@geekity/cms 0.30.0 → 0.32.0

package/admin/pages/settings/privacy.njk

@@ -2,7 +2,7 @@
 {% import "components/fields.njk" as field %}
 
 {% block settingsProblems %}
-  {{ field.problem('settings-location-sharing', problems.locationSharing) }}
+  {{ field.problem('settings-location-sharing', problems.location_sharing) }}
 {% endblock %}
 
 {% block settingsFields %}
@@ -16,13 +16,13 @@
     are right now. Changing this changes every post at once, and nothing is
     rewritten.
   {% endset %}
-  {% call field.select('settings-location-sharing', fields.locationSharing, 'Location on posts',
-       error=problems.locationSharing, hint=locationHint, autofocus=true) %}
+  {% call field.select('settings-location-sharing', fields.location_sharing, 'Location on posts',
+       error=problems.location_sharing, hintHtml=locationHint, autofocus=true) %}
     {% for option in [
          ['none', 'Keep it, publish nothing'],
          ['place', 'Publish the place only: its name, locality, region and country'],
          ['exact', 'Publish the exact coordinates too']] %}
-      <option value="{{ option[0] }}"{% if option[0] == form.locationSharing %} selected{% endif %}>{{ option[1] }}</option>
+      <option value="{{ option[0] }}"{% if option[0] == form.location_sharing %} selected{% endif %}>{{ option[1] }}</option>
     {% endfor %}
   {% endcall %}
 
@@ -31,7 +31,7 @@
   <p class="max-w-prose text-sm">
     Location and camera metadata is always removed from pictures and videos as
     they are uploaded, whatever is chosen above. Files uploaded before this
-    version keep theirs until <code>geekity strip-metadata</code> is run over
-    <code>content/uploads/</code>; the package README describes the command.
+    version keep theirs until the sweep on the <a class="link" href="{{ adminUrl }}/media#strip-metadata">Media</a>
+    screen, or <code>geekity strip-metadata</code>, is run over <code>content/uploads/</code>.
   </p>
 {% endblock %}

package/admin/pages/settings/reading.njk

@@ -6,16 +6,16 @@
 
 {% block settingsProblems %}
   {{ field.problem('settings-homepage', problems.homepage) }}
-  {{ field.problem('settings-posts-page', problems.postsPage) }}
-  {{ field.problem('settings-posts-per-page', problems.postsPerPage) }}
-  {{ field.problem('settings-notify-server', problems.notifyServer) }}
-  {{ field.problem('settings-feed-update-period', problems.feedUpdatePeriod) }}
-  {{ field.problem('settings-feed-update-frequency', problems.feedUpdateFrequency) }}
-  {{ field.problem('settings-ai-crawlers', problems.aiCrawlers) }}
-  {{ field.problem('settings-content-signal-search', problems.contentSignalSearch) }}
-  {{ field.problem('settings-content-signal-ai-input', problems.contentSignalAiInput) }}
-  {{ field.problem('settings-content-signal-ai-train', problems.contentSignalAiTrain) }}
-  {{ field.problem('settings-robots-rules', problems.robotsRules) }}
+  {{ field.problem('settings-posts-page', problems.posts_page) }}
+  {{ field.problem('settings-posts-per-page', problems.posts_per_page) }}
+  {{ field.problem('settings-notify-server', problems.notify_server) }}
+  {{ field.problem('settings-feed-update-period', problems.feed_update_period) }}
+  {{ field.problem('settings-feed-update-frequency', problems.feed_update_frequency) }}
+  {{ field.problem('settings-ai-crawlers', problems.ai_crawlers) }}
+  {{ field.problem('settings-content-signal-search', problems.content_signal_search) }}
+  {{ field.problem('settings-content-signal-ai-input', problems.content_signal_ai_input) }}
+  {{ field.problem('settings-content-signal-ai-train', problems.content_signal_ai_train) }}
+  {{ field.problem('settings-robots-rules', problems.robots_rules) }}
 {% endblock %}
 
 {% block settingsFields %}
@@ -36,7 +36,7 @@
     there, and its own URL redirects to <code>/</code> so there is one front page.
   {% endset %}
   {% call field.select('settings-homepage', fields.homepage, 'Your homepage displays',
-       error=problems.homepage, errorHtml=homepageGone, hint=homepageHint, autofocus=true) %}
+       error=problems.homepage, errorHtml=homepageGone, hintHtml=homepageHint, autofocus=true) %}
     <option value="">Your latest posts</option>
     {% for page in pageChoices %}
       <option value="{{ page.slug }}"{% if page.slug == form.homepage %} selected{% endif %}>{{ page.title }}</option>
@@ -46,7 +46,7 @@
   {% set postsPageGone %}
     {% if postsPageMissing %}
       <p>
-        The posts page was <code>{{ form.postsPage }}</code>, which is no longer published,
+        The posts page was <code>{{ form.posts_page }}</code>, which is no longer published,
         so the listing has no page of its own.
       </p>
     {% endif %}
@@ -56,16 +56,16 @@
     listing, with its own title and words above it. It needs a homepage first.
     The feeds stay at <code>/feed/</code> either way.
   {% endset %}
-  {% call field.select('settings-posts-page', fields.postsPage, 'Posts page',
-       error=problems.postsPage, errorHtml=postsPageGone, hint=postsPageHint) %}
+  {% call field.select('settings-posts-page', fields.posts_page, 'Posts page',
+       error=problems.posts_page, errorHtml=postsPageGone, hintHtml=postsPageHint) %}
     <option value="">&mdash; None &mdash;</option>
     {% for page in pageChoices %}
-      <option value="{{ page.slug }}"{% if page.slug == form.postsPage %} selected{% endif %}>{{ page.title }}</option>
+      <option value="{{ page.slug }}"{% if page.slug == form.posts_page %} selected{% endif %}>{{ page.title }}</option>
     {% endfor %}
   {% endcall %}
 
-  {{ field.text('settings-posts-per-page', fields.postsPerPage, 'Posts per page', form.postsPerPage,
-       error=problems.postsPerPage, inputmode='numeric', required=true,
+  {{ field.text('settings-posts-per-page', fields.posts_per_page, 'Posts per page', form.posts_per_page,
+       error=problems.posts_per_page, inputmode='numeric', required=true,
        hint='How many posts a listing page holds, on the home page and on every archive.') }}
 
   {% set notifyHint %}
@@ -73,8 +73,8 @@
     hear at once instead of waiting for their next poll. Every feed advertises
     it. Leave it empty for none.
   {% endset %}
-  {{ field.text('settings-notify-server', fields.notifyServer, 'Notify server', form.notifyServer,
-       error=problems.notifyServer, hint=notifyHint, inputmode='url') }}
+  {{ field.text('settings-notify-server', fields.notify_server, 'Notify server', form.notify_server,
+       error=problems.notify_server, hintHtml=notifyHint, inputmode='url') }}
 
   {# TASK-152. The Syndication module's polling hint, which only RSS has an
      element for. #}
@@ -82,20 +82,20 @@
     How often RSS readers should check the feeds. Readers that see no new post
     for much longer than this may check less often, so pick a pace the site keeps.
   {% endset %}
-  {% call field.select('settings-feed-update-period', fields.feedUpdatePeriod, 'Feed update period',
-       error=problems.feedUpdatePeriod, hint=periodHint) %}
+  {% call field.select('settings-feed-update-period', fields.feed_update_period, 'Feed update period',
+       error=problems.feed_update_period, hintHtml=periodHint) %}
     {% for option in [
          ['hourly', 'Hourly'],
          ['daily', 'Daily'],
          ['weekly', 'Weekly'],
          ['monthly', 'Monthly'],
          ['yearly', 'Yearly']] %}
-      <option value="{{ option[0] }}"{% if option[0] == form.feedUpdatePeriod %} selected{% endif %}>{{ option[1] }}</option>
+      <option value="{{ option[0] }}"{% if option[0] == form.feed_update_period %} selected{% endif %}>{{ option[1] }}</option>
     {% endfor %}
   {% endcall %}
 
-  {{ field.text('settings-feed-update-frequency', fields.feedUpdateFrequency, 'Checks per period',
-       form.feedUpdateFrequency, error=problems.feedUpdateFrequency, inputmode='numeric', required=true,
+  {{ field.text('settings-feed-update-frequency', fields.feed_update_frequency, 'Checks per period',
+       form.feed_update_frequency, error=problems.feed_update_frequency, inputmode='numeric', required=true,
        hint='How many times in each period. Daily and 2 means twice a day.') }}
 
   {# TASK-148. What /robots.txt tells crawlers beyond keeping them out of the
@@ -108,22 +108,22 @@
     site being cited. Each choice writes its own groups into
     <a href="/robots.txt"><code>/robots.txt</code></a>.
   {% endset %}
-  {% call field.select('settings-ai-crawlers', fields.aiCrawlers, 'AI crawlers',
-       error=problems.aiCrawlers, hint=aiHint) %}
+  {% call field.select('settings-ai-crawlers', fields.ai_crawlers, 'AI crawlers',
+       error=problems.ai_crawlers, hintHtml=aiHint) %}
     {% for option in [
          ['allow', 'Allow all'],
          ['block-training', 'Block training crawlers'],
          ['block-all', 'Block all AI crawlers']] %}
-      <option value="{{ option[0] }}"{% if option[0] == form.aiCrawlers %} selected{% endif %}>{{ option[1] }}</option>
+      <option value="{{ option[0] }}"{% if option[0] == form.ai_crawlers %} selected{% endif %}>{{ option[1] }}</option>
     {% endfor %}
   {% endcall %}
 
   {% for signal in [
-       ['contentSignalSearch', 'settings-content-signal-search', 'Content signal: search',
+       ['content_signal_search', 'settings-content-signal-search', 'Content signal: search',
         'Whether pages may be indexed and shown as search results.'],
-       ['contentSignalAiInput', 'settings-content-signal-ai-input', 'Content signal: AI input',
+       ['content_signal_ai_input', 'settings-content-signal-ai-input', 'Content signal: AI input',
         'Whether pages may be fed to an AI model to answer a question.'],
-       ['contentSignalAiTrain', 'settings-content-signal-ai-train', 'Content signal: AI training',
+       ['content_signal_ai_train', 'settings-content-signal-ai-train', 'Content signal: AI training',
         'Whether pages may be used to train or fine-tune an AI model.']] %}
     {% call field.select(signal[1], fields[signal[0]], signal[2],
          error=problems[signal[0]], hint=signal[3]) %}
@@ -139,8 +139,8 @@
     <code>Crawl-delay</code> or <code>Content-Signal</code> lines. Every group still
     keeps crawlers out of <code>/admin/</code>, and the sitemap is always named.
   {% endset %}
-  {{ field.textarea('settings-robots-rules', fields.robotsRules, 'More robots.txt rules',
-       form.robotsRules, error=problems.robotsRules, hint=rulesHint,
+  {{ field.textarea('settings-robots-rules', fields.robots_rules, 'More robots.txt rules',
+       form.robots_rules, error=problems.robots_rules, hintHtml=rulesHint,
        rows='5', spellcheck='false') }}
 
   {# TASK-149. The index for language models, beside the file for crawlers. #}
@@ -149,8 +149,8 @@
     posts, each linked to its Markdown, for AI tools to read. The home page points
     to it. To write it yourself, put your own file at <code>content/llms.txt</code>.
   {% endset %}
-  {{ field.checkbox('settings-llms-txt', fields.llmsTxt, 'Serve /llms.txt',
-       checked=form.llmsTxt, hint=llmsHint) }}
+  {{ field.checkbox('settings-llms-txt', fields.llms_txt, 'Serve /llms.txt',
+       checked=form.llms_txt, hintHtml=llmsHint) }}
 
   {# TASK-151. Telling the search engines, beside the files they read. #}
   {% set indexNowHint %}
@@ -159,6 +159,6 @@
     minutes. Turning it on creates a key the site serves at
     <code>/{key}.txt</code>. Nothing is sent while the site's URL is local.
   {% endset %}
-  {{ field.checkbox('settings-index-now', fields.indexNow, 'Submit changes to IndexNow',
-       checked=form.indexNow, hint=indexNowHint) }}
+  {{ field.checkbox('settings-index-now', fields.index_now, 'Submit changes to IndexNow',
+       checked=form.index_now, hintHtml=indexNowHint) }}
 {% endblock %}

package/admin/pages/tools/dev-mode.njk

@@ -1,4 +1,8 @@
 {% extends "layouts/shell.njk" %}
+{% import "components/fields.njk" as field %}
+{% from "components/alert.njk" import alert %}
+{% from "components/button.njk" import button %}
+{% from "components/card.njk" import card, cardActions %}
 {% from "components/table.njk" import table %}
 
 {% block title %}{{ heading }}{% endblock %}
@@ -7,18 +11,40 @@
   <h1 class="mb-6 text-2xl font-bold">{{ heading }}</h1>
 
   <div class="flex flex-col gap-6">
+    {% if problem %}
+      {% call field.summary('Nothing was saved.') %}
+        {{ field.problem('dev-mode-on', problem) }}
+      {% endcall %}
+    {% endif %}
+
     <p class="max-w-prose">
       {% if on %}
         Dev mode is on. Nothing this site does reaches the outside world: no ActivityPub
         delivery or relay follow, no webmention, no rssCloud or WebSub ping, no IndexNow
-        submission and no email. Each one is recorded here instead. Run
-        <code>geekity dev-mode off</code> to take the site live; nothing held is sent then.
+        submission and no email. Each one is recorded here instead. Turn the switch off, or
+        run <code>geekity dev-mode off</code>, to take the site live; nothing held is sent then.
       {% else %}
         Dev mode is off, and the site is live. This is what it held while it was on. To hold
-        everything again, run <code>geekity dev-mode on</code>.
+        everything again, turn the switch on or run <code>geekity dev-mode on</code>.
       {% endif %}
     </p>
 
+    {% if latched %}
+      {% call alert(color='warning', style='soft') %}
+        <span>{{ latched }}</span>
+      {% endcall %}
+    {% endif %}
+
+    {% call card(title='Dev mode') %}
+      <form method="post" action="{{ saveUrl }}">
+        <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+        {{ field.checkbox('dev-mode-on', 'on', 'Hold everything this site would send', checked=on, error=problem) }}
+        {% call cardActions() %}
+          {{ button('Save', type='submit', color='primary') }}
+        {% endcall %}
+      </form>
+    {% endcall %}
+
     <p>{{ heldCount }} held in all{% if rows.length >= shown %}; the newest {{ shown }} entries are listed, and <code>data/dev-mode.jsonl</code> has the rest{% endif %}.</p>
 
     {% if rows.length %}

package/admin/pages/tools/export.njk

@@ -0,0 +1,89 @@
+{% extends "layouts/shell.njk" %}
+{% import "components/fields.njk" as field %}
+{% from "components/button.njk" import button, buttonLink %}
+{% from "components/card.njk" import card, cardActions %}
+{% from "components/job-status.njk" import jobStatus %}
+
+{% block title %}{{ heading }}{% endblock %}
+
+{% block content %}
+  <h1 class="mb-6 text-2xl font-bold">{{ heading }}</h1>
+
+  <div class="flex max-w-2xl flex-col gap-6">
+    {% if problem %}
+      {% call field.summary('Nothing was exported. Fix the field marked below and try again.') %}
+        {{ field.problem('export-password', problem) }}
+      {% endcall %}
+    {% endif %}
+
+    <p class="max-w-prose">
+      An export is one <code>.tar.gz</code> file of <code>content/</code> and everything under
+      <code>data/</code> that the site cannot make again. <code>geekity import</code> restores
+      it on another host. It holds the actors' signing keys, password hashes and personal
+      data, so store it as carefully as <code>data/</code>.
+    </p>
+
+    <p id="export-pending" class="max-w-prose">
+      {% if pending.deliveries == 1 %}1 delivery is{% else %}{{ pending.deliveries }} deliveries are{% endif %}
+      waiting in <code>data/queue.sqlite</code>. They are not exported: before moving the
+      site, wait until none are, and look again here.
+    </p>
+
+    {% if job %}
+      <section id="export-status" aria-labelledby="export-status-heading">
+        {% call card() %}
+          <h2 id="export-status-heading" class="card-title">Latest export</h2>
+          {% call jobStatus(job, exportUrl, verb='Exported', unit='files') %}
+            {% if result %}
+              <p>
+                {{ result.files }} {% if result.files == 1 %}file{% else %}files{% endif %},
+                {{ result.size }} before compression, {% if result.credentials %}with{% else %}without{% endif %} credentials.
+              </p>
+              {% if result.credentialsLeftOut.length %}
+                <p>Credentials left out: {{ result.credentialsLeftOut | join(', ') }}.</p>
+              {% endif %}
+              {% if result.undeclared.length %}
+                <p>Left out because no declaration says what they are:</p>
+                <ul class="list-disc pl-6">
+                  {% for file in result.undeclared %}<li><code class="break-all">{{ file }}</code></li>{% endfor %}
+                </ul>
+              {% endif %}
+              {% if result.notCarried.length %}
+                <p>Left out because an export holds only regular files:</p>
+                <ul class="list-disc pl-6">
+                  {% for entry in result.notCarried %}<li><code class="break-all">{{ entry.path }}</code>, {{ entry.why }}</li>{% endfor %}
+                </ul>
+              {% endif %}
+              {% if archive %}
+                <p>
+                  <code class="break-all">{{ archive.name }}</code> is deleted at
+                  <time datetime="{{ archive.expiresAt }}">{{ archive.expiresAt | date('datetime') }}</time>,
+                  or when the next export finishes.
+                </p>
+                <div>{{ buttonLink('Download ' + archive.size, downloadUrl, color='primary') }}</div>
+              {% else %}
+                <p>The archive was deleted 24 hours after it was written, or a later export replaced it. Export again to download one.</p>
+              {% endif %}
+            {% endif %}
+          {% endcall %}
+        {% endcall %}
+      </section>
+    {% endif %}
+
+    {% if not job or not job.active %}
+      {% call card(title='Export the site') %}
+        <form method="post" action="{{ exportUrl }}">
+          <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+          {{ field.checkbox('export-with-credentials', fields.withCredentials,
+               'Include credentials', checked=withCredentials,
+               hint='API keys and logins for other services, such as an email provider. Left out, they are typed in again after an import.') }}
+          {{ field.password('export-password', fields.password, 'Your password',
+               error=problem, autocomplete='current-password', required=true) }}
+          {% call cardActions() %}
+            {{ button('Export', type='submit', color='primary') }}
+          {% endcall %}
+        </form>
+      {% endcall %}
+    {% endif %}
+  </div>
+{% endblock %}

package/admin/pages/tools/maintenance.njk

@@ -0,0 +1,51 @@
+{% extends "layouts/shell.njk" %}
+{% import "components/fields.njk" as field %}
+{% from "components/alert.njk" import alert %}
+{% from "components/button.njk" import button %}
+{% from "components/card.njk" import card, cardActions %}
+
+{% block title %}{{ heading }}{% endblock %}
+
+{% block content %}
+  <h1 class="mb-6 text-2xl font-bold">{{ heading }}</h1>
+
+  <div class="flex max-w-2xl flex-col gap-6">
+    {% if problems.on or problems.until %}
+      {% call field.summary('Nothing was saved. Fix the fields marked below.') %}
+        {{ field.problem('maintenance-on', problems.on) }}
+        {{ field.problem('maintenance-until', problems.until) }}
+      {% endcall %}
+    {% endif %}
+
+    <p class="max-w-prose">
+      {% if on %}
+        Maintenance mode is on. Pages, feeds, sitemaps and inbox deliveries answer 503 with
+        Retry-After; the admin, <code>/healthz</code> and signed-in users are let through.
+      {% else %}
+        Maintenance mode is off, and the site is serving.
+      {% endif %}
+    </p>
+
+    {% if overriddenBy %}
+      {% call alert(color='warning', style='soft') %}
+        <span>{{ overriddenBy }}</span>
+      {% endcall %}
+    {% endif %}
+
+    {% call card(title='Maintenance mode') %}
+      <form method="post" action="{{ saveUrl }}">
+        <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+        {{ field.checkbox('maintenance-on', 'on', 'Take the public site down for maintenance', checked=on, error=problems.on) }}
+        {{ field.text('maintenance-until', 'until', 'Expected back', value=until, hint='Optional. An ISO 8601 time such as 2026-09-28T14:00:00Z, sent as Retry-After and shown on the maintenance page.', error=problems.until) }}
+        {% call cardActions() %}
+          {{ button('Save', type='submit', color='primary') }}
+        {% endcall %}
+      </form>
+    {% endcall %}
+
+    <p class="max-w-prose text-sm">
+      <code>geekity maintenance on</code> and <code>off</code> at the command line turn the
+      same switch, and a running site notices either within a second.
+    </p>
+  </div>
+{% endblock %}

package/admin/pages/users/apps.njk

@@ -183,9 +183,9 @@
 
     <form class="mt-4 max-w-2xl" method="post" action="{{ withoutPkce.addUrl }}">
       <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
-      {{ field.text('without-pkce-client', withoutPkce.field, 'App&rsquo;s client_id', withoutPkce.value,
+      {{ field.text('without-pkce-client', withoutPkce.field, labelHtml='App&rsquo;s client_id', value=withoutPkce.value,
            error=withoutPkce.problem, inputmode='url', spellcheck='false', required=true,
-           hint='The URL the app names itself by when it signs in, as App activity shows it, such as <code>https://ia.net/writer</code>.') }}
+           hintHtml='The URL the app names itself by when it signs in, as App activity shows it, such as <code>https://ia.net/writer</code>.') }}
       <div class="mt-4">{{ button('Allow without PKCE', type='submit', color='primary') }}</div>
     </form>
   </section>

package/admin/pages/users/edit.njk

@@ -58,7 +58,7 @@
       {% endif %}
     {% endset %}
     {{ field.text('user-email', fields.email, 'Email address', account.email,
-         type='email', autocomplete='email', hint=emailHint) }}
+         type='email', autocomplete='email', hintHtml=emailHint) }}
 
     <div class="mt-2">{{ button('Save email address', type='submit', color='primary') }}</div>
   </form>
@@ -96,7 +96,7 @@
 
     {% set avatarHint %}A path such as <code>/uploads/2026/09/me.jpg</code>, or a full URL.{% endset %}
     {{ field.text('profile-avatar', fields.avatar, 'Avatar', account.profile.avatar,
-         hint=avatarHint) }}
+         hintHtml=avatarHint) }}
 
     {{ field.text('profile-job-title', fields.jobTitle, 'Job title', account.profile.jobTitle,
          hint='What they do, printed beside the name on the archive.') }}
@@ -125,7 +125,7 @@
       Geekity needs it.
     {% endset %}
     {{ field.textarea('profile-links', fields.links, 'Links', account.profile.links, rows='4',
-         hint=linksHint, error=profileProblems.links) }}
+         hintHtml=linksHint, error=profileProblems.links) }}
 
     <div class="mt-2">{{ button('Save profile', type='submit', color='primary') }}</div>
   </form>

package/admin/pages/users/new.njk

@@ -30,8 +30,8 @@
     {{ field.text('add-username', fields.username, 'Username', addForm.username,
          error=addProblems.username, required=true) }}
 
-    {{ field.text('add-email', fields.email, 'Email <span class="font-normal">(optional)</span>',
-         addForm.email, type='email', autocomplete='email', error=addProblems.email) }}
+    {{ field.text('add-email', fields.email, labelHtml='Email <span class="font-normal">(optional)</span>',
+         value=addForm.email, type='email', autocomplete='email', error=addProblems.email) }}
 
     {{ field.password('add-password', fields.password, 'Password',
          error=addProblems.password, autocomplete='new-password') }}

package/admin/static/admin.css

@@ -3617,6 +3617,82 @@
       overflow-x: auto;
     }
 
+    .progress {
+      appearance: none;
+      border-radius: var(--radius-box);
+      background-color: currentColor;
+      width: 100%;
+      height: .5rem;
+      position: relative;
+      overflow: hidden;
+    }
+
+    @supports (color: color-mix(in lab, red, red)) {
+      .progress {
+        background-color: color-mix(in oklab, currentcolor 20%, transparent);
+      }
+    }
+
+    .progress {
+      color: var(--color-base-content);
+    }
+
+    .progress:indeterminate {
+      background-image: repeating-linear-gradient(90deg, currentColor -1% 10%, #0000 10% 90%);
+      background-position-x: 15%;
+      background-size: 200%;
+    }
+
+    @media (prefers-reduced-motion: no-preference) {
+      .progress:indeterminate {
+        animation: 5s ease-in-out infinite progress;
+      }
+    }
+
+    @supports ((-moz-appearance: none)) {
+      .progress:indeterminate::-moz-progress-bar {
+        background-color: #0000;
+      }
+
+      @media (prefers-reduced-motion: no-preference) {
+        .progress:indeterminate::-moz-progress-bar {
+          background-image: repeating-linear-gradient(90deg, currentColor -1% 10%, #0000 10% 90%);
+          background-position-x: 15%;
+          background-size: 200%;
+          animation: 5s ease-in-out infinite progress;
+        }
+      }
+
+      .progress::-moz-progress-bar {
+        border-radius: var(--radius-box);
+        background-color: currentColor;
+      }
+
+      @media (prefers-reduced-motion: no-preference) {
+        .progress::-moz-progress-bar {
+          transition: inline-size .3s;
+        }
+      }
+    }
+
+    @supports ((-webkit-appearance: none)) {
+      .progress::-webkit-progress-bar {
+        border-radius: var(--radius-box);
+        background-color: #0000;
+      }
+
+      .progress::-webkit-progress-value {
+        border-radius: var(--radius-box);
+        background-color: currentColor;
+      }
+
+      @media (prefers-reduced-motion: no-preference) {
+        .progress::-webkit-progress-value {
+          transition: inline-size .3s;
+        }
+      }
+    }
+
     .file-input {
       border: var(--border) solid #0000;
       cursor: pointer;
@@ -5890,6 +5966,10 @@
       --alert-color: var(--color-warning);
     }
 
+    .progress-primary {
+      color: var(--color-primary);
+    }
+
     .link-hover {
       text-decoration-line: none;
     }

package/dist/access-log.d.ts

@@ -1,14 +1,6 @@
 import type { MiddlewareHandler } from 'hono';
-import type { ResolvedConfig } from './config.ts';
-import type { GeekityEnv } from './env.ts';
-/**
- * Where one access-log line goes.
- *
- * The line arrives without a trailing newline; the sink decides the framing.
- * The default sink is stdout — what a container collects, what dockge shows
- * and what journald keeps — and a test hands in one that keeps the lines.
- */
-export type AccessLogWriter = (line: string) => void;
+import type { AccessLogWriter, ResolvedConfig } from './config.ts';
+import type { GeekityEnv } from './web/env.ts';
 /** What {@link createAccessLog} needs to know. */
 export interface AccessLogOptions {
     /**

package/dist/access-log.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-log.d.ts","sourceRoot":"","sources":["../src/access-log.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAG9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;AAErD,kDAAkD;AAClD,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,kBAAkB,GAAG,YAAY,CAAC,CAAC;IAChE,8CAA8C;IAC9C,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAsBD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,iBAAiB,CAAC,UAAU,CAAC,CA4BxF"}
+{"version":3,"file":"access-log.d.ts","sourceRoot":"","sources":["../src/access-log.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAG9C,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,kDAAkD;AAClD,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,kBAAkB,GAAG,YAAY,CAAC,CAAC;IAChE,8CAA8C;IAC9C,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAsBD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,iBAAiB,CAAC,UAAU,CAAC,CA4BxF"}

package/dist/access-log.js

@@ -1,4 +1,4 @@
-import { clientAddress } from './admin/throttle.js';
+import { clientAddress } from './web/throttle.js';
 /** The default sink: one write per line, the newline included, like the CLI's. */
 function writeToStdout(line) {
     process.stdout.write(`${line}\n`);

package/dist/access-log.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-log.js","sourceRoot":"","sources":["../src/access-log.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAyBpD,kFAAkF;AAClF,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC;IACvE,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,eAAe,CAAC,OAAyB;IACvD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,aAAa,CAAC;IAC7C,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAExD,OAAO,KAAK,UAAU,SAAS,CAAC,CAAC,EAAE,IAAI;QACrC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAClC,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,uEAAuE;YACvE,sEAAsE;YACtE,qEAAqE;YACrE,kDAAkD;YAClD,KAAK,GAAG,IAAI,CAAC;YACb,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;YAC1C,IAAI,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,OAAO,IAAI,CAAC;YACxF,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;gBACjD,IAAI,OAAO,KAAK,SAAS;oBAAE,IAAI,IAAI,IAAI,OAAO,EAAE,CAAC;YACnD,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"access-log.js","sourceRoot":"","sources":["../src/access-log.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAgBlD,kFAAkF;AAClF,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC;IACvE,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,eAAe,CAAC,OAAyB;IACvD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,aAAa,CAAC;IAC7C,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAExD,OAAO,KAAK,UAAU,SAAS,CAAC,CAAC,EAAE,IAAI;QACrC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAClC,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,uEAAuE;YACvE,sEAAsE;YACtE,qEAAqE;YACrE,kDAAkD;YAClD,KAAK,GAAG,IAAI,CAAC;YACb,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;YAC1C,IAAI,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,OAAO,IAAI,CAAC;YACxF,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;gBACjD,IAAI,OAAO,KAAK,SAAS;oBAAE,IAAI,IAAI,IAAI,OAAO,EAAE,CAAC;YACnD,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/{web → admin}/admin-bar.d.ts

@@ -1,5 +1,5 @@
 import type { MiddlewareHandler } from 'hono';
-import type { GeekityEnv } from '../env.ts';
+import type { GeekityEnv } from '../web/env.ts';
 /**
  * The admin bar across the top of the public site, for a signed-in user
  * (TASK-183).
@@ -7,7 +7,8 @@ import type { GeekityEnv } from '../env.ts';
  * Where the public site's pages learn who is reading them. An anonymous request
  * goes through untouched, so what everybody else is sent, headers and bytes, is what
  * it was before the bar existed. For a signed-in one the account is put on the
- * context for the handlers, and whatever HTML they answer with, a document, a
+ * context for the handlers, every page they draw has `signedIn` in its
+ * template context, and whatever HTML they answer with, a document, a
  * listing, a search, the 404 or the 500, gets the bar straight after its
  * `<body>` tag, the `geekity-admin-bar` class on `<html>`, and the headers of
  * a page drawn for one reader: private, no-store, and no validator. Anything

package/dist/admin/admin-bar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-bar.d.ts","sourceRoot":"","sources":["../../src/admin/admin-bar.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAYvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAkBhD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,cAAc,EAAE,iBAAiB,CAAC,UAAU,CAyBxD,CAAC"}