@goodfellow-cms/admin 0.6.0 → 0.8.0

package/dist/{entry-values-BrY3L0Ai.js → entry-values-Bu8ljnoX.js}

@@ -1,200 +1,7 @@
-import { n as CONNECT_MESSAGE, r as createChannel } from "./plugin-protocol-DkvBDqsF.js";
-import { APP_API_HEADER, COLOR_SCHEME_ATTRIBUTE, ConflictError, DraftError, FOOTER_FILE, GOODFELLOW_REGISTRY, HEADER_FILE, MAX_UPLOAD_BYTES, MEDIA_DIR, MENUS_FILE, PluginTaskError, REDIRECTS_FILE, SHADCN_NAMESPACE, SHADCN_REGISTRY, SITE_FILE, ScheduledBuildsError, SignInError, TASK_INPUT_LIMIT, addressPatternFor, adminOrigin, allPages, checkEntrySlug, checkPageAddress, checkSite, codeFileChanges, collectionFileChange, collectionFileChange as collectionFileChange$1, customCssFileChange, deleteCollectionChanges, describedConfig, duplicatePageData, entryFileChange, entryFileChange as entryFileChange$1, entryLanguage, entryPathIn, entryTitle, escapeStyleText, extensionOf, fileName, goodfellowRegistryUrl, googleFontsUrl, isDemoStore, isStorableAddress, keptDrafts, layoutFileChange, loadSiteContent, markdownToHtml, mediaFileChange, mediaKind, mediaKind as mediaKind$1, mediaStorageFileChange, memoryKeeper, menusFileChange, moveEntryChanges, movePageChanges, newCollectionSettings, newDraftName, newPageData, newTaskRequestId, openTaskAnswer, outsideHost, pageFileChange, pageTitle as pageTitle$1, pluginFrameUrl, pluginMayList, pluginMayUse, publishProblems, redirectsFileChange, relinkSite, relinkedChanges, scheduleOf, scheduleProblem, scheduleState, siteLanguages, siteSettingsFileChange, slugify, storedCss, storedData, storedEntryFields, storedMediaUrl, taskKeys, themeToCss, todayIn, trimChars, uniqueName, upcomingChanges, updateSettingsFileChange, uploadName, wallClock, withStoredFiles, withoutCredits, writeChanges } from "@goodfellow-cms/core";
+import { B as siteSettingsFileChange, R as pageTitle$1, _ as mediaUsage, a as CONNECT_MESSAGE, c as MEDIA_URL_PREFIX, d as fileName$1, f as formatSize, g as mediaUrl, h as mediaPath, i as showMediaInPreview, l as allMedia, m as mediaKind$1, n as createMediaPreviews, o as createChannel, p as isStoredMedia, q as withoutCredits, r as mediaType, s as MAX_UPLOAD_BYTES, u as extensionOf, y as uploadName } from "./plugin-protocol-BgYL9WSm.js";
+import { APP_API_HEADER, COLOR_SCHEME_ATTRIBUTE, ConflictError, DraftError, FOOTER_FILE, GOODFELLOW_REGISTRY, HEADER_FILE, MEDIA_DIR, MENUS_FILE, PluginTaskError, REDIRECTS_FILE, SHADCN_NAMESPACE, SHADCN_REGISTRY, SITE_FILE, ScheduledBuildsError, SignInError, TASK_INPUT_LIMIT, adminOrigin, allPages, checkSite, describedConfig, entryTitle, escapeStyleText, fileName, goodfellowRegistryUrl, googleFontsUrl, isDemoStore, isStorableAddress, keptDrafts, limitsFor, loadSiteContent, mayChangeEntry, mayChangeLayout, mayChangeMedia, mayChangeMenus, mayChangePage, mediaStorageFileChange, memoryKeeper, newDraftName, newTaskRequestId, openTaskAnswer, outsideHost, outsideLimits, pluginFrameUrl, pluginMayList, pluginMayUse, publishProblems, reviewersFor, scheduleOf, scheduleProblem, scheduleState, siteLanguages, storedMediaUrl, taskKeys, themeToCss, todayIn, upcomingChanges, wallClock, withStoredFiles, writeChanges } from "@goodfellow-cms/core";
 import { createContext, useCallback, useContext, useEffect, useId, useLayoutEffect, useMemo, useRef, useState, useSyncExternalStore } from "react";
-import TurndownService from "turndown";
-import { gfm } from "turndown-plugin-gfm";
 import { Fragment as Fragment$1, jsx, jsxs } from "react/jsx-runtime";
-//#region src/markdown-text.ts
-let service;
-/** Converts the formatted editor's HTML to Markdown, in the style most Markdown is written in. */
-function htmlToMarkdown(html) {
-	if (!service) {
-		service = new TurndownService({
-			headingStyle: "atx",
-			bulletListMarker: "-",
-			codeBlockStyle: "fenced",
-			emDelimiter: "*",
-			strongDelimiter: "**",
-			hr: "---"
-		});
-		service.use(gfm);
-		service.addRule("underline", {
-			filter: ["u"],
-			replacement: (content) => content
-		});
-		service.addRule("strikethrough", {
-			filter: ["del", "s"],
-			replacement: (content) => `~~${content}~~`
-		});
-		service.addRule("listItem", {
-			filter: "li",
-			replacement(content, node) {
-				const parent = node.parentNode;
-				let marker = "- ";
-				if (parent?.nodeName === "OL") marker = `${Number(parent.getAttribute("start") ?? "1") + Array.prototype.indexOf.call(parent.children, node)}. `;
-				const indent = " ".repeat(marker.length);
-				const text = content.replace(/^\n+/, "").replace(/\n+$/, "").replace(/\n/g, `\n${indent}`);
-				return `${marker}${text}${node.nextSibling ? "\n" : ""}`;
-			}
-		});
-	}
-	return service.turndown(html).replace(/[ \t]+$/gm, "").trim();
-}
-/** The HTML the formatted editor starts from for some Markdown. */
-function formattedHtml(markdown) {
-	return markdownToHtml(markdown);
-}
-/**
-* The Markdown to save after the formatted editor changed `html`. If the text
-* is the same as `original`'s, only written differently (the formatted editor
-* tidies what it loads), `original` is kept, so the file isn't rewritten.
-*/
-function editedMarkdown(original, html) {
-	const edited = htmlToMarkdown(html);
-	return edited === htmlToMarkdown(formattedHtml(original)) ? original : edited;
-}
-//#endregion
-//#region src/changes.ts
-/**
-* The file changes the admin panel saves. Most are built by core's helpers,
-* which the Claude connector shares; converting a collection's items between
-* Markdown and formatted text needs the browser's HTML handling, so it's here.
-*/
-/**
-* A stored value as it fits its collection's field now, or `undefined` if it
-* doesn't: the field must exist, and a choice must still be offered. Tags
-* keep the ones that still are.
-*/
-function keptValue(fields, name, value) {
-	const field = fields.get(name);
-	if (!field) return void 0;
-	const offered = (choice) => field.options?.some((option) => option.value === choice) === true;
-	if (field.type === "select") return offered(value) ? value : void 0;
-	if (field.type === "tags" && Array.isArray(value)) {
-		const tags = value.filter(offered);
-		if (tags.length === value.length) return value;
-		return tags.length > 0 ? tags : void 0;
-	}
-	return value;
-}
-/** Where each item's page goes when its collection's address patterns change, in each of the site's languages. */
-function movedEntryPages(site, collection, settings) {
-	if (!collection.settings.path || !settings.path) return [];
-	return collection.entries.flatMap((entry) => {
-		const to = entryPathIn(site, settings, entry.slug, entryLanguage(site, entry));
-		return entry.path && to && to !== entry.path ? [{
-			from: entry.path,
-			to
-		}] : [];
-	});
-}
-/**
-* Saves a collection's new settings. Values of fields that were removed, and
-* choices that are no longer offered, are removed from every entry in the
-* same save, so a field added later with the same name starts empty. Given
-* the `site`, a new address pattern points every link to an item's page at
-* its new address, in the same save.
-*/
-function collectionSettingsChanges(collection, settings, site) {
-	const relinked = site ? relinkSite({
-		...site.content,
-		collections: site.content.collections.map((candidate) => candidate.id === collection.id ? {
-			...collection,
-			settings: {
-				...collection.settings,
-				template: settings.template
-			}
-		} : candidate)
-	}, movedEntryPages(site.content.settings, collection, settings), site.blocks) : void 0;
-	const current = relinked?.content.collections.find((candidate) => candidate.id === collection.id) ?? collection;
-	const relinkedFiles = new Set(relinked?.files);
-	const fields = new Map(settings.fields.map((field) => [field.name, field]));
-	const changes = [collectionFileChange(collection.id, {
-		...settings,
-		template: current.settings.template
-	})];
-	const before = collection.settings.markdown?.body;
-	const after = settings.markdown?.body;
-	const reformat = before !== after;
-	for (const entry of current.entries) {
-		const values = Object.entries(entry.content.fields);
-		const remaining = values.flatMap(([name, value]) => {
-			const kept = keptValue(fields, name, value);
-			return kept === void 0 ? [] : [[name, kept]];
-		});
-		if (!(remaining.length !== values.length || remaining.some(([name, value]) => value !== entry.content.fields[name])) && !reformat && !relinkedFiles.has(entry.file)) continue;
-		const kept = Object.fromEntries(remaining);
-		if (reformat) {
-			if (before !== void 0 && typeof kept[before] === "string") kept[before] = formattedHtml(kept[before]);
-			if (after !== void 0 && typeof kept[after] === "string") kept[after] = htmlToMarkdown(kept[after]);
-		}
-		const change = entryFileChange({
-			id: collection.id,
-			settings
-		}, entry.slug, kept, entry.content);
-		if (change.path !== entry.file) changes.push({
-			path: entry.file,
-			delete: true
-		});
-		changes.push(change);
-	}
-	if (relinked) changes.push(...relinkedChanges(relinked, [collection.file, ...collection.entries.map((entry) => entry.file)]));
-	return changes;
-}
-//#endregion
-//#region src/media.ts
-/** Files in `public/media/` are served from `/media/` on the site. */
-const MEDIA_URL_PREFIX = "/media/";
-/** `public/media/photo.jpg` → `/media/photo.jpg`. */
-function mediaUrl(path) {
-	return `${MEDIA_URL_PREFIX}${path.slice(MEDIA_DIR.length + 1)}`;
-}
-/** `/media/photo.jpg` → `public/media/photo.jpg`, or `undefined` for addresses outside the media folder. */
-function mediaPath(url) {
-	if (!url.startsWith("/media/")) return void 0;
-	const rest = url.slice(7).split(/[?#]/)[0] ?? "";
-	if (!rest || rest.split("/").some((part) => part === "" || part === "." || part === "..")) return void 0;
-	return `${MEDIA_DIR}/${decodeURIComponent(rest)}`;
-}
-/** A file size in words: `2.4 MB`. */
-function formatSize(bytes) {
-	if (bytes < 1024) return `${bytes} B`;
-	if (bytes < 1048576) return `${Math.round(bytes / 1024)} KB`;
-	return `${(bytes / 1048576).toFixed(1)} MB`;
-}
-/** Where a media file is used, by name, so editors know what deleting or replacing it affects. */
-function mediaUsage(content, url, names) {
-	const uses = (value) => JSON.stringify(value).includes(url);
-	const used = [];
-	if (uses(content.settings)) used.push(names.settings);
-	if (uses(content.header)) used.push(names.header);
-	if (uses(content.footer)) used.push(names.footer);
-	for (const page of content.pages) if (uses(page.content)) used.push(pageTitle$1(page));
-	for (const collection of content.collections) {
-		if (uses(collection.settings)) used.push(collection.settings.name);
-		for (const entry of collection.entries) if (uses(entry.content)) used.push(entryTitle(entry));
-	}
-	if (content.customCss.includes(url)) used.push(names.css);
-	return used;
-}
-/** The addresses of the site's uploaded images, such as `/media/photo.jpg`. */
-function siteImages(media) {
-	return media.filter((path) => mediaKind(path) === "image").map(mediaUrl);
-}
-/**
-* Every media file the site has, as `public/media/…` paths: those in the
-* site's own files and those a plugin keeps outside them
-* (`content/media-storage.json`), which content refers to the same way.
-*/
-function allMedia(content, media) {
-	const stored = Object.keys(content.mediaStorage?.files ?? {}).flatMap((url) => mediaPath(url) ?? []);
-	return [.../* @__PURE__ */ new Set([...media, ...stored])];
-}
-/** Whether a plugin keeps a media file outside the site's own files. */
-function isStoredMedia(content, url) {
-	return Object.hasOwn(content.mediaStorage?.files ?? {}, url);
-}
-//#endregion
 //#region src/site-code.ts
 /**
 * What the admin panel needs the site's own code for: the pages its blocks add
@@ -348,7 +155,8 @@ function languageName$1(content, code) {
 function describeProblem(t, content, problem) {
 	switch (problem.kind) {
 		case "missing-page":
-		case "missing-media": return t(`checks.${problem.kind}`, {
+		case "missing-media":
+		case "unsafe-link": return t(`checks.${problem.kind}`, {
 			place: problemPlace(t, content, problem.file),
 			target: problem.target
 		});
@@ -408,6 +216,7 @@ const defaultStrings = {
 	"nav.blocks": "Blocks",
 	"nav.layout": "Header & Footer",
 	"nav.settings": "Site Settings",
+	"nav.menu": "Menu",
 	loading: "Loading…",
 	"setup.noBackend": "This site's settings don't say where the site is stored, so the admin panel can't open it. A developer needs to add a backend to goodfellow.config.tsx.",
 	"signIn.title": "Sign in to edit this site",
@@ -493,13 +302,24 @@ const defaultStrings = {
 	"editor.failed": "The editor stopped working. Reload the page to start it again.",
 	"editor.frame": "Editing {title}",
 	"editor.choose": "Editor",
+	"editor.blockSearch": "Search blocks",
+	"editor.blockSearchNone": "No blocks match. Try another word, such as \"picture\" or \"columns\".",
+	"editor.blockSearchFound": "Blocks found",
 	"editor.standard": "Standard editor",
+	"editor.plugin.switchLoses": "Some of what you changed in {editor} can't be kept in the other editor, so switching now leaves behind everything you changed since you opened {editor}. Switch anyway?\n\n{problems}",
+	"editor.plugin.pageSettings": "The page's settings",
+	"editor.plugin.problem": "{block}: {message}",
+	"editor.plugin.problemField": "{block}, {field}: {message}",
+	"editor.plugin.loading": "Opening {editor}…",
 	"editor.plugin.failed": "{editor} didn't start. Choose the standard editor to keep editing.",
+	"editor.invalid": "The editor gave back something this site can't publish, so nothing was published. Reload the page and try again.",
 	"editor.plugin.invalid": "{editor} gave back something this site can't publish, so nothing was published. Try again, or choose the standard editor.",
 	"publish.publishing": "Publishing…",
 	"publish.done": "Published.",
 	"publish.conflict": "Someone else changed the site since you opened this page, so your changes weren't published. Reload to see their changes, then make yours again.",
 	"publish.error": "Your changes couldn't be published. Check your connection and try again.",
+	"publish.reloaded": "This is the page as the other person left it. Make your changes again, or put yours back to publish them over theirs.",
+	"publish.putMineBack": "Put my changes back",
 	"publish.invalid": "Fix the highlighted problems before publishing.",
 	"draft.label": "Draft",
 	"draft.add": "Add to draft",
@@ -522,6 +342,9 @@ const defaultStrings = {
 	"draft.leave": "Back to the live site",
 	"draft.waiting": "A draft started {date} is waiting to be published.",
 	"draft.waitingMany": "{count} drafts are waiting to be published.",
+	"draft.reviewWaiting": "A draft is waiting for review: {title}.",
+	"draft.reviewWaitingMany": "{count} drafts are waiting for review.",
+	"draft.inReview": "Submitted for review.",
 	"draft.choose": "Draft to open",
 	"draft.started": "Started {date}",
 	"draft.open": "Open",
@@ -541,8 +364,25 @@ const defaultStrings = {
 	"checks.alsoWarnings": "These could be better too:",
 	"checks.publishAnyway": "Publish anyway",
 	"checks.goBack": "Go back",
+	"limits.title": "Some of this is outside what you can change",
+	"limits.intro": "An owner has limited what you can change on this site, and these changes are outside it:",
+	"limits.review": "Submit them for review instead: the site's reviewers are asked to look, and can publish them for you.",
+	"limits.noReview": "Ask an owner to make these changes for you, or to let you make them on Site Settings' Editors screen.",
+	"limits.goBack": "Go back",
+	"limits.submitting": "Submitting for review…",
+	"limits.submitted": "Submitted for review. The live site stays as it is until a reviewer publishes it.",
+	"limits.submitError": "The changes couldn't be submitted for review. Check your connection and try again.",
+	"limits.page": "The page {name}",
+	"limits.entry": "{name}, in {collection}",
+	"limits.media": "The media library",
+	"limits.layout": "The header and footer",
+	"limits.menus": "The menus",
+	"limits.other": "The site's settings, or other things only owners change",
+	"limits.readOnly": "You can look at this, but an owner has limited what you can change, and it's outside it.",
+	"limits.mediaReadOnly": "An owner has limited what you can change, and the media library is outside it. You can still use its files on pages you can change.",
 	"checks.missing-page": "{place} links to {target}, which isn't a page on the site.",
 	"checks.missing-media": "{place} uses {target}, which isn't in the media library.",
+	"checks.unsafe-link": "{place} links to {target}, an address that would run code on the site. Pages leave it out: use an address that starts with https://, or one of the site's own pages.",
 	"checks.no-title": "{place} has no title, so browser tabs and search results show only the site's name.",
 	"checks.missing-translation": "{place} has no translation in {language} yet. Visitors reading in {language} are sent to its home page instead.",
 	"checks.outdated-translation": "{place} has changed since its translation in {language} was made. Update the translation, then mark it as up to date.",
@@ -572,6 +412,7 @@ const defaultStrings = {
 	"pages.empty": "This site has no pages yet.",
 	"pages.column.title": "Title",
 	"pages.column.address": "Address",
+	"pages.look": "Look",
 	"pages.edit": "Edit",
 	"pages.move": "Change address",
 	"pages.duplicate": "Duplicate",
@@ -633,7 +474,7 @@ const defaultStrings = {
 	"deletePage.submit": "Delete page",
 	"deletePage.message": "Delete page \"{title}\"",
 	"address.invalid": "Use lowercase letters, numbers and hyphens, with / between parts, such as /about-us.",
-	"address.reserved": "This address is used by the admin panel. Choose another.",
+	"address.reserved": "This address can't be used: the admin panel uses it, or it ends in /index, which is the page above it. Choose another.",
 	"address.taken": "Another page already uses this address.",
 	"field.required": "This can't be empty.",
 	"editPage.message": "Update page \"{title}\"",
@@ -711,7 +552,7 @@ const defaultStrings = {
 	"newEntry.addressHint": "The last part of the page's address, as in {example}.",
 	"newEntry.message": "Add {entry} \"{title}\"",
 	"entryName.invalid": "Use lowercase letters, numbers and hyphens only, such as easter-vigil.",
-	"entryName.reserved": "This address is used by the admin panel. Choose another.",
+	"entryName.reserved": "This address can't be used: the admin panel uses it, or it ends in /index, which is the page above it. Choose another.",
 	"entryName.taken": "Something else on the site already uses this address.",
 	"moveEntry.message": "Move {entry} \"{title}\" from {from} to {to}",
 	"deleteEntry.body": "{title} will be removed from {name}.",
@@ -842,6 +683,11 @@ const defaultStrings = {
 	"blocks.discard": "Discard changes",
 	"blocks.publish": "Publish",
 	"blocks.publishedNotice": "Published. Added blocks will be in the editor's list of blocks, and removed ones gone from it, once the site has been updated.",
+	"blocks.submit": "Submit for review",
+	"blocks.reviewHint": "Blocks' code runs on this site's server, which holds its secrets, so adding and removing blocks is submitted for review, for a developer to accept.",
+	"blocks.reviewDescription": "From the admin panel's Blocks screen. The blocks' code runs on the site's server.",
+	"blocks.submittedNotice": "Submitted for review. Once a developer accepts it and the site has been updated, the editor's list of blocks will change.",
+	"blocks.seeReview": "See it",
 	"blocks.addMessage": "Add the {name} block",
 	"blocks.removeMessage": "Remove the {name} block",
 	"blocks.changeMessage": "Change blocks: {changes}",
@@ -879,6 +725,7 @@ const defaultStrings = {
 	"media.uploaded": "Uploaded. Visitors see new files once the live site is updated.",
 	"media.uploadMessage": "Add {names}",
 	"media.replaceMessage": "Replace {name}",
+	"media.replaceKind": "{name} is a different kind of file from {target}. Replace it with a file of the same kind, or upload {name} as a new file.",
 	"media.deleteMessage": "Delete {name}",
 	"media.deleteTitle": "Delete {name}?",
 	"media.deleteBody": "{name} will be removed from the site.",
@@ -904,6 +751,57 @@ const defaultStrings = {
 	"table.removeColumn": "Remove this column",
 	"table.removeColumnNumber": "Remove column {column}",
 	"table.cell": "Row {row}, column {column}",
+	"style.align": "Text alignment",
+	"style.align.default": "As the block has it",
+	"style.align.left": "Left",
+	"style.align.center": "Centered",
+	"style.align.right": "Right",
+	"style.align.justify": "Justified",
+	"style.fontSize": "Text size",
+	"style.fontSize.xs": "Extra small",
+	"style.fontSize.sm": "Small",
+	"style.fontSize.base": "Normal",
+	"style.fontSize.lg": "Large",
+	"style.fontSize.xl": "Extra large",
+	"style.fontSize.2xl": "Very large",
+	"style.fontSize.3xl": "Huge",
+	"style.fontSize.4xl": "Very huge",
+	"style.fontSize.5xl": "Giant",
+	"style.fontSize.6xl": "Enormous",
+	"style.color": "Text color",
+	"style.background": "Background color",
+	"style.colorDefault": "As the block has it",
+	"style.colorCustom": "Choose a color",
+	"style.contrast": "This text may be hard to read on this background. Try colors further apart.",
+	"style.padding": "Space inside",
+	"style.margin": "Space around",
+	"style.eachSide": "Set each side",
+	"style.side.top": "Top",
+	"style.side.right": "Right",
+	"style.side.bottom": "Bottom",
+	"style.side.left": "Left",
+	"style.allSides": "All sides",
+	"style.none": "None",
+	"style.radius": "Rounded corners",
+	"style.hiddenOn": "Hide on",
+	"style.hiddenOn.phones": "Phones (narrower than 640px)",
+	"style.hiddenOn.tablets": "Tablets (640px to 1023px)",
+	"style.hiddenOn.computers": "Computers (1024px and wider)",
+	"style.hiddenOnHint": "Choose a preview width above the page to see it as each size of screen does. A block hidden there is still in the Outline, where you can choose it.",
+	"style.hiddenOnAll": "This block is hidden on every size of screen, so visitors never see it.",
+	"style.radius.none": "Square",
+	"style.radius.sm": "Slightly rounded",
+	"style.radius.md": "Rounded",
+	"style.radius.lg": "The theme's rounding",
+	"style.radius.xl": "Very rounded",
+	"style.radius.full": "Round",
+	"style.default": "As the block has it",
+	"style.custom": "Your own…",
+	"style.customLength": "Your own size, such as 12px or 1.5rem",
+	"style.customLengthInvalid": "Write a number with px, rem, em or %, such as 12px.",
+	"style.other": "Other CSS classes",
+	"style.otherHint": "Tailwind classes, or your own from Custom CSS, separated by spaces.",
+	"style.reset": "Back to the block's own look",
 	"media.credit": "Credit: {credit}",
 	"media.stored": "Kept by {plugin}",
 	"media.error.storageSize": "{name} is too large: {plugin} takes files up to {size}.",
@@ -995,10 +893,8 @@ const defaultStrings = {
 	"ai.error.answer": "The answer couldn't be used. Try again, or try a different model or service.",
 	"ai.error.service": "{service} reported a problem. Try again in a moment.",
 	"settings.title": "Site Settings",
-	"appearance.choice": "Colors of the admin panel",
-	"appearance.system": "Match my computer",
-	"appearance.light": "Light",
-	"appearance.dark": "Dark",
+	"appearance.darkMode": "Dark mode",
+	"adminLanguage.label": "Language of the admin panel",
 	"settings.tab.general": "General",
 	"settings.tab.languages": "Languages",
 	"settings.tab.theme": "Colors & fonts",
@@ -1014,6 +910,7 @@ const defaultStrings = {
 	"settings.previewEmpty": "Add a home page to see a preview here.",
 	"domain.intro": "Connect a domain you own, such as example.org, so the site is at that address.",
 	"domain.current": "The site is at {address} now.",
+	"domain.copy": "This admin panel is a copy of the site's, such as a staging site, at {address}. That address is set where the copy is built, so the domain this screen connects is the main site's.",
 	"domain.connected": "Connected to {domain}.",
 	"domain.signIn": "Editors sign in by going to {host} and coming back here. Add {address} to the redirect URIs of the application they sign in with on {host}, or signing in will stop working once the site moves.",
 	"domain.local": "Domains are connected in the published site's admin panel, where you sign in with GitHub, GitLab or Bitbucket.",
@@ -1113,6 +1010,7 @@ const defaultStrings = {
 	"security.contentOnly": "The sign-in page is set in the site's code, which is kept apart from its content, so a developer sets it there.",
 	"security.broker.title": "Sign-in page",
 	"security.broker.intro": "A sign-in page of its own, called a token broker, keeps editors' sign-in and AI keys at an address that holds nothing else, and shows the admin panel from there, so nothing on the site's pages can reach them. It asks the editor before publishing the site's code. It needs an address of its own, such as signin.example.org, that serves nothing else.",
+	"security.exposed": "Editors sign in at the site's own address, where its pages could reach their sign-in: code added on the Code tab, or by a block, could act as anyone signed in. A sign-in page of its own, below, keeps it out of their reach, and needs no domain on GitLab, Cloudflare Pages or Vercel. Where you have a domain and the host allows it, an admin address of its own, on the Domain screen, does too.",
 	"security.broker.useTitle": "Sign in at a sign-in page that's online",
 	"security.add.title": "Add a token broker",
 	"security.add.intro": "Makes a project on {host} for the sign-in page, from Goodfellow's released files and a file naming this site, and puts it online where you choose. It needs a token that can create projects, used only now and kept only until you leave this screen.",
@@ -1185,6 +1083,74 @@ const defaultStrings = {
 	"settings.tab.editors": "Editors",
 	"settings.tab.updates": "Updates",
 	"settings.tab.history": "Site history",
+	"settings.tab.comments": "Comments",
+	"comments.intro": "Visitors' comments are kept on GitHub, in a public project of their own, and shown on pages with the Comments block through Giscus. Visitors sign in with a GitHub account to comment.",
+	"comments.demo": "Comments can't be set up in the demo.",
+	"comments.local": "Comments are set up from the admin panel on the live site, which signs in to GitHub. Pages here show them once they are.",
+	"comments.unavailable": "The admin panel can set comments up only where it signs in to GitHub itself. Set them up on GitHub as the documentation's Comments page says, then paste Giscus's code into the Comments block.",
+	"comments.setup.title": "Set up comments",
+	"comments.setup.new": "Make a new project for comments",
+	"comments.setup.existing": "Use a project I already have",
+	"comments.setup.name": "Name of the new project",
+	"comments.setup.nameHint": "It's made beside the site's own on GitHub. Anyone can read it, since visitors read the comments from there.",
+	"comments.setup.existingName": "The project, as owner/name or its address on GitHub",
+	"comments.setup.existingHint": "It must be public. Its Discussions are turned on if they're off.",
+	"comments.setup.button": "Set up comments",
+	"comments.setup.working": "Setting up…",
+	"comments.setup.description": "Visitors' comments on {site}",
+	"comments.setup.message": "Set up comments",
+	"comments.install.title": "Last step: install Giscus",
+	"comments.install.intro": "Giscus is the GitHub app that shows comments on pages and posts what visitors write. Install it on {project}, choosing only that project.",
+	"comments.install.button": "Install Giscus",
+	"comments.install.then": "Then add the Comments block to a page, or to a collection's template. Pages show comments once the site has been rebuilt.",
+	"comments.place.title": "Where comments are kept",
+	"comments.place.kept": "Comments are kept as {category} discussions in",
+	"comments.place.install": "If pages don't show comments, check that Giscus is installed on the project:",
+	"comments.place.giscus": "Giscus on GitHub",
+	"comments.stop.button": "Stop using comments",
+	"comments.stop.title": "Stop using comments?",
+	"comments.stop.body": "Pages stop showing comments once the site has been rebuilt. Everything visitors wrote stays in {project} on GitHub, so you can set comments up with it again later.",
+	"comments.stop.message": "Stop using comments",
+	"comments.moderate.title": "What visitors have written",
+	"comments.moderate.empty": "No one has commented yet.",
+	"comments.moderate.more": "Show more pages",
+	"comments.moderate.block": "To stop someone commenting at all, block them on GitHub.",
+	"comments.moderate.blockLink": "How to block someone",
+	"comments.thread.count": "Comments: {count}",
+	"comments.thread.locked": "Closed to new comments",
+	"comments.thread.lock": "Close to new comments",
+	"comments.thread.unlock": "Open to new comments",
+	"comments.openOnGitHub": "Open on GitHub",
+	"comments.comment.hidden": "Hidden",
+	"comments.comment.hiddenAs": "Hidden as {reason}",
+	"comments.comment.hide": "Hide",
+	"comments.comment.show": "Show again",
+	"comments.comment.delete": "Delete",
+	"comments.hide.title": "Hide this comment?",
+	"comments.hide.body": "It stays on the page, folded away and marked with why it was hidden, until you show it again.",
+	"comments.hide.reason": "Why",
+	"comments.reason.spam": "spam",
+	"comments.reason.abuse": "abusive",
+	"comments.reason.off-topic": "off topic",
+	"comments.delete.title": "Delete this comment?",
+	"comments.delete.body": "It's removed for good.",
+	"comments.delete.bodyReplies": "It's removed for good, with the replies to it.",
+	"comments.token.title": "Use a GitHub token for comments",
+	"comments.token.intro": "The admin panel's sign-in can reach only the site's own project on GitHub. To set up and moderate comments, use a GitHub token of your own. It's kept only in this tab, until you sign out.",
+	"comments.token.create": "Create a token on GitHub",
+	"comments.token.scope": "It's filled in with what comments need: leave the choices as they are.",
+	"comments.token.paste": "Copy the token and paste it here:",
+	"comments.token.label": "GitHub token",
+	"comments.token.active": "This tab is using a GitHub token of your own for comments.",
+	"comments.error.no-access": "GitHub didn't let this sign-in do that. Use a GitHub token of your own, made by someone who can manage the project.",
+	"comments.error.not-found": "GitHub has no project with that name, or this sign-in can't see it.",
+	"comments.error.not-public": "That project is private, so visitors couldn't read its comments. Make it public on GitHub, then try again.",
+	"comments.error.name-taken": "There's already a project with that name. Choose another name, or use it as a project you already have.",
+	"comments.error.name-invalid": "A project's name can have only letters, numbers, hyphens, underscores and dots.",
+	"comments.error.no-discussions": "Discussions are off in that project, and this sign-in can't turn them on. Turn them on in the project's settings on GitHub, then try again.",
+	"comments.error.no-category": "That project's Discussions have no categories yet. Open its Discussions on GitHub once, then try again.",
+	"comments.error.other": "Something went wrong on GitHub. Try again in a moment.",
+	"comments.error.fix": "Open it on GitHub",
 	"settings.tab.import": "WordPress",
 	"settings.tab.themes": "Themes",
 	"plugins.notFound": "The site has no plugin screen at this address.",
@@ -1540,7 +1506,7 @@ const defaultStrings = {
 	"updates.error.save": "The change couldn't be saved. Try again in a moment.",
 	"updates.error.other": "Something went wrong. Try again in a moment.",
 	"editors.intro": "The people who can edit this site.",
-	"editors.roles": "Editors can change and publish everything in the admin panel. Owners can also invite and remove editors, and connect a domain.",
+	"editors.roles": "Editors can change and publish everything in the admin panel, unless their limits below say otherwise. Owners can also invite and remove editors, limit what they can change, and connect a domain.",
 	"editors.local": "Editors are invited in the published site's admin panel, where you sign in with GitHub, GitLab or Bitbucket.",
 	"editors.demo": "Editors can't be invited in a demo.",
 	"editors.loading": "Loading editors…",
@@ -1576,6 +1542,33 @@ const defaultStrings = {
 	"editors.error.invalid": "That isn't a username or email address that {host} accepts.",
 	"editors.error.already": "They already edit the site, or have been invited.",
 	"editors.error.other": "Something went wrong. Try again in a moment.",
+	"permissions.title": "Limits",
+	"permissions.intro": "Limit what someone can change: some pages, some collections, the media library, the header and footer, or the menus. Anyone not listed here can change everything their role allows. Changes outside someone's limits go to a reviewer, who publishes them or not.",
+	"permissions.where": "The admin panel keeps people to their limits, so nobody changes the wrong page by mistake. People who can publish to the site on {host} could still change other files there, so only a site with its own server holds everyone to them.",
+	"permissions.whereServer": "The site's server holds everyone to their limits, whatever they try.",
+	"permissions.host": "the site's host",
+	"permissions.person": "Their username",
+	"permissions.personHint": "The name they sign in with, as the list above shows it.",
+	"permissions.add": "Limit what they can change",
+	"permissions.change": "Change",
+	"permissions.remove": "Remove limits",
+	"permissions.nothing": "Nothing yet",
+	"permissions.allPages": "Every page",
+	"permissions.editTitle": "What {name} can change",
+	"permissions.editIntro": "Tick what they can change. They can look at everything else, and submit changes to it for review.",
+	"permissions.pages": "Pages",
+	"permissions.pagesHint": "Each with the pages under it, and their translations.",
+	"permissions.collections": "Collections' items",
+	"permissions.more": "Also",
+	"permissions.languages": "Languages",
+	"permissions.everyLanguage": "Every language",
+	"permissions.save": "Publish limits",
+	"permissions.message": "Change what {name} can change",
+	"permissions.removeMessage": "Let {name} change everything",
+	"permissions.reviewers": "Who reviews changes outside someone's limits",
+	"permissions.reviewersHint": "Usernames, separated by commas. Leave it empty for every owner.",
+	"permissions.saveReviewers": "Publish reviewers",
+	"permissions.reviewersMessage": "Change who reviews changes outside editors' limits",
 	"general.siteTitle": "Site name",
 	"general.description": "Description",
 	"general.descriptionHint": "Shown by search engines when a page doesn't have its own description.",
@@ -1628,6 +1621,25 @@ const defaultStrings = {
 	"forms.accessKeyLink": "Get an access key from Web3Forms",
 	"forms.captcha": "Ask visitors to show they aren't robots (hCaptcha)",
 	"forms.captchaHint": "Adds Web3Forms' hCaptcha and its script to pages with a form. To turn away answers without it, also turn hCaptcha on for the form in a Web3Forms account.",
+	"consent.title": "Visitors' consent",
+	"consent.ask": "Ask visitors before showing content from other sites",
+	"consent.hint": "Videos from YouTube and Vimeo, Google forms and maps, hCaptcha and the code under Code wait until visitors agree, with a notice at the bottom of the page that asks them. Their answer is kept in their browser. Links to #consent, such as in a menu, open the notice again.",
+	"consent.message": "What the notice says",
+	"consent.accept": "Button that agrees",
+	"consent.decline": "Button that doesn't",
+	"consent.held": "What's shown in a video's or form's place",
+	"consent.heldHint": "{site} is where it comes from, such as youtube-nocookie.com.",
+	"consent.show": "Button there that shows it",
+	"consent.policy": "Privacy page",
+	"consent.policyHint": "The page that says what the site and the sites it shows content from do, such as /privacy.",
+	"consent.policyLabel": "Words of the link to it",
+	"consent.choose": "Button that shows the choices",
+	"consent.save": "Button that keeps the choices",
+	"consent.kind.content": "Choice for content from other sites",
+	"consent.kind.statistics": "Choice for statistics",
+	"consent.kind.marketing": "Choice for advertising",
+	"consent.days": "Ask again after this many days",
+	"consent.daysHint": "Visitors' answers last this long, then the notice asks again. 180 days, about six months, is common; regulators in Europe accept up to 395, 13 months.",
 	"forms.formspree": "Formspree form address",
 	"forms.formspreeHint": "Make a form in Formspree and copy its address, such as https://formspree.io/f/xyzabcde. On Formspree's free plan, visitors see Formspree's own thank-you page.",
 	"forms.address": "Address forms send answers to",
@@ -1746,13 +1758,23 @@ const defaultStrings = {
 	"css.label": "Custom CSS",
 	"code.editorHint": "Tab indents, and suggestions appear as you type. Press Escape, then Tab, to leave the editor. Ctrl+F finds and replaces.",
 	"code.intro": "Code from services such as analytics or site verification, added to every page of the site. It never runs in the admin panel, so check it on the site once it's published. Paste only code you trust: it can change anything on the site.",
+	"code.exposed": "Editors sign in at the same address as the site's pages, so code here runs where it could act as anyone signed in to the admin panel, and publish changes as them.",
+	"code.exposedFix": "A sign-in page or an admin address of its own, on the Security tab, keeps their sign-in out of its reach.",
 	"code.head": "In the page head",
 	"code.headHint": "Script, style, link, meta and noscript tags, such as the ones Google Analytics gives you.",
+	"code.purpose.head": "What the code in the page head is for",
+	"code.purpose.body": "What the code at the end of the page is for",
+	"code.purposeHint": "Visitors choose which kinds to allow. Code needed for the site to work loads for everyone without asking, so choose it only for code that doesn't follow visitors.",
+	"code.purpose.needed": "Needed for the site to work: loads without asking",
+	"code.purpose.content": "Content from other sites, such as a chat widget",
+	"code.purpose.statistics": "Statistics, such as Google Analytics",
+	"code.purpose.marketing": "Advertising",
 	"code.body": "At the end of the page",
 	"code.bodyHint": "Any HTML, such as a chat widget, added just before the end of every page.",
 	"code.error.text": "The code in the page head has text outside a tag: \"{text}\". Only tags such as <script> and <meta> can go there.",
 	"code.error.tag": "A <{tag}> tag can't go in the page head. Put it in \"At the end of the page\" instead.",
-	"code.error.unclosed": "A {tag} tag in the page head isn't closed."
+	"code.error.unclosed": "A {tag} tag in the page head isn't closed.",
+	"code.error.template": "This code has </template> in it. While the site asks visitors before loading other sites' content, that would let the code run before they agree. Take it out."
 };
 const StringsContext = createContext(defaultStrings);
 function StringsProvider({ strings, children }) {
@@ -2014,6 +2036,16 @@ function draftStarted(name) {
 	});
 }
 //#endregion
+//#region src/editor-text.ts
+const EditorTextContext = createContext({
+	puck: {},
+	labels: {}
+});
+/** Puck's text and blocks' labels in the admin panel's language, which the page gives its frames. */
+function useEditorText() {
+	return useContext(EditorTextContext);
+}
+//#endregion
 //#region src/frame/protocol.ts
 /** A frame sends this to the admin panel's page once it's listening, and the page answers with a port. */
 const READY_MESSAGE = "goodfellow:frame-ready";
@@ -2235,140 +2267,131 @@ function SiteCodeFrame({ onClient }) {
 	});
 }
 //#endregion
-//#region src/media-previews.ts
-const TYPES = {
-	jpg: "image/jpeg",
-	jpeg: "image/jpeg",
-	png: "image/png",
-	gif: "image/gif",
-	webp: "image/webp",
-	avif: "image/avif",
-	svg: "image/svg+xml",
-	ico: "image/x-icon",
-	pdf: "application/pdf",
-	mp3: "audio/mpeg",
-	m4a: "audio/mp4",
-	mp4: "video/mp4",
-	webm: "video/webm",
-	vtt: "text/vtt"
-};
-/** The type to show a file as, from its name. Needed so browsers display SVGs from memory. */
-function mediaType(name) {
-	return TYPES[extensionOf(name)] ?? "application/octet-stream";
-}
-function createMediaPreviews(store, siteUrl, storage = () => void 0) {
-	const local = /* @__PURE__ */ new Map();
-	const remembered = /* @__PURE__ */ new Map();
-	const listeners = /* @__PURE__ */ new Set();
-	const loading = /* @__PURE__ */ new Map();
-	const base = trimChars(siteUrl, "/", { start: false });
-	const remember = (url, bytes) => {
-		const previous = local.get(url);
-		if (previous) URL.revokeObjectURL(previous);
-		remembered.set(url, bytes);
-		for (const listener of listeners) listener(url, bytes);
-		local.set(url, URL.createObjectURL(new Blob([new Uint8Array(bytes)], { type: mediaType(url) })));
-	};
-	return {
-		resolve(url) {
-			if (!url.startsWith("/media/")) return url;
-			const end = url.search(/[?#]/);
-			const stored = local.has(url) ? void 0 : storedMediaUrl(storage(), end < 0 ? url : url.slice(0, end));
-			return stored ? `${stored}${end < 0 ? "" : url.slice(end)}` : local.get(url) ?? `${base}${url}`;
-		},
-		remember,
-		onRemember(listener) {
-			for (const [url, bytes] of remembered) listener(url, bytes);
-			listeners.add(listener);
-			return () => listeners.delete(listener);
-		},
-		async bytes(url) {
-			const known = remembered.get(url);
-			if (known) return known;
-			const path = mediaPath(url);
-			return path ? await store.readBytes(path).catch(() => void 0) : void 0;
-		},
-		load(url) {
-			const known = local.get(url);
-			if (known) return Promise.resolve(known);
-			const path = mediaPath(url);
-			if (!path) return Promise.resolve(void 0);
-			let pending = loading.get(url);
-			if (!pending) {
-				pending = store.readBytes(path).then((bytes) => {
-					if (!bytes) return void 0;
-					remember(url, bytes);
-					return local.get(url);
-				}).catch(() => void 0);
-				loading.set(url, pending);
-			}
-			return pending;
+//#region src/limits-dialog.tsx
+/** What a change outside someone's limits touches, in words. Files that are none of those are named once, together. */
+function describeLimitProblems(t, content, problems) {
+	const described = /* @__PURE__ */ new Set();
+	const pages = allPages(content);
+	for (const problem of problems) if (problem.kind === "page") {
+		const title = (pages.find((found) => found.path === problem.address)?.content.data.root.props)?.title;
+		described.add(t("limits.page", { name: typeof title === "string" && title ? title : problem.address }));
+	} else if (problem.kind === "entry") {
+		const collection = content.collections.find((found) => found.id === problem.collection);
+		const title = (collection?.entries.find((found) => found.slug === problem.slug))?.content.fields.title;
+		described.add(t("limits.entry", {
+			name: typeof title === "string" && title ? title : problem.slug,
+			collection: collection?.settings.name ?? problem.collection
+		}));
+	} else described.add(t(`limits.${problem.kind}`));
+	return [...described];
+}
+/**
+* Changes outside what someone may change: listed, with what they can do
+* instead, submitting them for review where the site can take one.
+*/
+function LimitsDialog({ problems, content, onSubmit, onClose }) {
+	const t = useStrings();
+	const [state, setState] = useState({ type: "asking" });
+	const submit = async () => {
+		if (!onSubmit) return;
+		setState({ type: "submitting" });
+		try {
+			setState({
+				type: "submitted",
+				...await onSubmit()
+			});
+		} catch (error) {
+			setState({
+				type: "error",
+				error
+			});
 		}
 	};
+	return /* @__PURE__ */ jsxs(Dialog, {
+		title: t("limits.title"),
+		onClose,
+		children: [
+			/* @__PURE__ */ jsx("p", { children: t("limits.intro") }),
+			/* @__PURE__ */ jsx("ul", {
+				className: "gfa-check-list",
+				children: describeLimitProblems(t, content, problems).map((line) => /* @__PURE__ */ jsx("li", { children: line }, line))
+			}),
+			state.type === "submitted" ? /* @__PURE__ */ jsxs("p", {
+				role: "status",
+				children: [
+					t("limits.submitted"),
+					" ",
+					state.url && /* @__PURE__ */ jsx("a", {
+						href: state.url,
+						target: "_blank",
+						rel: "noreferrer",
+						children: t("draft.seeReview")
+					})
+				]
+			}) : /* @__PURE__ */ jsx("p", { children: t(onSubmit ? "limits.review" : "limits.noReview") }),
+			state.type === "error" && /* @__PURE__ */ jsx(ErrorMessage, {
+				message: t("limits.submitError"),
+				error: state.error
+			}),
+			/* @__PURE__ */ jsxs("div", {
+				className: "gfa-dialog-actions",
+				children: [/* @__PURE__ */ jsx(Button, {
+					onClick: onClose,
+					children: t(state.type === "submitted" ? "action.close" : "limits.goBack")
+				}), onSubmit && state.type !== "submitted" && /* @__PURE__ */ jsx(Button, {
+					variant: "primary",
+					disabled: state.type === "submitting",
+					onClick: () => void submit(),
+					children: t(state.type === "submitting" ? "limits.submitting" : "draft.submit")
+				})]
+			})
+		]
+	});
 }
-const URL_ATTRIBUTES = [
-	"src",
-	"href",
-	"poster"
-];
-const MEDIA_IN_STYLE = /url\((['"]?)(\/media\/[^'")]+)\1\)/g;
+//#endregion
+//#region src/limits.ts
 /**
-* Keeps media in a preview document showing: rewrites `/media/…` addresses in
-* images, links and inline styles as the preview changes, and if an image
-* still doesn't load, reads it from the repository instead.
+* What the signed-in person may change, for screens that show the rest
+* read-only. Publishing checks every change again (`outsideLimits()`), so
+* these only spare people changes they couldn't publish.
 */
-function showMediaInPreview(doc, previews) {
-	const fix = (element) => {
-		for (const attribute of URL_ATTRIBUTES) {
-			const value = element.getAttribute(attribute);
-			if (!value?.startsWith("/media/")) continue;
-			const resolved = previews.resolve(value);
-			if (resolved !== value) {
-				element.setAttribute(`data-gf-${attribute}`, value);
-				element.setAttribute(attribute, resolved);
-			}
-		}
-		const style = element.getAttribute("style");
-		if (style?.includes("/media/")) {
-			const resolved = style.replace(MEDIA_IN_STYLE, (_match, quote, url) => `url(${quote}${previews.resolve(url)}${quote})`);
-			if (resolved !== style) element.setAttribute("style", resolved);
+/** Whether someone with `limits` may change what's open. Collections' templates are their settings, which limits never cover. */
+function mayChange(content, limits, what) {
+	if (!limits) return true;
+	switch (what.kind) {
+		case "page": {
+			const page = content.pages.find((found) => found.path === what.path);
+			return mayChangePage(content, limits, page ?? { path: what.path });
 		}
-	};
-	const fixTree = (root) => {
-		fix(root);
-		for (const element of root.querySelectorAll("[src], [href], [poster], [style]")) fix(element);
-	};
-	const observer = new MutationObserver((records) => {
-		for (const record of records) {
-			if (record.type === "attributes" && record.target.nodeType === 1) fix(record.target);
-			for (const node of record.addedNodes) if (node.nodeType === 1) fixTree(node);
+		case "header":
+		case "footer": return mayChangeLayout(content, limits, what.language);
+		case "template": return false;
+		case "entry": {
+			const entry = content.collections.find((found) => found.id === what.collection)?.entries.find((found) => found.slug === what.entry);
+			return entry ? mayChangeEntry(content, limits, entry) : (limits.collections ?? []).includes(what.collection);
 		}
-	});
-	observer.observe(doc.documentElement, {
-		subtree: true,
-		childList: true,
-		attributes: true,
-		attributeFilter: [...URL_ATTRIBUTES, "style"]
-	});
-	fixTree(doc.documentElement);
-	const onError = (event) => {
-		const image = event.target;
-		if (image?.tagName !== "IMG") return;
-		const original = image.getAttribute("data-gf-src") ?? image.getAttribute("src") ?? "";
-		if (!original.startsWith("/media/") || image.hasAttribute("data-gf-loaded")) return;
-		image.setAttribute("data-gf-loaded", "");
-		previews.load(original).then((url) => {
-			if (url) {
-				image.setAttribute("data-gf-src", original);
-				image.setAttribute("src", url);
-			}
-		});
-	};
-	doc.addEventListener("error", onError, true);
-	return () => {
-		observer.disconnect();
-		doc.removeEventListener("error", onError, true);
-	};
+		case "media": return mayChangeMedia(limits);
+		case "menus": return mayChangeMenus(content, limits, what.language);
+	}
+}
+/** Whether the signed-in person may change what's open, once the site has loaded. */
+function useMayChange(what) {
+	const { state, limits } = useAdmin();
+	return state.status !== "ready" || mayChange(state.content, limits, what);
+}
+//#endregion
+//#region src/plugin-server.ts
+/**
+* The address a plugin's frame asks its server module at, or `undefined` where
+* `path` would leave the plugin's own addresses: `..` in any spelling (browsers
+* read `%2e%2e` as `..`), encoded slashes, backslashes, and other origins.
+*/
+function pluginServerAddress(base, id, path, relativeTo = location.href) {
+	if (/%2e|%2f|%5c|\\/i.test(path) || /^[a-z][a-z\d+.-]*:/i.test(path)) return void 0;
+	if ((path.split(/[?#]/, 1)[0]?.split("/") ?? []).some((segment) => segment === "." || segment === "..")) return void 0;
+	const prefix = new URL(`${base.replace(/\/+$/, "")}/${encodeURIComponent(id)}/`, relativeTo);
+	const url = new URL(path.replace(/^\/+/, ""), prefix);
+	return url.origin === prefix.origin && url.pathname.startsWith(prefix.pathname) ? url.href : void 0;
 }
 //#endregion
 //#region src/plugin-frames.tsx
@@ -2455,10 +2478,11 @@ function pluginHandlers(plugin, host, onResize, editor) {
 			const base = host().server;
 			if (!plugin.server || !base) throw new RefusedError(`${plugin.title} has no server here.`);
 			const path = params?.path;
-			if (typeof path !== "string" || path.includes("..") || /^[a-z]+:/i.test(path)) throw new RefusedError("That isn't one of the plugin's addresses.");
+			const address = typeof path === "string" ? pluginServerAddress(base, plugin.id, path) : void 0;
+			if (!address) throw new RefusedError("That isn't one of the plugin's addresses.");
 			const method = typeof params.method === "string" ? params.method.toUpperCase() : "GET";
 			const headers = Object.fromEntries(Object.entries(params.headers ?? {}).filter(([name, value]) => typeof value === "string" && /^(content-type|accept|x-goodfellow-plugin-[\w-]+)$/i.test(name)));
-			const response = await fetch(`${base.replace(/\/+$/, "")}/${encodeURIComponent(plugin.id)}/${path.replace(/^\/+/, "")}`, {
+			const response = await fetch(address, {
 				method,
 				headers: {
 					...headers,
@@ -2519,6 +2543,11 @@ function pluginHandlers(plugin, host, onResize, editor) {
 			return hooks.draw(block);
 		},
 		"editor.styles": () => editing("read the site's styles").styles(),
+		"media.bytes": async (url) => {
+			const hooks = editing("show media");
+			if (typeof url !== "string" || !url.startsWith("/media/") || url.includes("..")) return null;
+			return await hooks.mediaBytes(url) ?? null;
+		},
 		task: async (params) => {
 			const id = params?.id;
 			if (typeof id !== "string" || !plugin.tasks?.some((task) => task.id === id)) throw new RefusedError(`${plugin.title} has no task called ${String(id)}.`);
@@ -2559,10 +2588,13 @@ function usePluginFrame(plugin, host, mode, screen, editor) {
 		let current;
 		let connections = 0;
 		let stopped = false;
+		let stopRemembering;
 		const onMessage = (event) => {
 			const frame = element.current?.contentWindow;
 			if (!frame || event.source !== frame || event.data !== "goodfellow:plugin-ready") return;
 			current?.close();
+			stopRemembering?.();
+			stopRemembering = void 0;
 			setChannel(void 0);
 			connections += 1;
 			if (connections > MAX_CONNECTIONS) {
@@ -2584,6 +2616,8 @@ function usePluginFrame(plugin, host, mode, screen, editor) {
 				siteUrl: latest.current.siteUrl,
 				theme: latest.current.theme
 			};
+			const storage = mode === "editor" ? latestEditor.current?.mediaStorage() : void 0;
+			if (storage) init.mediaStorage = storage;
 			next.call("init", init).then((opened) => {
 				if (stopped || current !== next) return;
 				setChannel(next);
@@ -2593,6 +2627,12 @@ function usePluginFrame(plugin, host, mode, screen, editor) {
 						set: said.set === true,
 						undo: said.undo === true
 					}, next);
+					stopRemembering = latestEditor.current?.onRemember((url, bytes) => {
+						next.call("media.remember", {
+							url,
+							bytes
+						}).catch(() => {});
+					});
 				}
 			}, () => {
 				if (!stopped && current === next) setFailed(true);
@@ -2602,6 +2642,7 @@ function usePluginFrame(plugin, host, mode, screen, editor) {
 		return () => {
 			stopped = true;
 			window.removeEventListener("message", onMessage);
+			stopRemembering?.();
 			current?.close();
 		};
 	}, [
@@ -2838,28 +2879,147 @@ async function resized(file, extension) {
 	const blob = await canvasBlob(canvas, type);
 	return blob && (scale < 1 || blob.size < file.size) ? blob : void 0;
 }
-const UNSAFE_SVG_ELEMENTS = [
-	"script",
-	"foreignObject",
-	"iframe",
-	"embed",
-	"object",
-	"audio",
-	"video"
-];
+const SVG_NAMESPACE = "http://www.w3.org/2000/svg";
+/** Namespaces an SVG's attributes may be in, besides none. */
+const SVG_ATTRIBUTE_NAMESPACES = /* @__PURE__ */ new Set([
+	"http://www.w3.org/1999/xlink",
+	"http://www.w3.org/XML/1998/namespace",
+	"http://www.w3.org/2000/xmlns/"
+]);
+/** The SVG elements uploads keep: drawing, text, links, styles and animation, but nothing that loads a page or runs code. */
+const SVG_ELEMENTS = /* @__PURE__ */ new Set([
+	"svg",
+	"g",
+	"defs",
+	"symbol",
+	"use",
+	"title",
+	"desc",
+	"switch",
+	"view",
+	"path",
+	"rect",
+	"circle",
+	"ellipse",
+	"line",
+	"polyline",
+	"polygon",
+	"text",
+	"tspan",
+	"textPath",
+	"image",
+	"a",
+	"style",
+	"clipPath",
+	"mask",
+	"pattern",
+	"marker",
+	"linearGradient",
+	"radialGradient",
+	"stop",
+	"filter",
+	"feBlend",
+	"feColorMatrix",
+	"feComponentTransfer",
+	"feComposite",
+	"feConvolveMatrix",
+	"feDiffuseLighting",
+	"feDisplacementMap",
+	"feDistantLight",
+	"feDropShadow",
+	"feFlood",
+	"feFuncA",
+	"feFuncB",
+	"feFuncG",
+	"feFuncR",
+	"feGaussianBlur",
+	"feImage",
+	"feMerge",
+	"feMergeNode",
+	"feMorphology",
+	"feOffset",
+	"fePointLight",
+	"feSpecularLighting",
+	"feSpotLight",
+	"feTile",
+	"feTurbulence",
+	"animate",
+	"animateMotion",
+	"animateTransform",
+	"mpath"
+]);
+/** Addresses links and images may have: within the file, on the web, relative ones, and pictures. */
+const SAFE_SVG_ADDRESS = /^(#|https?:|data:image\/(png|jpeg|gif|webp)[;,]|(?![a-z][a-z\d+.-]*:))/;
+/**
+* Addresses an SVG loads as it draws (images, filters' images, `use` and CSS's
+* `url()`): within the file, the site's own, and pictures in the file, so an
+* SVG opened on its own never asks another site for anything.
+*/
+const LOADED_SVG_ADDRESS = /^(#|data:image\/(png|jpeg|gif|webp)[;,]|(?![a-z][a-z\d+.-]*:)(?!\/\/))/;
 /**
-* Removes anything from an SVG that could run code if someone opens the
-* file directly: scripts, embedded pages, event handlers, and javascript:, vbscript:
-* and data: links other than images.
+* CSS with what would load from another site taken out: `@import`, and
+* `url()`s other than the file's own and the site's. Escapes could spell
+* either some other way, so CSS with any is left out whole (`undefined`).
+*/
+function cssWithoutOutsideAddresses(css) {
+	if (css.includes("\\")) return void 0;
+	return css.replace(/@import[^;]*;?/gi, "").replace(/url\(\s*(['"]?)(.*?)\1\s*\)/gi, (whole, _quote, address) => LOADED_SVG_ADDRESS.test(normalized(address)) ? whole : "none");
+}
+/** An attribute's value as a browser reads an address: without the spaces and control characters it skips. */
+function normalized(value) {
+	return value.replace(/[\s\p{Cc}]/gu, "").toLowerCase();
+}
+function isLink(name) {
+	return name === "href" || name === "xlink:href";
+}
+/** Whether an element can stay, once its attributes are cleaned. */
+function keepsElement(element) {
+	if (element.namespaceURI !== SVG_NAMESPACE || !SVG_ELEMENTS.has(element.localName)) return false;
+	if (element.localName.startsWith("animate")) {
+		const name = normalized(element.getAttribute("attributeName") ?? "");
+		if (isLink(name) || name.startsWith("on")) return false;
+	}
+	return true;
+}
+function cleanElement(element) {
+	const loads = element.localName !== "a";
+	for (const attribute of [...element.attributes]) {
+		const value = normalized(attribute.value);
+		if (attribute.value.includes("url(") || attribute.localName === "style" && attribute.value.includes("\\")) {
+			const css = cssWithoutOutsideAddresses(attribute.value);
+			if (css === void 0) {
+				element.removeAttributeNode(attribute);
+				continue;
+			}
+			attribute.value = css;
+		}
+		if (attribute.namespaceURI !== null && !SVG_ATTRIBUTE_NAMESPACES.has(attribute.namespaceURI) || attribute.name.includes(":") && !/^(xlink|xml|xmlns):/.test(attribute.name) || attribute.localName.toLowerCase().startsWith("on") || value.includes("javascript:") || value.includes("vbscript:") || isLink(attribute.name.toLowerCase()) && !(loads ? LOADED_SVG_ADDRESS : SAFE_SVG_ADDRESS).test(value)) element.removeAttributeNode(attribute);
+	}
+	for (const child of [...element.childNodes]) if (child.nodeType === Node.ELEMENT_NODE) {
+		if (keepsElement(child)) cleanElement(child);
+		else child.remove();
+	} else if (child.nodeType !== Node.TEXT_NODE && child.nodeType !== Node.CDATA_SECTION_NODE) child.remove();
+	if (element.localName === "style") {
+		const css = cssWithoutOutsideAddresses(element.textContent ?? "");
+		if (css === void 0) element.remove();
+		else if (css !== element.textContent) element.textContent = css;
+	}
+}
+/**
+* Keeps only what an SVG needs to draw itself, so it can't run code if someone
+* opens the file directly: SVG's own drawing elements, with no scripts,
+* embedded pages, elements from other namespaces, event handlers, processing
+* instructions (an XSL stylesheet could write a page), or javascript:, vbscript:
+* and other addresses than the web's, the file's own and pictures. What it
+* loads as it draws comes only from the file itself or the site, so opening it
+* tells no one else.
 */
 function cleanSvg(text) {
 	const doc = new DOMParser().parseFromString(text, "image/svg+xml");
-	if (doc.querySelector("parsererror") || doc.documentElement.nodeName.toLowerCase() !== "svg") return void 0;
-	for (const name of UNSAFE_SVG_ELEMENTS) for (const element of [...doc.getElementsByTagName(name)]) element.remove();
-	for (const element of [doc.documentElement, ...doc.documentElement.querySelectorAll("*")]) for (const attribute of [...element.attributes]) {
-		const value = attribute.value.trim().toLowerCase();
-		if (attribute.name.toLowerCase().startsWith("on") || value.startsWith("javascript:") || value.startsWith("vbscript:") || value.startsWith("data:") && !value.startsWith("data:image/")) element.removeAttribute(attribute.name);
-	}
+	const root = doc.documentElement;
+	if (doc.querySelector("parsererror") || root.namespaceURI !== SVG_NAMESPACE || root.localName !== "svg") return;
+	for (const child of [...doc.childNodes]) if (child !== root) child.remove();
+	cleanElement(root);
 	return new XMLSerializer().serializeToString(doc);
 }
 /** A file checked and made ready, as a `Blob`: photos made web-sized, SVGs made safe, other files as they are. */
@@ -2913,6 +3073,29 @@ async function prepareStoredUpload(file, maxBytes) {
 		...await imageSize(blob, file.name)
 	};
 }
+/**
+* Changes as they're published: a file into the media library must be a kind
+* the site can use by the name it's saved under, whatever it was chosen as,
+* and an SVG keeps only what draws it (`cleanSvg()`), however it got there,
+* from an upload, a replaced file or a plugin. Throws `UploadError` for a file
+* that can't be saved there.
+*/
+function safeMediaChanges(changes) {
+	return changes.map((change) => {
+		if (!change.path.startsWith(`${MEDIA_DIR}/`) || "delete" in change) return change;
+		const name = fileName(change.path);
+		if (!mediaKind$1(name)) throw new UploadError("type", name, `${name} isn't a kind of file the site can use.`);
+		if (extensionOf(name) !== "svg") return change;
+		const text = "bytes" in change ? new TextDecoder().decode(change.bytes) : change.content;
+		const cleaned = cleanSvg(text);
+		if (cleaned === void 0) throw new UploadError("unreadable", name, `${name} isn't a valid SVG image.`);
+		if (cleaned === new XMLSerializer().serializeToString(new DOMParser().parseFromString(text, "image/svg+xml"))) return change;
+		return {
+			path: change.path,
+			bytes: new TextEncoder().encode(cleaned)
+		};
+	});
+}
 //#endregion
 //#region src/router.tsx
 function parseHash(hash) {
@@ -2961,8 +3144,13 @@ function navigate(to, confirmLeave) {
 /** Sections of Site Settings' General tab that links can scroll to, as `#/settings/general?section=forms`. */
 const SETTINGS_SECTIONS = {
 	contact: "contact",
-	forms: "forms"
+	forms: "forms",
+	consent: "consent"
 };
+/** The id of a General tab section's heading, which links scroll to. */
+function sectionId(section) {
+	return `gfa-settings-${section}`;
+}
 function pageEditorHref(path) {
 	return `#/pages/edit?path=${encodeURIComponent(path)}`;
 }
@@ -3129,7 +3317,7 @@ function useUploadMedia() {
 		if (problem) return problem;
 		const { plugin } = client;
 		const maxBytes = plugin.mediaStorage?.maxBytes ?? MAX_UPLOAD_BYTES;
-		const taken = allMedia(content, media).map(fileName);
+		const taken = allMedia(content, media).map(fileName$1);
 		const added = {};
 		const batch = [];
 		for (const file of files) {
@@ -3151,7 +3339,7 @@ function useUploadMedia() {
 				};
 			}
 			const url = replace ? mediaUrl(replace) : `${MEDIA_URL_PREFIX}${uploadName(file.name, taken)}`;
-			taken.push(fileName(url));
+			taken.push(fileName$1(url));
 			batch.push({
 				address: url,
 				type: ready.type,
@@ -3163,7 +3351,7 @@ function useUploadMedia() {
 		try {
 			await client.upload(batch);
 		} catch (error) {
-			const name = batch.map((file) => fileName(file.address)).join(", ");
+			const name = batch.map((file) => fileName$1(file.address)).join(", ");
 			return {
 				ok: false,
 				message: t("media.storage.failed", {
@@ -3181,12 +3369,20 @@ function useUploadMedia() {
 		});
 		const credits = replace ? withoutCredits(content.credits, [mediaUrl(replace)]) : void 0;
 		if (credits) changes.push(credits);
-		const names = urls.map(fileName).join(", ");
+		const names = urls.map(fileName$1).join(", ");
 		return published(changes, replace ? t("media.replaceMessage", { name: names }) : t("media.uploadMessage", { names }), urls);
 	};
 	return async (files, replace) => {
+		const different = replace && files.find((file) => sameExtension(file.name) !== sameExtension(replace));
+		if (replace && different) return {
+			ok: false,
+			message: t("media.replaceKind", {
+				name: different.name,
+				target: fileName$1(replace)
+			})
+		};
 		if (storage && client && (!replace || isStorableAddress(mediaUrl(replace)))) return toStorage(files, replace);
-		const taken = allMedia(content, media).map(fileName);
+		const taken = allMedia(content, media).map(fileName$1);
 		const changes = [];
 		const uploads = [];
 		for (const file of files) {
@@ -3200,7 +3396,7 @@ function useUploadMedia() {
 				};
 			}
 			const path = replace ?? `${MEDIA_DIR}/${uploadName(file.name, taken)}`;
-			taken.push(fileName(path));
+			taken.push(fileName$1(path));
 			changes.push({
 				path,
 				bytes: prepared.bytes
@@ -3211,7 +3407,7 @@ function useUploadMedia() {
 			});
 		}
 		for (const upload of uploads) mediaPreviews.remember(upload.url, upload.bytes);
-		const names = changes.map((change) => fileName(change.path)).join(", ");
+		const names = changes.map((change) => fileName$1(change.path)).join(", ");
 		const credits = replace ? withoutCredits(content.credits, [mediaUrl(replace)]) : void 0;
 		const unstored = replace && storage && isStoredMedia(content, mediaUrl(replace)) ? mediaStorageFileChange(withStoredFiles(storage, {}, [mediaUrl(replace)])) : void 0;
 		return published([
@@ -3227,7 +3423,7 @@ function DeleteMediaDialog({ url, onClose }) {
 	const { content } = useSiteContent();
 	const [busy, setBusy] = useState(false);
 	const [failure, setFailure] = useState(null);
-	const name = fileName(url);
+	const name = fileName$1(url);
 	const used = mediaUsage(content, url, {
 		header: t("layout.header"),
 		footer: t("layout.footer"),
@@ -3397,7 +3593,7 @@ function MoveToStorageDialog({ client, paths, onClose }) {
 				if (batch.length > 0) await client.upload(batch);
 				Object.assign(added, sizes);
 			} catch (error) {
-				const name = batch.map((file) => fileName(file.address)).join(", ");
+				const name = batch.map((file) => fileName$1(file.address)).join(", ");
 				failed = {
 					ok: false,
 					message: t("media.storage.failed", {
@@ -3492,7 +3688,7 @@ function MoveBackDialog({ plugin, onClose }) {
 	const [problem, setProblem] = useState();
 	const [failure, setFailure] = useState(null);
 	const files = Object.entries(storage?.files ?? {});
-	const large = files.filter(([, file]) => file.size > MAX_UPLOAD_BYTES).map(([url]) => fileName(url));
+	const large = files.filter(([, file]) => file.size > MAX_UPLOAD_BYTES).map(([url]) => fileName$1(url));
 	const moveBack = async () => {
 		if (!storage) return;
 		setBusy(true);
@@ -3516,7 +3712,7 @@ function MoveBackDialog({ plugin, onClose }) {
 				setBusy(false);
 				return setProblem({
 					message: t("media.back.failed", {
-						name: fileName(url),
+						name: fileName$1(url),
 						plugin
 					}),
 					error
@@ -3619,6 +3815,15 @@ function StorageSection({ onDone }) {
 		]
 	});
 }
+/** A file's extension as names are saved: lowercase, with `.jpeg` as `.jpg`. */
+function sameExtension(name) {
+	return extensionOf(name).replace(/^jpeg$/, "jpg");
+}
+/** What the file chooser offers when replacing a file: files of its kind. */
+function replacementAccept(url) {
+	const extension = sameExtension(url);
+	return extension === "jpg" ? ".jpg,.jpeg" : `.${extension}`;
+}
 /** Every uploaded image and file, with buttons to upload, replace and delete them. */
 /** Cloudflare's terms for its CDN, which limit serving video on its free plans. */
 const CLOUDFLARE_TERMS = "https://www.cloudflare.com/service-specific-terms-application-services/";
@@ -3632,6 +3837,7 @@ function MediaScreen() {
 	const [copied, setCopied] = useState(null);
 	const [moved, setMoved] = useState();
 	const searchId = useId();
+	const mayChange = useMayChange({ kind: "media" });
 	useEffect(() => {
 		const stop = (event) => {
 			if (event.dataTransfer?.types.includes("Files")) event.preventDefault();
@@ -3644,13 +3850,13 @@ function MediaScreen() {
 		};
 	}, []);
 	const cloudflareVideos = useOutsideHost() === "cloudflare-pages" && media.some((path) => mediaKind$1(mediaUrl(path)) === "video");
-	const urls = useMemo(() => media.map(mediaUrl).filter((url) => fileName(url).toLowerCase().includes(query.trim().toLowerCase())).sort((a, b) => fileName(a).localeCompare(fileName(b))), [media, query]);
+	const urls = useMemo(() => media.map(mediaUrl).filter((url) => fileName$1(url).toLowerCase().includes(query.trim().toLowerCase())).sort((a, b) => fileName$1(a).localeCompare(fileName$1(b))), [media, query]);
 	return /* @__PURE__ */ jsxs("div", {
 		className: "gfa-screen gfa-screen-wide",
 		children: [
 			/* @__PURE__ */ jsxs("div", {
 				className: "gfa-screen-header",
-				children: [/* @__PURE__ */ jsx("h1", { children: t("media.title") }), /* @__PURE__ */ jsx(UploadButton, {
+				children: [/* @__PURE__ */ jsx("h1", { children: t("media.title") }), mayChange && /* @__PURE__ */ jsx(UploadButton, {
 					label: t("media.upload"),
 					disabled: status.type === "uploading",
 					onFiles: (files) => void run(files)
@@ -3660,6 +3866,11 @@ function MediaScreen() {
 				className: "gfa-hint",
 				children: t("media.intro")
 			}),
+			!mayChange && /* @__PURE__ */ jsx("p", {
+				className: "gfa-notice",
+				role: "note",
+				children: t("limits.mediaReadOnly")
+			}),
 			cloudflareVideos && /* @__PURE__ */ jsxs("p", {
 				className: "gfa-notice",
 				role: "note",
@@ -3674,7 +3885,7 @@ function MediaScreen() {
 					})
 				]
 			}),
-			/* @__PURE__ */ jsx(StorageSection, { onDone: setMoved }),
+			mayChange && /* @__PURE__ */ jsx(StorageSection, { onDone: setMoved }),
 			moved && /* @__PURE__ */ jsx("p", {
 				className: "gfa-notice gfa-notice-success",
 				role: "status",
@@ -3696,7 +3907,7 @@ function MediaScreen() {
 				})]
 			}),
 			/* @__PURE__ */ jsx(DropZone, {
-				onFiles: (files) => void run(files),
+				onFiles: (files) => void (mayChange && run(files)),
 				children: media.length === 0 ? /* @__PURE__ */ jsx("p", { children: t("media.empty") }) : urls.length === 0 ? /* @__PURE__ */ jsx("p", { children: t("media.noMatches") }) : /* @__PURE__ */ jsx("ul", {
 					className: "gfa-media-grid",
 					children: urls.map((url) => /* @__PURE__ */ jsxs("li", {
@@ -3706,7 +3917,7 @@ function MediaScreen() {
 							/* @__PURE__ */ jsx("span", {
 								className: "gfa-media-name",
 								title: url,
-								children: fileName(url)
+								children: fileName$1(url)
 							}),
 							content.credits?.[url] && /* @__PURE__ */ jsx(MediaCredit, { credit: content.credits[url] }),
 							isStoredMedia(content, url) && /* @__PURE__ */ jsx("span", {
@@ -3715,25 +3926,22 @@ function MediaScreen() {
 							}),
 							/* @__PURE__ */ jsxs("div", {
 								className: "gfa-media-actions",
-								children: [
-									/* @__PURE__ */ jsx(Button, {
-										variant: "ghost",
-										onClick: () => void navigator.clipboard?.writeText(url).then(() => setCopied(url), () => setCopied(null)),
-										children: copied === url ? t("media.copied") : t("media.copy")
-									}),
-									/* @__PURE__ */ jsx(UploadButton, {
-										label: t("media.replace"),
-										variant: "secondary",
-										multiple: false,
-										disabled: status.type === "uploading",
-										onFiles: (files) => void run(files.slice(0, 1), mediaPath(url))
-									}),
-									/* @__PURE__ */ jsx(Button, {
-										variant: "ghost",
-										onClick: () => setDeleting(url),
-										children: t("media.delete")
-									})
-								]
+								children: [/* @__PURE__ */ jsx(Button, {
+									variant: "ghost",
+									onClick: () => void navigator.clipboard?.writeText(url).then(() => setCopied(url), () => setCopied(null)),
+									children: copied === url ? t("media.copied") : t("media.copy")
+								}), mayChange && /* @__PURE__ */ jsxs(Fragment$1, { children: [/* @__PURE__ */ jsx(UploadButton, {
+									label: t("media.replace"),
+									variant: "secondary",
+									multiple: false,
+									accept: replacementAccept(url),
+									disabled: status.type === "uploading",
+									onFiles: (files) => void run(files.slice(0, 1), mediaPath(url))
+								}), /* @__PURE__ */ jsx(Button, {
+									variant: "ghost",
+									onClick: () => setDeleting(url),
+									children: t("media.delete")
+								})] })]
 							})
 						]
 					}, url))
@@ -3770,7 +3978,7 @@ function MediaPickerDialog({ kind, onSelect, onClose }) {
 	const { content, media: own } = useSiteContent();
 	const media = allMedia(content, own);
 	const { status, run } = useUploads();
-	const urls = media.map(mediaUrl).filter((url) => kind === "file" || mediaKind$1(url) === kind).sort((a, b) => fileName(a).localeCompare(fileName(b)));
+	const urls = media.map(mediaUrl).filter((url) => kind === "file" || mediaKind$1(url) === kind).sort((a, b) => fileName$1(a).localeCompare(fileName$1(b)));
 	return /* @__PURE__ */ jsx(Dialog, {
 		title: t(PICKER_TITLES[kind]),
 		onClose,
@@ -3806,7 +4014,7 @@ function MediaPickerDialog({ kind, onSelect, onClose }) {
 						},
 						children: [/* @__PURE__ */ jsx(MediaThumb, { url }), /* @__PURE__ */ jsx("span", {
 							className: "gfa-media-name",
-							children: fileName(url)
+							children: fileName$1(url)
 						})]
 					}) }, url))
 				}),
@@ -3966,8 +4174,13 @@ function pluginSecretsHelp(place, plugin, t) {
 }
 //#endregion
 //#region src/registry-version.ts
-/** The release of Goodfellow's block registry this admin panel was built with, so a site gets blocks that match it. */
-const REGISTRY_VERSION = "0.6.0";
+/**
+* The release of Goodfellow's block registry this admin panel was built with,
+* so a site gets blocks that match it, never whatever is newest. Every
+* Goodfellow package is released with the same version, so where a build
+* bundled the admin panel's source without saying, it's core's.
+*/
+const REGISTRY_VERSION = "0.8.0";
 //#endregion
 //#region src/schedule.tsx
 /** The computer's own time zone, which a site without one takes when something is first scheduled. */
@@ -4244,6 +4457,15 @@ function subscribe(listener) {
 		media.removeEventListener("change", listener);
 	};
 }
+/**
+* Makes the admin panel dark or light, as its dark mode switch does. Choosing
+* what the computer's setting already gives follows that setting again, so
+* the admin panel changes with the computer, as it did before anyone chose.
+*/
+function setDarkMode(dark) {
+	const computer = matchMedia("(prefers-color-scheme: dark)").matches;
+	setThemeChoice(dark === computer ? "system" : dark ? "dark" : "light");
+}
 /** The choice, kept in this browser. */
 function useThemeChoice() {
 	return useSyncExternalStore(subscribe, choice, () => "system");
@@ -4318,13 +4540,15 @@ function AdminProvider({ site, frames, store, account, preview, siteUrl, registr
 	const [draftPaths, setDraftPaths] = useState([]);
 	const content = draft?.store ?? store;
 	const [checking, setChecking] = useState();
+	const [limiting, setLimiting] = useState();
+	const [draftReviews, setDraftReviews] = useState([]);
 	const blocks = useMemo(() => describedConfig(site.description, "template").components, [site.description]);
 	const storage = useRef(void 0);
 	storage.current = state.status === "ready" ? state.content.mediaStorage : void 0;
 	const mediaPreviews = useMemo(() => createMediaPreviews(content, siteUrl, () => storage.current), [content, siteUrl]);
 	const outOfReach = registry !== void 0 || atAdminAddress(site.admin) || site.broker !== void 0;
 	const registries = useMemo(() => ({
-		[GOODFELLOW_REGISTRY]: registry ?? goodfellowRegistryUrl("0.6.0"),
+		[GOODFELLOW_REGISTRY]: registry ?? goodfellowRegistryUrl("0.8.0"),
 		...outOfReach && {
 			[SHADCN_NAMESPACE]: SHADCN_REGISTRY,
 			...site.registries
@@ -4357,6 +4581,7 @@ function AdminProvider({ site, frames, store, account, preview, siteUrl, registr
 	const versions = isGitBackend(store) ? store : void 0;
 	const changedPaths = useMemo(() => isGitBackend(store) ? (from, to) => store.changedPaths(from, to) : void 0, [store]);
 	const editors = isGitBackend(store) ? store.editors : void 0;
+	const comments = isGitBackend(store) ? store.comments : void 0;
 	const updates = isGitBackend(store) ? store.updates : void 0;
 	const contentOnly = isGitBackend(store) && store.contentOnly === true;
 	const scheduledBuilds = isGitBackend(store) ? store.scheduledBuilds : void 0;
@@ -4422,9 +4647,14 @@ function AdminProvider({ site, frames, store, account, preview, siteUrl, registr
 		reload
 	]);
 	const refreshDrafts = useCallback(async (current) => {
-		const [names, paths] = await Promise.all([siteDrafts.list().catch(() => []), current ? current.paths().catch(() => []) : []]);
+		const [names, paths, reviews] = await Promise.all([
+			siteDrafts.list().catch(() => []),
+			current ? current.paths().catch(() => []) : [],
+			siteDrafts.reviews().catch(() => [])
+		]);
 		setDraftNames(names);
 		setDraftPaths(paths);
+		setDraftReviews(reviews);
 	}, [siteDrafts]);
 	useEffect(() => {
 		if (draftFound) refreshDrafts(draft);
@@ -4444,12 +4674,74 @@ function AdminProvider({ site, frames, store, account, preview, siteUrl, registr
 		setChecking(void 0);
 		return go;
 	}, []);
-	const publish = useCallback(async (changes, message, options) => {
+	const limits = useMemo(() => state.status === "ready" ? limitsFor(state.content.permissions, account?.user.login) : void 0, [state, account]);
+	/** Who's asked to review: those the permissions name, else every owner, never the one asking. */
+	const reviewers = useCallback(async () => {
+		const owners = await editors?.list().then((list) => list.editors.flatMap((editor) => editor.role === "owner" && editor.login ? [editor.login] : [])).catch(() => []);
+		const self = account?.user.login.toLowerCase();
+		const permissions = state.status === "ready" ? state.content.permissions : void 0;
+		return reviewersFor(permissions, owners ?? []).filter((login) => login.toLowerCase() !== self);
+	}, [
+		editors,
+		account,
+		state
+	]);
+	/** Shows what's outside someone's limits, and lets them submit it for review where the site can take one. */
+	const askLimits = useCallback((problems, shown, submit) => new Promise((done) => setLimiting({
+		problems,
+		content: shown,
+		...submit && { submit },
+		done
+	})), []);
+	const publish = useCallback(async (given, message, options) => {
 		if (state.status !== "ready") return {
 			ok: false,
 			reason: "error",
 			error: /* @__PURE__ */ new Error("The site isn't loaded.")
 		};
+		let changes;
+		try {
+			changes = safeMediaChanges(given);
+		} catch (error) {
+			return {
+				ok: false,
+				reason: "error",
+				error
+			};
+		}
+		const outside = draft || options?.draft ? [] : outsideLimits(state.content, limits, changes);
+		if (outside.length > 0) {
+			const from = state.revision;
+			const description = [
+				t("draft.reviewDescription"),
+				"",
+				...changes.map((change) => `- \`${change.path}\``)
+			].join("\n");
+			const submit = backendDrafts ? async () => {
+				const review = await siteDrafts.create(newDraftName(), { from });
+				await writeChanges(review.store, changes, {
+					message,
+					expectedRevision: await review.store.revision()
+				});
+				const { url } = await review.submitForReview({
+					title: message,
+					description,
+					reviewers: await reviewers()
+				});
+				refreshDrafts(void 0);
+				return { url };
+			} : account?.review ? () => account.review?.(changes, {
+				title: message,
+				description,
+				from
+			}) ?? Promise.resolve({}) : void 0;
+			await askLimits(outside, state.content, submit);
+			return {
+				ok: false,
+				reason: "checks",
+				error: void 0
+			};
+		}
 		const checks = options?.checks === false ? void 0 : await checkPublish(content, state, changes, {
 			blocks,
 			code
@@ -4504,7 +4796,13 @@ function AdminProvider({ site, frames, store, account, preview, siteUrl, registr
 		confirmChecks,
 		refreshDrafts,
 		loadFrom,
-		onSignInError
+		onSignInError,
+		limits,
+		backendDrafts,
+		account,
+		askLimits,
+		reviewers,
+		t
 	]);
 	const openDraft = useCallback(async (name) => {
 		if (name === draft?.name) return true;
@@ -4548,6 +4846,29 @@ function AdminProvider({ site, frames, store, account, preview, siteUrl, registr
 			reason: "error",
 			error: live.status === "error" && live.error
 		};
+		const outside = outsideLimits(live.content, limitsFor(live.content.permissions, account?.user.login), changes);
+		if (outside.length > 0) {
+			const current = draft;
+			const submit = backendDrafts ? async () => {
+				const paths = changes.map((change) => change.path);
+				return current.submitForReview({
+					title: t("draft.reviewTitle", { name: current.name }),
+					description: [
+						t("draft.reviewDescription"),
+						"",
+						...paths.map((path) => `- \`${path}\``)
+					].join("\n"),
+					reviewers: await reviewers()
+				});
+			} : void 0;
+			await askLimits(outside, live.content, submit);
+			refreshDrafts(current);
+			return {
+				ok: false,
+				reason: "checks",
+				error: void 0
+			};
+		}
 		if (!await confirmChecks(await checkPublish(store, live, changes, {
 			blocks,
 			code
@@ -4584,7 +4905,12 @@ function AdminProvider({ site, frames, store, account, preview, siteUrl, registr
 		key,
 		t,
 		confirmChecks,
-		onSignInError
+		onSignInError,
+		account,
+		backendDrafts,
+		askLimits,
+		reviewers,
+		refreshDrafts
 	]);
 	const submitDraft = useCallback(async () => {
 		if (!draft) return {
@@ -4599,8 +4925,10 @@ function AdminProvider({ site, frames, store, account, preview, siteUrl, registr
 					t("draft.reviewDescription"),
 					"",
 					...paths.map((path) => `- \`${path}\``)
-				].join("\n")
+				].join("\n"),
+				reviewers: await reviewers()
 			});
+			refreshDrafts(draft);
 			return {
 				ok: true,
 				url
@@ -4611,7 +4939,12 @@ function AdminProvider({ site, frames, store, account, preview, siteUrl, registr
 				error
 			};
 		}
-	}, [draft, t]);
+	}, [
+		draft,
+		t,
+		reviewers,
+		refreshDrafts
+	]);
 	const discardDraft = useCallback(async () => {
 		if (!draft) return { ok: true };
 		try {
@@ -4630,6 +4963,7 @@ function AdminProvider({ site, frames, store, account, preview, siteUrl, registr
 	const drafts = useMemo(() => ({
 		kept: backendDrafts === void 0,
 		names: draftNames,
+		reviews: draftReviews,
 		...draft && { current: {
 			name: draft.name,
 			paths: draftPaths
@@ -4641,6 +4975,7 @@ function AdminProvider({ site, frames, store, account, preview, siteUrl, registr
 	}), [
 		backendDrafts,
 		draftNames,
+		draftReviews,
 		draft,
 		draftPaths,
 		openDraft,
@@ -4692,6 +5027,7 @@ function AdminProvider({ site, frames, store, account, preview, siteUrl, registr
 	const pluginInstalls = demo || contentOnly ? void 0 : account?.review ? "review" : atAdminAddress(site.admin) || site.broker !== void 0 ? "publish" : void 0;
 	const value = useMemo(() => ({
 		site,
+		...limits && { limits },
 		blocks,
 		code,
 		preview,
@@ -4715,6 +5051,7 @@ function AdminProvider({ site, frames, store, account, preview, siteUrl, registr
 		changedPaths,
 		editors,
 		ownerAccess,
+		comments,
 		updates,
 		contentOnly,
 		scheduledBuilds,
@@ -4724,6 +5061,7 @@ function AdminProvider({ site, frames, store, account, preview, siteUrl, registr
 		tasks
 	}), [
 		site,
+		limits,
 		blocks,
 		code,
 		preview,
@@ -4747,6 +5085,7 @@ function AdminProvider({ site, frames, store, account, preview, siteUrl, registr
 		changedPaths,
 		editors,
 		ownerAccess,
+		comments,
 		updates,
 		contentOnly,
 		scheduledBuilds,
@@ -4766,16 +5105,28 @@ function AdminProvider({ site, frames, store, account, preview, siteUrl, registr
 		value,
 		children: /* @__PURE__ */ jsxs(StringsProvider, {
 			strings,
-			children: [state.status === "ready" ? /* @__PURE__ */ jsx(SiteFrames, {
-				frames,
-				state,
-				onCodeClient,
-				children
-			}) : children, checking && /* @__PURE__ */ jsx(ChecksDialog, {
-				checks: checking.checks,
-				content: checking.content,
-				onDecide: checking.decide
-			})]
+			children: [
+				state.status === "ready" ? /* @__PURE__ */ jsx(SiteFrames, {
+					frames,
+					state,
+					onCodeClient,
+					children
+				}) : children,
+				checking && /* @__PURE__ */ jsx(ChecksDialog, {
+					checks: checking.checks,
+					content: checking.content,
+					onDecide: checking.decide
+				}),
+				limiting && /* @__PURE__ */ jsx(LimitsDialog, {
+					problems: limiting.problems,
+					content: limiting.content,
+					...limiting.submit && { onSubmit: limiting.submit },
+					onClose: () => {
+						setLimiting(void 0);
+						limiting.done();
+					}
+				})
+			]
 		})
 	});
 }
@@ -4797,6 +5148,7 @@ function useSiteCss(stylesheets) {
 function SiteFrames({ frames, state, onCodeClient, children }) {
 	const t = useStrings();
 	const strings = useStringTable();
+	const { puck, labels } = useEditorText();
 	const theme = useThemeChoice();
 	const { site, preview, siteUrl, mediaPreviews, account, scheduledBuilds, repositoryVisibility, scheduleSyncProblem, readFile, readBytes, listFiles, publish, tasks } = useAdmin();
 	const { timing, visibility } = useScheduleInfoOf(scheduledBuilds, repositoryVisibility);
@@ -4858,6 +5210,8 @@ function SiteFrames({ frames, state, onCodeClient, children }) {
 			siteUrl,
 			preview,
 			strings,
+			puck,
+			labels,
 			theme,
 			hostName: account?.hostName ?? ""
 		},
@@ -4881,6 +5235,8 @@ function SiteFrames({ frames, state, onCodeClient, children }) {
 		siteUrl,
 		preview,
 		strings,
+		puck,
+		labels,
 		theme,
 		account,
 		siteCss,
@@ -5079,4 +5435,4 @@ function formValues(collection, entry) {
 	return values;
 }
 //#endregion
-export { useDebounced as $, useRoute as A, redirectsFileChange as At, FrameServicesProvider as B, AppLink as C, menusFileChange as Ct, hasUnsavedChanges as D, newPageData as Dt, entryEditorHref as E, newCollectionSettings as Et, PluginScreenFrame as F, storedEntryFields as Ft, READY_MESSAGE as G, useFrame as H, usePluginFrame as I, uniqueName as It, Dialog as J, draftStarted as K, usePluginHost as L, updateSettingsFileChange as Lt, prepareUpload as M, slugify as Mt, useOutsideHost as N, storedCss as Nt, navigate as O, pageFileChange as Ot, PublishFailure as P, storedData as Pt, TextField as Q, createMediaPreviews as R, editedMarkdown as Rt, MediaScreen as S, mediaFileChange as St, collectionHref as T, movePageChanges as Tt, useFrameServices as U, reloadFrames as V, useFrameUpdates as W, Field as X, ErrorMessage as Y, PublishedNotice as Z, scheduleSettingsChanges as _, customCssFileChange as _t, AdminContext as a, findPage as at, MediaChooser as b, entryFileChange$1 as bt, useCanChangeSettings as c, mediaUrl as ct, useApplyThemeChoice as d, addressPatternFor as dt, StringsProvider as et, useDarkMode as f, checkEntrySlug as ft, ScheduleStatus as g, collectionSettingsChanges as gt, ScheduleFields as h, collectionFileChange$1 as ht, usePreviewStyles as i, describeContrast as it, useUnsavedChanges as j, siteSettingsFileChange as jt, pageEditorHref as k, pageTitle$1 as kt, useSiteContent as l, siteImages as lt, ComingUp as m, codeFileChanges as mt, formValues as n, useStringTable as nt, AdminProvider as o, allMedia as ot, useThemeChoice as p, checkPageAddress as pt, Button as q, PreviewFrame as r, useStrings as rt, useAdmin as s, fileName as st, SCHEDULE_PROP as t, defaultStrings as tt, setThemeChoice as u, uploadName as ut, REGISTRY_VERSION as v, deleteCollectionChanges as vt, SETTINGS_SECTIONS as w, moveEntryChanges as wt, MediaField as x, layoutFileChange as xt, MediaChoiceContext as y, duplicatePageData as yt, showMediaInPreview as z, formattedHtml as zt };
+export { ErrorMessage as $, pageEditorHref as A, mayChange as B, MediaScreen as C, entryEditorHref as D, collectionHref as E, useOutsideHost as F, useFrameServices as G, FrameServicesProvider as H, PublishFailure as I, EditorTextContext as J, useFrameUpdates as K, PluginScreenFrame as L, useRoute as M, useUnsavedChanges as N, hasUnsavedChanges as O, prepareUpload as P, Dialog as Q, usePluginFrame as R, MediaField as S, SETTINGS_SECTIONS as T, reloadFrames as U, useMayChange as V, useFrame as W, draftStarted as X, useEditorText as Y, Button as Z, ScheduleStatus as _, AdminContext as a, defaultStrings as at, MediaChoiceContext as b, useCanChangeSettings as c, describeContrast as ct, setThemeChoice as d, Field as et, useApplyThemeChoice as f, ScheduleFields as g, ComingUp as h, usePreviewStyles as i, StringsProvider as it, sectionId as j, navigate as k, useSiteContent as l, findPage as lt, useThemeChoice as m, formValues as n, TextField as nt, AdminProvider as o, useStringTable as ot, useDarkMode as p, READY_MESSAGE as q, PreviewFrame as r, useDebounced as rt, useAdmin as s, useStrings as st, SCHEDULE_PROP as t, PublishedNotice as tt, setDarkMode as u, scheduleSettingsChanges as v, AppLink as w, MediaChooser as x, REGISTRY_VERSION as y, usePluginHost as z };