL_PATTERN = /^[^\s@]+@[^\s@.]+(?:\.[^\s@.]+)+$/;
 /**
  * What a site is worth before anybody has said otherwise.
  *
@@ -44,11 +47,28 @@ export const DEFAULT_SITE_SETTINGS = {
     tagline: '',
     baseUrl: '',
     timezone: 'UTC',
+    language: 'en',
     postsPerPage: 10,
+    homepage: '',
+    postsPage: '',
     author: '',
-    actorHandle: 'blog',
-    actorType: 'Person',
-    avatar: '',
+    theme: '',
+    tagBase: DEFAULT_TAXONOMY_BASES.tag,
+    categoryBase: DEFAULT_TAXONOMY_BASES.category,
+    comments: true,
+    commentsCloseAfterDays: DEFAULT_COMMENTS_CLOSE_AFTER_DAYS,
+    webmentionsSend: true,
+    webmentionsReceive: true,
+    notifyServer: DEFAULT_NOTIFY_SERVER,
+    mailProvider: 'none',
+    mailFromName: '',
+    mailFromAddress: '',
+    mailReplyTo: '',
+    contactEmail: '',
+    relays: [],
+    wordpressActivityPub: false,
+    menus: {},
+    taxonomyRedirects: [],
 };
 /** The form field each setting is submitted under. */
 export const SETTINGS_FIELDS = {
@@ -56,74 +76,151 @@ export const SETTINGS_FIELDS = {
     tagline: 'tagline',
     baseUrl: 'base_url',
     timezone: 'timezone',
+    language: 'language',
     postsPerPage: 'posts_per_page',
+    homepage: 'homepage',
+    postsPage: 'posts_page',
     author: 'author',
-    actorHandle: 'actor_handle',
-    actorType: 'actor_type',
+    theme: 'theme',
+    tagBase: 'tag_base',
+    categoryBase: 'category_base',
+    comments: 'comments',
+    commentsCloseAfterDays: 'comments_close_after_days',
+    webmentionsSend: 'webmentions_send',
+    webmentionsReceive: 'webmentions_receive',
+    notifyServer: 'notify_server',
+    mailProvider: 'mail_provider',
+    mailFromName: 'mail_from_name',
+    mailFromAddress: 'mail_from_address',
+    mailReplyTo: 'mail_reply_to',
+    contactEmail: 'contact_email',
+    relays: 'relays',
+    wordpressActivityPub: 'wordpress_activitypub',
 };
-/** The stored settings, with every default filled in. */
-export function readSiteSettings(store) {
-    const stored = store.allSettings();
-    const postsPerPage = Number(stored['postsPerPage']);
-    return {
-        title: stored['title'] ?? DEFAULT_SITE_SETTINGS.title,
-        tagline: stored['tagline'] ?? DEFAULT_SITE_SETTINGS.tagline,
-        baseUrl: stored['baseUrl'] ?? DEFAULT_SITE_SETTINGS.baseUrl,
-        timezone: stored['timezone'] ?? DEFAULT_SITE_SETTINGS.timezone,
-        postsPerPage: Number.isInteger(postsPerPage) && postsPerPage > 0
-            ? postsPerPage
-            : DEFAULT_SITE_SETTINGS.postsPerPage,
-        author: stored['author'] ?? DEFAULT_SITE_SETTINGS.author,
-        actorHandle: stored['actorHandle'] ?? DEFAULT_SITE_SETTINGS.actorHandle,
-        actorType: ACTOR_TYPES.includes(stored['actorType'] ?? '')
-            ? stored['actorType']
-            : DEFAULT_SITE_SETTINGS.actorType,
-        avatar: stored['avatar'] ?? DEFAULT_SITE_SETTINGS.avatar,
-    };
-}
-/** Write a whole settings object back to the store. */
-export function writeSiteSettings(store, settings) {
-    store.setSettings({
-        title: settings.title,
-        tagline: settings.tagline,
-        baseUrl: settings.baseUrl,
-        timezone: settings.timezone,
-        postsPerPage: String(settings.postsPerPage),
-        author: settings.author,
-        actorHandle: settings.actorHandle,
-        actorType: settings.actorType,
-        avatar: settings.avatar,
-    });
+/**
+ * A site's settings, as its `content/_data/site.json` says them right now.
+ *
+ * Read on every request that needs one rather than cached, which is what a
+ * source of truth being a file is worth: a hand edit shows on the public site,
+ * on the settings screen and in the actor document without a restart and
+ * without anything being told. The file is a few hundred bytes, so the read
+ * costs less than the parse of the template that is about to use it.
+ *
+ * A file that is missing, or one that will not parse, is the defaults rather
+ * than an error: a typo in `site.json` should leave a site up and answerable,
+ * with the settings screen there to put it right.
+ */
+export function readSiteSettings(contentDir) {
+    return settingsFromSiteJson(readSiteJsonSync(siteDataPath(contentDir)));
 }
 /**
- * The settings as the `site` global, for the theme and for the JSON mirror.
+ * `content/_data/site.json` as the settings it names, defaults filled in.
  *
- * Empty strings are left out rather than written as empty values, so a key a
- * site keeps in `site.json` by hand and leaves blank in the form is overlaid
- * rather than blanked.
+ * Read tolerantly, key by key, because the file is public, in git and editable
+ * by hand: a key of the wrong type, or one a site has never written, falls
+ * back to the default rather than taking the site down. The empty string is a
+ * value of its own for `tagline`, `author` and `notifyServer`, where empty is
+ * a decision — no tagline, no author, notifications off — and not for
+ * `title`, `timezone`, `language` or the two archive bases, where it is a hole
+ * only a default can fill.
  */
-export function settingsSiteData(settings) {
+export function settingsFromSiteJson(file) {
+    const postsPerPage = Number(file['postsPerPage']);
+    const closeAfterDays = Number(file['commentsCloseAfterDays']);
     return {
-        ...(settings.title === '' ? {} : { title: settings.title }),
-        ...(settings.tagline === '' ? {} : { tagline: settings.tagline }),
-        ...(settings.baseUrl === '' ? {} : { url: settings.baseUrl }),
-        ...(settings.author === '' ? {} : { author: settings.author }),
-        ...(settings.timezone === '' ? {} : { timezone: settings.timezone }),
-        ...(settings.avatar === '' ? {} : { avatar: settings.avatar }),
-        postsPerPage: settings.postsPerPage,
+        ...DEFAULT_SITE_SETTINGS,
+        ...(typeof file['title'] === 'string' && file['title'] !== '' ? { title: file['title'] } : {}),
+        ...(typeof file['tagline'] === 'string' ? { tagline: file['tagline'] } : {}),
+        ...(typeof file['author'] === 'string' ? { author: file['author'] } : {}),
+        ...(typeof file['timezone'] === 'string' && file['timezone'] !== ''
+            ? { timezone: file['timezone'] }
+            : {}),
+        ...(typeof file['language'] === 'string' && file['language'] !== ''
+            ? { language: file['language'] }
+            : {}),
+        // Absent is the ordinary state of this one: a site on the packaged theme
+        // has never written the key, so anything but a string is that site.
+        ...(typeof file['theme'] === 'string' ? { theme: file['theme'] } : {}),
+        // Absent is the ordinary state of these two: a site showing its latest
+        // posts writes neither key, so anything but a string is read as none.
+        ...(typeof file['homepage'] === 'string' ? { homepage: file['homepage'] } : {}),
+        ...(typeof file['postsPage'] === 'string' ? { postsPage: file['postsPage'] } : {}),
+        ...(typeof file['tagBase'] === 'string' && file['tagBase'] !== ''
+            ? { tagBase: file['tagBase'] }
+            : {}),
+        ...(typeof file['categoryBase'] === 'string' && file['categoryBase'] !== ''
+            ? { categoryBase: file['categoryBase'] }
+            : {}),
+        ...(typeof file['comments'] === 'boolean' ? { comments: file['comments'] } : {}),
+        ...(Number.isInteger(closeAfterDays) && closeAfterDays >= 0
+            ? { commentsCloseAfterDays: closeAfterDays }
+            : {}),
+        ...(typeof file['webmentionsSend'] === 'boolean'
+            ? { webmentionsSend: file['webmentionsSend'] }
+            : {}),
+        ...(typeof file['webmentionsReceive'] === 'boolean'
+            ? { webmentionsReceive: file['webmentionsReceive'] }
+            : {}),
+        ...(typeof file['notifyServer'] === 'string' ? { notifyServer: file['notifyServer'] } : {}),
+        // Only a provider this version ships, for the reason the actor type is
+        // read that way: a file naming one it has never heard of is a site that
+        // sends no mail rather than a boot that fails.
+        ...(typeof file['mailProvider'] === 'string' &&
+            MAIL_PROVIDERS.includes(file['mailProvider'])
+            ? { mailProvider: file['mailProvider'] }
+            : {}),
+        ...(typeof file['mailFromName'] === 'string' ? { mailFromName: file['mailFromName'] } : {}),
+        ...(typeof file['mailFromAddress'] === 'string'
+            ? { mailFromAddress: file['mailFromAddress'] }
+            : {}),
+        ...(typeof file['mailReplyTo'] === 'string' ? { mailReplyTo: file['mailReplyTo'] } : {}),
+        ...(typeof file['contactEmail'] === 'string' ? { contactEmail: file['contactEmail'] } : {}),
+        // Through the same normaliser a submitted form goes through, so the file
+        // and the screen cannot mean different things by the same line.
+        ...(Array.isArray(file['relays'])
+            ? {
+                relays: relayList(file['relays'].filter((entry) => typeof entry === 'string').join('\n')),
+            }
+            : {}),
+        // Absent is the ordinary state of this one, like `homepage`: a site that
+        // has never carried WordPress's paths does not write the key at all.
+        ...(typeof file['wordpressActivityPub'] === 'boolean'
+            ? { wordpressActivityPub: file['wordpressActivityPub'] }
+            : {}),
+        // Every menu the site holds, whether or not the theme in use renders it.
+        // The `navigation` key the one menu used to live under is not read at all:
+        // menus were renamed rather than migrated (TASK-107).
+        ...(file['menus'] === undefined ? {} : { menus: menusOf(file['menus']) }),
+        // The renames a site has published redirects for: facts about its URLs
+        // rather than preferences, which is why a content directory restored on
+        // its own keeps answering the archive URLs it used to.
+        ...(Array.isArray(file['taxonomyRedirects'])
+            ? { taxonomyRedirects: taxonomyRedirectsOf(file['taxonomyRedirects']) }
+            : {}),
+        ...(Number.isInteger(postsPerPage) && postsPerPage > 0 ? { postsPerPage } : {}),
+        ...(typeof file['url'] === 'string' ? { baseUrl: file['url'] } : {}),
     };
 }
+/** The two archive bases the settings hold, as the URL builders want them. */
+export function taxonomyBasesFromSettings(settings) {
+    return { tag: settings.tagBase, category: settings.categoryBase };
+}
 /**
  * `content/_data/site.json` as it should read for these settings.
  *
- * Every key the form manages is written whether or not it has a value, so the
- * file's shape is stable and an Eleventy template may reference `site.author`
- * without guarding it. Every other key the file already had is kept: a site
- * may put anything in there and reach it from its templates, and the settings
- * form is not going to be the thing that throws it away.
+ * Every key the settings model is written whether or not it has a value, so
+ * the file's shape is stable and an Eleventy template may reference
+ * `site.author` without guarding it. Every other key the file already had is
+ * kept: a site may put anything in there and reach it from its templates, and
+ * the settings form is not going to be the thing that throws it away.
+ *
+ * `homepage` and `postsPage` are the one exception, and they earn it: a site
+ * showing its latest posts has no static front page at all rather than an
+ * empty one, so the keys are absent rather than empty — which is also how a
+ * `site.json` written before this version reads, and what it should mean.
  */
 export function siteJsonFor(settings, existing = {}) {
-    return {
+    const file = {
         ...existing,
         title: settings.title,
         tagline: settings.tagline,
@@ -131,69 +228,167 @@ export function siteJsonFor(settings, existing = {}) {
         author: settings.author,
         postsPerPage: settings.postsPerPage,
         timezone: settings.timezone,
-        avatar: settings.avatar,
+        language: settings.language,
+        tagBase: settings.tagBase,
+        categoryBase: settings.categoryBase,
+        comments: settings.comments,
+        commentsCloseAfterDays: settings.commentsCloseAfterDays,
+        webmentionsSend: settings.webmentionsSend,
+        webmentionsReceive: settings.webmentionsReceive,
+        notifyServer: settings.notifyServer,
+        mailProvider: settings.mailProvider,
+        mailFromName: settings.mailFromName,
+        mailFromAddress: settings.mailFromAddress,
+        mailReplyTo: settings.mailReplyTo,
+        contactEmail: settings.contactEmail,
+        relays: [...settings.relays],
+        // Every menu the site holds, written whole. A settings page never has
+        // them off its own form — it reads them out of the file inside the write
+        // and hands them straight back — so the one screen that models them is the
+        // one that edits them (TASK-108).
+        menus: Object.fromEntries(Object.entries(settings.menus).map(([name, items]) => [
+            name,
+            items.map((item) => ({ ...item })),
+        ])),
+        taxonomyRedirects: settings.taxonomyRedirects.map((entry) => ({ ...entry })),
     };
+    // The key the menu lived under before menus had names. A rename leaves
+    // nothing behind: a `navigation` array sitting beside `menus` in a file
+    // nothing reads it from is the kind of thing somebody edits for an hour
+    // before noticing.
+    delete file['navigation'];
+    // `theme` is absent for a site on the packaged theme, on the same rule and
+    // for the same reason as the two above: running what the package ships is
+    // not a choice a site should have to write down, and a `theme` of `""` would
+    // be a name no directory has.
+    for (const key of ['homepage', 'postsPage', 'theme']) {
+        if (settings[key] === '')
+            delete file[key];
+        else
+            file[key] = settings[key];
+    }
+    // And the WordPress switch, on the same rule and for a sharper reason: it is
+    // a temporary accommodation for one migrated site (decision-14), so a site
+    // that has never turned it on should have nothing to say about it, and one
+    // that has turned it off again should go back to saying nothing.
+    if (settings.wordpressActivityPub)
+        file['wordpressActivityPub'] = true;
+    else
+        delete file['wordpressActivityPub'];
+    return file;
 }
 /** The absolute path of one site's `content/_data/site.json`. */
 export function siteDataPath(contentDir) {
     return path.join(contentDir, ...SITE_DATA_FILE.split('/'));
 }
+/** The bytes of one settings object, as the file holds them. */
+function siteJsonText(settings, existing) {
+    return `${JSON.stringify(siteJsonFor(settings, existing), null, 2)}\n`;
+}
 /**
- * Rewrite `content/_data/site.json` from the settings.
+ * Rewrite `content/_data/site.json` as these settings, keeping the keys they
+ * do not model.
  *
- * Written to a temporary file in the same directory and renamed over the old
- * one, so a reader — an Eleventy build, or the CMS's own site data source —
- * sees either the whole old file or the whole new one and never a half-written
- * one.
+ * {@link updateSiteSettings} for a caller whose new settings depend on the old
+ * ones, which every screen's is: this is for the callers that have the whole
+ * object already, a test's set-up among them.
  */
 export async function writeSiteJson(options) {
-    const file = siteDataPath(options.contentDir);
-    await mkdir(path.dirname(file), { recursive: true });
-    let existing = {};
-    try {
-        existing = parseSiteJson(await readFile(file, 'utf8'));
-    }
-    catch {
-        // No file yet, or one that will not parse. Either way the settings are
-        // what the file is about to say.
+    await updateSiteSettings({ contentDir: options.contentDir, change: () => options.settings });
+}
+/**
+ * Change the settings: re-read the file, apply the change, write it back, with
+ * nothing able to write that file in between ({@link updateFileAtomically}).
+ *
+ * The re-read is what makes the file win the way it wins for a post
+ * (decision-9). Two people with the settings screen open both save what they
+ * see, and the second save is applied to what the first one actually wrote
+ * rather than to what the second one had on screen — so a change to a field
+ * the second person did not touch survives. The write is a temporary file and
+ * a rename, so a reader — an Eleventy build, the site data source, another
+ * process entirely — never sees a half-written file. Keys the settings do not
+ * model, `feedSize` and anything a site added, are kept.
+ */
+export async function updateSiteSettings(options) {
+    let written = DEFAULT_SITE_SETTINGS;
+    await updateFileAtomically(siteDataPath(options.contentDir), (current) => {
+        const existing = parseSiteJson(current ?? '');
+        written = options.change(settingsFromSiteJson(existing));
+        return siteJsonText(written, existing);
+    });
+    return written;
+}
+/**
+ * Turn an older site's settings rows into `content/_data/site.json`, once, and
+ * drop the table.
+ *
+ * TASK-14 made SQLite the source and the file its mirror; decision-9 reversed
+ * that, and a site upgrading across the two has rows nothing would ever read
+ * again. So the first boot of this version writes them out. Which side wins
+ * when both have something to say is decided the way it is decided everywhere
+ * else: the file wins when it was written after the last save, because that is
+ * a hand edit or a restored checkout, and the rows win otherwise. Either way
+ * the actor handle and type come from the rows, because `site.json` never
+ * carried them and losing them would rename the site's actor.
+ *
+ * Synchronous because `createCms` is: it runs before the server is listening
+ * and before anything else has touched the file.
+ */
+export function migrateSettingsToFile(options) {
+    const { admin, contentDir } = options;
+    const rows = admin.legacySettings();
+    if (rows !== undefined && rows.length > 0) {
+        const stored = settingsFromRows(rows);
+        const file = siteDataPath(contentDir);
+        const existing = parseSiteJson(readFileIfPresentSync(file) ?? '');
+        const settings = fileWasEditedLast(file, rows) ? settingsFromSiteJson(existing) : stored;
+        writeFileAtomicallySync(file, siteJsonText(settings, existing));
     }
-    const temporary = `${file}.${process.pid.toString(36)}.tmp`;
-    await writeFile(temporary, `${JSON.stringify(siteJsonFor(options.settings, existing), null, 2)}\n`, 'utf8');
-    await rename(temporary, file);
+    // Dropped whether or not it had rows: a fresh database gets the table from
+    // migration 3, which has shipped and so is never edited, and a site that has
+    // been migrated must not be asked again on the next boot.
+    admin.dropLegacyTable('settings');
+}
+/** The old key/value rows as settings, defaults filled in. */
+function settingsFromRows(rows) {
+    const stored = {};
+    for (const row of rows)
+        stored[row.key] = row.value;
+    // Through the file's own reader, so one description of what a setting is
+    // worth serves both: the rows are spelled as the file spells them and read
+    // back the same way. `relays`, `navigation` and `taxonomyRedirects` were
+    // stored one entry per line, which is not how the file holds them.
+    return settingsFromSiteJson({
+        ...stored,
+        ...(stored['baseUrl'] === undefined ? {} : { url: stored['baseUrl'] }),
+        ...(stored['postsPerPage'] === undefined
+            ? {}
+            : { postsPerPage: Number(stored['postsPerPage']) }),
+        relays: relayList(stored['relays'] ?? ''),
+        menus: { [DEFAULT_MENU_NAME]: menuItemsFromText(stored['navigation'] ?? '') },
+        taxonomyRedirects: redirectList(stored['taxonomyRedirects'] ?? ''),
+    });
 }
 /**
- * Fill an empty settings table from `content/_data/site.json`, so a site that
- * existed before this screen did — or one `geekity init` just wrote — keeps
- * the values it already had.
+ * Whether `site.json` has been written since the newest settings row was.
  *
- * Runs once, on the boot that finds the table empty. After that SQLite is the
- * source and the file is the mirror, so a later hand edit of the file no
- * longer wins.
+ * A missing file has not, so the rows win. A file whose modification time
+ * cannot be read is treated the same way: the rows are the only thing that is
+ * certainly there.
  */
-export function seedSiteSettings(options) {
-    const { store, config } = options;
-    if (store.countSettings() > 0)
-        return readSiteSettings(store);
-    const file = readSiteJsonSync(siteDataPath(config.contentDir));
-    const postsPerPage = Number(file['postsPerPage']);
-    const seeded = {
-        ...DEFAULT_SITE_SETTINGS,
-        ...(typeof file['title'] === 'string' && file['title'] !== '' ? { title: file['title'] } : {}),
-        ...(typeof file['tagline'] === 'string' ? { tagline: file['tagline'] } : {}),
-        ...(typeof file['author'] === 'string' ? { author: file['author'] } : {}),
-        ...(typeof file['timezone'] === 'string' && file['timezone'] !== ''
-            ? { timezone: file['timezone'] }
-            : {}),
-        ...(typeof file['avatar'] === 'string' ? { avatar: file['avatar'] } : {}),
-        ...(Number.isInteger(postsPerPage) && postsPerPage > 0 ? { postsPerPage } : {}),
-        // The file's `url` only becomes the setting when the deployment has not
-        // named one; otherwise the setting records what is actually in effect.
-        baseUrl: config.baseUrlSource === 'default' && typeof file['url'] === 'string' && file['url'] !== ''
-            ? file['url']
-            : config.baseUrl,
-    };
-    writeSiteSettings(store, seeded);
-    return seeded;
+function fileWasEditedLast(file, rows) {
+    let modified;
+    try {
+        modified = statSync(file).mtimeMs;
+    }
+    catch {
+        return false;
+    }
+    const newest = rows.reduce((latest, row) => {
+        const at = Date.parse(row.updatedAt);
+        return Number.isNaN(at) ? latest : Math.max(latest, at);
+    }, 0);
+    return modified > newest;
 }
 /**
  * The base URL actually in effect, and why.
@@ -209,28 +404,141 @@ export function effectiveBaseUrl(config, settings) {
         return config.baseUrl;
     return settings.baseUrl === '' ? config.baseUrl : settings.baseUrl;
 }
-/** What is wrong with a submitted settings form, one message per field. */
-export function settingsProblems(form) {
+/**
+ * What is wrong with each field of a submitted form: one check per field, so a
+ * page can run the checks for the fields it carries and no others.
+ *
+ * A field nothing can be wrong with — a tagline, an author, a checkbox — has a
+ * check all the same, because a table with a hole in it is a field somebody
+ * added and forgot to think about.
+ */
+const FIELD_CHECKS = {
+    title: (form) => (form.title.trim() === '' ? 'The site needs a title.' : undefined),
+    tagline: () => undefined,
+    author: () => undefined,
+    baseUrl: (form) => normalizeBaseUrl(form.baseUrl) === undefined
+        ? 'The base URL has to be an absolute http:// or https:// URL.'
+        : undefined,
+    postsPerPage: (form) => {
+        const perPage = Number(form.postsPerPage);
+        return !Number.isInteger(perPage) || perPage < 1
+            ? 'Posts per page has to be a whole number of one or more.'
+            : undefined;
+    },
+    // The two picks are checked as a pair, the way the archive bases are, and
+    // for the same reason: two of the three rules are about the pair. Neither
+    // check asks whether the slug still names a published page — the select only
+    // offers ones that do, and a page drafted after it was picked is a site back
+    // on its latest posts rather than a settings screen that will not save.
+    homepage: (form) => slugProblem(form.homepage, 'A homepage'),
+    postsPage: (form) => {
+        if (form.postsPage.trim() === '')
+            return undefined;
+        if (form.homepage.trim() === '') {
+            return 'A posts page needs a homepage: pick the page the front page shows first.';
+        }
+        if (form.postsPage.trim() === form.homepage.trim()) {
+            return 'The homepage and the posts page have to be two different pages.';
+        }
+        return slugProblem(form.postsPage, 'A posts page');
+    },
+    timezone: (form) => isValidTimezone(form.timezone)
+        ? undefined
+        : 'That is not an IANA time zone name, such as Europe/London.',
+    language: (form) => LANGUAGE_TAG_PATTERN.test(form.language.trim())
+        ? undefined
+        : 'That is not a language tag, such as en, en-GB or pt-BR.',
+    // Empty is a value here — it is how a site says "the theme the package
+    // ships" — so only a name has anything to check. A name that is not a theme
+    // is refused rather than saved and warned about later: the screen has a list
+    // of the themes that are there, so the only way to type one that is not is a
+    // theme deleted between drawing the list and saving it, and the person is in
+    // front of the form and can be told.
+    theme: (form, context) => {
+        const name = form.theme.trim();
+        if (name === '')
+            return undefined;
+        const badName = themeNameProblem(name);
+        if (badName !== undefined)
+            return badName;
+        if (context.themesDir === undefined)
+            return undefined;
+        const read = readTheme(path.join(context.themesDir, name));
+        return read.ok ? undefined : `There is no theme called "${name}": ${read.reason}`;
+    },
+    comments: () => undefined,
+    // The empty string is refused rather than read as zero, which is what
+    // `Number('')` would make it: a cleared field is a mistake, and "never close
+    // comments" should have to be typed.
+    commentsCloseAfterDays: (form) => {
+        const typed = form.commentsCloseAfterDays.trim();
+        const days = Number(typed);
+        return typed === '' || !Number.isInteger(days) || days < 0
+            ? 'Comments close after a whole number of days, or 0 for never.'
+            : undefined;
+    },
+    webmentionsSend: () => undefined,
+    webmentionsReceive: () => undefined,
+    // Empty is a value here — it is how a site turns real-time notification off
+    // — so only a non-empty one has to be a URL. http as well as https, because
+    // a notify server on a private network or a loopback port is a real one.
+    notifyServer: (form) => form.notifyServer.trim() !== '' && normalizeBaseUrl(form.notifyServer) === undefined
+        ? 'A notify server is an absolute http:// or https:// URL, or empty for none.'
+        : undefined,
+    mailProvider: (form) => MAIL_PROVIDERS.includes(form.mailProvider)
+        ? undefined
+        : `A mail provider is one of ${MAIL_PROVIDERS.join(', ')}.`,
+    mailFromName: () => undefined,
+    // Empty is a value for both of these — no From address falls back to
+    // `no-reply@` at the site's host, and no reply-to means replies go to the
+    // From address — so only a non-empty one has to look like an address.
+    mailFromAddress: (form) => form.mailFromAddress.trim() !== '' && !EMAIL_PATTERN.test(form.mailFromAddress.trim())
+        ? 'A From address is an email address, such as blog@example.com, or empty for the default.'
+        : undefined,
+    mailReplyTo: (form) => form.mailReplyTo.trim() !== '' && !EMAIL_PATTERN.test(form.mailReplyTo.trim())
+        ? 'A reply-to is an email address, such as hello@example.com, or empty to reply to the From address.'
+        : undefined,
+    // Empty is a value here too — it is how a site says "whichever admin has an
+    // address" — so only a non-empty one has to look like one.
+    contactEmail: (form) => form.contactEmail.trim() !== '' && !EMAIL_PATTERN.test(form.contactEmail.trim())
+        ? 'A contact address is an email address, such as hello@example.com, or empty for the first admin with one.'
+        : undefined,
+    // A relay list is checked line by line, and the first bad line is what the
+    // field says: a textarea has one message, and pointing at the line somebody
+    // has to fix is more use than counting how many are wrong.
+    relays: (form) => {
+        const bad = relayLines(form.relays).find((line) => normalizeRelayInbox(line) === undefined);
+        return bad === undefined
+            ? undefined
+            : `A relay is its inbox as an absolute http:// or https:// URL, one per line. ` +
+                `"${bad}" is not one.`;
+    },
+    // A checkbox is either submitted or not, so there is nothing a person could
+    // get wrong about it.
+    wordpressActivityPub: () => undefined,
+    // The two archive bases are checked as a pair, because two of the rules —
+    // that they differ, and that neither takes a path the site already answers
+    // on — are about the pair rather than either one. They are on one page for
+    // exactly that reason.
+    tagBase: (form) => taxonomyBaseProblems({ tag: form.tagBase, category: form.categoryBase }).tag,
+    categoryBase: (form) => taxonomyBaseProblems({ tag: form.tagBase, category: form.categoryBase }).category,
+};
+/** Every field of the settings, in the order the form fields name them. */
+export const SETTINGS_FIELD_NAMES = Object.keys(SETTINGS_FIELDS);
+/**
+ * What is wrong with a submitted settings form, one message per field.
+ *
+ * `fields` is what a page carries: it validates its own fields and says
+ * nothing about the rest, so a page cannot refuse a save over a field it does
+ * not show and gives no way to fix. `context` is what a check needs beyond the
+ * form; see {@link SettingsContext}.
+ */
+export function settingsProblems(form, fields = SETTINGS_FIELD_NAMES, context = {}) {
     const problems = {};
-    if (form.title.trim() === '')
-        problems.title = 'The site needs a title.';
-    const url = normalizeBaseUrl(form.baseUrl);
-    if (url === undefined) {
-        problems.baseUrl = 'The base URL has to be an absolute http:// or https:// URL.';
-    }
-    const perPage = Number(form.postsPerPage);
-    if (!Number.isInteger(perPage) || perPage < 1) {
-        problems.postsPerPage = 'Posts per page has to be a whole number of one or more.';
-    }
-    if (!isValidTimezone(form.timezone)) {
-        problems.timezone = 'That is not an IANA time zone name, such as Europe/London.';
-    }
-    if (!ACTOR_HANDLE_PATTERN.test(form.actorHandle)) {
-        problems.actorHandle =
-            'An actor handle is 1 to 64 letters, digits, dashes or underscores, with no @ and no dots.';
-    }
-    if (!ACTOR_TYPES.includes(form.actorType)) {
-        problems.actorType = `An actor type is one of ${ACTOR_TYPES.join(', ')}.`;
+    for (const name of fields) {
+        const problem = FIELD_CHECKS[name](form, context);
+        if (problem !== undefined)
+            problems[name] = problem;
     }
     return problems;
 }
@@ -238,21 +546,47 @@ export function settingsProblems(form) {
  * A validated form as settings. Only call it on a form
  * {@link settingsProblems} found nothing wrong with.
  *
- * The avatar is carried in rather than read off the form, because it is not on
- * it: the image is uploaded and removed through {@link AVATAR_PATH}, and a
- * save of the other fields keeps whatever is stored.
+ * The archive renames and the menus are carried in rather than read off the
+ * form, because they are not on it: the taxonomy screens write the one and the
+ * Navigation screen the other, and a save of the fields that are on the form
+ * keeps whatever is stored. Passing the settings read inside the write is all
+ * a caller has to do, since they hold both.
  */
-export function settingsFromForm(form, avatar = DEFAULT_SITE_SETTINGS.avatar) {
+export function settingsFromForm(form, carried = {}) {
     return {
-        avatar,
+        taxonomyRedirects: carried.taxonomyRedirects ?? DEFAULT_SITE_SETTINGS.taxonomyRedirects,
+        menus: carried.menus ?? DEFAULT_SITE_SETTINGS.menus,
         title: form.title.trim(),
         tagline: form.tagline.trim(),
         baseUrl: normalizeBaseUrl(form.baseUrl) ?? '',
         timezone: form.timezone.trim(),
+        language: form.language.trim(),
         postsPerPage: Number(form.postsPerPage),
+        homepage: form.homepage.trim(),
+        // A posts page means nothing without a homepage, and the validator has
+        // already refused the pair; this is what makes clearing the homepage clear
+        // the listing's own page with it rather than leave it stranded.
+        postsPage: form.homepage.trim() === '' ? '' : form.postsPage.trim(),
         author: form.author.trim(),
-        actorHandle: form.actorHandle.trim(),
-        actorType: form.actorType,
+        theme: form.theme.trim(),
+        tagBase: form.tagBase.trim(),
+        categoryBase: form.categoryBase.trim(),
+        // A checkbox submits nothing at all when it is clear, which is what the
+        // empty string here means.
+        comments: form.comments !== '',
+        commentsCloseAfterDays: Number(form.commentsCloseAfterDays),
+        webmentionsSend: form.webmentionsSend !== '',
+        webmentionsReceive: form.webmentionsReceive !== '',
+        notifyServer: normalizeBaseUrl(form.notifyServer) ?? '',
+        mailProvider: MAIL_PROVIDERS.includes(form.mailProvider)
+            ? form.mailProvider
+            : 'none',
+        mailFromName: form.mailFromName.trim(),
+        mailFromAddress: form.mailFromAddress.trim(),
+        mailReplyTo: form.mailReplyTo.trim(),
+        contactEmail: form.contactEmail.trim(),
+        relays: relayList(form.relays),
+        wordpressActivityPub: form.wordpressActivityPub !== '',
     };
 }
 /** The settings as the form shows them. */
@@ -262,169 +596,109 @@ export function formFromSettings(settings) {
         tagline: settings.tagline,
         baseUrl: settings.baseUrl,
         timezone: settings.timezone,
+        language: settings.language,
         postsPerPage: String(settings.postsPerPage),
+        homepage: settings.homepage,
+        postsPage: settings.postsPage,
         author: settings.author,
-        actorHandle: settings.actorHandle,
-        actorType: settings.actorType,
+        theme: settings.theme,
+        tagBase: settings.tagBase,
+        categoryBase: settings.categoryBase,
+        comments: settings.comments ? '1' : '',
+        commentsCloseAfterDays: String(settings.commentsCloseAfterDays),
+        webmentionsSend: settings.webmentionsSend ? '1' : '',
+        webmentionsReceive: settings.webmentionsReceive ? '1' : '',
+        notifyServer: settings.notifyServer,
+        mailProvider: settings.mailProvider,
+        mailFromName: settings.mailFromName,
+        mailFromAddress: settings.mailFromAddress,
+        mailReplyTo: settings.mailReplyTo,
+        contactEmail: settings.contactEmail,
+        relays: settings.relays.join('\n'),
+        wordpressActivityPub: settings.wordpressActivityPub ? '1' : '',
     };
 }
 /**
- * Register the settings screen.
+ * A `taxonomy|from|to` block as the renames it names, which is how the old
+ * settings table spelled them ({@link migrateSettingsToFile}).
  *
- * A save writes SQLite and `content/_data/site.json` in that order, so the
- * store — which is what the theme reads — is never behind the file. A form the
- * validator has anything to say about is a 400 that writes neither.
+ * The same tolerance the rest of this file reads its lists with: a line that
+ * is not three non-empty parts naming a real taxonomy is dropped rather than
+ * failing the read.
  */
-export function mountSettings(app, options) {
-    const { render } = options;
-    app.get(SETTINGS_PATH, (c) => render(c, ADMIN_TEMPLATES.settings, screen(c.var.config, readSiteSettings(c.var.admin))));
-    app.post(SETTINGS_PATH, async (c) => {
-        const body = await c.req.parseBody();
-        const stored = readSiteSettings(c.var.admin);
-        const submitted = {
-            title: field(body[SETTINGS_FIELDS.title]),
-            tagline: field(body[SETTINGS_FIELDS.tagline]),
-            // A field the form rendered read-only is not submitted, so an overridden
-            // base URL keeps the value it had rather than being cleared by a save.
-            baseUrl: c.var.config.baseUrlSource === 'default'
-                ? field(body[SETTINGS_FIELDS.baseUrl])
-                : stored.baseUrl === ''
-                    ? c.var.config.baseUrl
-                    : stored.baseUrl,
-            timezone: field(body[SETTINGS_FIELDS.timezone]),
-            postsPerPage: field(body[SETTINGS_FIELDS.postsPerPage]),
-            author: field(body[SETTINGS_FIELDS.author]),
-            actorHandle: field(body[SETTINGS_FIELDS.actorHandle]),
-            actorType: field(body[SETTINGS_FIELDS.actorType]),
-        };
-        const problems = settingsProblems(submitted);
-        if (Object.keys(problems).length > 0) {
-            c.status(400);
-            return render(c, ADMIN_TEMPLATES.settings, {
-                ...screen(c.var.config, stored),
-                form: submitted,
-                problems,
-            });
-        }
-        const settings = settingsFromForm(submitted, stored.avatar);
-        await store(c, settings);
-        // The name, the summary and the handle are the actor's profile as much as
-        // the avatar is, and a follower's copy of it is only as fresh as the last
-        // thing it was told.
-        const report = profileChanged(stored, settings)
-            ? await c.var.delivery.updateActor()
-            : undefined;
-        flash(c, 'notice', `Settings saved.${toldFollowers(report)}`);
-        return c.redirect(SETTINGS_PATH, 303);
-    });
-    /**
-     * The avatar's own endpoint: one multipart form uploads an image, and a
-     * second, plain one takes it down again.
-     *
-     * It is separate from the settings form because a file cannot travel in a
-     * urlencoded body, and because the two should not share a fate: a rejected
-     * image must not lose an edit to the title, and a rejected title must not
-     * lose the avatar. A refusal is a flash and a redirect, so what is stored is
-     * exactly what it was and the screen says why.
-     */
-    app.post(AVATAR_PATH, async (c) => {
-        const body = await c.req.parseBody();
-        const stored = readSiteSettings(c.var.admin);
-        if (field(body[AVATAR_FIELDS.action]) === AVATAR_REMOVE) {
-            if (stored.avatar === '') {
-                flash(c, 'notice', 'The site has no avatar.');
-                return c.redirect(SETTINGS_PATH, 303);
-            }
-            await store(c, { ...stored, avatar: '' });
-            const removal = await c.var.delivery.updateActor();
-            flash(c, 'notice', `Avatar removed.${toldFollowers(removal)}`);
-            return c.redirect(SETTINGS_PATH, 303);
-        }
-        const outcome = await storeUpload(body[AVATAR_FIELDS.file], c.var.config, {
-            imagesOnly: true,
+function redirectList(value) {
+    const entries = [];
+    for (const line of value.split('\n')) {
+        const parts = line.split('|');
+        if (parts.length !== 3)
+            continue;
+        entries.push({
+            taxonomy: (parts[0] ?? '').trim(),
+            from: (parts[1] ?? '').trim(),
+            to: (parts[2] ?? '').trim(),
         });
-        if (refusedUpload(outcome)) {
-            flash(c, 'error', `${outcome.error} The avatar is unchanged.`);
-            return c.redirect(SETTINGS_PATH, 303);
-        }
-        await store(c, { ...stored, avatar: outcome.url });
-        const report = await c.var.delivery.updateActor();
-        flash(c, 'notice', `Avatar saved.${toldFollowers(report)}`);
-        return c.redirect(SETTINGS_PATH, 303);
-    });
-    /**
-     * Write settings to SQLite and then to `content/_data/site.json`, in that
-     * order, so the store — which is what the theme reads — is never behind the
-     * file.
-     */
-    async function store(c, settings) {
-        writeSiteSettings(c.var.admin, settings);
-        await writeSiteJson({ contentDir: c.var.config.contentDir, settings });
     }
+    // Through the same reader `site.json` goes through, so the two spellings of
+    // the list cannot mean different things.
+    return taxonomyRedirectsOf(entries);
 }
 /**
- * Whether a save moved something the ActivityPub actor carries, which is what
- * decides whether the followers are told (doc-4: the profile fields come from
- * the settings). The rest — the time zone, the page size — is the site's own
- * business and nobody else's.
- *
- * The base URL is not here either, though the profile is built on it: it is
- * settled at boot ({@link effectiveBaseUrl}), so an actor built the moment it
- * is saved would carry the old one and say nothing new.
+ * A base URL, normalised the way `resolveConfig` normalises the configured
+ * one, or `undefined` when it is not an absolute http(s) URL.
  */
-export function profileChanged(before, after) {
-    return (before.title !== after.title ||
-        before.tagline !== after.tagline ||
-        before.actorHandle !== after.actorHandle ||
-        before.actorType !== after.actorType ||
-        before.avatar !== after.avatar);
+function normalizeBaseUrl(value) {
+    const trimmed = value.trim();
+    if (trimmed === '')
+        return undefined;
+    let parsed;
+    try {
+        parsed = new URL(trimmed);
+    }
+    catch {
+        return undefined;
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
+        return undefined;
+    const pathname = parsed.pathname.endsWith('/') ? parsed.pathname.slice(0, -1) : parsed.pathname;
+    return parsed.origin + pathname;
 }
 /**
- * The sentence a flash adds about the followers, when there were any: a save
- * of the profile is also an announcement, and it should say so rather than
- * leave the admin wondering.
+ * The non-empty lines of a relay textarea, trimmed.
+ *
+ * Blank lines are not an error: somebody pasting a list leaves them, and a
+ * blank line asks for nothing.
  */
-function toldFollowers(report) {
-    const total = report?.deliveries.length ?? 0;
-    if (total === 0)
-        return '';
-    return total === 1
-        ? ' One follower has been told.'
-        : ` ${String(total)} followers have been told.`;
-}
-/** Everything the settings template renders, for a given set of settings. */
-function screen(config, settings) {
-    const overridden = config.baseUrlSource !== 'default';
-    return {
-        section: 'settings',
-        settingsUrl: SETTINGS_PATH,
-        fields: SETTINGS_FIELDS,
-        actorTypes: ACTOR_TYPES,
-        avatar: settings.avatar,
-        avatarUrl: AVATAR_PATH,
-        avatarFields: AVATAR_FIELDS,
-        avatarRemove: AVATAR_REMOVE,
-        form: formFromSettings(settings),
-        problems: {},
-        baseUrlInEffect: effectiveBaseUrl(config, settings),
-        baseUrlOverridden: overridden,
-        baseUrlSource: config.baseUrlSource,
-        baseUrlNote: overridden
-            ? config.baseUrlSource === 'environment'
-                ? 'GEEKITY_BASE_URL is set, so it is the base URL in effect and this field is not editable here.'
-                : 'The config file sets baseUrl, so it is the base URL in effect and this field is not editable here.'
-            : 'Absolute URLs, the feeds and the session cookie pick this up when the site next starts.',
-    };
+function relayLines(value) {
+    return value
+        .split('\n')
+        .map((line) => line.trim())
+        .filter((line) => line !== '');
 }
-/** A form field as a string. A file upload, or a missing field, is the empty one. */
-function field(value) {
-    return typeof value === 'string' ? value : '';
+/**
+ * A relay textarea as the list of inboxes it names: normalised, in the order
+ * they were given, with repeats dropped.
+ *
+ * Exported because the same parsing turns a stored setting, a submitted form
+ * and a `site.json` array into the one list; a second spelling of it would let
+ * the file and the database disagree about what a site subscribes to.
+ */
+export function relayList(value) {
+    const relays = [];
+    for (const line of relayLines(value)) {
+        const inbox = normalizeRelayInbox(line);
+        if (inbox !== undefined && !relays.includes(inbox))
+            relays.push(inbox);
+    }
+    return relays;
 }
 /**
- * A base URL, normalised the way `resolveConfig` normalises the configured
- * one, or `undefined` when it is not an absolute http(s) URL.
+ * A relay inbox URL, or `undefined` when it is not an absolute http(s) one.
+ *
+ * Unlike {@link normalizeBaseUrl} this keeps the whole URL bar a trailing
+ * slash: a relay inbox is a path — `/user/_____relay_____/inbox` — rather than
+ * an origin, and some relays hang one off a query string.
  */
-function normalizeBaseUrl(value) {
+export function normalizeRelayInbox(value) {
     const trimmed = value.trim();
     if (trimmed === '')
         return undefined;
@@ -437,8 +711,23 @@ function normalizeBaseUrl(value) {
     }
     if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
         return undefined;
-    const pathname = parsed.pathname.endsWith('/') ? parsed.pathname.slice(0, -1) : parsed.pathname;
-    return parsed.origin + pathname;
+    const href = parsed.href;
+    return href.endsWith('/') && parsed.pathname !== '/' ? href.slice(0, -1) : href;
+}
+/**
+ * What a page slug may be made of on this screen: the shape
+ * {@link slugify} produces, which is what the editor writes.
+ *
+ * The setting travels no further than a lookup by slug, so this is about
+ * catching a hand-typed value rather than about safety.
+ */
+const PAGE_SLUG_PATTERN = /^[A-Za-z0-9._~-]{1,200}$/;
+/** What is wrong with one page pick, or `undefined`. Empty is a value. */
+function slugProblem(value, what) {
+    const slug = value.trim();
+    return slug === '' || PAGE_SLUG_PATTERN.test(slug)
+        ? undefined
+        : `${what} is the slug of one of the site's pages, such as about.`;
 }
 /** Whether `Intl` knows the zone. An empty name is not a zone. */
 function isValidTimezone(value) {
@@ -453,16 +742,19 @@ function isValidTimezone(value) {
         return false;
     }
 }
+/** One site.json as an object, empty when it is missing or will not parse. */
 function readSiteJsonSync(file) {
+    return parseSiteJson(readFileIfPresentSync(file) ?? '');
+}
+/** The same, from bytes already in hand. */
+function parseSiteJson(source) {
+    let parsed;
     try {
-        return parseSiteJson(readFileSync(file, 'utf8'));
+        parsed = JSON.parse(source);
     }
     catch {
         return {};
     }
-}
-function parseSiteJson(source) {
-    const parsed = JSON.parse(source);
     return typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)
         ? parsed
         : {};