@takuhon/cli 0.10.0 → 0.12.0

package/dist/index.js

@@ -1,15 +1,24 @@
 #!/usr/bin/env node
+import {
+  ADMIN_DIST_DIRNAME,
+  resolveAdminBundleDir
+} from "./chunk-XMSWT5NY.js";
 
 // src/index.ts
-import { readFileSync as readFileSync9, realpathSync } from "fs";
+import { readFileSync as readFileSync15, realpathSync } from "fs";
 import { stdin, stdout } from "process";
 import { createInterface } from "readline/promises";
 import { fileURLToPath } from "url";
 
-// src/build-command.ts
-import { mkdirSync as mkdirSync2, readFileSync } from "fs";
-import { dirname as dirname2, join as join2 } from "path";
-import { applyPublicPrivacyFilter, normalize, validate } from "@takuhon/core";
+// src/activity-command.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { dirname as dirname3, join as join3 } from "path";
+import { fetchActivitySnapshot, isEmptySnapshot } from "@takuhon/activity";
+
+// src/file-activity-storage.ts
+import { readFileSync } from "fs";
+import { dirname as dirname2, join as join2, resolve } from "path";
+import { isActivitySnapshot } from "@takuhon/core";
 
 // src/backup.ts
 import { mkdirSync, renameSync, rmSync, writeFileSync } from "fs";
@@ -35,6 +44,9 @@ function preRestoreName(date, withMillis = false) {
 function preImportName(date, withMillis = false) {
   return `pre-import-${compactTimestamp(date, withMillis)}.json`;
 }
+function preAdminSaveName(date, withMillis = false) {
+  return `pre-admin-${compactTimestamp(date, withMillis)}.json`;
+}
 function backupDirFor(targetPath) {
   return join(dirname(targetPath), BACKUP_DIR_NAME);
 }
@@ -76,11 +88,273 @@ function writeFileAtomic(target, content) {
   }
 }
 
-// src/site.ts
-import { resolveLocale } from "@takuhon/core";
+// src/file-activity-storage.ts
+var ACTIVITY_FILENAME = "activity.json";
+function isNotFound(err) {
+  return typeof err === "object" && err !== null && err.code === "ENOENT";
+}
+function activityPathFor(profilePath) {
+  return join2(dirname2(resolve(profilePath)), ACTIVITY_FILENAME);
+}
+function readSnapshotFile(path) {
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch (err) {
+    if (isNotFound(err)) return null;
+    throw err;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  return isActivitySnapshot(parsed) ? parsed : null;
+}
+function readActivitySnapshotSync(profilePath) {
+  return readSnapshotFile(activityPathFor(profilePath));
+}
+var FileActivityStorage = class {
+  /** Absolute path of the `activity.json` this storage reads and writes. */
+  path;
+  constructor(profilePath) {
+    this.path = activityPathFor(profilePath);
+  }
+  // The filesystem work is synchronous, but the ActivityStorage contract is
+  // async. Each method runs its body inside `Promise.resolve().then(...)` so a
+  // synchronous throw becomes a rejected promise rather than an exception the
+  // caller must catch outside `await` (same pattern as FileStorage).
+  getActivitySnapshot() {
+    return Promise.resolve().then(() => readSnapshotFile(this.path));
+  }
+  saveActivitySnapshot(snapshot) {
+    return Promise.resolve().then(() => {
+      writeFileAtomic(this.path, `${JSON.stringify(snapshot, null, 2)}
+`);
+    });
+  }
+};
+
+// src/activity-command.ts
+var DEFAULT_PATH = "takuhon.json";
+var GITHUB_TOKEN_ENV = "TAKUHON_GITHUB_TOKEN";
+var WAKATIME_KEY_ENV = "TAKUHON_WAKATIME_KEY";
+var SYNC_USAGE = `Usage: takuhon activity sync [path]
+
+Fetch the GitHub / WakaTime activity configured under settings.activity in a
+takuhon.json and store the result as activity.json beside it \u2014 the sibling
+snapshot the renderer reads, kept outside the canonical profile. With no path,
+syncs ./takuhon.json in the current working directory.
+
+Secrets are read from the environment, never from flags or the profile:
+  ${GITHUB_TOKEN_ENV}   Optional. Raises the GitHub rate limit and unlocks the
+                         contribution calendar (which is GraphQL/token-only).
+                         Languages work without it.
+  ${WAKATIME_KEY_ENV}   Required to read WakaTime coding time.
+
+A sync that gathers no data keeps the last-known activity.json \u2014 a good
+snapshot is never overwritten with an empty one.
+
+Exit codes: 0 = synced, 1 = no data gathered (last-known snapshot kept),
+2 = bad arguments / profile missing / unreadable / not JSON / activity not
+configured or not enabled in settings.activity.
+`;
+var SHOW_USAGE = `Usage: takuhon activity show [path]
+
+Print the stored activity snapshot (the activity.json beside the profile) as
+JSON. With no path, reads beside ./takuhon.json in the current working
+directory.
+
+Exit codes: 0 = printed, 1 = no (or invalid) snapshot stored, 2 = bad
+arguments.
+`;
+function defaultSecrets() {
+  return {
+    githubToken: process.env[GITHUB_TOKEN_ENV],
+    wakatimeKey: process.env[WAKATIME_KEY_ENV]
+  };
+}
+function parsePathArg(args, sub) {
+  let path;
+  for (const arg of args) {
+    if (arg.startsWith("-")) {
+      return { error: `takuhon: unknown option \`${arg}\` for \`activity ${sub}\`.` };
+    }
+    if (path !== void 0) {
+      return { error: `takuhon: \`activity ${sub}\` takes at most one path argument.` };
+    }
+    path = arg;
+  }
+  return { path: path ?? DEFAULT_PATH };
+}
+function activityDisplayPath(profilePath) {
+  return join3(dirname3(profilePath), ACTIVITY_FILENAME);
+}
+function readActivityConfig(path) {
+  const fail = (code, stderr) => ({
+    outcome: { code, stdout: "", stderr }
+  });
+  let raw;
+  try {
+    raw = readFileSync2(path, "utf8");
+  } catch {
+    return fail(
+      2,
+      `takuhon: cannot read '${path}'. Pass a path, or run from a directory containing a takuhon.json.
+`
+    );
+  }
+  let data;
+  try {
+    data = JSON.parse(raw);
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return fail(2, `takuhon: '${path}' is not valid JSON: ${detail}
+`);
+  }
+  const settings = typeof data === "object" && data !== null ? data.settings : void 0;
+  const config = settings?.activity;
+  if (config === void 0) {
+    return fail(
+      2,
+      `takuhon: '${path}' has no settings.activity; nothing to sync.
+Opt in by adding settings.activity with "enabled": true and a github/wakatime username.
+`
+    );
+  }
+  if (config.enabled !== true) {
+    return fail(
+      2,
+      `takuhon: activity is not enabled in '${path}'; nothing to sync.
+Set settings.activity.enabled to true to opt in.
+`
+    );
+  }
+  const hasGithub = config.github?.username !== void 0 && config.github.username !== "";
+  const hasWakatime = config.wakatime?.username !== void 0 && config.wakatime.username !== "";
+  if (!hasGithub && !hasWakatime) {
+    return fail(
+      2,
+      `takuhon: settings.activity in '${path}' names no github or wakatime username; nothing to sync.
+`
+    );
+  }
+  return { config };
+}
+function redactSecrets(text, secrets) {
+  let out = text;
+  for (const secret of [secrets.githubToken, secrets.wakatimeKey]) {
+    if (secret !== void 0 && secret !== "") out = out.split(secret).join("***");
+  }
+  return out;
+}
+async function runActivitySync(args = [], deps = {}) {
+  if (args[0] === "--help" || args[0] === "-h") {
+    return { code: 0, stdout: SYNC_USAGE, stderr: "" };
+  }
+  const parsed = parsePathArg(args, "sync");
+  if ("error" in parsed) {
+    return {
+      code: 2,
+      stdout: "",
+      stderr: `${parsed.error}
+Run \`takuhon activity sync --help\` for usage.
+`
+    };
+  }
+  const read = readActivityConfig(parsed.path);
+  if ("outcome" in read) return read.outcome;
+  const { config } = read;
+  const getSecrets = deps.getSecrets ?? defaultSecrets;
+  const secrets = getSecrets();
+  const notes = [];
+  const githubUser = config.github?.username;
+  if (githubUser !== void 0 && githubUser !== "" && config.github?.showContributions !== false && !secrets.githubToken) {
+    notes.push(
+      `takuhon: ${GITHUB_TOKEN_ENV} is not set; skipping GitHub contributions (languages need no token).
+`
+    );
+  }
+  const wakatimeUser = config.wakatime?.username;
+  if (wakatimeUser !== void 0 && wakatimeUser !== "" && config.wakatime?.showCodingTime !== false && !secrets.wakatimeKey) {
+    notes.push(`takuhon: ${WAKATIME_KEY_ENV} is not set; skipping WakaTime coding time.
+`);
+  }
+  const snapshot = await fetchActivitySnapshot(config, secrets, {
+    fetch: deps.fetch,
+    now: deps.now,
+    onError: (source, err) => {
+      const detail = err instanceof Error ? err.message : String(err);
+      notes.push(`takuhon: ${source} failed: ${redactSecrets(detail, secrets)}
+`);
+    }
+  });
+  const storage = new FileActivityStorage(parsed.path);
+  const displayPath = activityDisplayPath(parsed.path);
+  const stderr = notes.join("");
+  if (isEmptySnapshot(snapshot)) {
+    const existing = await storage.getActivitySnapshot();
+    const kept = existing !== null ? `keeping the last-known snapshot at '${displayPath}'` : "nothing written";
+    return {
+      code: 1,
+      stdout: "",
+      stderr: `${stderr}takuhon: the sync gathered no activity data; ${kept}.
+`
+    };
+  }
+  await storage.saveActivitySnapshot(snapshot);
+  const gathered = ["languages", "contributions", "codingTime", "rank"].filter((field) => snapshot[field] !== void 0).join(", ");
+  return { code: 0, stdout: `synced activity -> ${displayPath} (${gathered})
+`, stderr };
+}
+async function runActivityShow(args = []) {
+  if (args[0] === "--help" || args[0] === "-h") {
+    return { code: 0, stdout: SHOW_USAGE, stderr: "" };
+  }
+  const parsed = parsePathArg(args, "show");
+  if ("error" in parsed) {
+    return {
+      code: 2,
+      stdout: "",
+      stderr: `${parsed.error}
+Run \`takuhon activity show --help\` for usage.
+`
+    };
+  }
+  const snapshot = await new FileActivityStorage(parsed.path).getActivitySnapshot();
+  if (snapshot === null) {
+    return {
+      code: 1,
+      stdout: "",
+      stderr: `takuhon: no activity snapshot at '${activityDisplayPath(parsed.path)}'. Run \`takuhon activity sync\` first.
+`
+    };
+  }
+  return { code: 0, stdout: `${JSON.stringify(snapshot, null, 2)}
+`, stderr: "" };
+}
+
+// src/admin-command.ts
+import { randomBytes as randomBytes2 } from "crypto";
+import { readFileSync as readFileSync6 } from "fs";
+import { extname as extname2, join as join5, resolve as resolve3, sep as sep2 } from "path";
+import { serve } from "@hono/node-server";
+import {
+  adminAssetSecurityHeaders,
+  createAdminApiApp,
+  noopAuditLogger,
+  noopCachePurger
+} from "@takuhon/api";
+import { Hono } from "hono";
+
+// src/dev-command.ts
+import { readFileSync as readFileSync3 } from "fs";
+import { createServer } from "http";
+import { applyPublicPrivacyFilter, normalize, validate } from "@takuhon/core";
 
 // src/build-html.ts
-import { generateJsonLd } from "@takuhon/core";
+import { generateJsonLd, renderActivitySvg } from "@takuhon/core";
 function escapeHtml(value) {
   return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
@@ -116,6 +390,7 @@ ul{padding:0;margin:0;list-style:none}
 .rec blockquote{margin:0;padding-left:.9rem;border-left:3px solid var(--line)}
 .rec figcaption{color:var(--muted);font-size:.9rem;margin-top:.3rem}
 nav.locales{display:flex;gap:.75rem;margin-bottom:1rem;font-size:.9rem}
+.activity svg{max-width:100%;height:auto}
 footer.powered{max-width:42rem;margin:0 auto;padding:1.5rem 1.25rem;color:var(--muted);font-size:.85rem}`;
 function dateRange(start, end, isCurrent) {
   const left = start ?? "";
@@ -203,6 +478,12 @@ function renderContact(contact) {
   if (items.length === 0) return "";
   return `<section><h2>Contact</h2><ul class="entries">${items.join("")}</ul></section>`;
 }
+function renderActivity(snapshot) {
+  if (!snapshot) return "";
+  const svg = renderActivitySvg(snapshot);
+  if (svg === "") return "";
+  return `<section class="activity"><h2>Activity</h2>${svg}</section>`;
+}
 function renderJsonLdScript(data) {
   const payload = JSON.stringify(generateJsonLd(data));
   return `<script type="application/ld+json">${escapeJsonLd(payload)}</script>`;
@@ -254,6 +535,7 @@ function renderProfileHtml(input) {
       }))
     ),
     renderSkills(d.skills),
+    renderActivity(input.activitySnapshot),
     entryList(
       "Education",
       d.education.map((e) => {
@@ -366,11 +648,13 @@ ${footer ? `${footer}
 }
 
 // src/site.ts
+import { resolveLocale } from "@takuhon/core";
 function generateSite(profile, options = {}) {
   const { baseUrl } = options;
   const defaultLocale = profile.settings.defaultLocale;
   const locales = [.../* @__PURE__ */ new Set([defaultLocale, ...profile.settings.availableLocales])];
   const jsonLd = profile.settings.enableJsonLd !== false;
+  const activitySnapshot = profile.settings.activity?.enabled === true ? options.activitySnapshot ?? void 0 : void 0;
   return locales.map((locale) => {
     const localized = resolveLocale(profile, locale);
     const isDefault = locale === defaultLocale;
@@ -381,7 +665,14 @@ function generateSite(profile, options = {}) {
     }));
     const canonicalUrl = baseUrl ? absoluteUrl(baseUrl, locale, defaultLocale) : void 0;
     const alternates = baseUrl ? buildAlternates(baseUrl, locales, defaultLocale) : [];
-    const html = renderProfileHtml({ localized, canonicalUrl, alternates, localeNav, jsonLd });
+    const html = renderProfileHtml({
+      localized,
+      canonicalUrl,
+      alternates,
+      localeNav,
+      jsonLd,
+      activitySnapshot
+    });
     return {
       route: isDefault ? "/" : `/${locale}/`,
       file: isDefault ? "index.html" : `${locale}/index.html`,
@@ -410,208 +701,60 @@ function localeHref(from, to, defaultLocale) {
   return toRoot ? "../" : `../${to}/`;
 }
 
-// src/build-command.ts
-var DEFAULT_PATH = "takuhon.json";
-var DEFAULT_OUTPUT = "dist";
-var USAGE = `Usage: takuhon build [path] [--output <dir>] [--base-url <url>]
+// src/dev-command.ts
+var DEFAULT_PATH2 = "takuhon.json";
+var DEFAULT_PORT = 4321;
+var USAGE = `Usage: takuhon dev [path] [--port <n>] [--base-url <url>]
 
-Render a takuhon.json into a static site (one HTML page per locale, with
-build-time Schema.org JSON-LD). With no path, builds ./takuhon.json.
+Serve a takuhon.json as a local static preview (one page per locale) \u2014 the same
+surface \`takuhon build\` produces. With no path, serves ./takuhon.json. The file
+is re-read and re-rendered on every request, so edit it and reload the browser
+to see changes. Stop with Ctrl-C.
 
 Options:
-  --output <dir>   Output directory (default: ${DEFAULT_OUTPUT}). The default
-                   locale is written to <dir>/index.html and each other locale
-                   to <dir>/<locale>/index.html.
+  --port <n>       Port to listen on (default: ${DEFAULT_PORT}).
   --base-url <url> Site origin (e.g. https://me.example). Enables absolute
                    canonical and hreflang links; without it those are omitted.
 
-The public privacy filter is applied (meta.privacy is honoured). Asset URLs are
-referenced as-is and are not copied. The output directory is written into, not
-cleaned \u2014 use a dedicated/empty directory so stale pages do not linger.
+The public privacy filter is applied (meta.privacy is honoured). An invalid
+takuhon.json is served as an error page so you can fix it and reload.
 
-Exit codes: 0 = built, 1 = source is not a valid profile,
-2 = bad arguments / file missing / unreadable / not JSON / write failed.
+Exit codes: 0 = served then stopped, 2 = bad arguments / file missing /
+unreadable / port in use.
 `;
-function runBuild(args = []) {
-  if (args[0] === "--help" || args[0] === "-h") {
-    return { code: 0, stdout: USAGE, stderr: "" };
-  }
-  const parsed = parseArgs(args);
-  if ("error" in parsed) {
-    return {
-      code: 2,
-      stdout: "",
-      stderr: `${parsed.error}
-Run \`takuhon build --help\` for usage.
-`
-    };
-  }
-  return buildSite(parsed);
-}
-function parseArgs(args) {
-  let path;
-  let output;
-  let baseUrl;
-  for (let i = 0; i < args.length; i++) {
-    const arg = args[i];
-    if (arg === "--output" || arg === "--base-url") {
-      const value = args[i + 1];
-      if (value === void 0 || value === "" || value.startsWith("-")) {
-        return { error: `takuhon: \`${arg}\` requires a value.` };
-      }
-      if (arg === "--output") output = value;
-      else baseUrl = value;
-      i++;
-      continue;
-    }
-    if (arg.startsWith("--output=")) {
-      const value = arg.slice("--output=".length);
-      if (value === "") return { error: "takuhon: `--output` requires a value." };
-      output = value;
-      continue;
-    }
-    if (arg.startsWith("--base-url=")) {
-      const value = arg.slice("--base-url=".length);
-      if (value === "") return { error: "takuhon: `--base-url` requires a value." };
-      baseUrl = value;
-      continue;
-    }
-    if (arg.startsWith("-")) {
-      return { error: `takuhon: unknown option \`${arg}\` for \`build\`.` };
-    }
-    if (path !== void 0) {
-      return { error: "takuhon: `build` takes at most one path argument." };
-    }
-    path = arg;
-  }
-  if (baseUrl !== void 0 && !isHttpUrl(baseUrl)) {
-    return { error: "takuhon: `--base-url` must be an absolute http(s) URL." };
-  }
-  return {
-    path: path ?? DEFAULT_PATH,
-    output: output ?? DEFAULT_OUTPUT,
-    // Drop any trailing slash so URL joins are predictable.
-    baseUrl: baseUrl?.replace(/\/+$/, "")
-  };
-}
-function isHttpUrl(value) {
-  try {
-    const url = new URL(value);
-    return url.protocol === "http:" || url.protocol === "https:";
-  } catch {
-    return false;
-  }
-}
-function buildSite(parsed) {
-  const { path, output, baseUrl } = parsed;
+function loadSiteState(path, baseUrl) {
   let raw;
   try {
-    raw = readFileSync(path, "utf8");
+    raw = readFileSync3(path, "utf8");
   } catch {
-    return {
-      code: 2,
-      stdout: "",
-      stderr: `takuhon: cannot read '${path}'. Pass a path, or run from a directory containing a takuhon.json.
-`
-    };
+    return { ok: false, status: 500, message: `cannot read '${path}'.` };
   }
   let data;
   try {
     data = JSON.parse(raw);
   } catch (error) {
     const detail = error instanceof Error ? error.message : String(error);
-    return { code: 2, stdout: "", stderr: `takuhon: '${path}' is not valid JSON: ${detail}
-` };
+    return { ok: false, status: 500, message: `'${path}' is not valid JSON: ${detail}` };
   }
   const result = validate(data);
   if (!result.ok) {
     const lines = result.errors.map((e) => `  ${e.pointer || "/"}: ${e.message}`);
     return {
-      code: 1,
-      stdout: "",
-      stderr: `takuhon: '${path}' is not a valid takuhon profile; refusing to build:
-${lines.join("\n")}
-`
+      ok: false,
+      status: 500,
+      message: `'${path}' is not a valid takuhon profile:
+${lines.join("\n")}`
     };
   }
   const filtered = applyPublicPrivacyFilter(normalize(result.data));
-  const written = [];
-  try {
-    for (const page of generateSite(filtered, { baseUrl })) {
-      const outFile = join2(output, page.file);
-      mkdirSync2(dirname2(outFile), { recursive: true });
-      writeFileAtomic(outFile, page.html);
-      written.push(outFile);
-    }
-  } catch (error) {
-    const detail = error instanceof Error ? error.message : String(error);
-    return { code: 2, stdout: "", stderr: `takuhon: failed to write the site: ${detail}
-` };
-  }
-  const summary = written.map((w) => `  ${w}`).join("\n");
-  return {
-    code: 0,
-    stdout: `built ${written.length} page${written.length === 1 ? "" : "s"} from ${path}:
-${summary}
-`,
-    stderr: ""
-  };
-}
-
-// src/dev-command.ts
-import { readFileSync as readFileSync2 } from "fs";
-import { createServer } from "http";
-import { applyPublicPrivacyFilter as applyPublicPrivacyFilter2, normalize as normalize2, validate as validate2 } from "@takuhon/core";
-var DEFAULT_PATH2 = "takuhon.json";
-var DEFAULT_PORT = 4321;
-var USAGE2 = `Usage: takuhon dev [path] [--port <n>] [--base-url <url>]
-
-Serve a takuhon.json as a local static preview (one page per locale) \u2014 the same
-surface \`takuhon build\` produces. With no path, serves ./takuhon.json. The file
-is re-read and re-rendered on every request, so edit it and reload the browser
-to see changes. Stop with Ctrl-C.
-
-Options:
-  --port <n>       Port to listen on (default: ${DEFAULT_PORT}).
-  --base-url <url> Site origin (e.g. https://me.example). Enables absolute
-                   canonical and hreflang links; without it those are omitted.
-
-The public privacy filter is applied (meta.privacy is honoured). An invalid
-takuhon.json is served as an error page so you can fix it and reload.
-
-Exit codes: 0 = served then stopped, 2 = bad arguments / file missing /
-unreadable / port in use.
-`;
-function loadSiteState(path, baseUrl) {
-  let raw;
-  try {
-    raw = readFileSync2(path, "utf8");
-  } catch {
-    return { ok: false, status: 500, message: `cannot read '${path}'.` };
-  }
-  let data;
-  try {
-    data = JSON.parse(raw);
-  } catch (error) {
-    const detail = error instanceof Error ? error.message : String(error);
-    return { ok: false, status: 500, message: `'${path}' is not valid JSON: ${detail}` };
-  }
-  const result = validate2(data);
-  if (!result.ok) {
-    const lines = result.errors.map((e) => `  ${e.pointer || "/"}: ${e.message}`);
-    return {
-      ok: false,
-      status: 500,
-      message: `'${path}' is not a valid takuhon profile:
-${lines.join("\n")}`
-    };
-  }
-  const filtered = applyPublicPrivacyFilter2(normalize2(result.data));
-  const pages = new Map(generateSite(filtered, { baseUrl }).map((p) => [p.route, p.html]));
-  return { ok: true, pages };
-}
-function resolveRoute(urlPath) {
-  let p = urlPath;
+  const activitySnapshot = filtered.settings.activity?.enabled === true ? readActivitySnapshotSync(path) : null;
+  const pages = new Map(
+    generateSite(filtered, { baseUrl, activitySnapshot }).map((p) => [p.route, p.html])
+  );
+  return { ok: true, pages };
+}
+function resolveRoute(urlPath) {
+  let p = urlPath;
   try {
     p = decodeURIComponent(urlPath);
   } catch {
@@ -661,10 +804,10 @@ async function runDev(args = [], deps = {}) {
   const out = deps.stdout ?? ((text) => void process.stdout.write(text));
   const err = deps.stderr ?? ((text) => void process.stderr.write(text));
   if (args[0] === "--help" || args[0] === "-h") {
-    out(USAGE2);
+    out(USAGE);
     return 0;
   }
-  const parsed = parseArgs2(args);
+  const parsed = parseArgs(args);
   if ("error" in parsed) {
     err(`${parsed.error}
 Run \`takuhon dev --help\` for usage.
@@ -672,7 +815,7 @@ Run \`takuhon dev --help\` for usage.
     return 2;
   }
   try {
-    readFileSync2(parsed.path, "utf8");
+    readFileSync3(parsed.path, "utf8");
   } catch {
     err(
       `takuhon: cannot read '${parsed.path}'. Pass a path, or run from a directory containing a takuhon.json.
@@ -681,14 +824,14 @@ Run \`takuhon dev --help\` for usage.
     return 2;
   }
   const server = createDevServer({ path: parsed.path, baseUrl: parsed.baseUrl });
-  return await new Promise((resolve3) => {
+  return await new Promise((resolve7) => {
     let closing = false;
     const shutdown = () => {
       if (closing) return;
       closing = true;
       process.removeListener("SIGINT", shutdown);
       process.removeListener("SIGTERM", shutdown);
-      server.close(() => resolve3(0));
+      server.close(() => resolve7(0));
       server.closeAllConnections();
     };
     server.once("error", (error) => {
@@ -699,7 +842,7 @@ Run \`takuhon dev --help\` for usage.
         err(`takuhon: ${error.message}
 `);
       }
-      resolve3(2);
+      resolve7(2);
     });
     server.listen(parsed.port, "127.0.0.1", () => {
       out(
@@ -711,33 +854,679 @@ Run \`takuhon dev --help\` for usage.
         err(
           `takuhon dev: ${parsed.path} is not a valid profile yet; the preview will show the error until it is fixed.
 `
-        );
-      }
-      process.once("SIGINT", shutdown);
-      process.once("SIGTERM", shutdown);
-    });
-  });
+        );
+      }
+      process.once("SIGINT", shutdown);
+      process.once("SIGTERM", shutdown);
+    });
+  });
+}
+function parseArgs(args) {
+  let path;
+  let portRaw;
+  let baseUrl;
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--port" || arg === "--base-url") {
+      const value = args[i + 1];
+      if (value === void 0 || value === "" || value.startsWith("-")) {
+        return { error: `takuhon: \`${arg}\` requires a value.` };
+      }
+      if (arg === "--port") portRaw = value;
+      else baseUrl = value;
+      i++;
+      continue;
+    }
+    if (arg.startsWith("--port=")) {
+      const value = arg.slice("--port=".length);
+      if (value === "") return { error: "takuhon: `--port` requires a value." };
+      portRaw = value;
+      continue;
+    }
+    if (arg.startsWith("--base-url=")) {
+      const value = arg.slice("--base-url=".length);
+      if (value === "") return { error: "takuhon: `--base-url` requires a value." };
+      baseUrl = value;
+      continue;
+    }
+    if (arg.startsWith("-")) {
+      return { error: `takuhon: unknown option \`${arg}\` for \`dev\`.` };
+    }
+    if (path !== void 0) {
+      return { error: "takuhon: `dev` takes at most one path argument." };
+    }
+    path = arg;
+  }
+  let port = DEFAULT_PORT;
+  if (portRaw !== void 0) {
+    const parsedPort = parsePort(portRaw);
+    if (parsedPort === void 0) {
+      return {
+        error: `takuhon: \`--port\` must be an integer between 1 and 65535 (got \`${portRaw}\`).`
+      };
+    }
+    port = parsedPort;
+  }
+  if (baseUrl !== void 0 && !isHttpUrl(baseUrl)) {
+    return { error: "takuhon: `--base-url` must be an absolute http(s) URL." };
+  }
+  return {
+    path: path ?? DEFAULT_PATH2,
+    port,
+    // Drop any trailing slash so URL joins are predictable.
+    baseUrl: baseUrl?.replace(/\/+$/, "")
+  };
+}
+function parsePort(value) {
+  if (!/^\d+$/.test(value)) return void 0;
+  const n = Number(value);
+  return Number.isInteger(n) && n >= 1 && n <= 65535 ? n : void 0;
+}
+function isHttpUrl(value) {
+  try {
+    const url = new URL(value);
+    return url.protocol === "http:" || url.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+function pathnameOf(url) {
+  try {
+    return new URL(url, "http://localhost").pathname;
+  } catch {
+    return url;
+  }
+}
+function devPage(title, body) {
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escapeHtml(title)}</title>
+<style>body{margin:0;font:16px/1.6 system-ui,-apple-system,sans-serif;color:#1a1a1a}main{max-width:42rem;margin:2rem auto;padding:0 1.25rem}pre{background:#f6f6f6;padding:1rem;border-radius:.4rem;overflow:auto;white-space:pre-wrap}code{background:#f2f2f2;padding:.1rem .3rem;border-radius:.2rem}</style>
+</head>
+<body>
+<main>
+${body}
+</main>
+</body>
+</html>
+`;
+}
+function renderErrorPage(message) {
+  return devPage(
+    "takuhon dev \u2014 error",
+    `<h1>takuhon dev</h1>
+<p>The profile could not be rendered:</p>
+<pre>${escapeHtml(message)}</pre>
+<p>Fix the file and reload.</p>`
+  );
+}
+function renderNotFoundPage(route, routes) {
+  const links = routes.map((r) => `<li><a href="${escapeHtml(r)}">${escapeHtml(r)}</a></li>`).join("");
+  return devPage(
+    "takuhon dev \u2014 404",
+    `<h1>404</h1>
+<p>No page for <code>${escapeHtml(route)}</code>.</p>
+<p>Available pages:</p>
+<ul>${links}</ul>`
+  );
+}
+
+// src/file-asset-storage.ts
+import { randomBytes } from "crypto";
+import {
+  existsSync,
+  mkdirSync as mkdirSync2,
+  readdirSync,
+  readFileSync as readFileSync4,
+  renameSync as renameSync2,
+  rmSync as rmSync2,
+  statSync,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { basename as basename2, dirname as dirname4, extname, join as join4, resolve as resolve2, sep } from "path";
+import {
+  ACCEPTED_IMAGE_MIME_TYPES,
+  detectImageMime,
+  IMAGE_EXTENSIONS,
+  NotFoundError,
+  readImageInfo
+} from "@takuhon/core";
+var ASSET_DIRNAME = "assets";
+var ASSET_KEY_PREFIX = `${ASSET_DIRNAME}/`;
+var DEFAULT_EXTENSION = "bin";
+var MIME_BY_EXTENSION = new Map(
+  Object.entries(IMAGE_EXTENSIONS).map(([mime, ext]) => [ext, mime])
+);
+function asAcceptedMime(value) {
+  if (value === void 0) return null;
+  return ACCEPTED_IMAGE_MIME_TYPES.includes(value) ? value : null;
+}
+function contentTypeForFile(name) {
+  const ext = extname(name).slice(1).toLowerCase();
+  return MIME_BY_EXTENSION.get(ext) ?? "application/octet-stream";
+}
+function timestampSeconds() {
+  return Math.floor(Date.now() / 1e3);
+}
+function shortHash() {
+  return randomBytes(2).toString("hex");
+}
+function isNotFound2(err) {
+  return typeof err === "object" && err !== null && err.code === "ENOENT";
+}
+function writeFileAtomicBinary(target, bytes) {
+  const tmp = join4(dirname4(target), `.${basename2(target)}.${String(process.pid)}.tmp`);
+  try {
+    writeFileSync2(tmp, bytes);
+    renameSync2(tmp, target);
+  } catch (error) {
+    rmSync2(tmp, { force: true });
+    throw error;
+  }
+}
+var FileTakuhonAssetStorage = class {
+  profilePath;
+  publicBaseUrl;
+  constructor(profilePath, options = {}) {
+    this.profilePath = profilePath;
+    this.publicBaseUrl = options.publicBaseUrl ?? "";
+  }
+  // Genuinely async (awaits the Blob), so no `Promise.resolve().then()` wrap is
+  // needed here — unlike the synchronous methods below.
+  async putAsset(file, options) {
+    const bytes = new Uint8Array(await file.arrayBuffer());
+    const mime = asAcceptedMime(options?.contentType) ?? detectImageMime(bytes);
+    const ext = mime !== null ? IMAGE_EXTENSIONS[mime] : DEFAULT_EXTENSION;
+    const contentType2 = mime ?? options?.contentType ?? file.type ?? "application/octet-stream";
+    const key = `${ASSET_KEY_PREFIX}${String(timestampSeconds())}-${shortHash()}.${ext}`;
+    const full = join4(this.projectDir, key);
+    mkdirSync2(dirname4(full), { recursive: true });
+    writeFileAtomicBinary(full, bytes);
+    const info = mime !== null ? readImageInfo(bytes, mime) : null;
+    const url = `/${key}`;
+    return {
+      id: key,
+      url,
+      publicUrl: this.absoluteUrl(url),
+      mimeType: contentType2,
+      size: bytes.length,
+      width: info?.width,
+      height: info?.height,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  }
+  getPublicUrl(assetId) {
+    return Promise.resolve().then(() => {
+      const full = this.resolveKey(assetId);
+      if (full === null || !existsSync(full)) {
+        throw new NotFoundError(`No asset is stored for "${assetId}".`);
+      }
+      return this.absoluteUrl(`/${assetId}`);
+    });
+  }
+  deleteAsset(assetId) {
+    return Promise.resolve().then(() => {
+      const full = this.resolveKey(assetId);
+      if (full !== null) rmSync2(full, { force: true });
+    });
+  }
+  listAssets() {
+    return Promise.resolve().then(() => {
+      const root = join4(this.projectDir, ASSET_DIRNAME);
+      let names;
+      try {
+        names = readdirSync(root);
+      } catch (err) {
+        if (isNotFound2(err)) return [];
+        throw err;
+      }
+      return names.filter((name) => statSync(join4(root, name)).isFile()).sort().map((name) => {
+        const key = `${ASSET_KEY_PREFIX}${name}`;
+        const url = `/${key}`;
+        return {
+          id: key,
+          url,
+          publicUrl: this.absoluteUrl(url),
+          mimeType: contentTypeForFile(name),
+          size: statSync(join4(root, name)).size,
+          createdAt: statSync(join4(root, name)).mtime.toISOString()
+        };
+      });
+    });
+  }
+  /**
+   * Local-server helper (not part of {@link TakuhonAssetStorage}): read an asset
+   * for static delivery, or `null` when it is absent or the key escapes the
+   * `assets/` directory. The traversal guard lives here so the delivery route
+   * and the persistence methods share one notion of "where assets live".
+   */
+  readForServing(key) {
+    const full = this.resolveKey(key);
+    if (full === null) return null;
+    let bytes;
+    try {
+      bytes = readFileSync4(full);
+    } catch (err) {
+      if (isNotFound2(err)) return null;
+      throw err;
+    }
+    return { bytes, contentType: contentTypeForFile(full) };
+  }
+  get projectDir() {
+    return dirname4(resolve2(this.profilePath));
+  }
+  /** Resolve an `assets/...` key to an absolute path, or null if out of bounds. */
+  resolveKey(key) {
+    const root = resolve2(this.projectDir, ASSET_DIRNAME);
+    const full = resolve2(this.projectDir, key);
+    if (full !== root && !full.startsWith(root + sep)) return null;
+    return full;
+  }
+  absoluteUrl(path) {
+    return this.publicBaseUrl !== "" ? `${this.publicBaseUrl}${path}` : path;
+  }
+};
+
+// src/file-storage.ts
+import { createHash } from "crypto";
+import { readFileSync as readFileSync5, rmSync as rmSync3 } from "fs";
+import { ConflictError, NotFoundError as NotFoundError2 } from "@takuhon/core";
+function sha256Hex(content) {
+  return createHash("sha256").update(content, "utf8").digest("hex");
+}
+function isNotFound3(err) {
+  return typeof err === "object" && err !== null && err.code === "ENOENT";
+}
+function readMaybe(path) {
+  try {
+    return readFileSync5(path, "utf8");
+  } catch (err) {
+    if (isNotFound3(err)) return void 0;
+    throw err;
+  }
+}
+var FileStorage = class {
+  constructor(path, deps = {}) {
+    this.path = path;
+    this.now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  }
+  path;
+  now;
+  // The filesystem work is synchronous, but the TakuhonStorage contract is
+  // async. Each method runs its body inside `Promise.resolve().then(...)` so a
+  // synchronous throw becomes a rejected promise (e.g. NotFoundError →
+  // ConflictError mapping in the admin API) rather than an exception the caller
+  // must catch outside `await`.
+  getProfile() {
+    return Promise.resolve().then(() => {
+      const raw = readMaybe(this.path);
+      if (raw === void 0) {
+        throw new NotFoundError2("No profile is stored yet.");
+      }
+      let data;
+      try {
+        data = JSON.parse(raw);
+      } catch (err) {
+        throw new Error("The profile file is not valid JSON.", { cause: err });
+      }
+      return { data, version: sha256Hex(raw) };
+    });
+  }
+  saveProfile(data, ifMatch) {
+    return Promise.resolve().then(() => {
+      const current = readMaybe(this.path);
+      if (ifMatch !== void 0) {
+        const currentVersion = current === void 0 ? void 0 : sha256Hex(current);
+        if (currentVersion !== ifMatch) {
+          throw new ConflictError(
+            `If-Match preconditioned on version "${ifMatch}" but current is "${currentVersion ?? "absent"}".`,
+            { currentVersion }
+          );
+        }
+      }
+      if (current !== void 0) {
+        const stamp = this.now();
+        createBackup({
+          targetPath: this.path,
+          content: current,
+          name: (withMillis) => preAdminSaveName(stamp, withMillis)
+        });
+      }
+      const content = `${JSON.stringify(data, null, 2)}
+`;
+      writeFileAtomic(this.path, content);
+      return { version: sha256Hex(content) };
+    });
+  }
+  deleteProfile() {
+    return Promise.resolve().then(() => {
+      const current = readMaybe(this.path);
+      if (current === void 0) return;
+      const stamp = this.now();
+      createBackup({
+        targetPath: this.path,
+        content: current,
+        name: (withMillis) => preAdminSaveName(stamp, withMillis)
+      });
+      rmSync3(this.path, { force: true });
+    });
+  }
+};
+
+// src/admin-command.ts
+var DEFAULT_PATH3 = "takuhon.json";
+var DEFAULT_PORT2 = 4322;
+var USAGE2 = `Usage: takuhon admin [path] [--port <n>] [--base-url <url>]
+
+Run a local admin server: the form editor at /admin, the admin API at
+/api/admin/*, and a preview at /. With no path, edits ./takuhon.json. A fresh
+admin token is printed each run; paste it into the sign-in form. The server
+binds 127.0.0.1 only. Stop with Ctrl-C.
+
+Options:
+  --port <n>       Port to listen on (default: ${DEFAULT_PORT2}).
+  --base-url <url> Site origin for the preview's canonical / hreflang links.
+
+Exit codes: 0 = served then stopped, 2 = bad arguments / port in use.
+`;
+var CONTENT_TYPES = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".ico": "image/x-icon",
+  ".woff2": "font/woff2",
+  ".map": "application/json; charset=utf-8"
+};
+function contentTypeFor(file) {
+  return CONTENT_TYPES[extname2(file).toLowerCase()] ?? "application/octet-stream";
+}
+function isNotFound4(err) {
+  return typeof err === "object" && err !== null && err.code === "ENOENT";
+}
+function localAdminHeaders() {
+  const headers = { ...adminAssetSecurityHeaders() };
+  delete headers["strict-transport-security"];
+  const csp = headers["content-security-policy"];
+  if (csp !== void 0) {
+    headers["content-security-policy"] = csp.split(";").map((directive) => directive.trim()).filter((directive) => directive !== "" && directive !== "upgrade-insecure-requests").join("; ");
+  }
+  return headers;
+}
+var plain = (status, body) => new Response(body, { status, headers: { "content-type": "text/plain; charset=utf-8" } });
+function escapeHtmlAttr(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function injectLocalToken(html, token) {
+  const meta = `<meta name="takuhon-local-token" content="${escapeHtmlAttr(token)}" />`;
+  if (html.includes("</head>")) return html.replace("</head>", `${meta}</head>`);
+  return meta + html;
+}
+function serveAdminBundle(bundleDir, method, pathname, token) {
+  if (method !== "GET" && method !== "HEAD") return plain(405, "Method Not Allowed\n");
+  const rest = pathname.slice("/admin".length);
+  let rel;
+  try {
+    rel = decodeURIComponent(rest).replace(/^\/+/, "");
+  } catch {
+    rel = "";
+  }
+  if (rel === "") rel = "index.html";
+  const root = resolve3(bundleDir);
+  let full = resolve3(root, rel);
+  if (full !== root && !full.startsWith(root + sep2)) return plain(403, "Forbidden\n");
+  let body;
+  try {
+    body = readFileSync6(full);
+  } catch (err) {
+    if (!isNotFound4(err)) throw err;
+    if (extname2(rel) !== "") return plain(404, "Not Found\n");
+    full = join5(root, "index.html");
+    try {
+      body = readFileSync6(full);
+    } catch {
+      return plain(404, "Not Found\n");
+    }
+  }
+  const contentType2 = contentTypeFor(full);
+  const headers = new Headers(localAdminHeaders());
+  headers.set("content-type", contentType2);
+  if (contentType2.startsWith("text/html")) {
+    const injected = injectLocalToken(body.toString("utf8"), token);
+    return new Response(method === "HEAD" ? null : injected, { status: 200, headers });
+  }
+  return new Response(method === "HEAD" ? null : body, { status: 200, headers });
+}
+function serveLocalAsset(assetStorage, method, pathname) {
+  if (method !== "GET" && method !== "HEAD") return plain(405, "Method Not Allowed\n");
+  let key;
+  try {
+    key = decodeURIComponent(pathname.slice(1));
+  } catch {
+    return plain(400, "Bad Request\n");
+  }
+  const asset = assetStorage.readForServing(key);
+  if (asset === null) return plain(404, "Not Found\n");
+  const headers = new Headers();
+  headers.set("content-type", asset.contentType);
+  headers.set("x-content-type-options", "nosniff");
+  headers.set("cache-control", "public, max-age=31536000, immutable");
+  return new Response(method === "HEAD" ? null : asset.bytes, { status: 200, headers });
+}
+function createAdminApp(opts) {
+  const bundleDir = opts.bundleDir ?? resolveAdminBundleDir();
+  const storage = new FileStorage(opts.path);
+  const assetStorage = new FileTakuhonAssetStorage(opts.path, { publicBaseUrl: opts.assetBaseUrl });
+  const app = new Hono();
+  app.route(
+    "/api/admin",
+    createAdminApiApp({
+      storage,
+      assetStorage,
+      getAdminToken: () => opts.token,
+      // Loopback, same-origin SPA: no Origin allowlist needed (empty = skip).
+      getAdminOrigins: () => [],
+      cachePurger: noopCachePurger,
+      auditLogger: noopAuditLogger
+    })
+  );
+  app.all("*", (c) => {
+    const { method, path } = c.req;
+    if (path === "/admin" || path.startsWith("/admin/")) {
+      return serveAdminBundle(bundleDir, method, path, opts.token);
+    }
+    if (path.startsWith("/assets/")) {
+      return serveLocalAsset(assetStorage, method, path);
+    }
+    const state = loadSiteState(opts.path, opts.baseUrl);
+    const res = handleRequest(method, path, state);
+    return new Response(method === "HEAD" ? null : res.body, {
+      status: res.status,
+      headers: { "content-type": res.contentType }
+    });
+  });
+  return app;
+}
+function parseArgs2(args) {
+  let path;
+  let portRaw;
+  let baseUrl;
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--port" || arg === "--base-url") {
+      const value = args[i + 1];
+      if (value === void 0 || value === "" || value.startsWith("-")) {
+        return { error: `takuhon: \`${arg}\` requires a value.` };
+      }
+      if (arg === "--port") portRaw = value;
+      else baseUrl = value;
+      i++;
+      continue;
+    }
+    if (arg.startsWith("--port=")) {
+      portRaw = arg.slice("--port=".length);
+      if (portRaw === "") return { error: "takuhon: `--port` requires a value." };
+      continue;
+    }
+    if (arg.startsWith("--base-url=")) {
+      baseUrl = arg.slice("--base-url=".length);
+      if (baseUrl === "") return { error: "takuhon: `--base-url` requires a value." };
+      continue;
+    }
+    if (arg.startsWith("-")) return { error: `takuhon: unknown option \`${arg}\` for \`admin\`.` };
+    if (path !== void 0) return { error: "takuhon: `admin` takes at most one path argument." };
+    path = arg;
+  }
+  let port = DEFAULT_PORT2;
+  if (portRaw !== void 0) {
+    if (!/^\d+$/.test(portRaw)) {
+      return {
+        error: `takuhon: \`--port\` must be an integer between 1 and 65535 (got \`${portRaw}\`).`
+      };
+    }
+    const n = Number(portRaw);
+    if (!Number.isInteger(n) || n < 1 || n > 65535) {
+      return {
+        error: `takuhon: \`--port\` must be an integer between 1 and 65535 (got \`${portRaw}\`).`
+      };
+    }
+    port = n;
+  }
+  if (baseUrl !== void 0 && !isHttpUrl2(baseUrl)) {
+    return { error: "takuhon: `--base-url` must be an absolute http(s) URL." };
+  }
+  return { path: path ?? DEFAULT_PATH3, port, baseUrl: baseUrl?.replace(/\/+$/, "") };
+}
+function isHttpUrl2(value) {
+  try {
+    const url = new URL(value);
+    return url.protocol === "http:" || url.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+async function runAdmin(args = [], deps = {}) {
+  const out = deps.stdout ?? ((text) => void process.stdout.write(text));
+  const err = deps.stderr ?? ((text) => void process.stderr.write(text));
+  if (args[0] === "--help" || args[0] === "-h") {
+    out(USAGE2);
+    return 0;
+  }
+  const parsed = parseArgs2(args);
+  if ("error" in parsed) {
+    err(`${parsed.error}
+Run \`takuhon admin --help\` for usage.
+`);
+    return 2;
+  }
+  const token = deps.token ?? randomBytes2(32).toString("base64url");
+  const app = createAdminApp({
+    path: parsed.path,
+    token,
+    baseUrl: parsed.baseUrl,
+    assetBaseUrl: `http://127.0.0.1:${String(parsed.port)}`
+  });
+  return await new Promise((resolvePromise) => {
+    let closing = false;
+    function shutdown() {
+      if (closing) return;
+      closing = true;
+      process.removeListener("SIGINT", shutdown);
+      process.removeListener("SIGTERM", shutdown);
+      server.close(() => resolvePromise(0));
+    }
+    const server = serve({ fetch: app.fetch, hostname: "127.0.0.1", port: parsed.port }, () => {
+      const origin = `http://127.0.0.1:${parsed.port}`;
+      out(`takuhon admin: editing ${parsed.path} at ${origin}/ (Ctrl-C to stop)
+`);
+      out(`  Admin UI:    ${origin}/admin
+`);
+      out(`  Admin token: ${token}
+`);
+      out(`  Paste the token into the sign-in form; it is valid for this run only.
+`);
+      process.once("SIGINT", shutdown);
+      process.once("SIGTERM", shutdown);
+    });
+    server.on("error", (error) => {
+      if (error.code === "EADDRINUSE") {
+        err(`takuhon: port ${parsed.port} is already in use; pass --port <n> to choose another.
+`);
+      } else {
+        err(`takuhon: ${error.message}
+`);
+      }
+      resolvePromise(2);
+    });
+  });
+}
+
+// src/build-command.ts
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync7 } from "fs";
+import { dirname as dirname5, join as join6 } from "path";
+import { applyPublicPrivacyFilter as applyPublicPrivacyFilter2, normalize as normalize2, validate as validate2 } from "@takuhon/core";
+var DEFAULT_PATH4 = "takuhon.json";
+var DEFAULT_OUTPUT = "dist";
+var USAGE3 = `Usage: takuhon build [path] [--output <dir>] [--base-url <url>]
+
+Render a takuhon.json into a static site (one HTML page per locale, with
+build-time Schema.org JSON-LD). With no path, builds ./takuhon.json.
+
+Options:
+  --output <dir>   Output directory (default: ${DEFAULT_OUTPUT}). The default
+                   locale is written to <dir>/index.html and each other locale
+                   to <dir>/<locale>/index.html.
+  --base-url <url> Site origin (e.g. https://me.example). Enables absolute
+                   canonical and hreflang links; without it those are omitted.
+
+The public privacy filter is applied (meta.privacy is honoured). Asset URLs are
+referenced as-is and are not copied. The output directory is written into, not
+cleaned \u2014 use a dedicated/empty directory so stale pages do not linger.
+
+Exit codes: 0 = built, 1 = source is not a valid profile,
+2 = bad arguments / file missing / unreadable / not JSON / write failed.
+`;
+function runBuild(args = []) {
+  if (args[0] === "--help" || args[0] === "-h") {
+    return { code: 0, stdout: USAGE3, stderr: "" };
+  }
+  const parsed = parseArgs3(args);
+  if ("error" in parsed) {
+    return {
+      code: 2,
+      stdout: "",
+      stderr: `${parsed.error}
+Run \`takuhon build --help\` for usage.
+`
+    };
+  }
+  return buildSite(parsed);
 }
-function parseArgs2(args) {
+function parseArgs3(args) {
   let path;
-  let portRaw;
+  let output;
   let baseUrl;
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
-    if (arg === "--port" || arg === "--base-url") {
+    if (arg === "--output" || arg === "--base-url") {
       const value = args[i + 1];
       if (value === void 0 || value === "" || value.startsWith("-")) {
         return { error: `takuhon: \`${arg}\` requires a value.` };
       }
-      if (arg === "--port") portRaw = value;
+      if (arg === "--output") output = value;
       else baseUrl = value;
       i++;
       continue;
     }
-    if (arg.startsWith("--port=")) {
-      const value = arg.slice("--port=".length);
-      if (value === "") return { error: "takuhon: `--port` requires a value." };
-      portRaw = value;
+    if (arg.startsWith("--output=")) {
+      const value = arg.slice("--output=".length);
+      if (value === "") return { error: "takuhon: `--output` requires a value." };
+      output = value;
       continue;
     }
     if (arg.startsWith("--base-url=")) {
@@ -747,39 +1536,24 @@ function parseArgs2(args) {
       continue;
     }
     if (arg.startsWith("-")) {
-      return { error: `takuhon: unknown option \`${arg}\` for \`dev\`.` };
+      return { error: `takuhon: unknown option \`${arg}\` for \`build\`.` };
     }
     if (path !== void 0) {
-      return { error: "takuhon: `dev` takes at most one path argument." };
+      return { error: "takuhon: `build` takes at most one path argument." };
     }
     path = arg;
   }
-  let port = DEFAULT_PORT;
-  if (portRaw !== void 0) {
-    const parsedPort = parsePort(portRaw);
-    if (parsedPort === void 0) {
-      return {
-        error: `takuhon: \`--port\` must be an integer between 1 and 65535 (got \`${portRaw}\`).`
-      };
-    }
-    port = parsedPort;
-  }
-  if (baseUrl !== void 0 && !isHttpUrl2(baseUrl)) {
+  if (baseUrl !== void 0 && !isHttpUrl3(baseUrl)) {
     return { error: "takuhon: `--base-url` must be an absolute http(s) URL." };
   }
   return {
-    path: path ?? DEFAULT_PATH2,
-    port,
+    path: path ?? DEFAULT_PATH4,
+    output: output ?? DEFAULT_OUTPUT,
     // Drop any trailing slash so URL joins are predictable.
     baseUrl: baseUrl?.replace(/\/+$/, "")
   };
 }
-function parsePort(value) {
-  if (!/^\d+$/.test(value)) return void 0;
-  const n = Number(value);
-  return Number.isInteger(n) && n >= 1 && n <= 65535 ? n : void 0;
-}
-function isHttpUrl2(value) {
+function isHttpUrl3(value) {
   try {
     const url = new URL(value);
     return url.protocol === "http:" || url.protocol === "https:";
@@ -787,56 +1561,69 @@ function isHttpUrl2(value) {
     return false;
   }
 }
-function pathnameOf(url) {
+function buildSite(parsed) {
+  const { path, output, baseUrl } = parsed;
+  let raw;
   try {
-    return new URL(url, "http://localhost").pathname;
+    raw = readFileSync7(path, "utf8");
   } catch {
-    return url;
+    return {
+      code: 2,
+      stdout: "",
+      stderr: `takuhon: cannot read '${path}'. Pass a path, or run from a directory containing a takuhon.json.
+`
+    };
   }
-}
-function devPage(title, body) {
-  return `<!DOCTYPE html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>${escapeHtml(title)}</title>
-<style>body{margin:0;font:16px/1.6 system-ui,-apple-system,sans-serif;color:#1a1a1a}main{max-width:42rem;margin:2rem auto;padding:0 1.25rem}pre{background:#f6f6f6;padding:1rem;border-radius:.4rem;overflow:auto;white-space:pre-wrap}code{background:#f2f2f2;padding:.1rem .3rem;border-radius:.2rem}</style>
-</head>
-<body>
-<main>
-${body}
-</main>
-</body>
-</html>
-`;
-}
-function renderErrorPage(message) {
-  return devPage(
-    "takuhon dev \u2014 error",
-    `<h1>takuhon dev</h1>
-<p>The profile could not be rendered:</p>
-<pre>${escapeHtml(message)}</pre>
-<p>Fix the file and reload.</p>`
-  );
-}
-function renderNotFoundPage(route, routes) {
-  const links = routes.map((r) => `<li><a href="${escapeHtml(r)}">${escapeHtml(r)}</a></li>`).join("");
-  return devPage(
-    "takuhon dev \u2014 404",
-    `<h1>404</h1>
-<p>No page for <code>${escapeHtml(route)}</code>.</p>
-<p>Available pages:</p>
-<ul>${links}</ul>`
-  );
+  let data;
+  try {
+    data = JSON.parse(raw);
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return { code: 2, stdout: "", stderr: `takuhon: '${path}' is not valid JSON: ${detail}
+` };
+  }
+  const result = validate2(data);
+  if (!result.ok) {
+    const lines = result.errors.map((e) => `  ${e.pointer || "/"}: ${e.message}`);
+    return {
+      code: 1,
+      stdout: "",
+      stderr: `takuhon: '${path}' is not a valid takuhon profile; refusing to build:
+${lines.join("\n")}
+`
+    };
+  }
+  const filtered = applyPublicPrivacyFilter2(normalize2(result.data));
+  const activitySnapshot = filtered.settings.activity?.enabled === true ? readActivitySnapshotSync(path) : null;
+  const written = [];
+  try {
+    for (const page of generateSite(filtered, { baseUrl, activitySnapshot })) {
+      const outFile = join6(output, page.file);
+      mkdirSync3(dirname5(outFile), { recursive: true });
+      writeFileAtomic(outFile, page.html);
+      written.push(outFile);
+    }
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return { code: 2, stdout: "", stderr: `takuhon: failed to write the site: ${detail}
+` };
+  }
+  const summary = written.map((w) => `  ${w}`).join("\n");
+  return {
+    code: 0,
+    stdout: `built ${written.length} page${written.length === 1 ? "" : "s"} from ${path}:
+${summary}
+`,
+    stderr: ""
+  };
 }
 
 // src/export-command.ts
-import { readFileSync as readFileSync3 } from "fs";
-import { resolve } from "path";
+import { readFileSync as readFileSync8 } from "fs";
+import { resolve as resolve4 } from "path";
 import { exportTakuhon, validate as validate3 } from "@takuhon/core";
-var DEFAULT_PATH3 = "takuhon.json";
-var USAGE3 = `Usage: takuhon export [path] [--output <file>]
+var DEFAULT_PATH5 = "takuhon.json";
+var USAGE4 = `Usage: takuhon export [path] [--output <file>]
 
 Serialise a takuhon.json into its transport form and print it to stdout, or
 write it to a file with --output. With no path, exports ./takuhon.json in the
@@ -850,9 +1637,9 @@ Exit codes: 0 = exported, 1 = source is not a valid profile,
 `;
 function runExport(args = []) {
   if (args[0] === "--help" || args[0] === "-h") {
-    return { code: 0, stdout: USAGE3, stderr: "" };
+    return { code: 0, stdout: USAGE4, stderr: "" };
   }
-  const parsed = parseArgs3(args);
+  const parsed = parseArgs4(args);
   if ("error" in parsed) {
     return {
       code: 2,
@@ -864,7 +1651,7 @@ Run \`takuhon export --help\` for usage.
   }
   return exportFile(parsed);
 }
-function parseArgs3(args) {
+function parseArgs4(args) {
   let path;
   let output;
   for (let i = 0; i < args.length; i++) {
@@ -899,11 +1686,11 @@ function parseArgs3(args) {
     }
     path = arg;
   }
-  return { path: path ?? DEFAULT_PATH3, output };
+  return { path: path ?? DEFAULT_PATH5, output };
 }
 function exportFile(parsed) {
   const { path, output } = parsed;
-  if (output !== void 0 && resolve(output) === resolve(path)) {
+  if (output !== void 0 && resolve4(output) === resolve4(path)) {
     return {
       code: 2,
       stdout: "",
@@ -914,7 +1701,7 @@ Omit --output to print to stdout, or choose a different file.
   }
   let raw;
   try {
-    raw = readFileSync3(path, "utf8");
+    raw = readFileSync8(path, "utf8");
   } catch {
     return {
       code: 2,
@@ -959,7 +1746,7 @@ ${lines.join("\n")}
 }
 
 // src/import-command.ts
-import { readFileSync as readFileSync4 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 import {
   ImportError,
   MigrationError,
@@ -967,8 +1754,8 @@ import {
   importTakuhon,
   migrateTakuhon
 } from "@takuhon/core";
-var DEFAULT_PATH4 = "takuhon.json";
-var USAGE4 = `Usage: takuhon import <file> [path]
+var DEFAULT_PATH6 = "takuhon.json";
+var USAGE5 = `Usage: takuhon import <file> [path]
 
 Load a previously exported profile from <file> into a local takuhon.json,
 migrating it to the current schema version if needed. With no path, writes
@@ -982,9 +1769,9 @@ version), 2 = bad arguments / file missing / unreadable / not JSON / write faile
 `;
 function runImport(args = [], deps = {}) {
   if (args[0] === "--help" || args[0] === "-h") {
-    return { code: 0, stdout: USAGE4, stderr: "" };
+    return { code: 0, stdout: USAGE5, stderr: "" };
   }
-  const parsed = parseArgs4(args);
+  const parsed = parseArgs5(args);
   if ("error" in parsed) {
     return {
       code: 2,
@@ -997,7 +1784,7 @@ Run \`takuhon import --help\` for usage.
   const now = deps.now ?? (() => /* @__PURE__ */ new Date());
   return importFile(parsed, now);
 }
-function parseArgs4(args) {
+function parseArgs5(args) {
   const positionals = [];
   for (const arg of args) {
     if (arg.startsWith("-")) {
@@ -1011,13 +1798,13 @@ function parseArgs4(args) {
   if (positionals.length > 2) {
     return { error: "takuhon: `import` takes at most an input <file> and a target path." };
   }
-  return { file: positionals[0], path: positionals[1] ?? DEFAULT_PATH4 };
+  return { file: positionals[0], path: positionals[1] ?? DEFAULT_PATH6 };
 }
 function importFile(parsed, now) {
   const { file, path } = parsed;
   let raw;
   try {
-    raw = readFileSync4(file, "utf8");
+    raw = readFileSync9(file, "utf8");
   } catch {
     return { code: 2, stdout: "", stderr: `takuhon: cannot read '${file}'.
 ` };
@@ -1082,9 +1869,9 @@ ${lines2.join("\n")}` : ".";
   }
   let currentRaw;
   try {
-    currentRaw = readFileSync4(path, "utf8");
+    currentRaw = readFileSync9(path, "utf8");
   } catch (error) {
-    if (!isNotFound(error)) {
+    if (!isNotFound5(error)) {
       return { code: 2, stdout: "", stderr: `takuhon: cannot read current profile '${path}'.
 ` };
     }
@@ -1123,13 +1910,13 @@ ${lines2.join("\n")}` : ".";
   return { code: 0, stdout: `${lines.join("\n")}
 `, stderr: "" };
 }
-function isNotFound(error) {
+function isNotFound5(error) {
   return typeof error === "object" && error !== null && error.code === "ENOENT";
 }
 
 // src/migrate-command.ts
-import { readFileSync as readFileSync5 } from "fs";
-import { resolve as resolve2 } from "path";
+import { readFileSync as readFileSync10 } from "fs";
+import { resolve as resolve5 } from "path";
 import {
   MigrationError as MigrationError2,
   SCHEMA_VERSION as SCHEMA_VERSION2,
@@ -1137,8 +1924,8 @@ import {
   migrateTakuhon as migrateTakuhon2,
   validate as validate4
 } from "@takuhon/core";
-var DEFAULT_PATH5 = "takuhon.json";
-var USAGE5 = `Usage: takuhon migrate [path] [--to <version>] [--out <file>] [--dry-run]
+var DEFAULT_PATH7 = "takuhon.json";
+var USAGE6 = `Usage: takuhon migrate [path] [--to <version>] [--out <file>] [--dry-run]
 
 Forward-migrate a takuhon.json to a newer schema version. The source version
 is read from the file's own schemaVersion. With no path, migrates
@@ -1160,9 +1947,9 @@ Exit codes: 0 = migrated / already current / dry-run, 1 = cannot migrate,
 `;
 function runMigrate(args = [], deps = {}) {
   if (args[0] === "--help" || args[0] === "-h") {
-    return { code: 0, stdout: USAGE5, stderr: "" };
+    return { code: 0, stdout: USAGE6, stderr: "" };
   }
-  const parsed = parseArgs5(args);
+  const parsed = parseArgs6(args);
   if ("error" in parsed) {
     return {
       code: 2,
@@ -1175,7 +1962,7 @@ Run \`takuhon migrate --help\` for usage.
   const now = deps.now ?? (() => /* @__PURE__ */ new Date());
   return migrateFile(parsed, now);
 }
-function parseArgs5(args) {
+function parseArgs6(args) {
   let path;
   let to;
   let out;
@@ -1218,13 +2005,13 @@ function parseArgs5(args) {
       error: `takuhon: unsupported --to version "${target}". Supported: ${SUPPORTED_SCHEMA_VERSIONS.join(", ")}.`
     };
   }
-  return { path: path ?? DEFAULT_PATH5, to: target, out, dryRun };
+  return { path: path ?? DEFAULT_PATH7, to: target, out, dryRun };
 }
 function migrateFile(parsed, now) {
   const { path, to: target, out, dryRun } = parsed;
   let raw;
   try {
-    raw = readFileSync5(path, "utf8");
+    raw = readFileSync10(path, "utf8");
   } catch {
     return {
       code: 2,
@@ -1259,7 +2046,7 @@ function migrateFile(parsed, now) {
     };
   }
   const writeTarget = out ?? path;
-  const inPlace = resolve2(writeTarget) === resolve2(path);
+  const inPlace = resolve5(writeTarget) === resolve5(path);
   let migrated;
   try {
     migrated = migrateTakuhon2(data, target);
@@ -1337,11 +2124,119 @@ ${lines2.join("\n")}
 `, stderr: "" };
 }
 
+// src/refresh-admin-command.ts
+import { readFileSync as readFileSync11 } from "fs";
+import { cp, mkdtemp, readdir, rename, rm, stat } from "fs/promises";
+import { join as join7, resolve as resolve6 } from "path";
+var PROFILE_FILENAME = "takuhon.json";
+var USAGE7 = `Usage: takuhon admin update [path]
+
+Refresh a project's ${ADMIN_DIST_DIRNAME}/ with the admin form-UI bundle shipped in
+this @takuhon/cli. Use it after upgrading @takuhon/cli to pick up a newer admin
+UI without re-scaffolding. With no path, refreshes the project in the current
+directory. The project must already have an ${ADMIN_DIST_DIRNAME}/ (created by
+create-takuhon); this command updates it, it does not create one.
+
+Exit codes: 0 = refreshed, 2 = bad arguments / not a takuhon project /
+no ${ADMIN_DIST_DIRNAME}/ to refresh / copy failed.
+`;
+async function runRefreshAdmin(args = [], opts = {}) {
+  if (args[0] === "--help" || args[0] === "-h") {
+    return { code: 0, stdout: USAGE7, stderr: "" };
+  }
+  const unknownFlag = args.find((arg) => arg.startsWith("-"));
+  if (unknownFlag !== void 0) {
+    return usageError(`unknown option '${unknownFlag}'.`);
+  }
+  if (args.length > 1) {
+    return usageError("`admin update` takes at most one path argument.");
+  }
+  const displayDir = args[0] ?? ".";
+  const projectDir = resolve6(args[0] ?? ".");
+  try {
+    await stat(join7(projectDir, PROFILE_FILENAME));
+  } catch {
+    return {
+      code: 2,
+      stdout: "",
+      stderr: `takuhon: '${displayDir}' is not a takuhon project (no ${PROFILE_FILENAME} found).
+Run \`takuhon admin update\` from a project created by create-takuhon.
+`
+    };
+  }
+  const adminDist = join7(projectDir, ADMIN_DIST_DIRNAME);
+  const adminDistStat = await stat(adminDist).catch(() => void 0);
+  if (adminDistStat === void 0) {
+    return {
+      code: 2,
+      stdout: "",
+      stderr: `takuhon: '${displayDir}' has no ${ADMIN_DIST_DIRNAME}/ directory to refresh.
+This project was not scaffolded with the admin form UI; create a new project with create-takuhon to add it.
+`
+    };
+  }
+  if (!adminDistStat.isDirectory()) {
+    return {
+      code: 2,
+      stdout: "",
+      stderr: `takuhon: '${join7(displayDir, ADMIN_DIST_DIRNAME)}' exists but is not a directory.
+`
+    };
+  }
+  const bundleDir = opts.bundleDir ?? resolveAdminBundleDir();
+  let fileCount;
+  let staged;
+  try {
+    fileCount = (await readdir(bundleDir, { recursive: true, withFileTypes: true })).filter(
+      (entry) => entry.isFile()
+    ).length;
+    staged = await mkdtemp(join7(projectDir, `.${ADMIN_DIST_DIRNAME}-`));
+    await cp(bundleDir, staged, { recursive: true });
+    await rm(adminDist, { recursive: true, force: true });
+    await rename(staged, adminDist);
+    staged = void 0;
+  } catch (err) {
+    if (staged !== void 0) {
+      await rm(staged, { recursive: true, force: true }).catch(() => void 0);
+    }
+    const code = isNodeErrnoException(err) ? ` (${err.code})` : "";
+    return {
+      code: 2,
+      stdout: "",
+      stderr: `takuhon: failed to refresh ${ADMIN_DIST_DIRNAME}/ from @takuhon/cli${code}. Reinstall or upgrade @takuhon/cli and try again.
+`
+    };
+  }
+  const plural = fileCount === 1 ? "" : "s";
+  return {
+    code: 0,
+    stdout: `Refreshed ${ADMIN_DIST_DIRNAME}/ from @takuhon/cli@${readVersion()} (${fileCount} file${plural}).
+`,
+    stderr: ""
+  };
+}
+function usageError(message) {
+  return {
+    code: 2,
+    stdout: "",
+    stderr: `takuhon: ${message}
+Run \`takuhon admin update --help\` for usage.
+`
+  };
+}
+function readVersion() {
+  const pkg2 = JSON.parse(readFileSync11(new URL("../package.json", import.meta.url), "utf8"));
+  return pkg2.version;
+}
+function isNodeErrnoException(err) {
+  return err instanceof Error && typeof err.code === "string";
+}
+
 // src/restore-command.ts
-import { readFileSync as readFileSync6 } from "fs";
+import { readFileSync as readFileSync12 } from "fs";
 import { validate as validate5 } from "@takuhon/core";
-var DEFAULT_PATH6 = "takuhon.json";
-var USAGE6 = `Usage: takuhon restore --from <backup> [path] [--yes]
+var DEFAULT_PATH8 = "takuhon.json";
+var USAGE8 = `Usage: takuhon restore --from <backup> [path] [--yes]
 
 Overwrite a profile with a previously saved backup. With no path, restores
 ./takuhon.json in the current working directory.
@@ -1358,9 +2253,9 @@ Exit codes: 0 = restored / aborted, 1 = backup failed validation,
 `;
 async function runRestore(args = [], deps = {}) {
   if (args[0] === "--help" || args[0] === "-h") {
-    return { code: 0, stdout: USAGE6, stderr: "" };
+    return { code: 0, stdout: USAGE8, stderr: "" };
   }
-  const parsed = parseArgs6(args);
+  const parsed = parseArgs7(args);
   if ("error" in parsed) {
     return {
       code: 2,
@@ -1373,7 +2268,7 @@ Run \`takuhon restore --help\` for usage.
   const now = deps.now ?? (() => /* @__PURE__ */ new Date());
   return restoreFile(parsed, now, deps.confirm);
 }
-function parseArgs6(args) {
+function parseArgs7(args) {
   let from;
   let path;
   let yes = false;
@@ -1407,13 +2302,13 @@ function parseArgs6(args) {
   if (from === void 0 || from.length === 0) {
     return { error: "takuhon: `restore` requires `--from <backup>`." };
   }
-  return { from, path: path ?? DEFAULT_PATH6, yes };
+  return { from, path: path ?? DEFAULT_PATH8, yes };
 }
 async function restoreFile(parsed, now, confirm) {
   const { from, path, yes } = parsed;
   let backupRaw;
   try {
-    backupRaw = readFileSync6(from, "utf8");
+    backupRaw = readFileSync12(from, "utf8");
   } catch {
     return { code: 2, stdout: "", stderr: `takuhon: cannot read backup '${from}'.
 ` };
@@ -1443,9 +2338,9 @@ ${lines2.join("\n")}
   }
   let currentRaw;
   try {
-    currentRaw = readFileSync6(path, "utf8");
+    currentRaw = readFileSync12(path, "utf8");
   } catch (error) {
-    if (!isNotFound2(error)) {
+    if (!isNotFound6(error)) {
       return { code: 2, stdout: "", stderr: `takuhon: cannot read current profile '${path}'.
 ` };
     }
@@ -1508,17 +2403,17 @@ function confirmationMessage(path, from, data, currentRaw, preRestorePath) {
 ${preNote}
 Continue? [y/N]`;
 }
-function isNotFound2(error) {
+function isNotFound6(error) {
   return typeof error === "object" && error !== null && error.code === "ENOENT";
 }
 
 // src/sync-command.ts
-import { readFileSync as readFileSync7 } from "fs";
+import { readFileSync as readFileSync13 } from "fs";
 import { validate as validate6 } from "@takuhon/core";
-var DEFAULT_PATH7 = "takuhon.json";
+var DEFAULT_PATH9 = "takuhon.json";
 var ADMIN_PROFILE_PATH = "/api/admin/profile";
 var TOKEN_ENV = "TAKUHON_ADMIN_TOKEN";
-var USAGE7 = `Usage: takuhon sync [path] --url <base-url> [--if-match <etag>] [--dry-run]
+var USAGE9 = `Usage: takuhon sync [path] --url <base-url> [--if-match <etag>] [--dry-run]
 
 Push a local takuhon.json to a deployed takuhon instance by calling its admin
 write endpoint (PUT <base-url>/api/admin/profile). With no path, syncs
@@ -1544,9 +2439,9 @@ unset / auth failure / network error / other non-success response.
 `;
 async function runSync(args = [], deps = {}) {
   if (args[0] === "--help" || args[0] === "-h") {
-    return { code: 0, stdout: USAGE7, stderr: "" };
+    return { code: 0, stdout: USAGE9, stderr: "" };
   }
-  const parsed = parseArgs7(args);
+  const parsed = parseArgs8(args);
   if ("error" in parsed) {
     return {
       code: 2,
@@ -1558,7 +2453,7 @@ Run \`takuhon sync --help\` for usage.
   }
   return syncProfile(parsed, deps);
 }
-function parseArgs7(args) {
+function parseArgs8(args) {
   let path;
   let url;
   let ifMatch;
@@ -1604,7 +2499,7 @@ function parseArgs7(args) {
   }
   const base = parseOrigin(url);
   if ("error" in base) return base;
-  return { path: path ?? DEFAULT_PATH7, url: base.origin, ifMatch, dryRun };
+  return { path: path ?? DEFAULT_PATH9, url: base.origin, ifMatch, dryRun };
 }
 function parseOrigin(value) {
   let parsed;
@@ -1637,7 +2532,7 @@ async function syncProfile(parsed, deps) {
   const { path, url, ifMatch, dryRun } = parsed;
   let raw;
   try {
-    raw = readFileSync7(path, "utf8");
+    raw = readFileSync13(path, "utf8");
   } catch {
     return { code: 2, stdout: "", stderr: `takuhon: cannot read '${path}'.
 ` };
@@ -1708,7 +2603,7 @@ Set it for this command only, e.g.:
 async function interpretResponse(res, target) {
   const { path, url, endpoint } = target;
   if (res.ok) {
-    const version = await readVersion(res);
+    const version = await readVersion2(res);
     if (version === void 0) {
       return {
         code: 2,
@@ -1750,7 +2645,7 @@ ${lines.join("\n")}` : ".";
   return { code: 2, stdout: "", stderr: `takuhon: sync failed (${String(status)})${tail}
 ` };
 }
-async function readVersion(res) {
+async function readVersion2(res) {
   try {
     const parsed = await res.json();
     const version = parsed.meta?.version;
@@ -1774,10 +2669,10 @@ async function readProblem(res) {
 }
 
 // src/validate-command.ts
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync14 } from "fs";
 import { validate as validate7 } from "@takuhon/core";
-var DEFAULT_PATH8 = "takuhon.json";
-var USAGE8 = `Usage: takuhon validate [path]
+var DEFAULT_PATH10 = "takuhon.json";
+var USAGE10 = `Usage: takuhon validate [path]
 
 Validate a takuhon.json against the takuhon schema. With no path, validates
 ./takuhon.json in the current working directory.
@@ -1786,7 +2681,7 @@ Exit codes: 0 = valid, 1 = invalid, 2 = file missing / unreadable / not JSON.
 `;
 function runValidate(args = []) {
   if (args[0] === "--help" || args[0] === "-h") {
-    return { code: 0, stdout: USAGE8, stderr: "" };
+    return { code: 0, stdout: USAGE10, stderr: "" };
   }
   if (args.length > 1) {
     return {
@@ -1798,10 +2693,10 @@ function runValidate(args = []) {
   return validateFile(args[0]);
 }
 function validateFile(pathArg) {
-  const target = pathArg ?? DEFAULT_PATH8;
+  const target = pathArg ?? DEFAULT_PATH10;
   let raw;
   try {
-    raw = readFileSync8(target, "utf8");
+    raw = readFileSync14(target, "utf8");
   } catch {
     return {
       code: 2,
@@ -1843,7 +2738,7 @@ ${lines.join("\n")}
 }
 
 // src/index.ts
-var pkg = JSON.parse(readFileSync9(new URL("../package.json", import.meta.url), "utf8"));
+var pkg = JSON.parse(readFileSync15(new URL("../package.json", import.meta.url), "utf8"));
 var VERSION = pkg.version;
 var HELP = `takuhon ${VERSION}
 
@@ -1869,10 +2764,22 @@ Commands:
   takuhon dev [path] [--port <n>]      Serve a takuhon.json as a local static preview,
                                        re-rendered on each request (default port: 4321).
                                        --base-url <url> adds canonical/hreflang links.
+  takuhon admin [path] [--port <n>]    Run a local admin server: edit the profile through
+                                       the form UI at /admin (writes takuhon.json, backs up
+                                       first) with a preview at / (default port: 4322). Binds
+                                       127.0.0.1; prints a per-run token to paste into the form.
+  takuhon admin update [path]          Refresh a project's admin-dist/ with the admin form UI
+                                       bundled in this @takuhon/cli (use after upgrading the
+                                       CLI). Updates an existing admin-dist/ only.
   takuhon sync [path] --url <url>      Push a takuhon.json to a deployment's admin API
                                        (PUT <url>/api/admin/profile). Reads the admin token
                                        from TAKUHON_ADMIN_TOKEN. --if-match <etag> opts into
                                        optimistic locking; --dry-run previews without sending.
+  takuhon activity sync [path]         Fetch the GitHub / WakaTime activity configured in
+                                       settings.activity and store it as activity.json beside
+                                       the profile. Secrets come from the environment only:
+                                       TAKUHON_GITHUB_TOKEN (optional) / TAKUHON_WAKATIME_KEY.
+  takuhon activity show [path]         Print the stored activity snapshot (activity.json).
 
 Scaffolding a new profile project:
   npx create-takuhon my-profile
@@ -1904,6 +2811,12 @@ async function main(argv) {
   if (first === "dev") {
     return runDev(argv.slice(1));
   }
+  if (first === "admin") {
+    if (argv[1] === "update") {
+      return emit(await runRefreshAdmin(argv.slice(2)));
+    }
+    return runAdmin(argv.slice(1));
+  }
   if (first === "import") {
     return emit(runImport(argv.slice(1)));
   }
@@ -1914,6 +2827,26 @@ async function main(argv) {
   if (first === "sync") {
     return emit(await runSync(argv.slice(1)));
   }
+  if (first === "activity") {
+    const sub = argv[1];
+    if (sub === "sync") {
+      return emit(await runActivitySync(argv.slice(2)));
+    }
+    if (sub === "show") {
+      return emit(await runActivityShow(argv.slice(2)));
+    }
+    const usage = "Subcommands:\n  takuhon activity sync [path]   Fetch and store the activity snapshot\n  takuhon activity show [path]   Print the stored activity snapshot\nRun `takuhon activity sync --help` for details.\n";
+    if (sub === "--help" || sub === "-h") {
+      process.stdout.write(usage);
+      return 0;
+    }
+    process.stderr.write(
+      sub === void 0 ? `takuhon: \`activity\` requires a subcommand.
+${usage}` : `takuhon: unknown subcommand \`${sub}\` for \`activity\`.
+${usage}`
+    );
+    return 2;
+  }
   process.stderr.write(
     `takuhon: unknown command '${first}'
 Run \`takuhon --help\` for usage. For scaffolding a new project, use \`create-takuhon\`.