@geekity/cms 0.7.0 → 0.8.0

package/README.md

@@ -79,18 +79,20 @@ changelog.
 site (or `npx geekity`, or a `package.json` script, which is how the generated
 `sync` script calls it).
 
-| Command                                 | What it does                                                                                                                                                          |
-| --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `geekity serve`                         | Boot from the config file and listen. The default when no command is given.                                                                                           |
-| `geekity init <dir>`                    | Create a new site in `<dir>`. Refuses a directory that is not empty.                                                                                                  |
-| `geekity sync`                          | Rebuild the content index once and exit. Exits non-zero if any file could not be parsed.                                                                              |
-| `geekity rebuild`                       | Delete `data/geekity.db` and build it again from the files.                                                                                                           |
-| `geekity user add <name>`               | Create an admin account, so a site can get its first login without the setup screen.                                                                                  |
-| `geekity import wordpress-actor <name>` | Bring one person across from the WordPress ActivityPub plugin: their key pair, the actor id their followers hold, the plugin's numeric actor id, and their followers. |
-| `geekity --help`, `-h`                  | The same table, on the terminal.                                                                                                                                      |
-| `geekity --version`                     | The installed version.                                                                                                                                                |
-
-`serve`, `sync`, `rebuild`, `user add` and `import wordpress-actor` take
+| Command                                   | What it does                                                                                                                                                          |
+| ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `geekity serve`                           | Boot from the config file and listen. The default when no command is given.                                                                                           |
+| `geekity init <dir>`                      | Create a new site in `<dir>`. Refuses a directory that is not empty.                                                                                                  |
+| `geekity sync`                            | Rebuild the content index once and exit. Exits non-zero if any file could not be parsed.                                                                              |
+| `geekity rebuild`                         | Delete `data/geekity.db` and build it again from the files.                                                                                                           |
+| `geekity resend --all`, `<slug>...`       | Send announced posts to every follower and relay again, as they now read. See [Quote posts](#quote-posts).                                                            |
+| `geekity maintenance on`, `off`, `status` | Take the public site down on purpose with a 503 and `Retry-After`, or bring it back, without a restart. `on --until <time>` names when it should be back.             |
+| `geekity user add <name>`                 | Create an admin account, so a site can get its first login without the setup screen.                                                                                  |
+| `geekity import wordpress-actor <name>`   | Bring one person across from the WordPress ActivityPub plugin: their key pair, the actor id their followers hold, the plugin's numeric actor id, and their followers. |
+| `geekity --help`, `-h`                    | The same table, on the terminal.                                                                                                                                      |
+| `geekity --version`                       | The installed version.                                                                                                                                                |
+
+`serve`, `sync`, `rebuild`, `resend`, `maintenance`, `user add` and `import wordpress-actor` take
 `--config <file>`; without it they look for `geekity.config.ts`, then
 `geekity.config.js`, then `geekity.config.mjs` in the working directory, and run
 on defaults if there is none.
@@ -273,6 +275,7 @@ directory; absolute ones are used as given.
 | `accessLog`        | `false`; `true` under `geekity serve` | `GEEKITY_ACCESS_LOG`         | One line per request on stdout: method, path with query, status, duration. See [The access log](#the-access-log).                                                                         |
 | `accessLogAddress` | `false`                               | `GEEKITY_ACCESS_LOG_ADDRESS` | Put the client address on the end of each access-log line. `trustProxy` decides which address that is.                                                                                    |
 | `accessLogWriter`  | stdout                                | —                            | Where the lines go instead. See [The access log](#the-access-log).                                                                                                                        |
+| `maintenance`      | `false`                               | `GEEKITY_MAINTENANCE`        | Keep the site in maintenance mode, answering 503, until a restart without it.                                                                                                             |
 | `onDocumentChange` | none                                  | —                            | Hook run for every change to the index. See [Hooks](#hooks).                                                                                                                              |
 | `onPublish`        | none                                  | —                            | Hook run when a document becomes visible. See [Hooks](#hooks).                                                                                                                            |
 | `federation`       | `{}`                                  | —                            | Federation stores and guards. See [Federation](#federation).                                                                                                                              |
@@ -538,17 +541,20 @@ its front matter: the record that the post has been announced and when, which
 is what decides `Create` against `Update` and what a resend reads. Restoring a
 trashed post reuses it too.
 
-Because that URL is a promise, the editor keeps it: **a published post's slug
-and permalink cannot be changed**. Both fields still move freely on a draft,
-and a site that really means to move a published post can edit the file,
-knowing that its followers will be handed a second object.
-
 A post whose file already names an `activitypub.id` keeps it as its object id
 for the life of the post — that is how a post migrated from WordPress keeps the
 `https://example.com/?p=813` its followers, its replies and its RSS subscribers
 already hold. The CMS serves the post's object at that URL on an ActivityStreams
 request, redirects a browser from it to the permalink, and names it in every
-`Update` and `Delete`. The CMS never writes one itself.
+`Update` and `Delete`.
+
+The CMS writes one itself in one case: when a published post's slug or
+permalink is changed in the editor. A fediverse server cannot rename an object
+it holds, so the URL the post is leaving becomes its stored `activitypub.id`.
+Followers get an `Update` of the object they already have, a peer at the old
+URL still gets the object, and a browser there is redirected to the new
+permalink. The object's `url` is the new permalink. See
+[Moved URLs](#moved-urls).
 
 One POST serves a whole instance — the shared inbox is preferred — but the
 outcome is recorded per recipient, so an admin can see which one did not get it
@@ -580,6 +586,56 @@ queue, which retries out of band) or `failed`.
 The one capability given up is tombstoning a post whose file is gone entirely
 rather than in the trash: there is no file left to build the `Tombstone` from.
 
+### Quote posts
+
+Mastodon 4.5 lets people quote a post only when the post says who may, and
+shows a quote only once the quoted author's server has approved it
+([FEP-044f]). Every post this site federates is public, so every `Note` and
+`Article` carries `interactionPolicy.canQuote` with `automaticApproval` set to
+the public collection: anybody may quote it, and nobody has to approve it by
+hand. Pages, drafts, scheduled and trashed posts do not federate, so nobody
+can quote them.
+
+A quoting server sends a `QuoteRequest` to the post's author. The inbox, and
+the WordPress-compatible inbox when that switch is on, answers it:
+
+- For a post the site federates, whose quote lives on the requester's own
+  server, it stores an approval and replies `Accept` with a
+  `QuoteAuthorization` as its `result`. The authorization names the quote
+  (`interactingObject`), the post (`interactionTarget`) and the author
+  (`attributedTo`).
+- For anything else it replies `Reject` and stores nothing.
+
+Approvals are files, like followers:
+`content/_data/federation/{username}/quotes.json` holds one object per quote of
+that user's posts. Each is served unsigned, as ActivityStreams JSON, at
+`{baseUrl}/author/{username}/quotes/{id}/`, for as long as the post is still
+published. An `Undo` of the `QuoteRequest`, or a `Delete` of the quoting post,
+removes the approval, and its URL answers 404 after that. A quote does not
+notify the author.
+
+Mastodon keeps the copy of a post it fetched first, so a post federated before
+the quote policy existed is not quotable until its followers receive an
+`Update`. Editing the post sends one. To update every announced post at once,
+run `geekity resend --all` in the site directory:
+
+```sh
+$ geekity resend --all
+hello-world: Update to 3 of 3 inboxes
+another-post: Update to 3 of 3 inboxes
+```
+
+`geekity resend <slug>...` does the same for named posts. Each is what the
+Resend button on the federation screen does: an `Update` for a post still
+published, a `Delete` for one that has been withdrawn, and a `Create` for a
+published post that was never announced. `--all` only reaches posts that were
+announced. The command delivers with no queue, so every activity has been
+posted before it exits, and it exits non-zero when a named slug has nothing to
+resend. It works while the server runs, because both read the same files and
+database.
+
+[FEP-044f]: https://codeberg.org/fediverse/fep/src/branch/main/fep/044f/fep-044f.md
+
 ### Relays
 
 A [Mastodon-style relay][fepae0c] boosts every public activity it is sent on to
@@ -2146,6 +2202,85 @@ hand-edited `site.json` that is not an object of lists of items yields no menu
 rather than an error, exactly as a bad archive base falls back rather than
 taking the site down.
 
+### Moved URLs
+
+Changing the slug or the permalink of a published post or page in the editor
+moves it, and the URL it leaves is written into its file:
+
+```yaml
+permalink: /2026/01/new-name/
+redirect_from:
+  - /2026/01/first-name/
+  - /2026/01/second-name/
+```
+
+Every URL in `redirect_from` answers `301 Moved Permanently` with the current
+permalink, and so do its `.md` and `.json` spellings. Each entry points at the
+document itself, not at the next rename, so no chain of redirects builds up.
+The list is in the file, so deleting `data/geekity.db` keeps it working.
+
+A URL in the list only redirects while nothing else lives there: a new document
+given that URL takes it over. Moving a document back to a URL in its list takes
+that URL off the list. A draft that was never published moves without leaving
+anything behind. Correcting a published post's date files it under the new
+day but keeps its URL.
+
+### Declared redirects
+
+A site that moves to this CMS, or reorganises, lists the old URLs that no
+document owns in `content/_data/redirects.json`. The file is a JSON list:
+
+```json
+[
+  { "from": "/?p=123", "to": "/2026/01/hello/" },
+  { "from": "/old-section/", "to": "/new-section/", "status": 301 },
+  { "from": "/sale/", "to": "/shop/", "status": 302 },
+  { "from": "/forum/", "to": "https://forum.example.com/", "status": 308 }
+]
+```
+
+- `from` is a path on this site. It starts with `/` and can carry a query
+  string.
+- `to` is a path on this site, or an absolute `http` or `https` URL.
+- `status` is `301` or `308` for a permanent redirect, and `302` or `307` for a
+  temporary one. It defaults to `301`.
+
+A `from` without a query string matches that path with any query, or none. The
+request's query goes on to a `to` that has no query of its own, so
+`/old-section/?page=2` lands on `/new-section/?page=2`. The path must match
+exactly, except that a `from` ending in `/` also answers the same path without
+the slash, in one hop.
+
+A `from` with a query string matches only that query. The order of the
+parameters does not matter, so `/archives/?cat=4&paged=2` also matches
+`/archives/?paged=2&cat=4`. Nothing else in the request's query may differ:
+`/?p=123` does not match `/?p=123&replytocom=9`. This is how old WordPress
+`?p=` links reach their posts.
+
+A declared redirect never hides something real. A path-only `from` is answered
+only after every document, archive, feed and moved URL has had its turn, and
+just before the 404 page, so a document given that URL later takes it over. A
+`from` with a query string is answered first, because no document is addressed
+by its query. The admin, the federation endpoints and the health check answer
+before any declared redirect.
+
+The file is read on the next request after it changes, with no restart. An
+entry that cannot be served is logged as a warning at boot, and again on the
+first request after the file changes, and it is skipped. The following entries are skipped:
+
+- An entry with a missing or malformed `from`, `to` or `status`.
+- A second entry with the same `from`. The first entry wins.
+- Every entry that leads into a loop, such as `/a/` to `/b/` and `/b/` back to
+  `/a/`.
+
+A file that is not a JSON list serves no redirects and is reported the same
+way.
+
+Every redirect the CMS sends carries `X-Redirect-By: Geekity CMS`. This
+includes the declared redirects, moved URLs, trailing slashes, feed spellings
+and the admin's redirects. Someone who traces a chain of redirects through a
+proxy can see which layer sent each one.
+
 ## Content negotiation
 
 Every public URL is one resource with more than one body. A post or a page has

package/admin/layouts/shell.njk

@@ -7,12 +7,19 @@
     <a class="admin-bar-site" href="{{ adminUrl }}">{{ site.title }}</a>
     <a href="{{ siteUrl }}">View site</a>
     <span class="admin-bar-spacer"></span>
-    {% if user %}
-      <span class="admin-bar-user">Signed in as {{ user.username }}</span>
-      <form method="post" action="{{ logoutUrl }}">
-        <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
-        <button type="submit">Log out</button>
-      </form>
+    {% if me %}
+      {# WordPress's "Howdy," menu, greeting the way this site's owner does.
+         A popover rather than a script: the browser opens and closes it,
+         shuts it on Escape or a click elsewhere, and tells a screen reader
+         whether it is expanded, all under the CSP's script-src 'self'. #}
+      <button type="button" class="admin-bar-account" popovertarget="admin-account-menu">Hoopla! {{ me.name }}</button>
+      <div id="admin-account-menu" class="admin-account-menu" popover>
+        <a href="{{ me.url }}">Edit profile</a>
+        <form method="post" action="{{ logoutUrl }}">
+          <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+          <button type="submit">Log out</button>
+        </form>
+      </div>
     {% endif %}
   </header>
 {% endblock %}

package/admin/pages/error.njk

@@ -0,0 +1,11 @@
+{% extends "layouts/base.njk" %}
+
+{% block title %}Something went wrong{% endblock %}
+
+{% block content %}
+  {# The page an admin request that threw answers with. It extends the bare
+     layout rather than the shell because the shell reads the session, the
+     menu and the site, and any of those may be what failed. #}
+  <h1>Something went wrong</h1>
+  <p>This screen could not be shown because of a problem on the server. The error has been logged. Try again in a moment, or go back to the <a href="{{ adminUrl }}">dashboard</a>.</p>
+{% endblock %}

package/admin/static/admin.css

@@ -54,11 +54,13 @@ a {
   min-height: 2.5rem;
   background: var(--admin-bar);
   color: var(--admin-nav-text);
+  anchor-name: --admin-bar;
 }
 
 .admin-bar a {
   color: var(--admin-nav-text);
   text-decoration: none;
+  white-space: nowrap;
 }
 
 .admin-bar a:hover,
@@ -74,22 +76,71 @@ a {
   flex: 1;
 }
 
-.admin-bar-user {
-  color: #c3c4c7;
+.admin-bar-account {
+  padding: 0;
+  border: 0;
+  background: none;
+  color: var(--admin-nav-text);
+  font: inherit;
+  text-align: right;
+  cursor: pointer;
+  anchor-name: --admin-account;
 }
 
-.admin-bar form {
-  display: inline;
+.admin-bar-account:hover,
+.admin-bar-account:focus-visible,
+.admin-bar-account:popover-open {
+  color: #72aee6;
 }
 
-.admin-bar button {
-  padding: 0;
+.admin-bar-account::after {
+  content: ' \25BE' / '';
+}
+
+/* The menu is in the top layer, so it is placed rather than laid out: under
+   the greeting where anchor positioning exists, at the bar's right edge
+   where it does not. */
+
+.admin-account-menu {
+  inset: 2.5rem 0 auto auto;
+  margin: 0;
+  min-width: 10rem;
+  padding: 0.25rem 0;
+  border: 0;
+  background: var(--admin-nav);
+  color: var(--admin-nav-text);
+  box-shadow: 0 3px 5px rgb(0 0 0 / 20%);
+}
+
+@supports (top: anchor(--admin-bar bottom)) {
+  .admin-account-menu {
+    inset: anchor(--admin-bar bottom) anchor(--admin-account right) auto auto;
+  }
+}
+
+.admin-account-menu a,
+.admin-account-menu button[type='submit'] {
+  display: block;
+  box-sizing: border-box;
+  width: 100%;
+  margin: 0;
+  padding: 0.5rem 1rem;
   border: 0;
+  border-radius: 0;
   background: none;
   color: var(--admin-nav-text);
   font: inherit;
+  text-align: left;
+  text-decoration: none;
   cursor: pointer;
-  text-decoration: underline;
+}
+
+.admin-account-menu a:hover,
+.admin-account-menu a:focus-visible,
+.admin-account-menu button[type='submit']:hover,
+.admin-account-menu button[type='submit']:focus-visible {
+  background: var(--admin-bar);
+  color: #72aee6;
 }
 
 /* The shell: navigation column beside the screen itself. */
@@ -331,6 +382,8 @@ label {
 input[type='text'],
 input[type='password'],
 input[type='email'],
+input[type='url'],
+select,
 textarea {
   width: 100%;
   padding: 0.4rem 0.5rem;
@@ -346,6 +399,13 @@ textarea {
   resize: vertical;
 }
 
+/* A select lays its text out at line-height: normal whatever it inherits, so
+   it is given the height a text box reaches: the body's 1.6 line, the padding
+   and the border. */
+select {
+  min-height: calc(1.6em + 0.8rem + 2px);
+}
+
 button[type='submit'],
 .admin-button {
   margin-top: 1rem;
@@ -477,6 +537,7 @@ button[type='submit']:hover,
 
 .admin-check input {
   width: auto;
+  margin: 0;
 }
 
 .admin-editor-buttons {
@@ -659,14 +720,6 @@ button[type='submit']:hover,
   border-top: 0;
 }
 
-.admin-settings select {
-  padding: 0.4rem 0.5rem;
-  border: 1px solid #8c8f94;
-  background: var(--admin-surface);
-  color: inherit;
-  font: inherit;
-}
-
 .admin-settings input:disabled {
   background: var(--admin-field);
   color: var(--admin-muted);
@@ -877,6 +930,7 @@ button[type='submit']:hover,
    switches and windows still reads as one column rather than as a form. */
 
 .admin-inline select {
+  width: auto;
   margin: 0;
 }
 

package/dist/admin/documents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"documents.d.ts","sourceRoot":"","sources":["../../src/admin/documents.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,KAAK,EAAE,QAAQ,EAAmB,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAStF,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AASxE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAe5C;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,0CAA0C;IAC1C,IAAI,EAAE,YAAY,CAAC;IACnB,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,KAAK,EAAE,OAAO,CAAC;IACf,oDAAoD;IACpD,MAAM,EAAE,OAAO,CAAC;IAChB,iEAAiE;IACjE,WAAW,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;;;;OAQG;IACH,WAAW,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,mCAAmC,CAAC;AAE5D;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB;aAAK,IAAI,EAAE,EAAE;aAAE,IAAI,EAAE,MAAM;aAAE,MAAM,EAAE,QAAQ;CAAW,CAAC;AAiBtF,2EAA2E;AAC3E,eAAO,MAAM,SAAS,EAAE,YAWvB,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,SAAS,EAAE,YAWvB,CAAC;AAEF,8CAA8C;AAC9C,wBAAgB,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,oEAAoE;AACpE,wBAAgB,aAAa,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAExD;AAED;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,WAAW,GAAG,WAAW,GAAG,OAAO,GAAG,OAAO,CAAC;AAEnF,gDAAgD;AAChD,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAMrD,CAAC;AAEF,iDAAiD;AACjD,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,cAAc,CAExE;AAED,wEAAwE;AACxE,wBAAgB,cAAc,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,GAAG,cAAc,CAQzF;AAED,mEAAmE;AACnE,MAAM,MAAM,WAAW,GAAG,CACxB,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,EACtB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC9B,QAAQ,CAAC;AAEd,wEAAwE;AACxE,MAAM,WAAW,2BAA2B;IAC1C,2CAA2C;IAC3C,IAAI,EAAE,YAAY,CAAC;IACnB,oFAAoF;IACpF,MAAM,EAAE,WAAW,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,EACrB,OAAO,EAAE,2BAA2B,GACnC,IAAI,CAuEN;AA4ZD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAOjD;AAkCD,+CAA+C;AAC/C,MAAM,WAAW,YAAY;IAC3B,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,YAAY,EAAE,CAkBrF;AA6LD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK5D;AAwBD,iEAAiE;AACjE,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,mEAAmE;IACnE,OAAO,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;OAOG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CACvB,IAAI,EAAE,YAAY,EAClB,QAAQ,GAAE,MAAyB,EACnC,GAAG,GAAE,IAAiB,GACrB,UAAU,CAqBZ;AAED;;;;;;;GAOG;AACH,wBAAgB,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,GAAE,MAAyB,GAAG,UAAU,CAkB3F;AAiFD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,YAAY,EACnB,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,MAAM,GACX,QAAQ,GAAG,SAAS,CAWtB;AAED,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAC1B,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,+EAA+E;IAC/E,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,SAAS,EAAE,OAAO,CAAC;IACnB,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B;;;OAGG;IACH,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B;AAED;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;aAAK,QAAQ,EAAE,YAAY;aAAE,SAAS,EAAE,YAAY;CAAW,CAAC;AAoD7F,2EAA2E;AAC3E,wBAAgB,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,SAAI,GAAG,MAAM,CAMvF"}
+{"version":3,"file":"documents.d.ts","sourceRoot":"","sources":["../../src/admin/documents.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,KAAK,EAAE,QAAQ,EAAmB,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAStF,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AASxE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAgB5C;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,0CAA0C;IAC1C,IAAI,EAAE,YAAY,CAAC;IACnB,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,KAAK,EAAE,OAAO,CAAC;IACf,oDAAoD;IACpD,MAAM,EAAE,OAAO,CAAC;IAChB,iEAAiE;IACjE,WAAW,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;;;;OAQG;IACH,WAAW,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,mCAAmC,CAAC;AAE5D;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB;aAAK,IAAI,EAAE,EAAE;aAAE,IAAI,EAAE,MAAM;aAAE,MAAM,EAAE,QAAQ;CAAW,CAAC;AAiBtF,2EAA2E;AAC3E,eAAO,MAAM,SAAS,EAAE,YAWvB,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,SAAS,EAAE,YAWvB,CAAC;AAEF,8CAA8C;AAC9C,wBAAgB,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,oEAAoE;AACpE,wBAAgB,aAAa,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAExD;AAED;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,WAAW,GAAG,WAAW,GAAG,OAAO,GAAG,OAAO,CAAC;AAEnF,gDAAgD;AAChD,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAMrD,CAAC;AAEF,iDAAiD;AACjD,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,cAAc,CAExE;AAED,wEAAwE;AACxE,wBAAgB,cAAc,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,GAAG,cAAc,CAQzF;AAED,mEAAmE;AACnE,MAAM,MAAM,WAAW,GAAG,CACxB,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,EACtB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC9B,QAAQ,CAAC;AAEd,wEAAwE;AACxE,MAAM,WAAW,2BAA2B;IAC1C,2CAA2C;IAC3C,IAAI,EAAE,YAAY,CAAC;IACnB,oFAAoF;IACpF,MAAM,EAAE,WAAW,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,EACrB,OAAO,EAAE,2BAA2B,GACnC,IAAI,CAuEN;AA4bD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAOjD;AAkCD,+CAA+C;AAC/C,MAAM,WAAW,YAAY;IAC3B,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,YAAY,EAAE,CAkBrF;AA6LD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK5D;AAwBD,iEAAiE;AACjE,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,mEAAmE;IACnE,OAAO,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;OAOG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CACvB,IAAI,EAAE,YAAY,EAClB,QAAQ,GAAE,MAAyB,EACnC,GAAG,GAAE,IAAiB,GACrB,UAAU,CAqBZ;AAED;;;;;;;GAOG;AACH,wBAAgB,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,GAAE,MAAyB,GAAG,UAAU,CAkB3F;AAiFD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,YAAY,EACnB,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,MAAM,GACX,QAAQ,GAAG,SAAS,CAWtB;AAED,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAC1B,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,+EAA+E;IAC/E,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,SAAS,EAAE,OAAO,CAAC;IACnB,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B;;;OAGG;IACH,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B;AAED;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;aAAK,QAAQ,EAAE,YAAY;aAAE,SAAS,EAAE,YAAY;CAAW,CAAC;AAoD7F,2EAA2E;AAC3E,wBAAgB,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,SAAI,GAAG,MAAM,CAMvF"}

package/dist/admin/documents.js

@@ -11,6 +11,7 @@ import { DuplicatePermalinkError, isTrashedPath, TRASH_DIRECTORY } from '../cont
 import { calendarDayIn, DEFAULT_TIMEZONE, toUtcInstant, wallClockIn, zoneLabel, } from '../content/time.js';
 import { normalizeBody, serializeDocument } from '../content/writer.js';
 import { isPublicDocument } from '../web/documents.js';
+import { absoluteUrl } from '../web/negotiate.js';
 import { COMMENTS_FRONT_MATTER_KEY } from '../comments/policy.js';
 import { CONTACT_FRONT_MATTER_KEY } from '../contact/form.js';
 import { userForAuthor } from '../web/authors.js';
@@ -258,27 +259,17 @@ async function saveFromForm(c, options) {
     const finalSlug = document === undefined
         ? await freeSlug({ contentDir, store, type: kind.type, slug, date: filed })
         : slug;
-    // decision-13: a published post's permalink is its name in the fediverse as
-    // well as on the web, and the two are one promise. Moving it hands every
-    // follower a second object and breaks every link somebody already shared, so
-    // the editor refuses. A draft has promised nothing yet and may still move;
-    // a site that really means to move a published post can still do it in the
-    // file, knowing what it costs.
-    const promised = promisedDocument(kind, document, store.now());
-    if (promised !== undefined) {
-        if (finalSlug !== promised.slug) {
-            return refuse(`The permalink of a published post is permanent, and the slug names the file it is filed under: this ${kind.singular} keeps the slug ${promised.slug}.`);
-        }
-        // An empty field is not a request to move: it is a form that carried no
-        // permalink, and the promised one is what it keeps. Only a field naming
-        // some other URL is somebody asking for the one thing this refuses.
-        const submitted = normalizePermalink(form.permalink);
-        if (submitted !== undefined && submitted !== promised.permalink) {
-            return refuse(`The permalink of a published post is permanent: this ${kind.singular} stays at ${promised.permalink}.`);
-        }
-    }
-    const permalink = promised?.permalink ??
-        resolvePermalink({
+    // A URL somebody has been shown only moves when the author asks it to, by
+    // editing the slug or the permalink: correcting a date refiles the file and
+    // leaves the URL where it was. An empty permalink field is a form that
+    // carried none, not a request to move.
+    const promised = promisedDocument(document, store.now());
+    const submitted = normalizePermalink(form.permalink);
+    const asked = promised !== undefined &&
+        (finalSlug !== promised.slug || (submitted !== undefined && submitted !== promised.permalink));
+    const permalink = promised !== undefined && !asked
+        ? promised.permalink
+        : resolvePermalink({
             kind,
             form,
             slug: finalSlug,
@@ -301,13 +292,14 @@ async function saveFromForm(c, options) {
         ...(date === undefined ? {} : { date }),
         updated: store.now().toISOString(),
         permalink,
+        ...optional('redirectFrom', formerPermalinks(document, promised, permalink)),
         tags: kind.tagged ? splitTags(form.tags) : [],
         categories: kind.categorised ? splitTags(form.categories) : [],
         draft,
         ...(form.description === '' ? {} : { description: form.description }),
         ...optional('author', chosenAuthor(c, form.author, document)),
         ...optional('inReplyTo', replyTo(kind, form, document)),
-        ...optional('activitypub', document?.activitypub),
+        ...optional('activitypub', keptIdentity(document, promised, permalink, c.var.config.baseUrl)),
         extra: resolveExtra(kind, document, form),
         body: form.body,
     };
@@ -373,19 +365,54 @@ function documentPath(input) {
     return input.trashed ? `${TRASH_DIRECTORY}/${relative}` : relative;
 }
 /**
- * The document whose permalink has already been promised, or `undefined` when
+ * The document whose URL has already been promised, or `undefined` when
  * nothing has been promised yet.
  *
- * A published post, and only a published post. decision-13 makes its permalink
- * its ActivityStreams object id, so the URL is a name its followers, its
- * replies and its feed subscribers are all holding; a draft, a trashed post
- * and one whose date has not arrived have been shown to nobody, and a page
- * federates nothing at all.
+ * A published post or page is at a URL readers, search engines and other
+ * sites may hold, and a post that was ever announced is at one its followers
+ * hold even while it is a draft. A draft nobody was told about, a trashed
+ * document and one whose date has not arrived have been shown to nobody, and
+ * may move without leaving anything behind.
  */
-function promisedDocument(kind, document, now) {
-    if (document === undefined || kind.type !== 'post')
+function promisedDocument(document, now) {
+    if (document === undefined)
         return undefined;
-    return isPublicDocument(document, now) ? document : undefined;
+    const announced = document.activitypub?.published !== undefined;
+    return isPublicDocument(document, now) || announced ? document : undefined;
+}
+/**
+ * The URLs a document is saved as having lived at (TASK-127).
+ *
+ * Every entry names the document itself rather than the next hop, so a chain
+ * of renames collapses by construction: the URL it is leaving joins the ones
+ * it already left, and all of them redirect straight to where it is now. The
+ * URL it is arriving at leaves the list, because a document moved back to an
+ * old URL lives there again.
+ */
+function formerPermalinks(document, promised, permalink) {
+    const left = promised !== undefined && promised.permalink !== permalink ? [promised.permalink] : [];
+    const former = [...new Set([...(document?.redirectFrom ?? []), ...left])].filter((url) => url !== permalink);
+    return former.length === 0 ? undefined : former;
+}
+/**
+ * The `activitypub` block to write, which pins the object id when a promised
+ * post moves (decision-20).
+ *
+ * decision-13 makes a post's object id its permalink, and a fediverse server
+ * cannot rename an object it holds. So the URL the post is leaving is written
+ * as its stored id, and the stored-id path does the rest: a peer at the old
+ * URL still gets the `Article`, a browser there is sent on, and every `Update`
+ * names the id the followers already have. An id the file already stores
+ * stays, since it is already what they hold.
+ */
+function keptIdentity(document, promised, permalink, baseUrl) {
+    const block = document?.activitypub;
+    if (promised === undefined || promised.type !== 'post' || promised.permalink === permalink) {
+        return block;
+    }
+    if (block?.id !== undefined)
+        return block;
+    return { ...block, id: absoluteUrl(promised.permalink, baseUrl) };
 }
 /**
  * The permalink to write.