@geekity/cms 0.8.0 → 0.10.0

package/dist/privacy/erase.js

@@ -0,0 +1,76 @@
+import { commentSlugs, readComments, rewriteComments } from '../comments/records.js';
+import { deleteContactMessage, listContactMessages } from '../contact/records.js';
+import { hasOptedOut, removeCommentOptOut } from '../notifications/optouts.js';
+import { withRedacted } from './retention.js';
+/**
+ * Erasing one person's personal data when they ask (TASK-135).
+ *
+ * A person is found by the email they gave, because that is the one thing
+ * they can prove is theirs: a name is anybody's to type. Their comments stay
+ * where they are in the thread, with their status and their words, under the
+ * name {@link ERASED_NAME} and with nothing else of theirs left on them; a
+ * comment deleted outright would take every reply to it out of the thread,
+ * and the Comments screen is there for a comment whose words have to go too.
+ * Their contact messages are deleted, because a message is nothing but what
+ * they wrote and where to answer them, and the opt-out list forgets their
+ * address.
+ */
+/** What an erased comment is signed with. */
+export const ERASED_NAME = 'Anonymous';
+/** An address as it is compared: trimmed and folded, as the opt-out list keeps it. */
+function folded(email) {
+    return email.trim().toLowerCase();
+}
+/** Whether a comment was left under `email`. */
+function isTheirs(comment, email) {
+    return comment.author.email !== null && folded(comment.author.email) === email;
+}
+/** A comment with everything that says who wrote it taken off. */
+export function eraseCommentAuthor(comment) {
+    return {
+        ...comment,
+        author: { name: ERASED_NAME, url: null, email: null, avatar: null },
+        addressHash: null,
+        notify: false,
+        redacted: withRedacted(comment.redacted, [
+            'email',
+            ...(comment.addressHash === null ? [] : ['addressHash']),
+            'author',
+        ]),
+    };
+}
+/** What the site holds under `email`, without changing any of it. */
+export function findPersonalData(stores, email) {
+    const wanted = folded(email);
+    const comments = commentSlugs(stores.records.contentDir)
+        .flatMap((slug) => readComments(stores.records, slug))
+        .filter((comment) => isTheirs(comment, wanted)).length;
+    const messages = listContactMessages(stores.dataDir).filter((message) => folded(message.from.email) === wanted).length;
+    return { comments, messages, optedOut: hasOptedOut(stores.dataDir, wanted) };
+}
+/**
+ * Erase everything the site holds under `email`, and say what was erased.
+ *
+ * Both this and {@link findPersonalData} read the files rather than the index,
+ * so a comment written by hand since the last boot is counted and erased.
+ */
+export async function erasePersonalData(stores, email) {
+    const wanted = folded(email);
+    if (wanted === '')
+        return { comments: 0, messages: 0, optedOut: false };
+    let comments = 0;
+    for (const slug of commentSlugs(stores.records.contentDir)) {
+        const changed = await rewriteComments(stores.records, slug, (comment) => isTheirs(comment, wanted) ? eraseCommentAuthor(comment) : undefined);
+        comments += changed.length;
+    }
+    let messages = 0;
+    for (const message of listContactMessages(stores.dataDir)) {
+        if (folded(message.from.email) !== wanted)
+            continue;
+        if (await deleteContactMessage(stores.dataDir, message.id))
+            messages += 1;
+    }
+    const optedOut = await removeCommentOptOut(stores.dataDir, wanted);
+    return { comments, messages, optedOut };
+}
+//# sourceMappingURL=erase.js.map

package/dist/privacy/erase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"erase.js","sourceRoot":"","sources":["../../src/privacy/erase.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAErF,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAClF,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C;;;;;;;;;;;;GAYG;AAEH,6CAA6C;AAC7C,MAAM,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC;AAoBvC,sFAAsF;AACtF,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,gDAAgD;AAChD,SAAS,QAAQ,CAAC,OAAsB,EAAE,KAAa;IACrD,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC;AACjF,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,kBAAkB,CAAC,OAAsB;IACvD,OAAO;QACL,GAAG,OAAO;QACV,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;QACnE,WAAW,EAAE,IAAI;QACjB,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE;YACvC,OAAO;YACP,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,aAAa,CAAW,CAAC;YACnE,QAAQ;SACT,CAAC;KACH,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,gBAAgB,CAAC,MAA0B,EAAE,KAAa;IACxE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;SACrD,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;SACrD,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IACzD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CACzD,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,MAAM,CACnD,CAAC,MAAM,CAAC;IACT,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAA0B,EAC1B,KAAa;IAEb,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAExE,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CACpE,CAAC;QACF,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7B,CAAC;IAED,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,OAAO,IAAI,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,MAAM;YAAE,SAAS;QACpD,IAAI,MAAM,oBAAoB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;YAAE,QAAQ,IAAI,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACnE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAC1C,CAAC"}

package/dist/privacy/policy.d.ts

@@ -0,0 +1,32 @@
+/**
+ * How long this site keeps the personal data its readers hand it (TASK-135).
+ *
+ * Three periods, each in whole days counted from the moment the data arrived,
+ * and `0` for keeping it for as long as the site stands. They are settings in
+ * `content/_data/site.json` rather than config: how long a site keeps what
+ * people give it is the owner's decision, made on the Discussion screen, and a
+ * public file is the right place for a policy a privacy notice will quote.
+ */
+/** Days a commenter's email is kept: long enough for a reply to reach them. */
+export declare const RECOMMENDED_COMMENT_EMAIL_RETENTION_DAYS = 180;
+/** Days an address hash is kept: long enough to spot a run of spam. */
+export declare const RECOMMENDED_ADDRESS_HASH_RETENTION_DAYS = 30;
+/** Days a contact message is kept: a year of correspondence. */
+export declare const RECOMMENDED_CONTACT_MESSAGE_RETENTION_DAYS = 365;
+/** The three periods. Zero keeps that data forever. */
+export interface RetentionPolicy {
+    /** Days a comment keeps its author's email, and with it their reply subscription. */
+    readonly commentEmailDays: number;
+    /** Days a comment or a contact message keeps the hash of the address it came from. */
+    readonly addressHashDays: number;
+    /** Days a contact message is kept at all. */
+    readonly contactMessageDays: number;
+}
+/**
+ * Whether data that arrived at `at` has outlived a period of `days`.
+ *
+ * A date that will not parse has no age, so it is never past anything: a hand
+ * edit that lost a timestamp should not be what deletes somebody's message.
+ */
+export declare function outlived(at: string, days: number, now: Date): boolean;
+//# sourceMappingURL=policy.d.ts.map

package/dist/privacy/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/privacy/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AASH,+EAA+E;AAC/E,eAAO,MAAM,wCAAwC,MAAM,CAAC;AAE5D,uEAAuE;AACvE,eAAO,MAAM,uCAAuC,KAAK,CAAC;AAE1D,gEAAgE;AAChE,eAAO,MAAM,0CAA0C,MAAM,CAAC;AAE9D,uDAAuD;AACvD,MAAM,WAAW,eAAe;IAC9B,qFAAqF;IACrF,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,sFAAsF;IACtF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,6CAA6C;IAC7C,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAID;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAKrE"}

package/dist/privacy/policy.js

@@ -0,0 +1,37 @@
+/**
+ * How long this site keeps the personal data its readers hand it (TASK-135).
+ *
+ * Three periods, each in whole days counted from the moment the data arrived,
+ * and `0` for keeping it for as long as the site stands. They are settings in
+ * `content/_data/site.json` rather than config: how long a site keeps what
+ * people give it is the owner's decision, made on the Discussion screen, and a
+ * public file is the right place for a policy a privacy notice will quote.
+ */
+/*
+ * A site that never chose a period keeps everything: a `site.json` without the
+ * keys reads as `0`, so upgrading the package never deletes anything. The
+ * periods below are what `geekity init` writes for a new site and what the
+ * Discussion screen recommends to an existing one.
+ */
+/** Days a commenter's email is kept: long enough for a reply to reach them. */
+export const RECOMMENDED_COMMENT_EMAIL_RETENTION_DAYS = 180;
+/** Days an address hash is kept: long enough to spot a run of spam. */
+export const RECOMMENDED_ADDRESS_HASH_RETENTION_DAYS = 30;
+/** Days a contact message is kept: a year of correspondence. */
+export const RECOMMENDED_CONTACT_MESSAGE_RETENTION_DAYS = 365;
+const DAY_MS = 24 * 60 * 60 * 1000;
+/**
+ * Whether data that arrived at `at` has outlived a period of `days`.
+ *
+ * A date that will not parse has no age, so it is never past anything: a hand
+ * edit that lost a timestamp should not be what deletes somebody's message.
+ */
+export function outlived(at, days, now) {
+    if (days <= 0)
+        return false;
+    const arrived = Date.parse(at);
+    if (Number.isNaN(arrived))
+        return false;
+    return now.getTime() - arrived > days * DAY_MS;
+}
+//# sourceMappingURL=policy.js.map

package/dist/privacy/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/privacy/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;;GAKG;AAEH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,wCAAwC,GAAG,GAAG,CAAC;AAE5D,uEAAuE;AACvE,MAAM,CAAC,MAAM,uCAAuC,GAAG,EAAE,CAAC;AAE1D,gEAAgE;AAChE,MAAM,CAAC,MAAM,0CAA0C,GAAG,GAAG,CAAC;AAY9D,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,EAAU,EAAE,IAAY,EAAE,GAAS;IAC1D,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,GAAG,IAAI,GAAG,MAAM,CAAC;AACjD,CAAC"}

package/dist/privacy/retention.d.ts

@@ -0,0 +1,79 @@
+import type { AdminStore, CommentRecord, RedactedField } from '../admin/store.ts';
+import type { ResolvedConfig } from '../config.ts';
+import type { ContactMessage } from '../contact/records.ts';
+import type { NotificationTimers } from '../notifications/digest.ts';
+import type { RetentionPolicy } from './policy.ts';
+/**
+ * The retention sweep (TASK-135): what removes the personal data a site has
+ * kept for longer than it said it would.
+ *
+ * The files are the truth (decision-9), so the sweep reads them rather than
+ * the index: every comment file under `content/_data/comments/` and every
+ * message under `data/contact/`, each rewritten inside the lock every other
+ * writer of that file takes, and each comment it changes put back into the
+ * index in the same step. Removing a value that is already gone is not a
+ * change, so a sweep run twice, or run again after a crash halfway through,
+ * finishes in the same place and writes nothing the second time.
+ */
+/** How often the sweep runs once the site serves. */
+export declare const RETENTION_SWEEP_MS: number;
+/** What one sweep changed. */
+export interface RetentionReport {
+    /** Comments that lost an email, an address hash or both. */
+    readonly comments: number;
+    /** Contact messages deleted for being older than the site keeps them. */
+    readonly messagesDeleted: number;
+    /** Contact messages that lost their address hash. */
+    readonly messagesRedacted: number;
+}
+/**
+ * One comment as the policy leaves it, or `undefined` when it has nothing to
+ * give up. The email goes with the reply subscription it served, since there
+ * is nowhere left to send one; the thread, the status and the words stay.
+ */
+export declare function expireComment(comment: CommentRecord, policy: RetentionPolicy, now: Date): CommentRecord | undefined;
+/** What a contact message comes to under the policy. */
+export type ContactExpiry = {
+    readonly kind: 'keep';
+} | {
+    readonly kind: 'delete';
+} | {
+    readonly kind: 'redact';
+    readonly message: ContactMessage;
+};
+/**
+ * One contact message under the policy: kept as it is, deleted outright, or
+ * kept without the hash of the address it came from. A message is its
+ * sender's words and address together, so it has no smaller form to shrink
+ * to once its own period is up.
+ */
+export declare function expireContactMessage(message: ContactMessage, policy: RetentionPolicy, now: Date): ContactExpiry;
+/** `held` with `added` joined in, in {@link REDACTED_FIELDS} order. */
+export declare function withRedacted(held: readonly RedactedField[] | undefined, added: readonly RedactedField[]): RedactedField[];
+/** What {@link createRetentionService} needs. */
+export interface CreateRetentionServiceOptions {
+    /** The comment index the sweep keeps in step with the files. */
+    readonly admin: AdminStore;
+    /** Where the files are, and the clock the ages are measured by. */
+    readonly config: Pick<ResolvedConfig, 'contentDir' | 'dataDir' | 'now'>;
+    /** Defaults to the real interval timer. */
+    readonly timers?: NotificationTimers | undefined;
+    /** Defaults to `console`. */
+    readonly logger?: {
+        warn(message: string): void;
+    } | undefined;
+}
+/** The sweep, on a timer once the site serves. */
+export interface RetentionService {
+    /** Sweep now, queued behind any sweep already running, and say what changed. */
+    sweep(): Promise<RetentionReport>;
+    /** Sweep now and then every {@link RETENTION_SWEEP_MS}. Safe twice. */
+    start(): void;
+    /** Stop the timer. Safe before starting and safe twice. */
+    stop(): void;
+    /** Resolve once the sweep in flight has finished. */
+    settled(): Promise<void>;
+}
+/** Build the retention sweep for one site. */
+export declare function createRetentionService(options: CreateRetentionServiceOptions): RetentionService;
+//# sourceMappingURL=retention.d.ts.map

package/dist/privacy/retention.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retention.d.ts","sourceRoot":"","sources":["../../src/privacy/retention.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAIlF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAMnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAErE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD;;;;;;;;;;;GAWG;AAEH,qDAAqD;AACrD,eAAO,MAAM,kBAAkB,QAAqB,CAAC;AAErD,8BAA8B;AAC9B,MAAM,WAAW,eAAe;IAC9B,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,qDAAqD;IACrD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,eAAe,EACvB,GAAG,EAAE,IAAI,GACR,aAAa,GAAG,SAAS,CAiB3B;AAED,wDAAwD;AACxD,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC;AAElE;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,eAAe,EACvB,GAAG,EAAE,IAAI,GACR,aAAa,CAMf;AAED,uEAAuE;AACvE,wBAAgB,YAAY,CAC1B,IAAI,EAAE,SAAS,aAAa,EAAE,GAAG,SAAS,EAC1C,KAAK,EAAE,SAAS,aAAa,EAAE,GAC9B,aAAa,EAAE,CAGjB;AAED,iDAAiD;AACjD,MAAM,WAAW,6BAA6B;IAC5C,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,YAAY,GAAG,SAAS,GAAG,KAAK,CAAC,CAAC;IACxE,2CAA2C;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IACjD,6BAA6B;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,SAAS,CAAC;CAC/D;AAED,kDAAkD;AAClD,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,KAAK,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IAClC,uEAAuE;IACvE,KAAK,IAAI,IAAI,CAAC;IACd,2DAA2D;IAC3D,IAAI,IAAI,IAAI,CAAC;IACb,qDAAqD;IACrD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAID,8CAA8C;AAC9C,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,6BAA6B,GAAG,gBAAgB,CAsE/F"}

package/dist/privacy/retention.js

@@ -0,0 +1,133 @@
+import { REDACTED_FIELDS } from '../admin/store.js';
+import { readSiteSettings, retentionPolicyOf } from '../admin/settings.js';
+import { commentSlugs, rewriteComments } from '../comments/records.js';
+import { deleteContactMessage, listContactMessages, updateContactMessage, } from '../contact/records.js';
+import { systemNotificationTimers } from '../notifications/digest.js';
+import { outlived } from './policy.js';
+/**
+ * The retention sweep (TASK-135): what removes the personal data a site has
+ * kept for longer than it said it would.
+ *
+ * The files are the truth (decision-9), so the sweep reads them rather than
+ * the index: every comment file under `content/_data/comments/` and every
+ * message under `data/contact/`, each rewritten inside the lock every other
+ * writer of that file takes, and each comment it changes put back into the
+ * index in the same step. Removing a value that is already gone is not a
+ * change, so a sweep run twice, or run again after a crash halfway through,
+ * finishes in the same place and writes nothing the second time.
+ */
+/** How often the sweep runs once the site serves. */
+export const RETENTION_SWEEP_MS = 6 * 60 * 60 * 1000;
+/**
+ * One comment as the policy leaves it, or `undefined` when it has nothing to
+ * give up. The email goes with the reply subscription it served, since there
+ * is nowhere left to send one; the thread, the status and the words stay.
+ */
+export function expireComment(comment, policy, now) {
+    const email = comment.author.email !== null && outlived(comment.submitted, policy.commentEmailDays, now);
+    const address = comment.addressHash !== null && outlived(comment.submitted, policy.addressHashDays, now);
+    if (!email && !address)
+        return undefined;
+    return {
+        ...comment,
+        author: email ? { ...comment.author, email: null } : comment.author,
+        addressHash: address ? null : comment.addressHash,
+        notify: email ? false : comment.notify,
+        redacted: withRedacted(comment.redacted, [
+            ...(email ? ['email'] : []),
+            ...(address ? ['addressHash'] : []),
+        ]),
+    };
+}
+/**
+ * One contact message under the policy: kept as it is, deleted outright, or
+ * kept without the hash of the address it came from. A message is its
+ * sender's words and address together, so it has no smaller form to shrink
+ * to once its own period is up.
+ */
+export function expireContactMessage(message, policy, now) {
+    if (outlived(message.received, policy.contactMessageDays, now))
+        return { kind: 'delete' };
+    if (message.addressHash !== null && outlived(message.received, policy.addressHashDays, now)) {
+        return { kind: 'redact', message: { ...message, addressHash: null } };
+    }
+    return { kind: 'keep' };
+}
+/** `held` with `added` joined in, in {@link REDACTED_FIELDS} order. */
+export function withRedacted(held, added) {
+    const all = new Set([...(held ?? []), ...added]);
+    return REDACTED_FIELDS.filter((field) => all.has(field));
+}
+const NOTHING = { comments: 0, messagesDeleted: 0, messagesRedacted: 0 };
+/** Build the retention sweep for one site. */
+export function createRetentionService(options) {
+    const { admin, config } = options;
+    const timers = options.timers ?? systemNotificationTimers;
+    const logger = options.logger ?? console;
+    let sweeping = Promise.resolve();
+    let handle;
+    async function sweepOnce() {
+        // Read every time, so a period changed on the Discussion screen holds from
+        // the next sweep without a restart.
+        const policy = retentionPolicyOf(readSiteSettings(config.contentDir));
+        const now = config.now();
+        const records = { admin, contentDir: config.contentDir, dataDir: config.dataDir };
+        let comments = 0;
+        for (const slug of commentSlugs(config.contentDir)) {
+            const changed = await rewriteComments(records, slug, (comment) => expireComment(comment, policy, now));
+            comments += changed.length;
+        }
+        let messagesDeleted = 0;
+        let messagesRedacted = 0;
+        for (const listed of listContactMessages(config.dataDir)) {
+            const expiry = expireContactMessage(listed, policy, now);
+            if (expiry.kind === 'delete') {
+                if (await deleteContactMessage(config.dataDir, listed.id))
+                    messagesDeleted += 1;
+            }
+            else if (expiry.kind === 'redact') {
+                let redacted = false;
+                // Decided again on the message as the lock finds it, so a Mark read
+                // that landed since the listing is kept.
+                await updateContactMessage(config.dataDir, listed.id, (current) => {
+                    const again = expireContactMessage(current, policy, now);
+                    if (again.kind !== 'redact')
+                        return undefined;
+                    redacted = true;
+                    return again.message;
+                });
+                if (redacted)
+                    messagesRedacted += 1;
+            }
+        }
+        return { comments, messagesDeleted, messagesRedacted };
+    }
+    return {
+        sweep() {
+            const next = sweeping.then(sweepOnce).catch((thrown) => {
+                logger.warn(`The retention sweep failed: ${messageOf(thrown)}`);
+                return NOTHING;
+            });
+            sweeping = next;
+            return next;
+        },
+        start() {
+            if (handle !== undefined)
+                return;
+            void this.sweep();
+            handle = timers.set(() => void this.sweep(), RETENTION_SWEEP_MS);
+        },
+        stop() {
+            if (handle !== undefined)
+                timers.clear(handle);
+            handle = undefined;
+        },
+        async settled() {
+            await sweeping;
+        },
+    };
+}
+function messageOf(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=retention.js.map

package/dist/privacy/retention.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retention.js","sourceRoot":"","sources":["../../src/privacy/retention.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEvE,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGvC;;;;;;;;;;;GAWG;AAEH,qDAAqD;AACrD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAYrD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAsB,EACtB,MAAuB,EACvB,GAAS;IAET,MAAM,KAAK,GACT,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAC7F,MAAM,OAAO,GACX,OAAO,CAAC,WAAW,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;IAC3F,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAEzC,OAAO;QACL,GAAG,OAAO;QACV,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM;QACnE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW;QACjD,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM;QACtC,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE;YACvC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,OAAO,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,aAAa,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC;KACH,CAAC;AACJ,CAAC;AAQD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAuB,EACvB,MAAuB,EACvB,GAAS;IAET,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,kBAAkB,EAAE,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC1F,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,eAAe,EAAE,GAAG,CAAC,EAAE,CAAC;QAC5F,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,YAAY,CAC1B,IAA0C,EAC1C,KAA+B;IAE/B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;IACjD,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3D,CAAC;AA0BD,MAAM,OAAO,GAAoB,EAAE,QAAQ,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC;AAE1F,8CAA8C;AAC9C,MAAM,UAAU,sBAAsB,CAAC,OAAsC;IAC3E,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,wBAAwB,CAAC;IAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC;IACzC,IAAI,QAAQ,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IACnD,IAAI,MAAe,CAAC;IAEpB,KAAK,UAAU,SAAS;QACtB,2EAA2E;QAC3E,oCAAoC;QACpC,MAAM,MAAM,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAElF,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YACnD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAC/D,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CACpC,CAAC;YACF,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;QAC7B,CAAC;QAED,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,gBAAgB,GAAG,CAAC,CAAC;QACzB,KAAK,MAAM,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACzD,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YACzD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,IAAI,MAAM,oBAAoB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;oBAAE,eAAe,IAAI,CAAC,CAAC;YAClF,CAAC;iBAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACpC,IAAI,QAAQ,GAAG,KAAK,CAAC;gBACrB,oEAAoE;gBACpE,yCAAyC;gBACzC,MAAM,oBAAoB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE;oBAChE,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;oBACzD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;wBAAE,OAAO,SAAS,CAAC;oBAC9C,QAAQ,GAAG,IAAI,CAAC;oBAChB,OAAO,KAAK,CAAC,OAAO,CAAC;gBACvB,CAAC,CAAC,CAAC;gBACH,IAAI,QAAQ;oBAAE,gBAAgB,IAAI,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,gBAAgB,EAAE,CAAC;IACzD,CAAC;IAED,OAAO;QACL,KAAK;YACH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,MAAe,EAAE,EAAE;gBAC9D,MAAM,CAAC,IAAI,CAAC,+BAA+B,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAChE,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK;YACH,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO;YACjC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,EAAE,kBAAkB,CAAC,CAAC;QACnE,CAAC;QAED,IAAI;YACF,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC/C,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;QAED,KAAK,CAAC,OAAO;YACX,MAAM,QAAQ,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/web/admin-bar.d.ts

@@ -0,0 +1,21 @@
+import type { MiddlewareHandler } from 'hono';
+import type { GeekityEnv } from '../env.ts';
+/**
+ * The admin bar across the top of the public site, for a signed-in user
+ * (TASK-183).
+ *
+ * Where the public site's pages learn who is reading them. An anonymous request
+ * goes through untouched, so what everybody else is sent, headers and bytes, is what
+ * it was before the bar existed. For a signed-in one the account is put on the
+ * context for the handlers, and whatever HTML they answer with, a document, a
+ * listing, a search, the 404 or the 500, gets the bar straight after its
+ * `<body>` tag, the stylesheet that makes room for it in `<head>`, the
+ * `geekity-admin-bar` class on `<html>`, and the headers of a page drawn for
+ * one reader: private, no-store, and no validator. Anything that is not HTML, the JSON, the
+ * Markdown, the feeds, ActivityPub, is left exactly as it was.
+ *
+ * Not inside `/admin`, which has a bar of its own and a CSP that would refuse
+ * this one's inline stylesheet.
+ */
+export declare const publicAdminBar: MiddlewareHandler<GeekityEnv>;
+//# sourceMappingURL=admin-bar.d.ts.map

package/dist/web/admin-bar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-bar.d.ts","sourceRoot":"","sources":["../../src/web/admin-bar.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAYvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAU5C;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,cAAc,EAAE,iBAAiB,CAAC,UAAU,CAwBxD,CAAC"}

package/dist/web/admin-bar.js

@@ -0,0 +1,145 @@
+import { editorPath, newEditorPath, PAGE_KIND, POST_KIND } from '../admin/documents.js';
+import { LOGOUT_PATH } from '../admin/routes.js';
+import { ADMIN_PREFIX } from '../admin/session.js';
+import { ADMIN_TEMPLATES, createAdminTemplateEnvironment } from '../admin/templates.js';
+import { editUserPath } from '../admin/users.js';
+import { signedInAccount } from '../comments/viewer.js';
+import { PRIVATE_CACHE_CONTROL } from './negotiate.js';
+import { requestPath } from './routes.js';
+/** The editor screens each kind of document is written in. */
+const KINDS = { post: POST_KIND, page: PAGE_KIND };
+/** Built on the first signed-in page; the admin's own is closed over by its mount. */
+let environment;
+/**
+ * The admin bar across the top of the public site, for a signed-in user
+ * (TASK-183).
+ *
+ * Where the public site's pages learn who is reading them. An anonymous request
+ * goes through untouched, so what everybody else is sent, headers and bytes, is what
+ * it was before the bar existed. For a signed-in one the account is put on the
+ * context for the handlers, and whatever HTML they answer with, a document, a
+ * listing, a search, the 404 or the 500, gets the bar straight after its
+ * `<body>` tag, the stylesheet that makes room for it in `<head>`, the
+ * `geekity-admin-bar` class on `<html>`, and the headers of a page drawn for
+ * one reader: private, no-store, and no validator. Anything that is not HTML, the JSON, the
+ * Markdown, the feeds, ActivityPub, is left exactly as it was.
+ *
+ * Not inside `/admin`, which has a bar of its own and a CSP that would refuse
+ * this one's inline stylesheet.
+ */
+export const publicAdminBar = async (c, next) => {
+    const pathname = requestPath(c);
+    if (pathname === ADMIN_PREFIX || pathname.startsWith(`${ADMIN_PREFIX}/`))
+        return await next();
+    const account = signedInAccount(c);
+    if (account === undefined)
+        return await next();
+    c.set('signedIn', account);
+    await next();
+    if (!(c.res.headers.get('content-type') ?? '').startsWith('text/html'))
+        return;
+    const headers = new Headers(c.res.headers);
+    headers.set('cache-control', PRIVATE_CACHE_CONTROL);
+    headers.delete('etag');
+    headers.delete('last-modified');
+    headers.delete('content-length');
+    const { status } = c.res;
+    const body = withAdminBar(withoutSpeculationRules(await c.res.text()), renderBar(c, account));
+    // Cleared first, because assigning over a response copies its headers onto
+    // the new one, and the validators being dropped would come straight back.
+    c.res = undefined;
+    c.res = new Response(body, { status, headers });
+};
+/** The bar's markup for this reader and this page. */
+function renderBar(c, account) {
+    environment ??= createAdminTemplateEnvironment({ noCache: c.var.config.watch });
+    const { user } = account;
+    const shown = c.var.shownDocument;
+    return environment
+        .render(ADMIN_TEMPLATES.publicAdminBar, {
+        site: c.var.renderer.site(),
+        adminUrl: ADMIN_PREFIX,
+        barLinks: [
+            { label: '+ New', url: newEditorPath(POST_KIND) },
+            ...(shown === undefined
+                ? []
+                : [
+                    {
+                        label: `Edit ${capitalized(KINDS[shown.type].singular)}`,
+                        url: editorPath(KINDS[shown.type], shown.slug),
+                    },
+                ]),
+        ],
+        me: { name: user.profile?.displayName ?? user.username, url: editUserPath(user.id) },
+        logoutUrl: LOGOUT_PATH,
+        csrfToken: account.csrfToken,
+    })
+        .trim();
+}
+/**
+ * `html` with every `<script type="speculationrules">` taken out (TASK-140).
+ *
+ * A signed-in reader's pages are drawn for them alone and never stored, so a
+ * prefetch is a second render nobody may see, and a speculative request that
+ * carries a session is one the site would rather not be sent. Removed here
+ * rather than left to each theme, so a theme's rules stay one static block and
+ * the anonymous page keeps its bytes.
+ */
+function withoutSpeculationRules(html) {
+    return html.replace(/<script\b[^>]*\btype\s*=\s*(["']?)speculationrules\1[^>]*>[\s\S]*?<\/script\s*>/gi, '');
+}
+/** The class on `<html>` of a page that carries the bar, for a theme to key off. */
+const ROOT_CLASS = 'geekity-admin-bar';
+/**
+ * The room the bar takes at the top of the page, set from outside its shadow
+ * root because the bar is fixed and takes none by itself.
+ *
+ * `--geekity-admin-bar-height` is the bar's height, for a theme's own sticky
+ * or fixed header to sit under it. The script in the bar replaces it with the
+ * height it measures; until then, or without script, it is one 40px line, and
+ * two on a screen narrow enough for the bar to wrap.
+ *
+ * The page moves down by a margin on `<html>`, as it does under WordPress's
+ * bar: a theme's padding on `<html>` or `<body>` is left alone, `!important`
+ * outlasts a reset such as `html, body { margin: 0 }`, and the root's
+ * background still fills the canvas behind the bar. `scroll-padding-top` is
+ * under `:where()` so that a theme that sets its own, for a sticky header of
+ * its own, keeps it.
+ */
+const OFFSET_STYLE = `<style id="geekity-admin-bar-offset">
+:root { --geekity-admin-bar-height: 40px; }
+@media (max-width: 600px) { :root { --geekity-admin-bar-height: 80px; } }
+html { margin-top: var(--geekity-admin-bar-height) !important; }
+:where(html) { scroll-padding-top: var(--geekity-admin-bar-height); }
+</style>`;
+/**
+ * `html` with `bar` straight after its opening `<body>` tag, the offset
+ * stylesheet before `</head>`, and the root class on `<html>`; unchanged when
+ * it has no `<body>` tag to put the bar after.
+ */
+function withAdminBar(html, bar) {
+    const body = /<body\b[^>]*>/i.exec(html);
+    if (body === null)
+        return html;
+    const afterBody = body.index + body[0].length;
+    const head = /<\/head\s*>/i.exec(html.slice(0, body.index));
+    const withBar = head === null
+        ? `${html.slice(0, afterBody)}${OFFSET_STYLE}${bar}${html.slice(afterBody)}`
+        : `${html.slice(0, head.index)}${OFFSET_STYLE}${html.slice(head.index, afterBody)}${bar}${html.slice(afterBody)}`;
+    return withRootClass(withBar);
+}
+/** `html` with ROOT_CLASS added to its `<html>` tag's classes. */
+function withRootClass(html) {
+    const tag = /<html\b[^>]*>/i.exec(html);
+    if (tag === null)
+        return html;
+    const attribute = /(\sclass\s*=\s*)(?:"([^"]*)"|'([^']*)'|([^\s>]+))/i;
+    const classed = attribute.test(tag[0])
+        ? tag[0].replace(attribute, (_match, lead, double, single, bare) => `${lead}"${ROOT_CLASS} ${(double ?? single ?? bare ?? '').replaceAll('"', '&quot;')}"`)
+        : tag[0].replace(/^<html\b/i, `<html class="${ROOT_CLASS}"`);
+    return `${html.slice(0, tag.index)}${classed}${html.slice(tag.index + tag[0].length)}`;
+}
+function capitalized(word) {
+    return `${word.charAt(0).toUpperCase()}${word.slice(1)}`;
+}
+//# sourceMappingURL=admin-bar.js.map

package/dist/web/admin-bar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-bar.js","sourceRoot":"","sources":["../../src/web/admin-bar.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAExF,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAIxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,KAAK,GAAiD,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAEjG,sFAAsF;AACtF,IAAI,WAAoC,CAAC;AAEzC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAkC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IAC7E,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,YAAY,GAAG,CAAC;QAAE,OAAO,MAAM,IAAI,EAAE,CAAC;IAE9F,MAAM,OAAO,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,MAAM,IAAI,EAAE,CAAC;IAE/C,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC3B,MAAM,IAAI,EAAE,CAAC;IAEb,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO;IAE/E,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;IACpD,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvB,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAChC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAEjC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;IACzB,MAAM,IAAI,GAAG,YAAY,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9F,2EAA2E;IAC3E,0EAA0E;IAC1E,CAAC,CAAC,GAAG,GAAG,SAAS,CAAC;IAClB,CAAC,CAAC,GAAG,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AAClD,CAAC,CAAC;AAEF,sDAAsD;AACtD,SAAS,SAAS,CAAC,CAAsB,EAAE,OAAwB;IACjE,WAAW,KAAK,8BAA8B,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAChF,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IACzB,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;IAElC,OAAO,WAAW;SACf,MAAM,CAAC,eAAe,CAAC,cAAc,EAAE;QACtC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;QAC3B,QAAQ,EAAE,YAAY;QACtB,QAAQ,EAAE;YACR,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,CAAC,SAAS,CAAC,EAAE;YACjD,GAAG,CAAC,KAAK,KAAK,SAAS;gBACrB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE;wBACE,KAAK,EAAE,QAAQ,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE;wBACxD,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC;qBAC/C;iBACF,CAAC;SACP;QACD,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,IAAI,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QACpF,SAAS,EAAE,WAAW;QACtB,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;SACD,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,uBAAuB,CAAC,IAAY;IAC3C,OAAO,IAAI,CAAC,OAAO,CACjB,mFAAmF,EACnF,EAAE,CACH,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,GAAG,mBAAmB,CAAC;AAEvC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,YAAY,GAAG;;;;;SAKZ,CAAC;AAEV;;;;GAIG;AACH,SAAS,YAAY,CAAC,IAAY,EAAE,GAAW;IAC7C,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9C,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5D,MAAM,OAAO,GACX,IAAI,KAAK,IAAI;QACX,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,YAAY,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE;QAC5E,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;IACtH,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,kEAAkE;AAClE,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,SAAS,GAAG,oDAAoD,CAAC;IACvE,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CACZ,SAAS,EACT,CAAC,MAAM,EAAE,IAAY,EAAE,MAAe,EAAE,MAAe,EAAE,IAAa,EAAE,EAAE,CACxE,GAAG,IAAI,IAAI,UAAU,IAAI,CAAC,MAAM,IAAI,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CACzF;QACH,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,gBAAgB,UAAU,GAAG,CAAC,CAAC;IAC/D,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;AACzF,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC"}

package/dist/web/assets.d.ts

@@ -17,8 +17,15 @@ export declare const UPLOAD_ASSET_MAX_AGE = 86400;
 export declare function findUpload(relative: string, contentDir: string): StaticAsset | undefined;
 /** Directory inside a theme that holds the files served over HTTP. */
 export declare const THEME_STATIC_DIR = "static";
-/** How long a browser may keep a theme asset. One hour. */
+/** How long a browser may keep a theme asset at its unhashed URL. One hour. */
 export declare const THEME_ASSET_MAX_AGE = 3600;
+/**
+ * How long a browser may keep a file whose URL names its bytes. A year, the
+ * longest lifetime HTTP caches are asked to honour.
+ */
+export declare const IMMUTABLE_ASSET_MAX_AGE = 31536000;
+/** The query parameter a fingerprinted theme asset URL carries its hash in. */
+export declare const ASSET_VERSION_PARAM = "v";
 /** A file on disk, located and described, ready to be served. */
 export interface StaticAsset {
     /** Absolute path on disk. */
@@ -52,7 +59,28 @@ export declare function findThemeAsset(relative: string, themeDirs: readonly str
 export interface AssetResponseOptions {
     /** Seconds. Defaults to {@link THEME_ASSET_MAX_AGE}. */
     maxAge?: number | undefined;
+    /** Whether the bytes at this URL can never change, so a browser need not revalidate. */
+    immutable?: boolean | undefined;
 }
+/** The lifetime of a response whose URL names its bytes. */
+export declare const IMMUTABLE_ASSET: AssetResponseOptions;
+/**
+ * A short hash of an asset's bytes, the part of a fingerprinted URL that
+ * changes when the file does.
+ *
+ * Memoised per file on the size-and-mtime validator, so a page pays a `stat`
+ * rather than a read, and an edit in place is seen on the next render with no
+ * restart and no watcher.
+ */
+export declare function assetVersion(asset: StaticAsset): string;
+/**
+ * The URL a theme should link one of its files at: under
+ * {@link THEME_ASSET_PREFIX} with a hash of the bytes the search path resolves
+ * to, so it can be cached for a year and still change the moment the file
+ * does. A file no theme has gets its plain URL, which will 404 as it would
+ * have anyway.
+ */
+export declare function themeAssetUrl(relative: string, themeDirs: readonly string[]): string;
 /** The response body and headers for an asset. */
 export declare function assetResponse(asset: StaticAsset, options?: AssetResponseOptions): Response;
 /** The 304 an unchanged asset gets, which carries the validators and no body. */

package/dist/web/assets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../src/web/assets.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAIrC,yDAAyD;AACzD,eAAO,MAAM,kBAAkB,YAAY,CAAC;AAE5C;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAE/C,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,YAAY,CAAC;AAE1C,qFAAqF;AACrF,eAAO,MAAM,oBAAoB,QAAQ,CAAC;AAE1C,yDAAyD;AACzD,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAExF;AAED,sEAAsE;AACtE,eAAO,MAAM,gBAAgB,WAAW,CAAC;AAEzC,2DAA2D;AAC3D,eAAO,MAAM,mBAAmB,OAAO,CAAC;AAExC,iEAAiE;AACjE,MAAM,WAAW,WAAW;IAC1B,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,KAAK,EAAE,KAAK,CAAC;IACb,sCAAsC;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;CACd;AAED,0EAA0E;AAC1E,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC;AAErC;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,WAAW,GAAG,SAAS,CA6BpF;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,SAAS,MAAM,EAAE,GAC3B,UAAU,GAAG,SAAS,CAKxB;AAED,0EAA0E;AAC1E,MAAM,WAAW,oBAAoB;IACnC,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AAED,kDAAkD;AAClD,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,GAAE,oBAAyB,GAAG,QAAQ,CAG9F;AAED,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,GAAE,oBAAyB,GAAG,QAAQ,CAKjG;AAED,2DAA2D;AAC3D,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,QAAQ,CAE9D;AAED,8DAA8D;AAC9D,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,UAAU,GAAG,QAAQ,CAEjE;AAED,6DAA6D;AAC7D,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAOlF"}
+{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../src/web/assets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAIrC,yDAAyD;AACzD,eAAO,MAAM,kBAAkB,YAAY,CAAC;AAE5C;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAE/C,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,YAAY,CAAC;AAE1C,qFAAqF;AACrF,eAAO,MAAM,oBAAoB,QAAQ,CAAC;AAE1C,yDAAyD;AACzD,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAExF;AAED,sEAAsE;AACtE,eAAO,MAAM,gBAAgB,WAAW,CAAC;AAEzC,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,OAAO,CAAC;AAExC;;;GAGG;AACH,eAAO,MAAM,uBAAuB,WAAW,CAAC;AAEhD,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAEvC,iEAAiE;AACjE,MAAM,WAAW,WAAW;IAC1B,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,KAAK,EAAE,KAAK,CAAC;IACb,sCAAsC;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;CACd;AAED,0EAA0E;AAC1E,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC;AAErC;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,WAAW,GAAG,SAAS,CA6BpF;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,SAAS,MAAM,EAAE,GAC3B,UAAU,GAAG,SAAS,CAKxB;AAED,0EAA0E;AAC1E,MAAM,WAAW,oBAAoB;IACnC,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,wFAAwF;IACxF,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACjC;AAED,4DAA4D;AAC5D,eAAO,MAAM,eAAe,EAAE,oBAG7B,CAAC;AAIF;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAOvD;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAKpF;AAED,kDAAkD;AAClD,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,GAAE,oBAAyB,GAAG,QAAQ,CAG9F;AAED,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,GAAE,oBAAyB,GAAG,QAAQ,CAKjG;AAED,2DAA2D;AAC3D,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,QAAQ,CAE9D;AAED,8DAA8D;AAC9D,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,UAAU,GAAG,QAAQ,CAEjE;AAED,6DAA6D;AAC7D,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAOlF"}