@geekity/cms 0.30.0 → 0.32.0

package/dist/cli.js

@@ -1,121 +1,282 @@
 #!/usr/bin/env node
-var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
-    if (typeof path === "string" && /^\.\.?\//.test(path)) {
-        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
-            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
-        });
-    }
-    return path;
-};
 import cluster from 'node:cluster';
 import { existsSync, realpathSync } from 'node:fs';
-import { createRequire } from 'node:module';
 import path from 'node:path';
 import { createInterface } from 'node:readline';
 import { DatabaseSync } from 'node:sqlite';
 import { Writable } from 'node:stream';
 import { pathToFileURL } from 'node:url';
-import { createUser, DuplicateUsernameError, migrateUsersToFile } from './admin/accounts.js';
 import { credentialProblem, emailProblem } from './admin/credentials.js';
-import { openAdminStore } from './admin/store.js';
+import { migrateUsersToFile } from './admin/legacy-migrations.js';
+import { adminStoreOwning, openAdminDatabase } from './store/admin-store.js';
 import { databaseFile, discardDatabase } from './cache.js';
+import { CONTENT_SCRATCH_FILES, dataPath } from './files/data-files.js';
+import { compactTime, exportFileName, planSiteExport, writeSiteExport, } from './export/site-export.js';
+import { checkImportTargets, discardStaging, finishSiteImport, importNotes, installArchivedPlugins, placeSiteImport, pluginFailureLine, readSiteManifest, restoreEnabledPlugins, stageSiteImport, } from './export/site-import.js';
+import { CONFIG_FILENAMES, loadConfig, loadResolvedConfig } from './config-loader.js';
 import { resolveConfig } from './config.js';
-import { migrateCommentEmails, migrateCommentKeys } from './comments/records.js';
-import { stripStoredUploads } from './content/metadata/sweep.js';
-import { UPLOAD_DIRECTORY } from './web/assets.js';
-import { createCms } from './index.js';
+import { migrateCommentEmails, migrateCommentKeys } from './comments/migrations.js';
+import { STRIP_METADATA_JOB } from './content/metadata/strip-job.js';
+import { RESEND_JOB } from './federation/resend-job.js';
+import { createUser, DuplicateUsernameError } from './site/users.js';
+import { createCms, settleConfig } from './index.js';
 import { initSite, ownManifest, seedStarterContent } from './init.js';
+import { finishedResult } from './jobs/types.js';
 import { importPluginFolders, scanPluginFolders } from './plugins/folder.js';
 import { ADD_WITH_COMMAND, addPlugin, installedFolders, parsePackageSpec, pluginRegistry, removePlugin, requirementNotes, } from './plugins/install.js';
 import { describeUpgrade, upgradePlugins } from './plugins/upgrade.js';
+import { migratePluginSettings } from './plugins/migrate-settings.js';
+import { siteDataFiles } from './plugins/data.js';
+import { readEnabledPlugins } from './plugins/enabled.js';
 import { pluginSite, sitePluginRegistry } from './plugins/site.js';
-import { askToReload } from './supervisor/control.js';
+import { askToReload, isServing } from './supervisor/control.js';
 import { superviseCluster } from './supervisor/primary.js';
 import { processChannel, superviseWorker } from './supervisor/worker.js';
-import { enterMaintenance, leaveMaintenance, maintenanceFile, readMaintenance, } from './maintenance.js';
-import { devModeOn, enterDevMode, leaveDevMode } from './dev-mode.js';
-/** The commands a site can name on the command line, as opposed to the flags. */
-const COMMANDS = [
-    'serve',
-    'init',
-    'sync',
-    'rebuild',
-    'resend',
-    'user',
-    'maintenance',
-    'dev-mode',
-    'strip-metadata',
-    'plugin',
-];
+import { DEV_MODE, DEV_MODE_LATCHED } from './settings/dev-mode.js';
+import { MAINTENANCE, MAINTENANCE_FILE } from './settings/maintenance.js';
+import { overridden, sourceLabel } from './settings/registry.js';
+import { createSettings } from './site/namespace.js';
+import { messageOf } from './util/errors.js';
+const COMMANDS = {
+    serve: {
+        synopsis: ['[serve] [--config <file>]'],
+        help: [['serve', ['Start the CMS (the default when no command is given).']]],
+        run: serveCommand,
+    },
+    init: {
+        synopsis: ['init <directory>'],
+        help: [['init', ['Create a new site in <directory>.']]],
+        run: initCommand,
+    },
+    sync: {
+        synopsis: ['sync [--config <file>]'],
+        help: [['sync', ['Rebuild the content index once and exit.']]],
+        run: syncCommand,
+    },
+    rebuild: {
+        synopsis: ['rebuild [--config <file>]'],
+        help: [
+            [
+                'rebuild',
+                [
+                    'Delete data/geekity.db and build it again from the files.',
+                    'Everything in it is derived, so this is always safe with the',
+                    'site stopped; sessions and delivery outcomes start empty.',
+                ],
+            ],
+        ],
+        run: rebuildCommand,
+    },
+    resend: {
+        synopsis: ['resend (--all | <slug>...) [--config <file>]'],
+        help: [
+            [
+                'resend',
+                [
+                    'Send announced posts to every follower and relay again, as',
+                    'they read now: an Update for a post still published, a',
+                    'Delete for one withdrawn. --all resends every post the site',
+                    'has announced; this is how posts federated before a new',
+                    'federation feature (such as quote posts) pick it up.',
+                ],
+            ],
+        ],
+        run: resendCommand,
+    },
+    maintenance: {
+        synopsis: ['maintenance (on [--until <time>] | off | status) [--config <file>]'],
+        help: [
+            [
+                'maintenance',
+                [
+                    'Take the public site down on purpose, or bring it back.',
+                    'While on, pages, feeds, sitemaps and inbox deliveries answer',
+                    '503 with Retry-After; the admin, /healthz and signed-in',
+                    'users are let through. A running site notices within a',
+                    'second, with no restart.',
+                ],
+            ],
+        ],
+        run: maintenanceCommand,
+    },
+    'dev-mode': {
+        synopsis: ['dev-mode (on | off | status) [--config <file>]'],
+        help: [
+            [
+                'dev-mode',
+                [
+                    'Hold everything the site would send to the outside world',
+                    '(ActivityPub deliveries and relay follows, webmentions,',
+                    'rssCloud and WebSub pings, IndexNow, email) while it is',
+                    'built or migrated, and record each one in',
+                    'data/dev-mode.jsonl. off takes the site live: nothing held',
+                    'is sent then, and the record says when it went live.',
+                ],
+            ],
+        ],
+        run: devModeCommand,
+    },
+    settings: {
+        synopsis: [
+            'settings list [<namespace>] [--config <file>]',
+            'settings get <namespace.key> [--config <file>]',
+            'settings set <namespace.key> (<value> | --unset) [--config <file>]',
+            'settings migrate-plugins [--config <file>]',
+        ],
+        help: [
+            [
+                'settings list',
+                [
+                    'Print every runtime setting: its value in effect, where',
+                    'that value came from (env, config, file or default) and',
+                    'what it does. A secret prints as (set) or (not set).',
+                    "Each running plugin's settings follow the core ones, as",
+                    '@geekity/plugin-llm.default_model.',
+                ],
+            ],
+            ['settings get', ['Print one value in effect, and what overrides it, if', 'anything.']],
+            [
+                'settings set',
+                [
+                    'Store one value, or remove it with --unset so the default',
+                    'applies. A setting the environment or the config overrides',
+                    'is refused. A secret set here is left in the shell history.',
+                ],
+            ],
+            [
+                'settings migrate-plugins',
+                [
+                    "Move each plugin's settings out of content/_data/site.json",
+                    'into data/plugins/<name>/settings.json, keeping enabled',
+                    'where it is. A server does this when it starts; run it',
+                    'with the site stopped to do it first. Safe to run twice.',
+                ],
+            ],
+        ],
+        run: settingsCommand,
+    },
+    'strip-metadata': {
+        synopsis: ['strip-metadata [--config <file>]'],
+        help: [
+            [
+                'strip-metadata',
+                [
+                    'Remove location and camera metadata (EXIF, XMP, IPTC, a',
+                    "video's location) from files already in content/uploads.",
+                    'New uploads are stripped as they arrive; this is for the',
+                    'ones from before. Safe to run again: a clean file is left',
+                    'as it is.',
+                ],
+            ],
+        ],
+        run: stripMetadataCommand,
+    },
+    export: {
+        synopsis: [
+            'export [--out <file>] [--with-credentials] [--without-content] [--list] [--config <file>]',
+        ],
+        help: [
+            [
+                'export',
+                [
+                    'Write the site to a .tar.gz: content/ and every file in',
+                    'data/ the site cannot rebuild, with manifest.json first.',
+                    'Credentials are left out unless --with-credentials is given.',
+                    'It only reads, so it runs while the site serves. It prints',
+                    'the deliveries waiting in the queue, which are never',
+                    'exported. --list prints what each file in data/ is and',
+                    'writes nothing.',
+                ],
+            ],
+        ],
+        run: exportCommand,
+    },
+    import: {
+        synopsis: ['import <file> [--replace] [--dev-mode] [--new-base-url] [--config <file>]'],
+        help: [
+            [
+                'import',
+                [
+                    'Restore a site from an archive geekity export wrote, with the',
+                    'site stopped. Every file is checked against the manifest and',
+                    'unpacked beside content/ and data/ before it replaces them.',
+                    'Folder plugins are installed from the npm registry at the',
+                    'versions the archive records, and the database is rebuilt.',
+                    'It exits 1 when a plugin could not be installed, naming it',
+                    'and the command to retry.',
+                ],
+            ],
+        ],
+        sharedWithPlugins: true,
+        run: importCommand,
+    },
+    user: {
+        synopsis: ['user add <username> [--password <pw>] [--email <address>] [--config <file>]'],
+        help: [
+            [
+                'user add',
+                ['Create an admin user, so a site can get its first login', 'without the setup screen.'],
+            ],
+        ],
+        run: userCommand,
+    },
+    plugin: {
+        synopsis: [
+            'plugin (add <package>[@version] | remove <package>) [--config <file>]',
+            'plugin upgrade [<package>...] [--check] [--config <file>]',
+        ],
+        help: [
+            [
+                'plugin add',
+                [
+                    "Install a plugin package's bundle from the npm registry",
+                    '(npm_config_registry, or registry.npmjs.org) into the',
+                    'plugins folder, GEEKITY_PLUGINS_DIR. It installs only the',
+                    'package named, and names any plugin it requires that is',
+                    'missing. Reload on the Plugins screen loads it.',
+                ],
+            ],
+            [
+                'plugin remove',
+                [
+                    "Delete a plugin's folder from the plugins folder. Reload on",
+                    'the Plugins screen unloads it. It refuses a plugin the site',
+                    'has enabled: disable it first.',
+                ],
+            ],
+            [
+                'plugin upgrade',
+                [
+                    'Bring each plugin in the plugins folder, or only the ones',
+                    'named, up to its newest version that this core and the',
+                    'other installed plugins can run, installed as plugin add',
+                    'installs one. Plugins that must move together do. It says,',
+                    'for each plugin, what it upgraded, or why it held a newer',
+                    'version back. --check reports and installs nothing.',
+                ],
+            ],
+        ],
+        run: pluginFolderCommand,
+    },
+};
 /**
  * The options one command reads out of {@link ParsedArgs.flags}, each of which
  * carries a value.
  */
-const VALUE_FLAGS = ['until'];
+const VALUE_FLAGS = ['until', 'out'];
 /** The options that are simply on or off. */
-const SWITCH_FLAGS = ['all', 'check'];
-const CONFIG_FILENAMES = ['geekity.config.ts', 'geekity.config.js', 'geekity.config.mjs'];
-const USAGE = `geekity — the Geekity CMS command line
-
-Usage:
-  geekity [serve] [--config <file>]
-  geekity init <directory>
-  geekity sync [--config <file>]
-  geekity rebuild [--config <file>]
-  geekity resend (--all | <slug>...) [--config <file>]
-  geekity maintenance (on [--until <time>] | off | status) [--config <file>]
-  geekity dev-mode (on | off | status) [--config <file>]
-  geekity strip-metadata [--config <file>]
-  geekity user add <username> [--password <pw>] [--email <address>] [--config <file>]
-  geekity plugin (add <package>[@version] | remove <package>) [--config <file>]
-  geekity plugin upgrade [<package>...] [--check] [--config <file>]
-
-Commands:
-  serve            Start the CMS (the default when no command is given).
-  init             Create a new site in <directory>.
-  sync             Rebuild the content index once and exit.
-  rebuild          Delete data/geekity.db and build it again from the files.
-                   Everything in it is derived, so this is always safe with the
-                   site stopped; sessions and delivery outcomes start empty.
-  resend           Send announced posts to every follower and relay again, as
-                   they read now: an Update for a post still published, a
-                   Delete for one withdrawn. --all resends every post the site
-                   has announced; this is how posts federated before a new
-                   federation feature (such as quote posts) pick it up.
-  maintenance      Take the public site down on purpose, or bring it back.
-                   While on, pages, feeds, sitemaps and inbox deliveries answer
-                   503 with Retry-After; the admin, /healthz and signed-in
-                   users are let through. A running site notices within a
-                   second, with no restart.
-  dev-mode         Hold everything the site would send to the outside world
-                   (ActivityPub deliveries and relay follows, webmentions,
-                   rssCloud and WebSub pings, IndexNow, email) while it is
-                   built or migrated, and record each one in
-                   data/dev-mode.jsonl. off takes the site live: nothing held
-                   is sent then, and the record says when it went live.
-  strip-metadata   Remove location and camera metadata (EXIF, XMP, IPTC, a
-                   video's location) from files already in content/uploads.
-                   New uploads are stripped as they arrive; this is for the
-                   ones from before. Safe to run again: a clean file is left
-                   as it is.
-  user add         Create an admin user, so a site can get its first login
-                   without the setup screen.
-  plugin add       Install a plugin package's bundle from the npm registry
-                   (npm_config_registry, or registry.npmjs.org) into the
-                   plugins folder, GEEKITY_PLUGINS_DIR. It installs only the
-                   package named, and names any plugin it requires that is
-                   missing. Reload on the Plugins screen loads it.
-  plugin remove    Delete a plugin's folder from the plugins folder. Reload on
-                   the Plugins screen unloads it. It refuses a plugin the site
-                   has enabled: disable it first.
-  plugin upgrade   Bring each plugin in the plugins folder, or only the ones
-                   named, up to its newest version that this core and the
-                   other installed plugins can run, installed as plugin add
-                   installs one. Plugins that must move together do. It says,
-                   for each plugin, what it upgraded, or why it held a newer
-                   version back. --check reports and installs nothing.
-
-Options:
+const SWITCH_FLAGS = [
+    'all',
+    'check',
+    'unset',
+    'with-credentials',
+    'without-content',
+    'list',
+    'replace',
+    'dev-mode',
+    'new-base-url',
+];
+const OPTIONS_HELP = `Options:
   --config <file>  Config file to load. Defaults to the first of
                    ${CONFIG_FILENAMES.join(', ')} found in the working directory.
   --password <pw>  The new user's password. Left off, it is asked for without
@@ -128,8 +289,24 @@ Options:
                    ISO 8601 time such as 2026-09-28T14:00:00Z. It is the
                    Retry-After a client is sent, and the maintenance page
                    says it.
+  --unset          With settings set: remove the stored value.
   --all            With resend: every announced post rather than named ones.
   --check          With plugin upgrade: say what would change, install nothing.
+  --out <file>     With export: the archive to write. Defaults to
+                   geekity-<host>-<time>.tar.gz in the working directory.
+  --with-credentials
+                   With export: include the API keys and logins kept in
+                   data/ (mail.json, akismet.json, each plugin's secrets).
+  --without-content
+                   With export: leave content/ out.
+  --list           With export: print each file data/ may hold, its class
+                   and what is lost without it, and write nothing.
+  --replace        With import: move what content/ and data/ hold into
+                   <dir>/.geekity-before-import-<time> when they hold a site.
+  --dev-mode       With import: turn dev mode on, for a staging copy of a
+                   live site.
+  --new-base-url   With import: accept a base URL in effect that differs
+                   from the one the archive was exported from.
   -h, --help       Show this help.
   -v, --version    Show the installed version.
 
@@ -247,143 +424,30 @@ export function parseArgs(argv) {
     return { command: command ?? 'serve', configPath, password, email, flags, args };
 }
 function isCommand(value) {
-    return COMMANDS.includes(value);
-}
-/** Extensions that need TypeScript support in the loader. */
-const TYPESCRIPT_EXTENSIONS = new Set(['.ts', '.mts', '.cts']);
-/**
- * Load a config module, returning `{}` when the site has no config file.
- *
- * A TypeScript config is imported directly first. That is all it takes on Node
- * 24, which strips types without a flag, and inside this repository, where
- * the CLI already runs under tsx. A Node started with stripping disabled — and
- * any file carrying TypeScript syntax that stripping cannot erase — falls back to
- * registering tsx from the *site's* own dependencies, which is where a site
- * scaffolded by `geekity init` has it. A site with neither writes
- * `geekity.config.js` instead; it is in the candidate list for exactly that.
- */
-export async function loadConfig(cwd, configPath) {
-    const candidates = configPath === undefined
-        ? CONFIG_FILENAMES.map((name) => path.resolve(cwd, name))
-        : [path.resolve(cwd, configPath)];
-    for (const candidate of candidates) {
-        const href = pathToFileURL(candidate).href;
-        let module;
-        try {
-            module = (await import(__rewriteRelativeImportExtension(href)));
-        }
-        catch (error) {
-            if (isModuleNotFound(error, candidate))
-                continue;
-            if (!needsTypeScriptLoader(error, candidate))
-                throw error;
-            await registerTypeScriptLoader(cwd, candidate);
-            module = (await import(__rewriteRelativeImportExtension(href)));
-        }
-        return module.default ?? {};
-    }
-    if (configPath !== undefined) {
-        throw new Error(`Config file not found: ${path.resolve(cwd, configPath)}`);
-    }
-    return {};
-}
-/**
- * The site's own tsx, as the directory the package was installed into, or
- * `undefined` when the site does not have one.
- *
- * Node's resolver is deliberately not asked: this has to be the tsx the *site*
- * installed, and a resolver anchored anywhere else — or patched by a tsx that
- * is already loaded, which is what happens inside this repository — would
- * happily answer with somebody else's copy.
- */
-export function findSiteTsx(cwd) {
-    let directory = path.resolve(cwd);
-    for (;;) {
-        const candidate = path.join(directory, 'node_modules', 'tsx');
-        if (existsSync(path.join(candidate, 'package.json')))
-            return candidate;
-        const parent = path.dirname(directory);
-        if (parent === directory)
-            return undefined;
-        directory = parent;
-    }
-}
-/**
- * Teach this process to import TypeScript, using the tsx installed alongside
- * the site.
- *
- * tsx is the site's rather than this package's because the CMS does not depend
- * on it at runtime: a site that runs `server.ts` already has it, and a site
- * that does not want it writes its config in JavaScript instead.
- */
-export async function registerTypeScriptLoader(cwd, configFile) {
-    const tsx = findSiteTsx(cwd);
-    if (tsx === undefined) {
-        throw new Error(`Could not load ${configFile}: this Node cannot import TypeScript on its own and tsx is ` +
-            'not installed in this site. Either add it (pnpm add -D tsx), or write the config as ' +
-            'geekity.config.js instead.');
-    }
-    const fromTsx = createRequire(path.join(tsx, 'package.json'));
-    const api = (await import(__rewriteRelativeImportExtension(pathToFileURL(fromTsx.resolve('tsx/esm/api')).href)));
-    api.register();
-}
-/**
- * Whether an import failed because the loader could not handle TypeScript.
- *
- * `ERR_UNKNOWN_FILE_EXTENSION` is Node before type stripping was on by
- * default; `ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX` is a file using `enum` or
- * `namespace`, which stripping refuses because erasing it is not enough.
- */
-function needsTypeScriptLoader(error, candidate) {
-    if (!TYPESCRIPT_EXTENSIONS.has(path.extname(candidate).toLowerCase()))
-        return false;
-    const code = error?.code;
-    return code === 'ERR_UNKNOWN_FILE_EXTENSION' || code === 'ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX';
-}
-function isModuleNotFound(error, candidate) {
-    return (typeof error === 'object' &&
-        error !== null &&
-        'code' in error &&
-        error.code === 'ERR_MODULE_NOT_FOUND' &&
-        String(error.message ?? '').includes(candidate));
+    return Object.hasOwn(COMMANDS, value);
 }
 /** Run one command. Resolves with the exit code the process should use. */
 async function main(argv) {
-    const first = leadingWords(argv)[0];
-    if (first !== undefined && !isCommand(first) && !argv.some(isHelpOrVersion)) {
-        return await pluginCommand(argv);
+    const words = leadingWords(argv);
+    const first = words[0];
+    if (first !== undefined && !argv.some(isHelpOrVersion)) {
+        if (!isCommand(first) || (await pluginExtends(first, words, configFlag(argv)))) {
+            return await pluginCommand(argv);
+        }
     }
-    const { command, configPath, password, email, flags, args } = parseArgs(argv);
-    if (command === 'help') {
-        process.stdout.write(await usage(configPath));
+    const parsed = parseArgs(argv);
+    if (parsed.command === 'help') {
+        process.stdout.write(await usage(parsed.configPath));
         return 0;
     }
-    if (command === 'version') {
+    if (parsed.command === 'version') {
         process.stdout.write(`${ownManifest().version}\n`);
         return 0;
     }
-    if (command === 'init')
-        return init(args);
-    if (command === 'user')
-        return userCommand(args, configPath, password, email);
-    if (command === 'sync')
-        return syncCommand(configPath);
-    if (command === 'rebuild')
-        return rebuildCommand(configPath);
-    if (command === 'resend')
-        return resendCommand(args, configPath, flags);
-    if (command === 'maintenance')
-        return maintenanceCommand(args, configPath, flags);
-    if (command === 'dev-mode')
-        return devModeCommand(args, configPath);
-    if (command === 'strip-metadata')
-        return stripMetadataCommand(configPath);
-    if (command === 'plugin')
-        return pluginFolderCommand(args, configPath, flags);
-    return serveCommand(configPath);
+    return COMMANDS[parsed.command].run(parsed);
 }
 /** `geekity init <directory>`: scaffold a new site. */
-async function init(args) {
+async function initCommand({ args }) {
     const directory = args[0];
     if (directory === undefined) {
         throw new Error('geekity init <directory> needs the directory to create.');
@@ -401,64 +465,205 @@ async function init(args) {
     ].join('\n'));
     return 0;
 }
-/**
- * `geekity maintenance on|off|status` (TASK-130).
- *
- * Only the file under `data/` is touched, so this works the same with the
- * site running or stopped: a running site re-reads it within a second.
- */
-async function maintenanceCommand(args, configPath, flags) {
+async function maintenanceCommand({ args, configPath, flags }) {
     const action = args[0];
-    const config = resolveConfig(await loadConfig(process.cwd(), configPath));
-    const file = maintenanceFile(config.dataDir);
+    const config = await loadResolvedConfig(configPath);
+    const settings = createSettings({ config });
     if (action === 'on') {
         const until = untilFlag(text(flags, 'until'));
-        await enterMaintenance(config.dataDir, { until });
+        await setOrThrow(settings, 'maintenance', { on: true, until: until?.toISOString() ?? '' });
+        const file = dataPath(config.dataDir, MAINTENANCE_FILE);
         process.stdout.write(`Maintenance mode is on (${file}).${untilLine(until)}\n`);
         return 0;
     }
     if (action === 'off') {
-        await leaveMaintenance(config.dataDir);
-        process.stdout.write(`Maintenance mode is off.${forcedLine(config.maintenance)}\n`);
+        if (overridden((await settings.resolve(MAINTENANCE.on)).source)) {
+            throw new Error(`Maintenance mode is still on.${forcedLine(true)}`);
+        }
+        await setOrThrow(settings, 'maintenance', { on: false });
+        process.stdout.write('Maintenance mode is off.\n');
         return 0;
     }
     if (action === 'status') {
-        const window = readMaintenance(config.dataDir);
-        if (window === undefined && !config.maintenance) {
+        const on = await settings.resolve(MAINTENANCE.on);
+        if (!on.value) {
             process.stdout.write('Maintenance mode is off.\n');
         }
         else {
-            process.stdout.write(`Maintenance mode is on.${untilLine(window?.until)}${forcedLine(config.maintenance)}\n`);
+            const until = await settings.get(MAINTENANCE.until);
+            process.stdout.write(`Maintenance mode is on.${untilLine(until === '' ? undefined : new Date(until))}${forcedLine(overridden(on.source))}\n`);
         }
         return 0;
     }
     throw new Error('geekity maintenance needs on, off or status.');
 }
-async function devModeCommand(args, configPath) {
+async function devModeCommand({ args, configPath }) {
     const action = args[0];
-    const config = resolveConfig(await loadConfig(process.cwd(), configPath));
+    const config = await loadResolvedConfig(configPath);
+    const settings = createSettings({ config });
     if (action === 'on') {
-        enterDevMode(config.dataDir, 'command');
+        await setOrThrow(settings, 'dev_mode', { on: true });
         process.stdout.write('Dev mode is on: nothing the site does is sent until `geekity dev-mode off`.\n');
         return 0;
     }
     if (action === 'off') {
         if (config.devMode) {
-            throw new Error('GEEKITY_DEV_MODE or the devMode setting still asks for dev mode. ' +
-                'Remove it, then run geekity dev-mode off again.');
+            throw new Error(`${DEV_MODE_LATCHED} Remove it, then run geekity dev-mode off again.`);
         }
-        const wasOn = leaveDevMode(config.dataDir);
+        const wasOn = await settings.get(DEV_MODE.on);
+        await setOrThrow(settings, 'dev_mode', { on: false });
         process.stdout.write(wasOn
             ? 'Dev mode is off: the site is live. Nothing held while it was on will be sent.\n'
             : 'Dev mode was already off: the site is live.\n');
         return 0;
     }
     if (action === 'status') {
-        process.stdout.write(devModeOn(config) ? 'Dev mode is on.\n' : 'Dev mode is off.\n');
+        process.stdout.write((await settings.get(DEV_MODE.on)) ? 'Dev mode is on.\n' : 'Dev mode is off.\n');
         return 0;
     }
     throw new Error('geekity dev-mode needs on, off or status.');
 }
+async function settingsCommand({ args, configPath, flags }) {
+    const [action, name, value] = args;
+    const config = await loadResolvedConfig(configPath);
+    if (action === 'migrate-plugins' && name === undefined) {
+        const moved = migratePluginSettings({
+            contentDir: config.contentDir,
+            dataDir: config.dataDir,
+            log: (line) => process.stdout.write(`${line}\n`),
+        });
+        if (moved.length === 0) {
+            process.stdout.write('No plugin settings are left in content/_data/site.json.\n');
+        }
+        return 0;
+    }
+    const request = settingsRequest(action, name, value, flags['unset'] === true);
+    if (request === undefined) {
+        throw new Error('geekity settings needs list [<namespace>], get <namespace.key>, set <namespace.key> with a value or --unset, or migrate-plugins.');
+    }
+    const settings = await settingsWithRunningPlugins(config);
+    if (request.action === 'list') {
+        const refs = settings.list().filter((ref) => name === undefined || ref.namespace === name);
+        if (refs.length === 0)
+            throw new Error(`There is no settings namespace ${String(name)}.`);
+        const rows = await Promise.all(refs.map((ref) => settingRow(settings, ref)));
+        process.stdout.write(table(rows));
+        return 0;
+    }
+    const ref = settingNamed(settings, request.name);
+    if (request.action === 'get') {
+        const resolved = await settings.resolve(ref);
+        const lines = [shown(ref, resolved.value)];
+        if (overridden(resolved.source)) {
+            const held = resolved.stored === undefined ? 'nothing' : shown(ref, resolved.stored);
+            lines.push(`overridden by ${sourceLabel(resolved.source)}; the file holds ${held}`);
+        }
+        process.stdout.write(`${lines.join('\n')}\n`);
+        return 0;
+    }
+    const { type } = ref.declaration;
+    let stored;
+    if (request.value !== undefined) {
+        const parsed = type.fromText(request.value);
+        if (!parsed.ok)
+            throw new Error(`${request.name} ${parsed.problem}.`);
+        stored = type.toJson(parsed.value);
+    }
+    await setOrThrow(settings, ref.namespace, { [ref.key]: stored });
+    process.stdout.write(table([await settingRow(settings, ref)]));
+    return 0;
+}
+function settingsRequest(action, name, value, unset) {
+    if (action === 'list')
+        return { action };
+    if (name === undefined)
+        return undefined;
+    if (action === 'get')
+        return { action, name };
+    if (action === 'set' && (value !== undefined) !== unset)
+        return { action, name, value };
+    return undefined;
+}
+async function settingsWithRunningPlugins(config) {
+    migratePluginSettings({
+        contentDir: config.contentDir,
+        dataDir: config.dataDir,
+        log: (line) => process.stderr.write(`${line}\n`),
+    });
+    const settings = createSettings({ config });
+    let registry;
+    try {
+        registry = await loadSitePlugins(config, settings);
+    }
+    catch (error) {
+        process.stderr.write(`Plugin settings are not listed: ${messageOf(error)}\n`);
+        return settings;
+    }
+    const enabled = readEnabledPlugins(config.contentDir);
+    const running = registry.active(enabled);
+    for (const entry of registry.plugins) {
+        const { name } = entry.plugin;
+        const declared = entry.settingsNamespace !== undefined;
+        const unremarkable = !declared && !enabled.has(name) && entry.problem === undefined;
+        if (running.has(name) || unremarkable)
+            continue;
+        const unlisted = declared ? ' Its settings are not listed.' : '';
+        process.stderr.write(`${name} ${whyNotRunning(entry, enabled)}${unlisted}\n`);
+        if (declared)
+            settings.unregister(name);
+    }
+    return settings;
+}
+function whyNotRunning(entry, enabled) {
+    if (entry.problem !== undefined)
+        return `did not load: ${entry.problem}`;
+    if (enabled.has(entry.plugin.name)) {
+        return 'is enabled but not running, because a plugin it requires is not running.';
+    }
+    return 'is installed but not enabled.';
+}
+function settingNamed(settings, name) {
+    const dot = name.lastIndexOf('.');
+    const found = settings
+        .list()
+        .find((ref) => ref.namespace === name.slice(0, dot) && ref.key === name.slice(dot + 1));
+    if (found === undefined) {
+        throw new Error(`There is no setting ${name}. geekity settings list names them.`);
+    }
+    return found;
+}
+async function setOrThrow(settings, namespace, changes) {
+    const result = await settings.set(namespace, new Map(Object.entries(changes)), 'cli');
+    if (!result.ok)
+        throw new Error(Object.values(result.problems).join(' '));
+}
+function shown(ref, value) {
+    if (ref.declaration.secret === true) {
+        return value === ref.declaration.default ? '(not set)' : '(set)';
+    }
+    return ref.declaration.type.toText(value);
+}
+async function settingRow(settings, ref) {
+    const resolved = await settings.resolve(ref);
+    let source = sourceLabel(resolved.source);
+    if (overridden(resolved.source) && resolved.stored !== undefined) {
+        source += ` (file: ${shown(ref, resolved.stored)})`;
+    }
+    if (ref.declaration.env === false)
+        source += ', not overridable';
+    return [
+        `${ref.namespace}.${ref.key}`,
+        shown(ref, resolved.value),
+        source,
+        ref.declaration.description,
+    ];
+}
+function table(rows) {
+    const widths = rows[0]?.map((_, column) => Math.max(...rows.map((row) => row[column]?.length ?? 0))) ?? [];
+    return rows
+        .map((row) => `${row.map((cell, column) => (column === row.length - 1 ? cell : cell.padEnd(widths[column] ?? 0))).join('  ')}\n`)
+        .join('');
+}
 function untilFlag(value) {
     if (value === undefined)
         return undefined;
@@ -476,28 +681,52 @@ function forcedLine(forced) {
         ? ' GEEKITY_MAINTENANCE or the maintenance setting keeps it on until the site restarts without it.'
         : '';
 }
-async function stripMetadataCommand(configPath) {
-    const config = resolveConfig(await loadConfig(process.cwd(), configPath));
-    const results = await stripStoredUploads(path.join(config.contentDir, UPLOAD_DIRECTORY));
-    let stripped = 0;
-    let clean = 0;
-    let unreadable = 0;
-    for (const result of results) {
-        if (result.outcome === 'stripped') {
-            stripped += 1;
-            process.stdout.write(`${result.path}: removed ${result.removed.join(', ')}\n`);
-        }
-        else if (result.outcome === 'clean') {
-            clean += 1;
-        }
-        else {
-            unreadable += 1;
-            process.stderr.write(`${result.path}: ${result.problem} Left as it was.\n`);
+/**
+ * Run one job in this process and return its result, or say on standard
+ * error why there is none. A job of the same name that is already active
+ * stops it before it is queued. A queued job counts only while a server is up
+ * to run it: one a command left queued when it died runs when a server next
+ * starts, and is no reason to refuse while none is.
+ */
+async function runJobHere(config, job, payload, what, prepare) {
+    const cms = createCms(config);
+    let status;
+    try {
+        await prepare?.(cms);
+        const enqueued = await cms.jobs.enqueueUnlessActive(job, payload, {
+            countQueued: await isServing(config.dataDir),
+        });
+        if (!enqueued.queued) {
+            process.stderr.write(`A ${job.name} job is already ${enqueued.active.state}, so this one did not start. ` +
+                `Run the command again once it finishes.\n`);
+            return undefined;
         }
+        status = await cms.jobs.run(enqueued.id);
+    }
+    finally {
+        await cms.close();
+    }
+    const result = finishedResult(job, status);
+    if (result === undefined) {
+        const problem = status.state === 'failed' ? status.error : `The job ended ${status.state}.`;
+        process.stderr.write(`The ${what} did not finish: ${problem}\n`);
+    }
+    return result;
+}
+async function stripMetadataCommand({ configPath }) {
+    const config = await loadResolvedConfig(configPath, (loaded) => ({ ...loaded, watch: false }));
+    const report = await runJobHere(config, STRIP_METADATA_JOB, null, 'sweep');
+    if (report === undefined)
+        return 1;
+    for (const file of report.stripped) {
+        process.stdout.write(`${file.path}: removed ${file.removed.join(', ')}\n`);
     }
-    process.stdout.write(`Checked ${count(results.length, 'file')}: ${String(stripped)} stripped, ` +
-        `${String(clean)} already clean, ${String(unreadable)} unreadable\n`);
-    return unreadable === 0 ? 0 : 1;
+    for (const file of report.unreadable) {
+        process.stderr.write(`${file.path}: ${file.problem} Left as it was.\n`);
+    }
+    process.stdout.write(`Checked ${count(report.checked, 'file')}: ${String(report.stripped.length)} stripped, ` +
+        `${String(report.clean)} already clean, ${String(report.unreadable.length)} unreadable\n`);
+    return report.unreadable.length === 0 ? 0 : 1;
 }
 /**
  * `geekity sync`: bring the index into line with the files once and stop.
@@ -505,9 +734,8 @@ async function stripMetadataCommand(configPath) {
  * Watching is forced off whatever the config says, because a one-shot scan
  * that then sat in a watcher would never exit.
  */
-async function syncCommand(configPath) {
-    const config = await loadConfig(process.cwd(), configPath);
-    const cms = createCms({ ...config, watch: false });
+async function syncCommand({ configPath }) {
+    const cms = createCms(await loadResolvedConfig(configPath, (config) => ({ ...config, watch: false })));
     try {
         const result = await cms.sync();
         process.stdout.write(`Scanned ${String(result.scanned)}: ${String(result.created)} created, ` +
@@ -532,44 +760,39 @@ async function syncCommand(configPath) {
  * Mastodon keeps the copy of a post it first fetched, so a property added
  * later — the quote policy (TASK-125) is the one that made this a command —
  * reaches a post already out only through an `Update`. This is the resend
- * button on the federation screen, for every post at once. Delivery runs with
- * no queue, so each activity has been posted before the process exits.
+ * button on the federation screen, for every post at once, and it runs the
+ * same resend job (TASK-393). Delivery runs with no queue, so each activity
+ * has been posted before the process exits.
  */
-async function resendCommand(args, configPath, flags) {
+async function resendCommand({ args, configPath, flags }) {
     const all = flags['all'] === true;
     if (all === args.length > 0) {
         throw new Error('geekity resend needs either --all or the slugs of the posts to resend, and not both.');
     }
-    const config = await loadConfig(process.cwd(), configPath);
-    const cms = createCms({
-        ...config,
+    const config = await loadResolvedConfig(configPath, (loaded) => ({
+        ...loaded,
         watch: false,
-        federation: { ...config.federation, queue: null },
-    });
-    try {
-        await cms.sync();
-        const slugs = all ? cms.store.listFederated().map((document) => document.slug) : args;
-        let failed = 0;
-        for (const slug of slugs) {
-            const report = await cms.delivery.resend(slug);
-            if (report === undefined) {
-                process.stderr.write(`${slug}: nothing to resend, no announced post has that slug.\n`);
-                failed += 1;
-                continue;
-            }
-            if (report.held) {
-                process.stdout.write(`${slug}: ${report.activityType} held by dev mode, nothing sent\n`);
-                continue;
-            }
-            const reached = report.deliveries.filter((delivery) => delivery.status === 'sent').length;
-            process.stdout.write(`${slug}: ${report.activityType} to ${String(reached)} of ` +
-                `${String(report.deliveries.length)} inboxes\n`);
+        federation: { ...loaded.federation, queue: null },
+    }));
+    const report = await runJobHere(config, RESEND_JOB, { slugs: all ? 'all' : args, webmentions: false }, 'resend', (cms) => cms.sync());
+    if (report === undefined)
+        return 1;
+    let failed = 0;
+    for (const post of report.posts) {
+        const activity = post.resent ? post.activity : null;
+        if (activity === null) {
+            process.stderr.write(`${post.slug}: nothing to resend, no announced post has that slug.\n`);
+            failed += 1;
+        }
+        else if (activity.heldByDevMode) {
+            process.stdout.write(`${post.slug}: ${activity.activityType} held by dev mode, nothing sent\n`);
+        }
+        else {
+            process.stdout.write(`${post.slug}: ${activity.activityType} to ${String(activity.reached)} of ` +
+                `${String(activity.inboxes)} inboxes\n`);
         }
-        return failed === 0 ? 0 : 1;
-    }
-    finally {
-        await cms.close();
     }
+    return failed === 0 ? 0 : 1;
 }
 /**
  * `geekity rebuild`: throw the database away and read it back out of the files.
@@ -590,9 +813,8 @@ async function resendCommand(args, configPath, flags) {
  * Watching is forced off for the reason `sync` forces it off: a one-shot
  * command that sat in a watcher would never exit.
  */
-async function rebuildCommand(configPath) {
-    const loaded = await loadConfig(process.cwd(), configPath);
-    const config = resolveConfig(loaded);
+async function rebuildCommand({ configPath }) {
+    const config = await loadResolvedConfig(configPath, (loaded) => ({ ...loaded, watch: false }));
     const file = databaseFile(config.dataDir);
     if (databaseInUse(config.dataDir)) {
         process.stderr.write(`${file} is in use: something else has it open, most likely the site itself. Stop the ` +
@@ -600,11 +822,14 @@ async function rebuildCommand(configPath) {
             'writing to a file nothing can find.\n');
         return 1;
     }
+    return (await rebuildDatabase(config)) > 0 ? 1 : 0;
+}
+async function rebuildDatabase(config) {
     discardDatabase(config.dataDir);
-    const cms = createCms({ ...loaded, watch: false });
+    const cms = createCms(config);
     try {
         const result = await cms.sync();
-        process.stdout.write(`Rebuilt ${file} from the files.\n` +
+        process.stdout.write(`Rebuilt ${databaseFile(config.dataDir)} from the files.\n` +
             `Scanned ${String(result.scanned)}: ${String(result.created)} created, ` +
             `${String(result.updated)} updated, ${String(result.removed)} removed, ` +
             `${String(result.unchanged)} unchanged, ${String(result.failed)} failed\n` +
@@ -615,14 +840,130 @@ async function rebuildCommand(configPath) {
             process.stderr.write(`${String(result.failed)} file${result.failed === 1 ? '' : 's'} could not be parsed and ` +
                 `${result.failed === 1 ? 'was' : 'were'} left out of the index; the warnings above name ` +
                 `${result.failed === 1 ? 'it' : 'them'}.\n`);
-            return 1;
         }
-        return 0;
+        return result.failed;
     }
     finally {
         await cms.close();
     }
 }
+async function importCommand({ args, configPath, flags }) {
+    const [file, ...extra] = args;
+    if (file === undefined) {
+        throw new Error('geekity import needs one archive: geekity import <file>.');
+    }
+    if (extra.length > 0) {
+        throw new Error(`geekity import takes one archive, and no plugin on this site adds "import ${file}".`);
+    }
+    const unsettled = resolveConfig({
+        ...(await loadConfig(process.cwd(), configPath)),
+        watch: false,
+    });
+    const { contentDir, dataDir } = unsettled;
+    if (databaseInUse(dataDir) || (await isServing(dataDir))) {
+        process.stderr.write(`The site is running: ${dataDir} is in use. Stop it and run geekity import again.\n`);
+        return 1;
+    }
+    const archive = path.resolve(file);
+    const targets = { contentDir, dataDir };
+    const settings = createSettings({ config: unsettled });
+    const archived = await readSiteManifest(archive);
+    const { manifest } = archived;
+    const occupied = checkImportTargets(archived, targets, settings).filter((target) => target.state === 'occupied');
+    if (occupied.length > 0 && flags['replace'] !== true) {
+        process.stderr.write(`${occupied.map((target) => target.dir).join(' and ')} already ${occupied.length === 1 ? 'holds' : 'hold'} a site. ` +
+            'Import into empty folders, or give --replace to move what they hold into <dir>/.geekity-before-import-<time> first.\n');
+        return 1;
+    }
+    const staged = await stageSiteImport({ archive, archived, targets, settings });
+    const inEffect = await settleConfig(Object.freeze({ ...unsettled, contentDir: staged.content ?? contentDir }));
+    if (inEffect.baseUrl !== manifest.baseUrl && flags['new-base-url'] !== true) {
+        await discardStaging(staged);
+        process.stderr.write(`The base URL in effect is ${inEffect.baseUrl}, and the archive was exported from ${manifest.baseUrl}. ` +
+            'Actor ids are built from the base URL, so followers would not follow the site to a new address. ' +
+            `Set GEEKITY_BASE_URL, or baseUrl in the config, to ${manifest.baseUrl}, ` +
+            `or give --new-base-url to import it at ${inEffect.baseUrl}.\n`);
+        return 1;
+    }
+    for (const skipped of staged.skipped) {
+        process.stderr.write(`Left out ${skipped.path}: ${skipped.why}.\n`);
+    }
+    for (const aside of await placeSiteImport(staged, { stamp: compactTime(unsettled.now()) })) {
+        process.stdout.write(`Moved what was there into ${aside}.\n`);
+    }
+    process.stdout.write(`Restored ${count(manifest.files.length - staged.skipped.length, 'file')} from ${archive}.\n`);
+    const config = await settleConfig(unsettled);
+    if (flags['dev-mode'] === true) {
+        await setOrThrow(createSettings({ config }), 'dev_mode', { on: true });
+        process.stdout.write('Dev mode is on: nothing the site does is sent until `geekity dev-mode off`.\n');
+    }
+    const failures = await installArchivedPlugins(manifest, {
+        pluginsDir: config.pluginsDir,
+        registry: pluginRegistry(process.env),
+        coreVersion: ownManifest().version,
+    });
+    for (const plugin of manifest.plugins) {
+        if (plugin.source === 'folder' && !failures.some((failed) => failed.name === plugin.name)) {
+            process.stdout.write(`Installed ${plugin.name} ${plugin.version}.\n`);
+        }
+    }
+    await restoreEnabledPlugins(manifest, config.contentDir);
+    await rebuildDatabase(config);
+    await finishSiteImport(targets);
+    process.stdout.write(importNotes(manifest)
+        .map((note) => `${note}\n`)
+        .join(''));
+    for (const failed of failures)
+        process.stderr.write(`${pluginFailureLine(failed)}\n`);
+    return failures.length > 0 ? 1 : 0;
+}
+/**
+ * It runs beside a serving site: no migration runs and no database is opened
+ * but the queue, read-only, to count what waits in it.
+ */
+async function exportCommand({ configPath, flags }) {
+    const config = await loadResolvedConfig(configPath, (loaded) => ({ ...loaded, watch: false }));
+    const settings = createSettings({ config });
+    const plugins = await loadSitePlugins(config, settings);
+    if (flags['list'] === true) {
+        const declarations = siteDataFiles({ dataDir: config.dataDir, settings, plugins });
+        process.stdout.write(table([
+            ...declarations.map((each) => [`data/${each.pattern}`, each.dataClass.kind, each.lost]),
+            ['content/**', 'kept', 'The site: its documents, uploads and _data.'],
+            ...CONTENT_SCRATCH_FILES.map((each) => [
+                `content/${each.pattern}`,
+                each.dataClass.kind,
+                each.lost,
+            ]),
+        ]));
+        return 0;
+    }
+    const plan = await planSiteExport({ config, settings, plugins }, {
+        withCredentials: flags['with-credentials'] === true,
+        withContent: flags['without-content'] !== true,
+    });
+    const { deliveries } = plan.site.pending;
+    process.stdout.write(`${count(deliveries, 'delivery is', 'deliveries are')} waiting in data/queue.sqlite. ` +
+        'They are not exported: before a move, wait until none are.\n' +
+        'The archive holds actor keys, password hashes and personal data. ' +
+        'Store it as carefully as data/.\n');
+    const now = config.now();
+    const out = path.resolve(text(flags, 'out') ?? exportFileName(config.baseUrl, now));
+    const manifest = await writeSiteExport(plan, { out, now });
+    for (const file of manifest.undeclared) {
+        process.stderr.write(`Left out ${file}: no declaration says what it is.\n`);
+    }
+    for (const entry of manifest.notCarried) {
+        process.stderr.write(`Left out ${entry.path}: it is ${entry.why}, and an export holds only regular files.\n`);
+    }
+    if (manifest.credentialsLeftOut.length > 0) {
+        process.stdout.write(`Credentials left out: ${manifest.credentialsLeftOut.join(', ')}. ` +
+            '--with-credentials includes them.\n');
+    }
+    const bytes = manifest.files.reduce((total, file) => total + file.size, 0);
+    process.stdout.write(`Wrote ${out}: ${count(manifest.files.length, 'file')}, ${count(bytes, 'byte')}.\n`);
+    return 0;
+}
 /** "1 follower", "2 followers". The plural is the singular plus s unless told. */
 /** How many comments the files hold, whatever a moderator has done with them. */
 function totalComments(admin) {
@@ -689,10 +1030,10 @@ const SQLITE_LOCKED = 6;
  * to show and the setup screen. It happens here rather than in `createCms` so
  * a site that builds its own server never has content written for it.
  */
-async function serveCommand(configPath) {
+async function serveCommand({ configPath }) {
     if (cluster.isWorker)
         return serveWorker(configPath);
-    const resolved = resolveConfig(await loadConfig(process.cwd(), configPath));
+    const resolved = await loadResolvedConfig(configPath);
     if (resolved.seedContent &&
         (await seedStarterContent({ contentDir: resolved.contentDir, baseUrl: resolved.baseUrl }))) {
         process.stdout.write(`Seeded ${resolved.contentDir} with the starter site\n`);
@@ -714,22 +1055,28 @@ async function serveWorker(configPath) {
     for (const signal of ['SIGINT', 'SIGTERM'])
         process.on(signal, () => undefined);
     try {
-        const config = await loadConfig(process.cwd(), configPath);
-        const loaded = scanPluginFolders(resolveConfig(config).pluginsDir);
+        // The access log is on here and off in `createCms`: a server that answers
+        // the internet should be able to say what it answered, while a CMS embedded
+        // in somebody else's app has no business writing to their stdout uninvited.
+        // Named as a config value rather than forced, so `GEEKITY_ACCESS_LOG` still
+        // wins and a site that wrote `accessLog: false` still gets silence.
+        const config = await loadResolvedConfig(configPath, (site) => ({
+            ...site,
+            accessLog: site.accessLog ?? true,
+        }));
+        const loaded = scanPluginFolders(config.pluginsDir);
         const worker = superviseWorker({
             channel,
             loaded,
             exit: (code) => process.exit(code),
             log: (line) => process.stderr.write(`${line}\n`),
         });
-        // The access log is on here and off in `createCms`: a server that answers
-        // the internet should be able to say what it answered, while a CMS embedded
-        // in somebody else's app has no business writing to their stdout uninvited.
-        // Named as a config value rather than forced, so `GEEKITY_ACCESS_LOG` still
-        // wins and a site that wrote `accessLog: false` still gets silence.
-        const cms = createCms({ ...config, accessLog: config.accessLog ?? true }, { folderPlugins: await importPluginFolders(loaded), supervision: worker.supervision });
+        const cms = createCms(config, {
+            folderPlugins: await importPluginFolders(loaded),
+            supervision: worker.supervision,
+        });
         const { port } = await cms.serve();
-        if (devModeOn(cms.config)) {
+        if (await cms.settings.get(DEV_MODE.on)) {
             process.stdout.write('Dev mode is on: ActivityPub, webmentions, feed pings, IndexNow and email are held ' +
                 'and recorded in data/dev-mode.jsonl. `geekity dev-mode off` takes the site live.\n');
         }
@@ -737,18 +1084,18 @@ async function serveWorker(configPath) {
         worker.serving(cms);
     }
     catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
+        const message = messageOf(error);
         channel.send({ type: 'boot-failed', error: message }, () => process.exit(1));
     }
     return 0;
 }
-async function pluginFolderCommand(args, configPath, flags) {
+async function pluginFolderCommand({ args, configPath, flags }) {
     const [action, ...names] = args;
     const spec = names.length === 1 ? names[0] : undefined;
     if (action !== 'upgrade' && action !== 'add' && action !== 'remove') {
         throw new Error(PLUGIN_USAGE);
     }
-    const config = resolveConfig(await loadConfig(process.cwd(), configPath));
+    const config = await loadResolvedConfig(configPath);
     const { pluginsDir } = config;
     if (pluginsDir === undefined) {
         throw new Error('geekity plugin needs a plugins folder: set GEEKITY_PLUGINS_DIR, or pluginsDir in the config.');
@@ -843,7 +1190,7 @@ function upgradeReportText(report) {
  * holding nobody but the user added here — which, the file winning, is what
  * the next boot would keep. So the same boot migration runs first.
  */
-async function userCommand(args, configPath, flagPassword, flagEmail) {
+async function userCommand({ args, configPath, password: flagPassword, email: flagEmail, }) {
     const subcommand = args[0];
     if (subcommand === undefined) {
         throw new Error('geekity user add <username> needs a subcommand. The only one is: add.');
@@ -862,11 +1209,18 @@ async function userCommand(args, configPath, flagPassword, flagEmail) {
         process.stderr.write(`${problem}\n`);
         return 1;
     }
-    const config = resolveConfig(await loadConfig(process.cwd(), configPath));
-    const admin = openAdminStore({ dataDir: config.dataDir });
-    migrateUsersToFile({ admin, dataDir: config.dataDir });
+    const config = await loadResolvedConfig(configPath);
+    const adminDb = openAdminDatabase(config.dataDir, config.now);
+    migrateUsersToFile(adminDb, config.dataDir);
+    const admin = adminStoreOwning(adminDb, databaseFile(config.dataDir), config.now);
     try {
-        const user = await createUser({ dataDir: config.dataDir, username, password, email });
+        const user = await createUser({
+            dataDir: config.dataDir,
+            username,
+            password,
+            email,
+            now: config.now(),
+        });
         process.stdout.write(`Created admin user ${user.username}${user.email === undefined ? '' : ` (${user.email})`}. Sign in at ${LOGIN_URL}.\n`);
         return 0;
     }
@@ -919,17 +1273,26 @@ function configFlag(argv) {
     }
     return undefined;
 }
+async function loadSitePlugins(config, settings) {
+    const folderPlugins = await importPluginFolders(scanPluginFolders(config.pluginsDir));
+    return sitePluginRegistry(config, folderPlugins, settings);
+}
 /**
  * Every command the site's available plugins add, from its config and its
  * plugins folder, longest words first.
  */
 async function pluginCommands(config) {
-    const folderPlugins = await importPluginFolders(scanPluginFolders(config.pluginsDir));
-    return sitePluginRegistry(config, folderPlugins)
-        .plugins.filter((entry) => entry.problem === undefined)
+    return (await loadSitePlugins(config, createSettings({ config }))).plugins
+        .filter((entry) => entry.problem === undefined)
         .flatMap((entry) => entry.commands.map((command) => ({ plugin: entry.plugin.name, command })))
         .sort((a, b) => b.command.words.length - a.command.words.length);
 }
+async function pluginExtends(first, words, configPath) {
+    if (COMMANDS[first].sharedWithPlugins !== true || words.length < 2)
+        return false;
+    const found = await pluginCommands(await loadResolvedConfig(configPath));
+    return found.some(({ command }) => command.words.every((word, index) => words[index] === word));
+}
 /**
  * Run a command a plugin added (decision-33). It needs no enabling: a
  * migration command runs before the plugin it prepares for is turned on.
@@ -939,19 +1302,28 @@ async function pluginCommands(config) {
  * version that kept its accounts in SQLite is migrated first. The comments
  * are migrated as a boot would migrate them for the same reason: a command
  * writing comments before any server has would otherwise meet ids the site
- * refuses to store.
+ * refuses to store. Plugin settings still in `site.json` move to
+ * `data/plugins/<name>/` first, so the command reads what a boot would.
  */
 async function pluginCommand(argv) {
     const configPath = configFlag(argv);
-    const config = resolveConfig(await loadConfig(process.cwd(), configPath));
+    const config = await loadResolvedConfig(configPath);
     const words = leadingWords(argv);
+    migratePluginSettings({
+        contentDir: config.contentDir,
+        dataDir: config.dataDir,
+        log: (line) => {
+            console.log(line);
+        },
+    });
     const found = (await pluginCommands(config)).find(({ command }) => command.words.every((word, index) => words[index] === word));
     if (found === undefined) {
         throw new Error(`Unknown command "${words[0] ?? ''}". Run geekity --help to see what is available.`);
     }
     const { args, options } = parseCommandArgs(withoutConfig(argv).slice(found.command.words.length), found.command);
-    const admin = openAdminStore({ dataDir: config.dataDir });
-    migrateUsersToFile({ admin, dataDir: config.dataDir });
+    const adminDb = openAdminDatabase(config.dataDir, config.now);
+    migrateUsersToFile(adminDb, config.dataDir);
+    const admin = adminStoreOwning(adminDb, databaseFile(config.dataDir), config.now);
     const comments = { contentDir: config.contentDir, dataDir: config.dataDir };
     migrateCommentEmails(comments);
     migrateCommentKeys(comments);
@@ -1025,14 +1397,14 @@ function parseCommandArgs(argv, command) {
 async function usage(configPath) {
     let found;
     try {
-        found = await pluginCommands(resolveConfig(await loadConfig(process.cwd(), configPath)));
+        found = await pluginCommands(await loadResolvedConfig(configPath));
     }
     catch (error) {
-        process.stderr.write(`Plugin commands are not listed: ${error instanceof Error ? error.message : String(error)}\n`);
-        return USAGE;
+        process.stderr.write(`Plugin commands are not listed: ${messageOf(error)}\n`);
+        return coreUsage();
     }
     if (found.length === 0)
-        return USAGE;
+        return coreUsage();
     const lines = ['', 'Plugin commands:'];
     for (const { plugin, command } of found) {
         const synopsis = wrap(`geekity ${[...command.words, command.usage].join(' ').trim()} [--config <file>]`, USAGE_CONTINUATION);
@@ -1040,18 +1412,31 @@ async function usage(configPath) {
         lines.push(...wrap(command.summary, HELP_INDENT), `${HELP_INDENT}From ${plugin}.`);
         for (const option of command.options ?? []) {
             const flag = `--${option.name}${option.value === undefined ? '' : ` ${option.value}`}`;
-            const described = wrap(option.description, HELP_INDENT);
-            const head = `    ${flag}`;
-            if (head.length < HELP_INDENT.length - 1 && described[0] !== undefined) {
-                described[0] = `${head.padEnd(HELP_INDENT.length)}${described[0].trimStart()}`;
-                lines.push(...described);
-            }
-            else {
-                lines.push(head, ...described);
-            }
+            lines.push(...helpEntry(`    ${flag}`, wrap(option.description, HELP_INDENT)));
         }
     }
-    return `${USAGE}${lines.join('\n')}\n`;
+    return `${coreUsage()}${lines.join('\n')}\n`;
+}
+function coreUsage() {
+    const entries = Object.values(COMMANDS);
+    return [
+        'geekity — the Geekity CMS command line',
+        '',
+        'Usage:',
+        ...entries.flatMap((entry) => entry.synopsis.map((line) => `  geekity ${line}`)),
+        '',
+        'Commands:',
+        ...entries.flatMap((entry) => entry.help.flatMap(([words, summary]) => helpEntry(`  ${words}`, summary.map((line) => `${HELP_INDENT}${line}`)))),
+        '',
+        OPTIONS_HELP,
+    ].join('\n');
+}
+function helpEntry(head, described) {
+    if (head.length < HELP_INDENT.length - 1 && described[0] !== undefined) {
+        described[0] = `${head.padEnd(HELP_INDENT.length)}${described[0].trimStart()}`;
+        return described;
+    }
+    return [head, ...described];
 }
 /** Where the help's descriptions start, as the core commands' do. */
 const HELP_INDENT = ' '.repeat(19);
@@ -1159,7 +1544,7 @@ if (isEntryPoint()) {
             process.exitCode = code;
     })
         .catch((error) => {
-        process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+        process.stderr.write(`${messageOf(error)}\n`);
         process.exit(1);
     });
 }