@geekity/cms 0.3.0 → 0.5.0

package/admin/static/slug.js

@@ -0,0 +1,61 @@
+/* The one bit of progressive enhancement doc-5 asks for: the slug follows the
+   title until somebody types a slug of their own, and the permalink follows
+   the slug on the same terms. Without this the form still works — an empty
+   slug is derived from the title on the server.
+
+   It is a file rather than an inline <script> so the admin's
+   Content-Security-Policy can say `script-src 'self'` and mean it: no nonce,
+   no 'unsafe-inline', and nothing an HTML injection could ever get to run. It
+   is loaded with `defer`, so the form is in the document by the time it runs.
+
+   Plain ES5-shaped browser JavaScript, checked by eslint's browser config and
+   left alone by the TypeScript build: it is served as it is written. */
+(function () {
+  var title = document.getElementById('editor-title');
+  var slug = document.getElementById('editor-slug');
+  var permalink = document.getElementById('editor-permalink');
+  if (!title || !slug) return;
+
+  var date = document.getElementById('editor-date');
+  var slugFollows = slug.value === '';
+  var permalinkFollows = !permalink || permalink.value === '';
+
+  function slugify(value) {
+    return value
+      .normalize('NFKD')
+      .toLowerCase()
+      .replace(/[\u0300-\u036f]/g, '')
+      .replace(/[^a-z0-9]+/g, '-')
+      .replace(/^-+|-+$/g, '');
+  }
+
+  /* The same shape defaultPermalink() writes on the server: a post lives under
+     the year and month of its date, a page at the top level. */
+  function syncPermalink() {
+    if (!permalink || !permalinkFollows) return;
+    if (slug.value === '') {
+      permalink.value = '';
+      return;
+    }
+    var month = date ? /^(\d{4})-(\d{2})/.exec(date.value) : null;
+    var prefix = month ? '/' + month[1] + '/' + month[2] + '/' : '/';
+    permalink.value = prefix + slug.value + '/';
+  }
+
+  slug.addEventListener('input', function () {
+    slugFollows = false;
+    syncPermalink();
+  });
+
+  if (permalink) {
+    permalink.addEventListener('input', function () {
+      permalinkFollows = false;
+    });
+  }
+
+  title.addEventListener('input', function () {
+    if (!slugFollows) return;
+    slug.value = slugify(title.value);
+    syncPermalink();
+  });
+})();

package/dist/access-log.d.ts

@@ -0,0 +1,44 @@
+import type { MiddlewareHandler } from 'hono';
+import type { ResolvedConfig } from './config.ts';
+import type { GeekityEnv } from './env.ts';
+/**
+ * Where one access-log line goes.
+ *
+ * The line arrives without a trailing newline; the sink decides the framing.
+ * The default sink is stdout — what a container collects, what dockge shows
+ * and what journald keeps — and a test hands in one that keeps the lines.
+ */
+export type AccessLogWriter = (line: string) => void;
+/** What {@link createAccessLog} needs to know. */
+export interface AccessLogOptions {
+    /**
+     * Whether a client address goes on the line, and which one is right. Read
+     * once, at boot: the log is registered before the context is, so it cannot
+     * read the config off a request.
+     */
+    config: Pick<ResolvedConfig, 'accessLogAddress' | 'trustProxy'>;
+    /** Where the lines go. Defaults to stdout. */
+    write?: AccessLogWriter;
+}
+/**
+ * One line per request: what was asked, what was answered, and how long it
+ * took.
+ *
+ * ```
+ * GET /.well-known/webfinger?resource=acct:ada@example.com 200 3.1ms
+ * ```
+ *
+ * The fields are in a fixed order and separated by spaces, so the status is
+ * always the third and a line is readable by eye, by `grep` and by `awk`
+ * alike. The client address, when the site asks for one, goes last for that
+ * reason — turning it on moves nothing else.
+ *
+ * Only the request line is ever read: no body is touched, so nothing is
+ * buffered and no password posted to the login form can reach the log, and no
+ * header but the forwarded address a site has said to believe is looked at, so
+ * no cookie and no `Authorization` can either. The query string is logged as
+ * it arrived, because it is what a peer's WebFinger lookup carries and what a
+ * question about who asked for what is answered with.
+ */
+export declare function createAccessLog(options: AccessLogOptions): MiddlewareHandler<GeekityEnv>;
+//# sourceMappingURL=access-log.d.ts.map

package/dist/access-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-log.d.ts","sourceRoot":"","sources":["../src/access-log.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAG9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;AAErD,kDAAkD;AAClD,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,kBAAkB,GAAG,YAAY,CAAC,CAAC;IAChE,8CAA8C;IAC9C,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAsBD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,iBAAiB,CAAC,UAAU,CAAC,CA4BxF"}

package/dist/access-log.js

@@ -0,0 +1,71 @@
+import { clientAddress } from './admin/throttle.js';
+/** The default sink: one write per line, the newline included, like the CLI's. */
+function writeToStdout(line) {
+    process.stdout.write(`${line}\n`);
+}
+/**
+ * The path and query string of a request, taken out of its URL by hand.
+ *
+ * `new URL(...)` per request would parse and allocate the whole of an address
+ * this only ever wants the tail of, and this runs on every request the site
+ * answers. There is nothing to escape: Node's HTTP parser refuses a request
+ * target with a control character in it, so whatever survives to here is one
+ * line's worth of text.
+ */
+function requestTarget(url) {
+    const afterScheme = url.indexOf('://');
+    const start = afterScheme < 0 ? -1 : url.indexOf('/', afterScheme + 3);
+    return start < 0 ? '/' : url.slice(start);
+}
+/**
+ * One line per request: what was asked, what was answered, and how long it
+ * took.
+ *
+ * ```
+ * GET /.well-known/webfinger?resource=acct:ada@example.com 200 3.1ms
+ * ```
+ *
+ * The fields are in a fixed order and separated by spaces, so the status is
+ * always the third and a line is readable by eye, by `grep` and by `awk`
+ * alike. The client address, when the site asks for one, goes last for that
+ * reason — turning it on moves nothing else.
+ *
+ * Only the request line is ever read: no body is touched, so nothing is
+ * buffered and no password posted to the login form can reach the log, and no
+ * header but the forwarded address a site has said to believe is looked at, so
+ * no cookie and no `Authorization` can either. The query string is logged as
+ * it arrived, because it is what a peer's WebFinger lookup carries and what a
+ * question about who asked for what is answered with.
+ */
+export function createAccessLog(options) {
+    const write = options.write ?? writeToStdout;
+    const { accessLogAddress, trustProxy } = options.config;
+    return async function accessLog(c, next) {
+        const started = performance.now();
+        let threw = false;
+        try {
+            await next();
+        }
+        catch (error) {
+            // A handler that threw has no response of its own: the error is on its
+            // way up to Hono's error handler, which answers 500, and `c.res` would
+            // hand back a freshly made 200 if asked. A request that failed is the
+            // one most worth having a line for, so it gets the status it will be
+            // answered with rather than the one it never had.
+            threw = true;
+            throw error;
+        }
+        finally {
+            const elapsed = (performance.now() - started).toFixed(1);
+            const status = threw ? 500 : c.res.status;
+            let line = `${c.req.method} ${requestTarget(c.req.url)} ${String(status)} ${elapsed}ms`;
+            if (accessLogAddress) {
+                const address = clientAddress(c, { trustProxy });
+                if (address !== undefined)
+                    line += ` ${address}`;
+            }
+            write(line);
+        }
+    };
+}
+//# sourceMappingURL=access-log.js.map

package/dist/access-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-log.js","sourceRoot":"","sources":["../src/access-log.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAyBpD,kFAAkF;AAClF,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC;IACvE,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,eAAe,CAAC,OAAyB;IACvD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,aAAa,CAAC;IAC7C,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAExD,OAAO,KAAK,UAAU,SAAS,CAAC,CAAC,EAAE,IAAI;QACrC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAClC,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,uEAAuE;YACvE,sEAAsE;YACtE,qEAAqE;YACrE,kDAAkD;YAClD,KAAK,GAAG,IAAI,CAAC;YACb,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;YAC1C,IAAI,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,OAAO,IAAI,CAAC;YACxF,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;gBACjD,IAAI,OAAO,KAAK,SAAS;oBAAE,IAAI,IAAI,IAAI,OAAO,EAAE,CAAC;YACnD,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/admin/accounts.d.ts

@@ -0,0 +1,413 @@
+import type { AdminStore } from './store.ts';
+/**
+ * Who may sign in: `data/users.json`, and everything that reads or writes it.
+ *
+ * decision-9 puts every piece of irreducible state in a file, and a login is
+ * as irreducible as state gets — an account cannot be derived from anything,
+ * and a site that lost its users would fall back into first-run setup with the
+ * door open to whoever reached it first. So the file is the truth and the
+ * database is a cache: `data/geekity.db` may be deleted at rest, and the next
+ * boot still knows exactly who may sign in.
+ *
+ * It lives in `data/` rather than `content/`, unlike `site.json`, because
+ * `content/` is published with the site and in git, and an argon2 hash is not
+ * something to hand a reader or a mirror. The file is written 0600 for the
+ * same reason; it sits directly in `dataDir`, so there is no private directory
+ * around it to lean on.
+ *
+ * Reads are synchronous and per call, exactly as `readSiteSettings` reads
+ * `site.json` per call: the file is a few hundred bytes and nothing anywhere
+ * can then be holding a stale copy of who exists. Writes go through
+ * {@link updateFileAtomically}, which puts the read inside the same queue as
+ * the write, so the uniqueness rule that used to be a `UNIQUE` index is
+ * checked and acted on as one step.
+ */
+/** The file, relative to `dataDir`. */
+export declare const USERS_FILE = "users.json";
+/** The permissions the file is written with: nobody but the site's own user. */
+export declare const USERS_FILE_MODE = 384;
+/** Where the users file lives for a given data directory. */
+export declare function usersFile(dataDir: string): string;
+/** An admin user. There is one role, so there is nothing else to say about one. */
+export interface User {
+    /** Its id, stable for the life of the user, and what a session names. */
+    readonly id: number;
+    /** Login name, unique and compared case sensitively. */
+    readonly username: string;
+    /**
+     * Where the site can reach this person, or `undefined` when nobody has said.
+     *
+     * Optional on purpose (TASK-54): a login is a username and a password, and a
+     * site that never sends email has no use for this. What it buys is a
+     * password that can be recovered without a shell, and, once TASK-55 lands,
+     * somewhere to send the notices an admin would otherwise have to go looking
+     * for. Not unique, and not a second login name: it is only ever matched
+     * against by the forgot-password form, which answers the same either way.
+     */
+    readonly email?: string | undefined;
+    /**
+     * Which notices this user has turned off, when they have turned any off
+     * (TASK-55).
+     *
+     * Absent for almost everybody, because it holds only what somebody actually
+     * changed: an event nothing says anything about is at the default
+     * `src/notifications/preferences.ts` gives it, which is what lets a new
+     * notice start working without anybody visiting the users screen. Keyed by
+     * event name, so adding an event adds no field here.
+     */
+    readonly notifications?: Readonly<Record<string, boolean>> | undefined;
+    /**
+     * How often each notice arrives, for the events that offer a choice and the
+     * users who have made one (TASK-60).
+     *
+     * A second map beside {@link User.notifications} rather than a widening of
+     * it, because the two answer different questions — whether, and how often —
+     * and a user who wants no notice at all is not a user with a delivery mode.
+     * Absent for almost everybody, on the same rule: `immediately` is the
+     * default and the default is never written down. Keyed by event name, so
+     * adding an event adds no field here either.
+     */
+    readonly notificationModes?: Readonly<Record<string, string>> | undefined;
+    /**
+     * What the public site says about this person, when somebody has filled any
+     * of it in (TASK-67).
+     *
+     * decision-14 makes a user an actor at their author URL, so the URL has to
+     * be a page before it can be an actor, and a page needs something to say.
+     * Absent for a user nobody has written a profile for, on the rule the two
+     * maps above follow: the file holds what somebody actually filled in, and a
+     * user with no profile still has an archive under their username.
+     */
+    readonly profile?: UserProfile | undefined;
+    /**
+     * The ActivityStreams id this person was published under somewhere else,
+     * when they were (TASK-69).
+     *
+     * decision-14 calls this identity rather than cache: a follower's server
+     * keys the account by it for as long as the follow lasts, and a document
+     * served under it with a different `id` reads as a different person, not as
+     * a moved one. So a site arriving from the WordPress ActivityPub plugin
+     * keeps the `https://example.com/?author=2` its followers already hold, for
+     * the life of the user.
+     *
+     * The CMS never mints one — a user born here is an actor at their author URL
+     * and has no second name to keep — and no screen writes one: it arrives with
+     * the import (TASK-71) or is typed into the file by hand. The whole URL is
+     * stored, query string and all, because that is what has to be matched.
+     */
+    readonly actorId?: string | undefined;
+    /**
+     * The number the WordPress ActivityPub plugin gave this person's actor, when
+     * they had one (TASK-70).
+     *
+     * The WordPress user id, which is what the plugin puts in the paths it
+     * publishes: `/wp-json/activitypub/1.0/actors/2/inbox` is user 2. Unlike
+     * {@link User.actorId} this is cache rather than identity — a follower's
+     * server replaces those paths the next time it refetches the actor — so it
+     * is only ever read behind the `wordpressActivityPub` site setting, and it
+     * is what maps a delivery arriving at one of those paths to a person.
+     *
+     * The CMS never mints one. It arrives with the import (TASK-71) or is typed
+     * into the file by hand, beside the stored actor id the same migration sets.
+     */
+    readonly wordpressActorId?: number | undefined;
+    /** When the user was created, as an ISO 8601 instant. */
+    readonly createdAt: string;
+}
+/**
+ * One thing a profile points at: somewhere else this person is.
+ *
+ * A label and a URL rather than a bare URL, because the label is what a theme
+ * prints and what an ActivityPub `attachment` calls the property (TASK-68).
+ */
+export interface ProfileLink {
+    /** What the link says. */
+    readonly label: string;
+    /** Where it goes. */
+    readonly href: string;
+}
+/**
+ * The public face of a user: what their archive is headed with and what their
+ * actor will carry.
+ *
+ * Every field is optional, and one that is empty is not stored at all: a
+ * profile is something somebody chose to write, and a user who has written
+ * none of it is not a user with four empty strings.
+ */
+export interface UserProfile {
+    /** The name to print instead of the username, when they gave one. */
+    readonly displayName?: string | undefined;
+    /** A few sentences about them. */
+    readonly bio?: string | undefined;
+    /** A picture, as the path or URL it is served at. */
+    readonly avatar?: string | undefined;
+    /**
+     * What they do, when they said: the line a theme prints under the name in a
+     * bio, and the `jobTitle` of the JSON-LD `Person` it emits (decision-16).
+     */
+    readonly jobTitle?: string | undefined;
+    /** Where they are, as they wrote it: "Madison, Wisconsin", "Somewhere wet". */
+    readonly location?: string | undefined;
+    /** Somewhere else they are, in the order they listed them. */
+    readonly links?: readonly ProfileLink[] | undefined;
+}
+/** A user with the field no screen may render: its password hash. */
+export interface StoredUser extends User {
+    /** The PHC-encoded argon2id hash. */
+    readonly passwordHash: string;
+}
+/** What {@link createUser} is given. */
+export interface CreateUserInput {
+    /** Which site's users file to add to. */
+    dataDir: string;
+    /** The name they will sign in with. Compared exactly, as it always was. */
+    username: string;
+    /** The plain password. It is hashed on the way in and never stored. */
+    password: string;
+    /** Where to reach them. Left off, or empty, is a user with no email. */
+    email?: string | undefined;
+}
+/** Thrown when a username is already taken. Usernames are the login key. */
+export declare class DuplicateUsernameError extends Error {
+    readonly name = "DuplicateUsernameError";
+    /** The name that was already in use. */
+    readonly username: string;
+    constructor(username: string);
+}
+/**
+ * Every user, by name, without password hashes.
+ *
+ * Sorted by code unit rather than by locale, which is how the `ORDER BY
+ * username` over a `BINARY` column this replaces sorted them: a listing that
+ * changed order with the server's locale would be a listing nobody could
+ * describe.
+ */
+export declare function listUsers(dataDir: string): User[];
+/**
+ * The site's first account: the lowest id, which is the one the first run
+ * made.
+ *
+ * decision-14 leaves the site with no actor of its own, and two things still
+ * have to be somebody's: a relay subscription, which is an instance-wide
+ * agreement rather than one person's, and a post whose `author` names nobody
+ * this site knows. Both fall to the first account, because a site's first
+ * account is the one that has always existed and the only one that can be
+ * chosen without asking. `undefined` before anybody has signed up, which is
+ * first-run setup and federates nothing.
+ */
+export declare function primaryUser(dataDir: string): User | undefined;
+/** How many users exist. Zero is what puts the admin into first-run setup. */
+export declare function countUsers(dataDir: string): number;
+/**
+ * One user with its password hash, or `undefined`. For auth, not for screens.
+ */
+export declare function findUser(dataDir: string, username: string): StoredUser | undefined;
+/** The user behind a session's `userId`, or `undefined`. */
+export declare function findUserById(dataDir: string, id: number): User | undefined;
+/**
+ * The user a forgot-password form named, by either of the two things somebody
+ * might type: their username or their email address.
+ *
+ * The username is compared exactly, because that is how logging in compares it
+ * and a second, looser rule would let one person's name match another's
+ * account. The email is folded to lower case on both sides, because an address
+ * is case-insensitive in practice and nobody remembers how they capitalised
+ * one. A user is matched by username first, so a site where somebody's address
+ * happens to be another person's username still resolves the way logging in
+ * would. The empty string matches nobody, however many users have no email.
+ */
+export declare function findUserByIdentifier(dataDir: string, identifier: string): User | undefined;
+/**
+ * Hash the password and add the user to the file.
+ *
+ * Throws {@link DuplicateUsernameError} when the name is taken. The check is
+ * inside the write, not before it, which is what makes it the rule the
+ * `UNIQUE` index used to be: two requests adding the same name at the same
+ * moment queue behind one another on the file, so the second one reads the
+ * first one's work and is refused.
+ */
+export declare function createUser(input: CreateUserInput): Promise<User>;
+/**
+ * Hash a new password and put it on a user, replacing the old one. Returns
+ * `false` when there is no such user. Sessions are left alone; deciding which
+ * of them a password change should end is the caller's business.
+ */
+export declare function setUserPassword(input: {
+    /** Which site's users file to write. */
+    dataDir: string;
+    /** Whose password. */
+    userId: number;
+    /** The new plain password, hashed on the way in. */
+    password: string;
+}): Promise<boolean>;
+/**
+ * Put an email address on a user, or take the one they had off.
+ *
+ * The empty string is how an address is removed, so one form field can do
+ * both: a box somebody cleared means "I do not want to be emailed", and there
+ * is nothing else it could mean. Returns `false` when there is no such user.
+ * The address is stored as it was typed, capitals and all — it is what a
+ * message is addressed to, and only the matching is case-insensitive.
+ */
+export declare function setUserEmail(input: {
+    /** Which site's users file to write. */
+    dataDir: string;
+    /** Whose address. */
+    userId: number;
+    /** The address, or the empty string to remove it. */
+    email: string;
+}): Promise<boolean>;
+/**
+ * Write a user's profile, replacing whatever was there.
+ *
+ * The whole profile at once rather than a field at a time, because that is
+ * what the form on the users screen submits: four boxes and a Save, and a
+ * field somebody cleared is a field they no longer want. {@link cleanProfile}
+ * drops the empties, so a profile with nothing left in it leaves the user with
+ * no `profile` key rather than with an empty object. Returns `false` when
+ * there is no such user.
+ */
+export declare function setUserProfile(input: {
+    /** Which site's users file to write. */
+    dataDir: string;
+    /** Whose profile. */
+    userId: number;
+    /** Everything the profile should say from now on. */
+    profile: UserProfile;
+}): Promise<boolean>;
+/**
+ * A profile with the empties taken out, or `undefined` when nothing is left.
+ *
+ * Trimming here rather than at the form is what makes a hand-edited file and a
+ * saved one read the same: a bio of three spaces is a bio nobody wrote, and a
+ * link with no URL is not somewhere this person is.
+ */
+export declare function cleanProfile(profile: UserProfile): UserProfile | undefined;
+/**
+ * Turn one notice on or off for one user.
+ *
+ * The map holds only what somebody changed, so this writes through
+ * {@link withNotification} and drops the key altogether when the answer is the
+ * default again. An event this version has never heard of changes nothing:
+ * there would be no switch to reach it with and no sender to read it. Returns
+ * `false` when there is no such user.
+ */
+export declare function setUserNotification(input: {
+    /** Which site's users file to write. */
+    dataDir: string;
+    /** Whose preference. */
+    userId: number;
+    /** Which notice, by its name in the registry. */
+    event: string;
+    /** Whether they want it. */
+    on: boolean;
+}): Promise<boolean>;
+/**
+ * Say how often one notice reaches one user.
+ *
+ * The twin of {@link setUserNotification}, and it writes on the same rule:
+ * through {@link withNotificationMode}, which drops the key when the answer is
+ * the default again, when the mode is one this version does not know, and when
+ * the event does not offer a choice at all. So a form submitting nonsense
+ * leaves the file saying nothing rather than saying something unreachable.
+ * Returns `false` when there is no such user.
+ */
+export declare function setUserNotificationMode(input: {
+    /** Which site's users file to write. */
+    dataDir: string;
+    /** Whose preference. */
+    userId: number;
+    /** Which notice, by its name in the registry. */
+    event: string;
+    /** How often they want it. */
+    mode: string;
+}): Promise<boolean>;
+/**
+ * Thrown when the id being imported already belongs to somebody else.
+ *
+ * Two accounts answering to one actor id is two people with one identity, and
+ * two carrying one WordPress number is a delivery to the plugin's old inbox
+ * that could go to either. Neither is something to pick a winner for, so the
+ * import stops and says whose it is.
+ */
+export declare class ConflictingActorIdError extends Error {
+    readonly name = "ConflictingActorIdError";
+    /** The user who already has it. */
+    readonly username: string;
+    constructor(username: string, what: string);
+}
+/**
+ * Write the two ids a site arriving from the WordPress ActivityPub plugin
+ * carries: the actor id its followers hold, and the number its paths are built
+ * from (TASK-69, TASK-70).
+ *
+ * The only writer of either field, and it is not a screen: doc-4 makes a
+ * stored actor id identity for the life of the account, and identity is not
+ * something a form should be able to retype. `geekity import wordpress-actor`
+ * is what calls this.
+ *
+ * Both ids have to be unique across the file, and the check is inside the
+ * write for the reason {@link createUser}'s duplicate check is: it is a rule
+ * about the file rather than about one user, so it is read and acted on as one
+ * step. Returns whether anything changed — a second run with the same ids
+ * writes nothing, which is what makes the import idempotent.
+ */
+export declare function setUserWordPressActor(input: {
+    /** Which site's users file to write. */
+    dataDir: string;
+    /** Whose record, by login name. */
+    username: string;
+    /** The id WordPress published them under, query string and all. */
+    actorId: string;
+    /** The WordPress user id. */
+    wordpressActorId: number;
+}): Promise<boolean>;
+/** Thrown when a command names a user this site does not have. */
+export declare class UnknownUserError extends Error {
+    readonly name = "UnknownUserError";
+    /** The name that was asked for. */
+    readonly username: string;
+    constructor(username: string);
+}
+/**
+ * Take a user out of the file. Returns `false` when there was nothing to take.
+ *
+ * Their sessions are not ended here: sessions are in the database, and the
+ * screen that deletes a user ends them itself. A session that outlives this —
+ * one in a database restored from a backup, say — names a user the file no
+ * longer holds, and the admin guard turns that into no session at all.
+ */
+export declare function deleteUser(input: {
+    dataDir: string;
+    userId: number;
+}): Promise<boolean>;
+/**
+ * The user, when the password is theirs; `undefined` when it is not, or when
+ * there is no such user. The two failures are deliberately indistinguishable.
+ */
+export declare function verifyUserPassword(dataDir: string, username: string, password: string): User | undefined;
+/**
+ * Turn an older site's users rows into `data/users.json`, once, and drop the
+ * table.
+ *
+ * TASK-9 put the accounts in SQLite; decision-9 made the database disposable,
+ * and a site upgrading across the two has rows nothing would ever read again.
+ * So the first boot of this version writes them out — ids and hashes exactly
+ * as they stand, because a session names its user by id and a hash is not
+ * something to re-encode on the way past.
+ *
+ * The file wins, as it does everywhere else: a `users.json` that is already
+ * there is left alone, so a database restored from a backup taken before the
+ * upgrade cannot bring deleted accounts back or undo a password change. The
+ * table is dropped either way, because a fresh database gets it from migration
+ * 1 — which has shipped, and so is never edited — and a site that has been
+ * migrated must not be asked again.
+ *
+ * Synchronous because `createCms` is: it runs before the server is listening
+ * and before anything else has touched the file.
+ */
+export declare function migrateUsersToFile(options: {
+    admin: AdminStore;
+    dataDir: string;
+}): void;
+//# sourceMappingURL=accounts.d.ts.map

package/dist/admin/accounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accounts.d.ts","sourceRoot":"","sources":["../../src/admin/accounts.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,uCAAuC;AACvC,eAAO,MAAM,UAAU,eAAe,CAAC;AAEvC,gFAAgF;AAChF,eAAO,MAAM,eAAe,MAAQ,CAAC;AAErC,6DAA6D;AAC7D,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,mFAAmF;AACnF,MAAM,WAAW,IAAI;IACnB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;OASG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IACvE;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;IAC1E;;;;;;;;;OASG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAC3C;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,0BAA0B;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qBAAqB;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,kCAAkC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,qDAAqD;IACrD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,WAAW,EAAE,GAAG,SAAS,CAAC;CACrD;AAED,qEAAqE;AACrE,MAAM,WAAW,UAAW,SAAQ,IAAI;IACtC,qCAAqC;IACrC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,wCAAwC;AACxC,MAAM,WAAW,eAAe;IAC9B,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAED,4EAA4E;AAC5E,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,SAAkB,IAAI,4BAA4B;IAClD,wCAAwC;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,YAAY,QAAQ,EAAE,MAAM,EAG3B;CACF;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,EAAE,CAMjD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAO7D;AAED,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAElF;AAED,4DAA4D;AAC5D,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAG1E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAW1F;AAED;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBtE;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE;IAC3C,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,OAAO,CAAC,CAiBnB;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE;IACxC,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,qBAAqB;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,OAAO,CAAC,CAiBnB;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE;IAC1C,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,qBAAqB;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,OAAO,EAAE,WAAW,CAAC;CACtB,GAAG,OAAO,CAAC,OAAO,CAAC,CAiBnB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,GAAG,WAAW,GAAG,SAAS,CAuB1E;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,4BAA4B;IAC5B,EAAE,EAAE,OAAO,CAAC;CACb,GAAG,OAAO,CAAC,OAAO,CAAC,CAiBnB;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,OAAO,CAAC,CAiBnB;AAED;;;;;;;GAOG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,SAAkB,IAAI,6BAA6B;IACnD,mCAAmC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,YAAY,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAGzC;CACF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,6BAA6B;IAC7B,gBAAgB,EAAE,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,OAAO,CAAC,CAsCnB;AAED,kEAAkE;AAClE,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAkB,IAAI,sBAAsB;IAC5C,mCAAmC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,YAAY,QAAQ,EAAE,MAAM,EAG3B;CACF;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAS7F;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,IAAI,GAAG,SAAS,CAUlB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAmBxF"}