@takuhon/cli 0.11.0 → 0.12.0

package/dist/index.js

@@ -1,18 +1,344 @@
 #!/usr/bin/env node
 import {
+  ADMIN_DIST_DIRNAME,
   resolveAdminBundleDir
-} from "./chunk-JI2AH5Y3.js";
+} from "./chunk-XMSWT5NY.js";
 
 // src/index.ts
-import { readFileSync as readFileSync11, realpathSync } from "fs";
+import { readFileSync as readFileSync15, realpathSync } from "fs";
 import { stdin, stdout } from "process";
 import { createInterface } from "readline/promises";
 import { fileURLToPath } from "url";
 
+// src/activity-command.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { dirname as dirname3, join as join3 } from "path";
+import { fetchActivitySnapshot, isEmptySnapshot } from "@takuhon/activity";
+
+// src/file-activity-storage.ts
+import { readFileSync } from "fs";
+import { dirname as dirname2, join as join2, resolve } from "path";
+import { isActivitySnapshot } from "@takuhon/core";
+
+// src/backup.ts
+import { mkdirSync, renameSync, rmSync, writeFileSync } from "fs";
+import { basename, dirname, join } from "path";
+var BACKUP_DIR_NAME = ".takuhon-backups";
+var BackupError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "BackupError";
+  }
+};
+function compactTimestamp(date, withMillis = false) {
+  const iso = date.toISOString();
+  const trimmed = withMillis ? iso : iso.replace(/\.\d{3}Z$/, "Z");
+  return trimmed.replace(/[-:]/g, "");
+}
+function migrateBackupName(version, date, withMillis = false) {
+  return `takuhon-backup-v${version}-${compactTimestamp(date, withMillis)}.json`;
+}
+function preRestoreName(date, withMillis = false) {
+  return `pre-restore-${compactTimestamp(date, withMillis)}.json`;
+}
+function preImportName(date, withMillis = false) {
+  return `pre-import-${compactTimestamp(date, withMillis)}.json`;
+}
+function preAdminSaveName(date, withMillis = false) {
+  return `pre-admin-${compactTimestamp(date, withMillis)}.json`;
+}
+function backupDirFor(targetPath) {
+  return join(dirname(targetPath), BACKUP_DIR_NAME);
+}
+function createBackup(params) {
+  const dir = backupDirFor(params.targetPath);
+  mkdirSync(dir, { recursive: true });
+  const primary = join(dir, params.name(false));
+  try {
+    writeFileSync(primary, params.content, { flag: "wx" });
+    return primary;
+  } catch (error) {
+    if (!isAlreadyExists(error)) throw error;
+  }
+  const fallback = join(dir, params.name(true));
+  try {
+    writeFileSync(fallback, params.content, { flag: "wx" });
+    return fallback;
+  } catch (error) {
+    if (isAlreadyExists(error)) {
+      throw new BackupError(
+        `backup target already exists and could not be disambiguated: ${fallback}`,
+        { cause: error }
+      );
+    }
+    throw error;
+  }
+}
+function isAlreadyExists(error) {
+  return typeof error === "object" && error !== null && error.code === "EEXIST";
+}
+function writeFileAtomic(target, content) {
+  const tmp = join(dirname(target), `.${basename(target)}.${process.pid}.tmp`);
+  try {
+    writeFileSync(tmp, content, "utf8");
+    renameSync(tmp, target);
+  } catch (error) {
+    rmSync(tmp, { force: true });
+    throw error;
+  }
+}
+
+// src/file-activity-storage.ts
+var ACTIVITY_FILENAME = "activity.json";
+function isNotFound(err) {
+  return typeof err === "object" && err !== null && err.code === "ENOENT";
+}
+function activityPathFor(profilePath) {
+  return join2(dirname2(resolve(profilePath)), ACTIVITY_FILENAME);
+}
+function readSnapshotFile(path) {
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch (err) {
+    if (isNotFound(err)) return null;
+    throw err;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  return isActivitySnapshot(parsed) ? parsed : null;
+}
+function readActivitySnapshotSync(profilePath) {
+  return readSnapshotFile(activityPathFor(profilePath));
+}
+var FileActivityStorage = class {
+  /** Absolute path of the `activity.json` this storage reads and writes. */
+  path;
+  constructor(profilePath) {
+    this.path = activityPathFor(profilePath);
+  }
+  // The filesystem work is synchronous, but the ActivityStorage contract is
+  // async. Each method runs its body inside `Promise.resolve().then(...)` so a
+  // synchronous throw becomes a rejected promise rather than an exception the
+  // caller must catch outside `await` (same pattern as FileStorage).
+  getActivitySnapshot() {
+    return Promise.resolve().then(() => readSnapshotFile(this.path));
+  }
+  saveActivitySnapshot(snapshot) {
+    return Promise.resolve().then(() => {
+      writeFileAtomic(this.path, `${JSON.stringify(snapshot, null, 2)}
+`);
+    });
+  }
+};
+
+// src/activity-command.ts
+var DEFAULT_PATH = "takuhon.json";
+var GITHUB_TOKEN_ENV = "TAKUHON_GITHUB_TOKEN";
+var WAKATIME_KEY_ENV = "TAKUHON_WAKATIME_KEY";
+var SYNC_USAGE = `Usage: takuhon activity sync [path]
+
+Fetch the GitHub / WakaTime activity configured under settings.activity in a
+takuhon.json and store the result as activity.json beside it \u2014 the sibling
+snapshot the renderer reads, kept outside the canonical profile. With no path,
+syncs ./takuhon.json in the current working directory.
+
+Secrets are read from the environment, never from flags or the profile:
+  ${GITHUB_TOKEN_ENV}   Optional. Raises the GitHub rate limit and unlocks the
+                         contribution calendar (which is GraphQL/token-only).
+                         Languages work without it.
+  ${WAKATIME_KEY_ENV}   Required to read WakaTime coding time.
+
+A sync that gathers no data keeps the last-known activity.json \u2014 a good
+snapshot is never overwritten with an empty one.
+
+Exit codes: 0 = synced, 1 = no data gathered (last-known snapshot kept),
+2 = bad arguments / profile missing / unreadable / not JSON / activity not
+configured or not enabled in settings.activity.
+`;
+var SHOW_USAGE = `Usage: takuhon activity show [path]
+
+Print the stored activity snapshot (the activity.json beside the profile) as
+JSON. With no path, reads beside ./takuhon.json in the current working
+directory.
+
+Exit codes: 0 = printed, 1 = no (or invalid) snapshot stored, 2 = bad
+arguments.
+`;
+function defaultSecrets() {
+  return {
+    githubToken: process.env[GITHUB_TOKEN_ENV],
+    wakatimeKey: process.env[WAKATIME_KEY_ENV]
+  };
+}
+function parsePathArg(args, sub) {
+  let path;
+  for (const arg of args) {
+    if (arg.startsWith("-")) {
+      return { error: `takuhon: unknown option \`${arg}\` for \`activity ${sub}\`.` };
+    }
+    if (path !== void 0) {
+      return { error: `takuhon: \`activity ${sub}\` takes at most one path argument.` };
+    }
+    path = arg;
+  }
+  return { path: path ?? DEFAULT_PATH };
+}
+function activityDisplayPath(profilePath) {
+  return join3(dirname3(profilePath), ACTIVITY_FILENAME);
+}
+function readActivityConfig(path) {
+  const fail = (code, stderr) => ({
+    outcome: { code, stdout: "", stderr }
+  });
+  let raw;
+  try {
+    raw = readFileSync2(path, "utf8");
+  } catch {
+    return fail(
+      2,
+      `takuhon: cannot read '${path}'. Pass a path, or run from a directory containing a takuhon.json.
+`
+    );
+  }
+  let data;
+  try {
+    data = JSON.parse(raw);
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return fail(2, `takuhon: '${path}' is not valid JSON: ${detail}
+`);
+  }
+  const settings = typeof data === "object" && data !== null ? data.settings : void 0;
+  const config = settings?.activity;
+  if (config === void 0) {
+    return fail(
+      2,
+      `takuhon: '${path}' has no settings.activity; nothing to sync.
+Opt in by adding settings.activity with "enabled": true and a github/wakatime username.
+`
+    );
+  }
+  if (config.enabled !== true) {
+    return fail(
+      2,
+      `takuhon: activity is not enabled in '${path}'; nothing to sync.
+Set settings.activity.enabled to true to opt in.
+`
+    );
+  }
+  const hasGithub = config.github?.username !== void 0 && config.github.username !== "";
+  const hasWakatime = config.wakatime?.username !== void 0 && config.wakatime.username !== "";
+  if (!hasGithub && !hasWakatime) {
+    return fail(
+      2,
+      `takuhon: settings.activity in '${path}' names no github or wakatime username; nothing to sync.
+`
+    );
+  }
+  return { config };
+}
+function redactSecrets(text, secrets) {
+  let out = text;
+  for (const secret of [secrets.githubToken, secrets.wakatimeKey]) {
+    if (secret !== void 0 && secret !== "") out = out.split(secret).join("***");
+  }
+  return out;
+}
+async function runActivitySync(args = [], deps = {}) {
+  if (args[0] === "--help" || args[0] === "-h") {
+    return { code: 0, stdout: SYNC_USAGE, stderr: "" };
+  }
+  const parsed = parsePathArg(args, "sync");
+  if ("error" in parsed) {
+    return {
+      code: 2,
+      stdout: "",
+      stderr: `${parsed.error}
+Run \`takuhon activity sync --help\` for usage.
+`
+    };
+  }
+  const read = readActivityConfig(parsed.path);
+  if ("outcome" in read) return read.outcome;
+  const { config } = read;
+  const getSecrets = deps.getSecrets ?? defaultSecrets;
+  const secrets = getSecrets();
+  const notes = [];
+  const githubUser = config.github?.username;
+  if (githubUser !== void 0 && githubUser !== "" && config.github?.showContributions !== false && !secrets.githubToken) {
+    notes.push(
+      `takuhon: ${GITHUB_TOKEN_ENV} is not set; skipping GitHub contributions (languages need no token).
+`
+    );
+  }
+  const wakatimeUser = config.wakatime?.username;
+  if (wakatimeUser !== void 0 && wakatimeUser !== "" && config.wakatime?.showCodingTime !== false && !secrets.wakatimeKey) {
+    notes.push(`takuhon: ${WAKATIME_KEY_ENV} is not set; skipping WakaTime coding time.
+`);
+  }
+  const snapshot = await fetchActivitySnapshot(config, secrets, {
+    fetch: deps.fetch,
+    now: deps.now,
+    onError: (source, err) => {
+      const detail = err instanceof Error ? err.message : String(err);
+      notes.push(`takuhon: ${source} failed: ${redactSecrets(detail, secrets)}
+`);
+    }
+  });
+  const storage = new FileActivityStorage(parsed.path);
+  const displayPath = activityDisplayPath(parsed.path);
+  const stderr = notes.join("");
+  if (isEmptySnapshot(snapshot)) {
+    const existing = await storage.getActivitySnapshot();
+    const kept = existing !== null ? `keeping the last-known snapshot at '${displayPath}'` : "nothing written";
+    return {
+      code: 1,
+      stdout: "",
+      stderr: `${stderr}takuhon: the sync gathered no activity data; ${kept}.
+`
+    };
+  }
+  await storage.saveActivitySnapshot(snapshot);
+  const gathered = ["languages", "contributions", "codingTime", "rank"].filter((field) => snapshot[field] !== void 0).join(", ");
+  return { code: 0, stdout: `synced activity -> ${displayPath} (${gathered})
+`, stderr };
+}
+async function runActivityShow(args = []) {
+  if (args[0] === "--help" || args[0] === "-h") {
+    return { code: 0, stdout: SHOW_USAGE, stderr: "" };
+  }
+  const parsed = parsePathArg(args, "show");
+  if ("error" in parsed) {
+    return {
+      code: 2,
+      stdout: "",
+      stderr: `${parsed.error}
+Run \`takuhon activity show --help\` for usage.
+`
+    };
+  }
+  const snapshot = await new FileActivityStorage(parsed.path).getActivitySnapshot();
+  if (snapshot === null) {
+    return {
+      code: 1,
+      stdout: "",
+      stderr: `takuhon: no activity snapshot at '${activityDisplayPath(parsed.path)}'. Run \`takuhon activity sync\` first.
+`
+    };
+  }
+  return { code: 0, stdout: `${JSON.stringify(snapshot, null, 2)}
+`, stderr: "" };
+}
+
 // src/admin-command.ts
-import { randomBytes } from "crypto";
-import { readFileSync as readFileSync3 } from "fs";
-import { extname, join as join2, resolve, sep } from "path";
+import { randomBytes as randomBytes2 } from "crypto";
+import { readFileSync as readFileSync6 } from "fs";
+import { extname as extname2, join as join5, resolve as resolve3, sep as sep2 } from "path";
 import { serve } from "@hono/node-server";
 import {
   adminAssetSecurityHeaders,
@@ -23,12 +349,12 @@ import {
 import { Hono } from "hono";
 
 // src/dev-command.ts
-import { readFileSync } from "fs";
+import { readFileSync as readFileSync3 } from "fs";
 import { createServer } from "http";
 import { applyPublicPrivacyFilter, normalize, validate } from "@takuhon/core";
 
 // src/build-html.ts
-import { generateJsonLd } from "@takuhon/core";
+import { generateJsonLd, renderActivitySvg } from "@takuhon/core";
 function escapeHtml(value) {
   return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
@@ -64,6 +390,7 @@ ul{padding:0;margin:0;list-style:none}
 .rec blockquote{margin:0;padding-left:.9rem;border-left:3px solid var(--line)}
 .rec figcaption{color:var(--muted);font-size:.9rem;margin-top:.3rem}
 nav.locales{display:flex;gap:.75rem;margin-bottom:1rem;font-size:.9rem}
+.activity svg{max-width:100%;height:auto}
 footer.powered{max-width:42rem;margin:0 auto;padding:1.5rem 1.25rem;color:var(--muted);font-size:.85rem}`;
 function dateRange(start, end, isCurrent) {
   const left = start ?? "";
@@ -151,6 +478,12 @@ function renderContact(contact) {
   if (items.length === 0) return "";
   return `<section><h2>Contact</h2><ul class="entries">${items.join("")}</ul></section>`;
 }
+function renderActivity(snapshot) {
+  if (!snapshot) return "";
+  const svg = renderActivitySvg(snapshot);
+  if (svg === "") return "";
+  return `<section class="activity"><h2>Activity</h2>${svg}</section>`;
+}
 function renderJsonLdScript(data) {
   const payload = JSON.stringify(generateJsonLd(data));
   return `<script type="application/ld+json">${escapeJsonLd(payload)}</script>`;
@@ -202,6 +535,7 @@ function renderProfileHtml(input) {
       }))
     ),
     renderSkills(d.skills),
+    renderActivity(input.activitySnapshot),
     entryList(
       "Education",
       d.education.map((e) => {
@@ -320,6 +654,7 @@ function generateSite(profile, options = {}) {
   const defaultLocale = profile.settings.defaultLocale;
   const locales = [.../* @__PURE__ */ new Set([defaultLocale, ...profile.settings.availableLocales])];
   const jsonLd = profile.settings.enableJsonLd !== false;
+  const activitySnapshot = profile.settings.activity?.enabled === true ? options.activitySnapshot ?? void 0 : void 0;
   return locales.map((locale) => {
     const localized = resolveLocale(profile, locale);
     const isDefault = locale === defaultLocale;
@@ -330,7 +665,14 @@ function generateSite(profile, options = {}) {
     }));
     const canonicalUrl = baseUrl ? absoluteUrl(baseUrl, locale, defaultLocale) : void 0;
     const alternates = baseUrl ? buildAlternates(baseUrl, locales, defaultLocale) : [];
-    const html = renderProfileHtml({ localized, canonicalUrl, alternates, localeNav, jsonLd });
+    const html = renderProfileHtml({
+      localized,
+      canonicalUrl,
+      alternates,
+      localeNav,
+      jsonLd,
+      activitySnapshot
+    });
     return {
       route: isDefault ? "/" : `/${locale}/`,
       file: isDefault ? "index.html" : `${locale}/index.html`,
@@ -360,7 +702,7 @@ function localeHref(from, to, defaultLocale) {
 }
 
 // src/dev-command.ts
-var DEFAULT_PATH = "takuhon.json";
+var DEFAULT_PATH2 = "takuhon.json";
 var DEFAULT_PORT = 4321;
 var USAGE = `Usage: takuhon dev [path] [--port <n>] [--base-url <url>]
 
@@ -383,7 +725,7 @@ unreadable / port in use.
 function loadSiteState(path, baseUrl) {
   let raw;
   try {
-    raw = readFileSync(path, "utf8");
+    raw = readFileSync3(path, "utf8");
   } catch {
     return { ok: false, status: 500, message: `cannot read '${path}'.` };
   }
@@ -405,7 +747,10 @@ ${lines.join("\n")}`
     };
   }
   const filtered = applyPublicPrivacyFilter(normalize(result.data));
-  const pages = new Map(generateSite(filtered, { baseUrl }).map((p) => [p.route, p.html]));
+  const activitySnapshot = filtered.settings.activity?.enabled === true ? readActivitySnapshotSync(path) : null;
+  const pages = new Map(
+    generateSite(filtered, { baseUrl, activitySnapshot }).map((p) => [p.route, p.html])
+  );
   return { ok: true, pages };
 }
 function resolveRoute(urlPath) {
@@ -470,7 +815,7 @@ Run \`takuhon dev --help\` for usage.
     return 2;
   }
   try {
-    readFileSync(parsed.path, "utf8");
+    readFileSync3(parsed.path, "utf8");
   } catch {
     err(
       `takuhon: cannot read '${parsed.path}'. Pass a path, or run from a directory containing a takuhon.json.
@@ -479,14 +824,14 @@ Run \`takuhon dev --help\` for usage.
     return 2;
   }
   const server = createDevServer({ path: parsed.path, baseUrl: parsed.baseUrl });
-  return await new Promise((resolve4) => {
+  return await new Promise((resolve7) => {
     let closing = false;
     const shutdown = () => {
       if (closing) return;
       closing = true;
       process.removeListener("SIGINT", shutdown);
       process.removeListener("SIGTERM", shutdown);
-      server.close(() => resolve4(0));
+      server.close(() => resolve7(0));
       server.closeAllConnections();
     };
     server.once("error", (error) => {
@@ -497,7 +842,7 @@ Run \`takuhon dev --help\` for usage.
         err(`takuhon: ${error.message}
 `);
       }
-      resolve4(2);
+      resolve7(2);
     });
     server.listen(parsed.port, "127.0.0.1", () => {
       out(
@@ -566,7 +911,7 @@ function parseArgs(args) {
     return { error: "takuhon: `--base-url` must be an absolute http(s) URL." };
   }
   return {
-    path: path ?? DEFAULT_PATH,
+    path: path ?? DEFAULT_PATH2,
     port,
     // Drop any trailing slash so URL joins are predictable.
     baseUrl: baseUrl?.replace(/\/+$/, "")
@@ -629,91 +974,177 @@ function renderNotFoundPage(route, routes) {
   );
 }
 
-// src/file-storage.ts
-import { createHash } from "crypto";
-import { readFileSync as readFileSync2, rmSync as rmSync2 } from "fs";
-import { ConflictError, NotFoundError } from "@takuhon/core";
-
-// src/backup.ts
-import { mkdirSync, renameSync, rmSync, writeFileSync } from "fs";
-import { basename, dirname, join } from "path";
-var BACKUP_DIR_NAME = ".takuhon-backups";
-var BackupError = class extends Error {
-  constructor(message, options) {
-    super(message, options);
-    this.name = "BackupError";
-  }
-};
-function compactTimestamp(date, withMillis = false) {
-  const iso = date.toISOString();
-  const trimmed = withMillis ? iso : iso.replace(/\.\d{3}Z$/, "Z");
-  return trimmed.replace(/[-:]/g, "");
-}
-function migrateBackupName(version, date, withMillis = false) {
-  return `takuhon-backup-v${version}-${compactTimestamp(date, withMillis)}.json`;
-}
-function preRestoreName(date, withMillis = false) {
-  return `pre-restore-${compactTimestamp(date, withMillis)}.json`;
-}
-function preImportName(date, withMillis = false) {
-  return `pre-import-${compactTimestamp(date, withMillis)}.json`;
-}
-function preAdminSaveName(date, withMillis = false) {
-  return `pre-admin-${compactTimestamp(date, withMillis)}.json`;
+// src/file-asset-storage.ts
+import { randomBytes } from "crypto";
+import {
+  existsSync,
+  mkdirSync as mkdirSync2,
+  readdirSync,
+  readFileSync as readFileSync4,
+  renameSync as renameSync2,
+  rmSync as rmSync2,
+  statSync,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { basename as basename2, dirname as dirname4, extname, join as join4, resolve as resolve2, sep } from "path";
+import {
+  ACCEPTED_IMAGE_MIME_TYPES,
+  detectImageMime,
+  IMAGE_EXTENSIONS,
+  NotFoundError,
+  readImageInfo
+} from "@takuhon/core";
+var ASSET_DIRNAME = "assets";
+var ASSET_KEY_PREFIX = `${ASSET_DIRNAME}/`;
+var DEFAULT_EXTENSION = "bin";
+var MIME_BY_EXTENSION = new Map(
+  Object.entries(IMAGE_EXTENSIONS).map(([mime, ext]) => [ext, mime])
+);
+function asAcceptedMime(value) {
+  if (value === void 0) return null;
+  return ACCEPTED_IMAGE_MIME_TYPES.includes(value) ? value : null;
+}
+function contentTypeForFile(name) {
+  const ext = extname(name).slice(1).toLowerCase();
+  return MIME_BY_EXTENSION.get(ext) ?? "application/octet-stream";
+}
+function timestampSeconds() {
+  return Math.floor(Date.now() / 1e3);
+}
+function shortHash() {
+  return randomBytes(2).toString("hex");
 }
-function backupDirFor(targetPath) {
-  return join(dirname(targetPath), BACKUP_DIR_NAME);
+function isNotFound2(err) {
+  return typeof err === "object" && err !== null && err.code === "ENOENT";
 }
-function createBackup(params) {
-  const dir = backupDirFor(params.targetPath);
-  mkdirSync(dir, { recursive: true });
-  const primary = join(dir, params.name(false));
+function writeFileAtomicBinary(target, bytes) {
+  const tmp = join4(dirname4(target), `.${basename2(target)}.${String(process.pid)}.tmp`);
   try {
-    writeFileSync(primary, params.content, { flag: "wx" });
-    return primary;
+    writeFileSync2(tmp, bytes);
+    renameSync2(tmp, target);
   } catch (error) {
-    if (!isAlreadyExists(error)) throw error;
-  }
-  const fallback = join(dir, params.name(true));
-  try {
-    writeFileSync(fallback, params.content, { flag: "wx" });
-    return fallback;
-  } catch (error) {
-    if (isAlreadyExists(error)) {
-      throw new BackupError(
-        `backup target already exists and could not be disambiguated: ${fallback}`,
-        { cause: error }
-      );
-    }
+    rmSync2(tmp, { force: true });
     throw error;
   }
 }
-function isAlreadyExists(error) {
-  return typeof error === "object" && error !== null && error.code === "EEXIST";
-}
-function writeFileAtomic(target, content) {
-  const tmp = join(dirname(target), `.${basename(target)}.${process.pid}.tmp`);
-  try {
-    writeFileSync(tmp, content, "utf8");
-    renameSync(tmp, target);
-  } catch (error) {
-    rmSync(tmp, { force: true });
-    throw error;
+var FileTakuhonAssetStorage = class {
+  profilePath;
+  publicBaseUrl;
+  constructor(profilePath, options = {}) {
+    this.profilePath = profilePath;
+    this.publicBaseUrl = options.publicBaseUrl ?? "";
+  }
+  // Genuinely async (awaits the Blob), so no `Promise.resolve().then()` wrap is
+  // needed here — unlike the synchronous methods below.
+  async putAsset(file, options) {
+    const bytes = new Uint8Array(await file.arrayBuffer());
+    const mime = asAcceptedMime(options?.contentType) ?? detectImageMime(bytes);
+    const ext = mime !== null ? IMAGE_EXTENSIONS[mime] : DEFAULT_EXTENSION;
+    const contentType2 = mime ?? options?.contentType ?? file.type ?? "application/octet-stream";
+    const key = `${ASSET_KEY_PREFIX}${String(timestampSeconds())}-${shortHash()}.${ext}`;
+    const full = join4(this.projectDir, key);
+    mkdirSync2(dirname4(full), { recursive: true });
+    writeFileAtomicBinary(full, bytes);
+    const info = mime !== null ? readImageInfo(bytes, mime) : null;
+    const url = `/${key}`;
+    return {
+      id: key,
+      url,
+      publicUrl: this.absoluteUrl(url),
+      mimeType: contentType2,
+      size: bytes.length,
+      width: info?.width,
+      height: info?.height,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
   }
-}
+  getPublicUrl(assetId) {
+    return Promise.resolve().then(() => {
+      const full = this.resolveKey(assetId);
+      if (full === null || !existsSync(full)) {
+        throw new NotFoundError(`No asset is stored for "${assetId}".`);
+      }
+      return this.absoluteUrl(`/${assetId}`);
+    });
+  }
+  deleteAsset(assetId) {
+    return Promise.resolve().then(() => {
+      const full = this.resolveKey(assetId);
+      if (full !== null) rmSync2(full, { force: true });
+    });
+  }
+  listAssets() {
+    return Promise.resolve().then(() => {
+      const root = join4(this.projectDir, ASSET_DIRNAME);
+      let names;
+      try {
+        names = readdirSync(root);
+      } catch (err) {
+        if (isNotFound2(err)) return [];
+        throw err;
+      }
+      return names.filter((name) => statSync(join4(root, name)).isFile()).sort().map((name) => {
+        const key = `${ASSET_KEY_PREFIX}${name}`;
+        const url = `/${key}`;
+        return {
+          id: key,
+          url,
+          publicUrl: this.absoluteUrl(url),
+          mimeType: contentTypeForFile(name),
+          size: statSync(join4(root, name)).size,
+          createdAt: statSync(join4(root, name)).mtime.toISOString()
+        };
+      });
+    });
+  }
+  /**
+   * Local-server helper (not part of {@link TakuhonAssetStorage}): read an asset
+   * for static delivery, or `null` when it is absent or the key escapes the
+   * `assets/` directory. The traversal guard lives here so the delivery route
+   * and the persistence methods share one notion of "where assets live".
+   */
+  readForServing(key) {
+    const full = this.resolveKey(key);
+    if (full === null) return null;
+    let bytes;
+    try {
+      bytes = readFileSync4(full);
+    } catch (err) {
+      if (isNotFound2(err)) return null;
+      throw err;
+    }
+    return { bytes, contentType: contentTypeForFile(full) };
+  }
+  get projectDir() {
+    return dirname4(resolve2(this.profilePath));
+  }
+  /** Resolve an `assets/...` key to an absolute path, or null if out of bounds. */
+  resolveKey(key) {
+    const root = resolve2(this.projectDir, ASSET_DIRNAME);
+    const full = resolve2(this.projectDir, key);
+    if (full !== root && !full.startsWith(root + sep)) return null;
+    return full;
+  }
+  absoluteUrl(path) {
+    return this.publicBaseUrl !== "" ? `${this.publicBaseUrl}${path}` : path;
+  }
+};
 
 // src/file-storage.ts
+import { createHash } from "crypto";
+import { readFileSync as readFileSync5, rmSync as rmSync3 } from "fs";
+import { ConflictError, NotFoundError as NotFoundError2 } from "@takuhon/core";
 function sha256Hex(content) {
   return createHash("sha256").update(content, "utf8").digest("hex");
 }
-function isNotFound(err) {
+function isNotFound3(err) {
   return typeof err === "object" && err !== null && err.code === "ENOENT";
 }
 function readMaybe(path) {
   try {
-    return readFileSync2(path, "utf8");
+    return readFileSync5(path, "utf8");
   } catch (err) {
-    if (isNotFound(err)) return void 0;
+    if (isNotFound3(err)) return void 0;
     throw err;
   }
 }
@@ -733,7 +1164,7 @@ var FileStorage = class {
     return Promise.resolve().then(() => {
       const raw = readMaybe(this.path);
       if (raw === void 0) {
-        throw new NotFoundError("No profile is stored yet.");
+        throw new NotFoundError2("No profile is stored yet.");
       }
       let data;
       try {
@@ -780,13 +1211,13 @@ var FileStorage = class {
         content: current,
         name: (withMillis) => preAdminSaveName(stamp, withMillis)
       });
-      rmSync2(this.path, { force: true });
+      rmSync3(this.path, { force: true });
     });
   }
 };
 
 // src/admin-command.ts
-var DEFAULT_PATH2 = "takuhon.json";
+var DEFAULT_PATH3 = "takuhon.json";
 var DEFAULT_PORT2 = 4322;
 var USAGE2 = `Usage: takuhon admin [path] [--port <n>] [--base-url <url>]
 
@@ -813,9 +1244,9 @@ var CONTENT_TYPES = {
   ".map": "application/json; charset=utf-8"
 };
 function contentTypeFor(file) {
-  return CONTENT_TYPES[extname(file).toLowerCase()] ?? "application/octet-stream";
+  return CONTENT_TYPES[extname2(file).toLowerCase()] ?? "application/octet-stream";
 }
-function isNotFound2(err) {
+function isNotFound4(err) {
   return typeof err === "object" && err !== null && err.code === "ENOENT";
 }
 function localAdminHeaders() {
@@ -828,7 +1259,15 @@ function localAdminHeaders() {
   return headers;
 }
 var plain = (status, body) => new Response(body, { status, headers: { "content-type": "text/plain; charset=utf-8" } });
-function serveAdminBundle(bundleDir, method, pathname) {
+function escapeHtmlAttr(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function injectLocalToken(html, token) {
+  const meta = `<meta name="takuhon-local-token" content="${escapeHtmlAttr(token)}" />`;
+  if (html.includes("</head>")) return html.replace("</head>", `${meta}</head>`);
+  return meta + html;
+}
+function serveAdminBundle(bundleDir, method, pathname, token) {
   if (method !== "GET" && method !== "HEAD") return plain(405, "Method Not Allowed\n");
   const rest = pathname.slice("/admin".length);
   let rel;
@@ -838,34 +1277,57 @@ function serveAdminBundle(bundleDir, method, pathname) {
     rel = "";
   }
   if (rel === "") rel = "index.html";
-  const root = resolve(bundleDir);
-  let full = resolve(root, rel);
-  if (full !== root && !full.startsWith(root + sep)) return plain(403, "Forbidden\n");
+  const root = resolve3(bundleDir);
+  let full = resolve3(root, rel);
+  if (full !== root && !full.startsWith(root + sep2)) return plain(403, "Forbidden\n");
   let body;
   try {
-    body = readFileSync3(full);
+    body = readFileSync6(full);
   } catch (err) {
-    if (!isNotFound2(err)) throw err;
-    if (extname(rel) !== "") return plain(404, "Not Found\n");
-    full = join2(root, "index.html");
+    if (!isNotFound4(err)) throw err;
+    if (extname2(rel) !== "") return plain(404, "Not Found\n");
+    full = join5(root, "index.html");
     try {
-      body = readFileSync3(full);
+      body = readFileSync6(full);
     } catch {
       return plain(404, "Not Found\n");
     }
   }
+  const contentType2 = contentTypeFor(full);
   const headers = new Headers(localAdminHeaders());
-  headers.set("content-type", contentTypeFor(full));
+  headers.set("content-type", contentType2);
+  if (contentType2.startsWith("text/html")) {
+    const injected = injectLocalToken(body.toString("utf8"), token);
+    return new Response(method === "HEAD" ? null : injected, { status: 200, headers });
+  }
   return new Response(method === "HEAD" ? null : body, { status: 200, headers });
 }
+function serveLocalAsset(assetStorage, method, pathname) {
+  if (method !== "GET" && method !== "HEAD") return plain(405, "Method Not Allowed\n");
+  let key;
+  try {
+    key = decodeURIComponent(pathname.slice(1));
+  } catch {
+    return plain(400, "Bad Request\n");
+  }
+  const asset = assetStorage.readForServing(key);
+  if (asset === null) return plain(404, "Not Found\n");
+  const headers = new Headers();
+  headers.set("content-type", asset.contentType);
+  headers.set("x-content-type-options", "nosniff");
+  headers.set("cache-control", "public, max-age=31536000, immutable");
+  return new Response(method === "HEAD" ? null : asset.bytes, { status: 200, headers });
+}
 function createAdminApp(opts) {
   const bundleDir = opts.bundleDir ?? resolveAdminBundleDir();
   const storage = new FileStorage(opts.path);
+  const assetStorage = new FileTakuhonAssetStorage(opts.path, { publicBaseUrl: opts.assetBaseUrl });
   const app = new Hono();
   app.route(
     "/api/admin",
     createAdminApiApp({
       storage,
+      assetStorage,
       getAdminToken: () => opts.token,
       // Loopback, same-origin SPA: no Origin allowlist needed (empty = skip).
       getAdminOrigins: () => [],
@@ -876,7 +1338,10 @@ function createAdminApp(opts) {
   app.all("*", (c) => {
     const { method, path } = c.req;
     if (path === "/admin" || path.startsWith("/admin/")) {
-      return serveAdminBundle(bundleDir, method, path);
+      return serveAdminBundle(bundleDir, method, path, opts.token);
+    }
+    if (path.startsWith("/assets/")) {
+      return serveLocalAsset(assetStorage, method, path);
     }
     const state = loadSiteState(opts.path, opts.baseUrl);
     const res = handleRequest(method, path, state);
@@ -935,7 +1400,7 @@ function parseArgs2(args) {
   if (baseUrl !== void 0 && !isHttpUrl2(baseUrl)) {
     return { error: "takuhon: `--base-url` must be an absolute http(s) URL." };
   }
-  return { path: path ?? DEFAULT_PATH2, port, baseUrl: baseUrl?.replace(/\/+$/, "") };
+  return { path: path ?? DEFAULT_PATH3, port, baseUrl: baseUrl?.replace(/\/+$/, "") };
 }
 function isHttpUrl2(value) {
   try {
@@ -959,8 +1424,13 @@ Run \`takuhon admin --help\` for usage.
 `);
     return 2;
   }
-  const token = deps.token ?? randomBytes(32).toString("base64url");
-  const app = createAdminApp({ path: parsed.path, token, baseUrl: parsed.baseUrl });
+  const token = deps.token ?? randomBytes2(32).toString("base64url");
+  const app = createAdminApp({
+    path: parsed.path,
+    token,
+    baseUrl: parsed.baseUrl,
+    assetBaseUrl: `http://127.0.0.1:${String(parsed.port)}`
+  });
   return await new Promise((resolvePromise) => {
     let closing = false;
     function shutdown() {
@@ -997,10 +1467,10 @@ Run \`takuhon admin --help\` for usage.
 }
 
 // src/build-command.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync4 } from "fs";
-import { dirname as dirname2, join as join3 } from "path";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync7 } from "fs";
+import { dirname as dirname5, join as join6 } from "path";
 import { applyPublicPrivacyFilter as applyPublicPrivacyFilter2, normalize as normalize2, validate as validate2 } from "@takuhon/core";
-var DEFAULT_PATH3 = "takuhon.json";
+var DEFAULT_PATH4 = "takuhon.json";
 var DEFAULT_OUTPUT = "dist";
 var USAGE3 = `Usage: takuhon build [path] [--output <dir>] [--base-url <url>]
 
@@ -1077,7 +1547,7 @@ function parseArgs3(args) {
     return { error: "takuhon: `--base-url` must be an absolute http(s) URL." };
   }
   return {
-    path: path ?? DEFAULT_PATH3,
+    path: path ?? DEFAULT_PATH4,
     output: output ?? DEFAULT_OUTPUT,
     // Drop any trailing slash so URL joins are predictable.
     baseUrl: baseUrl?.replace(/\/+$/, "")
@@ -1095,7 +1565,7 @@ function buildSite(parsed) {
   const { path, output, baseUrl } = parsed;
   let raw;
   try {
-    raw = readFileSync4(path, "utf8");
+    raw = readFileSync7(path, "utf8");
   } catch {
     return {
       code: 2,
@@ -1124,11 +1594,12 @@ ${lines.join("\n")}
     };
   }
   const filtered = applyPublicPrivacyFilter2(normalize2(result.data));
+  const activitySnapshot = filtered.settings.activity?.enabled === true ? readActivitySnapshotSync(path) : null;
   const written = [];
   try {
-    for (const page of generateSite(filtered, { baseUrl })) {
-      const outFile = join3(output, page.file);
-      mkdirSync2(dirname2(outFile), { recursive: true });
+    for (const page of generateSite(filtered, { baseUrl, activitySnapshot })) {
+      const outFile = join6(output, page.file);
+      mkdirSync3(dirname5(outFile), { recursive: true });
       writeFileAtomic(outFile, page.html);
       written.push(outFile);
     }
@@ -1148,10 +1619,10 @@ ${summary}
 }
 
 // src/export-command.ts
-import { readFileSync as readFileSync5 } from "fs";
-import { resolve as resolve2 } from "path";
+import { readFileSync as readFileSync8 } from "fs";
+import { resolve as resolve4 } from "path";
 import { exportTakuhon, validate as validate3 } from "@takuhon/core";
-var DEFAULT_PATH4 = "takuhon.json";
+var DEFAULT_PATH5 = "takuhon.json";
 var USAGE4 = `Usage: takuhon export [path] [--output <file>]
 
 Serialise a takuhon.json into its transport form and print it to stdout, or
@@ -1215,11 +1686,11 @@ function parseArgs4(args) {
     }
     path = arg;
   }
-  return { path: path ?? DEFAULT_PATH4, output };
+  return { path: path ?? DEFAULT_PATH5, output };
 }
 function exportFile(parsed) {
   const { path, output } = parsed;
-  if (output !== void 0 && resolve2(output) === resolve2(path)) {
+  if (output !== void 0 && resolve4(output) === resolve4(path)) {
     return {
       code: 2,
       stdout: "",
@@ -1230,7 +1701,7 @@ Omit --output to print to stdout, or choose a different file.
   }
   let raw;
   try {
-    raw = readFileSync5(path, "utf8");
+    raw = readFileSync8(path, "utf8");
   } catch {
     return {
       code: 2,
@@ -1275,7 +1746,7 @@ ${lines.join("\n")}
 }
 
 // src/import-command.ts
-import { readFileSync as readFileSync6 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 import {
   ImportError,
   MigrationError,
@@ -1283,7 +1754,7 @@ import {
   importTakuhon,
   migrateTakuhon
 } from "@takuhon/core";
-var DEFAULT_PATH5 = "takuhon.json";
+var DEFAULT_PATH6 = "takuhon.json";
 var USAGE5 = `Usage: takuhon import <file> [path]
 
 Load a previously exported profile from <file> into a local takuhon.json,
@@ -1327,13 +1798,13 @@ function parseArgs5(args) {
   if (positionals.length > 2) {
     return { error: "takuhon: `import` takes at most an input <file> and a target path." };
   }
-  return { file: positionals[0], path: positionals[1] ?? DEFAULT_PATH5 };
+  return { file: positionals[0], path: positionals[1] ?? DEFAULT_PATH6 };
 }
 function importFile(parsed, now) {
   const { file, path } = parsed;
   let raw;
   try {
-    raw = readFileSync6(file, "utf8");
+    raw = readFileSync9(file, "utf8");
   } catch {
     return { code: 2, stdout: "", stderr: `takuhon: cannot read '${file}'.
 ` };
@@ -1398,9 +1869,9 @@ ${lines2.join("\n")}` : ".";
   }
   let currentRaw;
   try {
-    currentRaw = readFileSync6(path, "utf8");
+    currentRaw = readFileSync9(path, "utf8");
   } catch (error) {
-    if (!isNotFound3(error)) {
+    if (!isNotFound5(error)) {
       return { code: 2, stdout: "", stderr: `takuhon: cannot read current profile '${path}'.
 ` };
     }
@@ -1439,13 +1910,13 @@ ${lines2.join("\n")}` : ".";
   return { code: 0, stdout: `${lines.join("\n")}
 `, stderr: "" };
 }
-function isNotFound3(error) {
+function isNotFound5(error) {
   return typeof error === "object" && error !== null && error.code === "ENOENT";
 }
 
 // src/migrate-command.ts
-import { readFileSync as readFileSync7 } from "fs";
-import { resolve as resolve3 } from "path";
+import { readFileSync as readFileSync10 } from "fs";
+import { resolve as resolve5 } from "path";
 import {
   MigrationError as MigrationError2,
   SCHEMA_VERSION as SCHEMA_VERSION2,
@@ -1453,7 +1924,7 @@ import {
   migrateTakuhon as migrateTakuhon2,
   validate as validate4
 } from "@takuhon/core";
-var DEFAULT_PATH6 = "takuhon.json";
+var DEFAULT_PATH7 = "takuhon.json";
 var USAGE6 = `Usage: takuhon migrate [path] [--to <version>] [--out <file>] [--dry-run]
 
 Forward-migrate a takuhon.json to a newer schema version. The source version
@@ -1534,13 +2005,13 @@ function parseArgs6(args) {
       error: `takuhon: unsupported --to version "${target}". Supported: ${SUPPORTED_SCHEMA_VERSIONS.join(", ")}.`
     };
   }
-  return { path: path ?? DEFAULT_PATH6, to: target, out, dryRun };
+  return { path: path ?? DEFAULT_PATH7, to: target, out, dryRun };
 }
 function migrateFile(parsed, now) {
   const { path, to: target, out, dryRun } = parsed;
   let raw;
   try {
-    raw = readFileSync7(path, "utf8");
+    raw = readFileSync10(path, "utf8");
   } catch {
     return {
       code: 2,
@@ -1575,7 +2046,7 @@ function migrateFile(parsed, now) {
     };
   }
   const writeTarget = out ?? path;
-  const inPlace = resolve3(writeTarget) === resolve3(path);
+  const inPlace = resolve5(writeTarget) === resolve5(path);
   let migrated;
   try {
     migrated = migrateTakuhon2(data, target);
@@ -1653,11 +2124,119 @@ ${lines2.join("\n")}
 `, stderr: "" };
 }
 
+// src/refresh-admin-command.ts
+import { readFileSync as readFileSync11 } from "fs";
+import { cp, mkdtemp, readdir, rename, rm, stat } from "fs/promises";
+import { join as join7, resolve as resolve6 } from "path";
+var PROFILE_FILENAME = "takuhon.json";
+var USAGE7 = `Usage: takuhon admin update [path]
+
+Refresh a project's ${ADMIN_DIST_DIRNAME}/ with the admin form-UI bundle shipped in
+this @takuhon/cli. Use it after upgrading @takuhon/cli to pick up a newer admin
+UI without re-scaffolding. With no path, refreshes the project in the current
+directory. The project must already have an ${ADMIN_DIST_DIRNAME}/ (created by
+create-takuhon); this command updates it, it does not create one.
+
+Exit codes: 0 = refreshed, 2 = bad arguments / not a takuhon project /
+no ${ADMIN_DIST_DIRNAME}/ to refresh / copy failed.
+`;
+async function runRefreshAdmin(args = [], opts = {}) {
+  if (args[0] === "--help" || args[0] === "-h") {
+    return { code: 0, stdout: USAGE7, stderr: "" };
+  }
+  const unknownFlag = args.find((arg) => arg.startsWith("-"));
+  if (unknownFlag !== void 0) {
+    return usageError(`unknown option '${unknownFlag}'.`);
+  }
+  if (args.length > 1) {
+    return usageError("`admin update` takes at most one path argument.");
+  }
+  const displayDir = args[0] ?? ".";
+  const projectDir = resolve6(args[0] ?? ".");
+  try {
+    await stat(join7(projectDir, PROFILE_FILENAME));
+  } catch {
+    return {
+      code: 2,
+      stdout: "",
+      stderr: `takuhon: '${displayDir}' is not a takuhon project (no ${PROFILE_FILENAME} found).
+Run \`takuhon admin update\` from a project created by create-takuhon.
+`
+    };
+  }
+  const adminDist = join7(projectDir, ADMIN_DIST_DIRNAME);
+  const adminDistStat = await stat(adminDist).catch(() => void 0);
+  if (adminDistStat === void 0) {
+    return {
+      code: 2,
+      stdout: "",
+      stderr: `takuhon: '${displayDir}' has no ${ADMIN_DIST_DIRNAME}/ directory to refresh.
+This project was not scaffolded with the admin form UI; create a new project with create-takuhon to add it.
+`
+    };
+  }
+  if (!adminDistStat.isDirectory()) {
+    return {
+      code: 2,
+      stdout: "",
+      stderr: `takuhon: '${join7(displayDir, ADMIN_DIST_DIRNAME)}' exists but is not a directory.
+`
+    };
+  }
+  const bundleDir = opts.bundleDir ?? resolveAdminBundleDir();
+  let fileCount;
+  let staged;
+  try {
+    fileCount = (await readdir(bundleDir, { recursive: true, withFileTypes: true })).filter(
+      (entry) => entry.isFile()
+    ).length;
+    staged = await mkdtemp(join7(projectDir, `.${ADMIN_DIST_DIRNAME}-`));
+    await cp(bundleDir, staged, { recursive: true });
+    await rm(adminDist, { recursive: true, force: true });
+    await rename(staged, adminDist);
+    staged = void 0;
+  } catch (err) {
+    if (staged !== void 0) {
+      await rm(staged, { recursive: true, force: true }).catch(() => void 0);
+    }
+    const code = isNodeErrnoException(err) ? ` (${err.code})` : "";
+    return {
+      code: 2,
+      stdout: "",
+      stderr: `takuhon: failed to refresh ${ADMIN_DIST_DIRNAME}/ from @takuhon/cli${code}. Reinstall or upgrade @takuhon/cli and try again.
+`
+    };
+  }
+  const plural = fileCount === 1 ? "" : "s";
+  return {
+    code: 0,
+    stdout: `Refreshed ${ADMIN_DIST_DIRNAME}/ from @takuhon/cli@${readVersion()} (${fileCount} file${plural}).
+`,
+    stderr: ""
+  };
+}
+function usageError(message) {
+  return {
+    code: 2,
+    stdout: "",
+    stderr: `takuhon: ${message}
+Run \`takuhon admin update --help\` for usage.
+`
+  };
+}
+function readVersion() {
+  const pkg2 = JSON.parse(readFileSync11(new URL("../package.json", import.meta.url), "utf8"));
+  return pkg2.version;
+}
+function isNodeErrnoException(err) {
+  return err instanceof Error && typeof err.code === "string";
+}
+
 // src/restore-command.ts
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync12 } from "fs";
 import { validate as validate5 } from "@takuhon/core";
-var DEFAULT_PATH7 = "takuhon.json";
-var USAGE7 = `Usage: takuhon restore --from <backup> [path] [--yes]
+var DEFAULT_PATH8 = "takuhon.json";
+var USAGE8 = `Usage: takuhon restore --from <backup> [path] [--yes]
 
 Overwrite a profile with a previously saved backup. With no path, restores
 ./takuhon.json in the current working directory.
@@ -1674,7 +2253,7 @@ Exit codes: 0 = restored / aborted, 1 = backup failed validation,
 `;
 async function runRestore(args = [], deps = {}) {
   if (args[0] === "--help" || args[0] === "-h") {
-    return { code: 0, stdout: USAGE7, stderr: "" };
+    return { code: 0, stdout: USAGE8, stderr: "" };
   }
   const parsed = parseArgs7(args);
   if ("error" in parsed) {
@@ -1723,13 +2302,13 @@ function parseArgs7(args) {
   if (from === void 0 || from.length === 0) {
     return { error: "takuhon: `restore` requires `--from <backup>`." };
   }
-  return { from, path: path ?? DEFAULT_PATH7, yes };
+  return { from, path: path ?? DEFAULT_PATH8, yes };
 }
 async function restoreFile(parsed, now, confirm) {
   const { from, path, yes } = parsed;
   let backupRaw;
   try {
-    backupRaw = readFileSync8(from, "utf8");
+    backupRaw = readFileSync12(from, "utf8");
   } catch {
     return { code: 2, stdout: "", stderr: `takuhon: cannot read backup '${from}'.
 ` };
@@ -1759,9 +2338,9 @@ ${lines2.join("\n")}
   }
   let currentRaw;
   try {
-    currentRaw = readFileSync8(path, "utf8");
+    currentRaw = readFileSync12(path, "utf8");
   } catch (error) {
-    if (!isNotFound4(error)) {
+    if (!isNotFound6(error)) {
       return { code: 2, stdout: "", stderr: `takuhon: cannot read current profile '${path}'.
 ` };
     }
@@ -1824,17 +2403,17 @@ function confirmationMessage(path, from, data, currentRaw, preRestorePath) {
 ${preNote}
 Continue? [y/N]`;
 }
-function isNotFound4(error) {
+function isNotFound6(error) {
   return typeof error === "object" && error !== null && error.code === "ENOENT";
 }
 
 // src/sync-command.ts
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync13 } from "fs";
 import { validate as validate6 } from "@takuhon/core";
-var DEFAULT_PATH8 = "takuhon.json";
+var DEFAULT_PATH9 = "takuhon.json";
 var ADMIN_PROFILE_PATH = "/api/admin/profile";
 var TOKEN_ENV = "TAKUHON_ADMIN_TOKEN";
-var USAGE8 = `Usage: takuhon sync [path] --url <base-url> [--if-match <etag>] [--dry-run]
+var USAGE9 = `Usage: takuhon sync [path] --url <base-url> [--if-match <etag>] [--dry-run]
 
 Push a local takuhon.json to a deployed takuhon instance by calling its admin
 write endpoint (PUT <base-url>/api/admin/profile). With no path, syncs
@@ -1860,7 +2439,7 @@ unset / auth failure / network error / other non-success response.
 `;
 async function runSync(args = [], deps = {}) {
   if (args[0] === "--help" || args[0] === "-h") {
-    return { code: 0, stdout: USAGE8, stderr: "" };
+    return { code: 0, stdout: USAGE9, stderr: "" };
   }
   const parsed = parseArgs8(args);
   if ("error" in parsed) {
@@ -1920,7 +2499,7 @@ function parseArgs8(args) {
   }
   const base = parseOrigin(url);
   if ("error" in base) return base;
-  return { path: path ?? DEFAULT_PATH8, url: base.origin, ifMatch, dryRun };
+  return { path: path ?? DEFAULT_PATH9, url: base.origin, ifMatch, dryRun };
 }
 function parseOrigin(value) {
   let parsed;
@@ -1953,7 +2532,7 @@ async function syncProfile(parsed, deps) {
   const { path, url, ifMatch, dryRun } = parsed;
   let raw;
   try {
-    raw = readFileSync9(path, "utf8");
+    raw = readFileSync13(path, "utf8");
   } catch {
     return { code: 2, stdout: "", stderr: `takuhon: cannot read '${path}'.
 ` };
@@ -2024,7 +2603,7 @@ Set it for this command only, e.g.:
 async function interpretResponse(res, target) {
   const { path, url, endpoint } = target;
   if (res.ok) {
-    const version = await readVersion(res);
+    const version = await readVersion2(res);
     if (version === void 0) {
       return {
         code: 2,
@@ -2066,7 +2645,7 @@ ${lines.join("\n")}` : ".";
   return { code: 2, stdout: "", stderr: `takuhon: sync failed (${String(status)})${tail}
 ` };
 }
-async function readVersion(res) {
+async function readVersion2(res) {
   try {
     const parsed = await res.json();
     const version = parsed.meta?.version;
@@ -2090,10 +2669,10 @@ async function readProblem(res) {
 }
 
 // src/validate-command.ts
-import { readFileSync as readFileSync10 } from "fs";
+import { readFileSync as readFileSync14 } from "fs";
 import { validate as validate7 } from "@takuhon/core";
-var DEFAULT_PATH9 = "takuhon.json";
-var USAGE9 = `Usage: takuhon validate [path]
+var DEFAULT_PATH10 = "takuhon.json";
+var USAGE10 = `Usage: takuhon validate [path]
 
 Validate a takuhon.json against the takuhon schema. With no path, validates
 ./takuhon.json in the current working directory.
@@ -2102,7 +2681,7 @@ Exit codes: 0 = valid, 1 = invalid, 2 = file missing / unreadable / not JSON.
 `;
 function runValidate(args = []) {
   if (args[0] === "--help" || args[0] === "-h") {
-    return { code: 0, stdout: USAGE9, stderr: "" };
+    return { code: 0, stdout: USAGE10, stderr: "" };
   }
   if (args.length > 1) {
     return {
@@ -2114,10 +2693,10 @@ function runValidate(args = []) {
   return validateFile(args[0]);
 }
 function validateFile(pathArg) {
-  const target = pathArg ?? DEFAULT_PATH9;
+  const target = pathArg ?? DEFAULT_PATH10;
   let raw;
   try {
-    raw = readFileSync10(target, "utf8");
+    raw = readFileSync14(target, "utf8");
   } catch {
     return {
       code: 2,
@@ -2159,7 +2738,7 @@ ${lines.join("\n")}
 }
 
 // src/index.ts
-var pkg = JSON.parse(readFileSync11(new URL("../package.json", import.meta.url), "utf8"));
+var pkg = JSON.parse(readFileSync15(new URL("../package.json", import.meta.url), "utf8"));
 var VERSION = pkg.version;
 var HELP = `takuhon ${VERSION}
 
@@ -2189,10 +2768,18 @@ Commands:
                                        the form UI at /admin (writes takuhon.json, backs up
                                        first) with a preview at / (default port: 4322). Binds
                                        127.0.0.1; prints a per-run token to paste into the form.
+  takuhon admin update [path]          Refresh a project's admin-dist/ with the admin form UI
+                                       bundled in this @takuhon/cli (use after upgrading the
+                                       CLI). Updates an existing admin-dist/ only.
   takuhon sync [path] --url <url>      Push a takuhon.json to a deployment's admin API
                                        (PUT <url>/api/admin/profile). Reads the admin token
                                        from TAKUHON_ADMIN_TOKEN. --if-match <etag> opts into
                                        optimistic locking; --dry-run previews without sending.
+  takuhon activity sync [path]         Fetch the GitHub / WakaTime activity configured in
+                                       settings.activity and store it as activity.json beside
+                                       the profile. Secrets come from the environment only:
+                                       TAKUHON_GITHUB_TOKEN (optional) / TAKUHON_WAKATIME_KEY.
+  takuhon activity show [path]         Print the stored activity snapshot (activity.json).
 
 Scaffolding a new profile project:
   npx create-takuhon my-profile
@@ -2225,6 +2812,9 @@ async function main(argv) {
     return runDev(argv.slice(1));
   }
   if (first === "admin") {
+    if (argv[1] === "update") {
+      return emit(await runRefreshAdmin(argv.slice(2)));
+    }
     return runAdmin(argv.slice(1));
   }
   if (first === "import") {
@@ -2237,6 +2827,26 @@ async function main(argv) {
   if (first === "sync") {
     return emit(await runSync(argv.slice(1)));
   }
+  if (first === "activity") {
+    const sub = argv[1];
+    if (sub === "sync") {
+      return emit(await runActivitySync(argv.slice(2)));
+    }
+    if (sub === "show") {
+      return emit(await runActivityShow(argv.slice(2)));
+    }
+    const usage = "Subcommands:\n  takuhon activity sync [path]   Fetch and store the activity snapshot\n  takuhon activity show [path]   Print the stored activity snapshot\nRun `takuhon activity sync --help` for details.\n";
+    if (sub === "--help" || sub === "-h") {
+      process.stdout.write(usage);
+      return 0;
+    }
+    process.stderr.write(
+      sub === void 0 ? `takuhon: \`activity\` requires a subcommand.
+${usage}` : `takuhon: unknown subcommand \`${sub}\` for \`activity\`.
+${usage}`
+    );
+    return 2;
+  }
   process.stderr.write(
     `takuhon: unknown command '${first}'
 Run \`takuhon --help\` for usage. For scaffolding a new project, use \`create-takuhon\`.