hanna/fabrica

feat(web): axum shell — layout, theming, auth, assets, healthz

7d9b1ab · hanna committed on 2026-07-25

Stand up the web server: axum 0.8 + maud templates + htmx (vendored, no
build step) + tower-http (compression, tracing, request-id). No TLS
feature, so ring stays out of the graph.

- Layout: slim top bar, off-canvas drawer, theme picker, footer; every
  page wrapped by one shell that works without JavaScript.
- Theming: base.css is structure-only against --fb-* tokens with no
  literal colours; embedded dark/light themes plus disk overrides from
  themes_dir; asset overrides from assets_dir; path traversal rejected;
  SIGHUP re-scans themes.
- Auth: sign-in/out over opaque session cookies (SHA-256 validated in the
  store), invite completion that sets the password, and a settings stub.
  CSRF is double-submit; every non-GET route is checked.
- Ops: /assets, /theme, /healthz (git + db status), /version; themed,
  self-contained error pages that never leak internals.

serve is wired in the binary (src/serve.rs) via a cli callback so no
library crate depends on web; it runs foreground with graceful shutdown.
13 handler tests via oneshot; driven end-to-end against a live server.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

Cargo.lock +597 −4

Cargo.toml +33 −1

assets/base.css +379 −0

assets/fabrica.js +86 −0

assets/htmx.min.js +1 −1

assets/themes/dark.css +45 −0

assets/themes/light.css +44 −0

crates/cli/src/lib.rs +52 −7

crates/store/src/sessions.rs +0 −1

crates/web/Cargo.toml +24 −0

crates/web/src/assets.rs +244 −0

crates/web/src/error.rs +125 −0

crates/web/src/layout.rs +144 −0

crates/web/src/lib.rs +218 −1

crates/web/src/pages.rs +460 −0

crates/web/src/serve.rs +94 −0

crates/web/src/session.rs +136 −0

crates/web/src/tests.rs +238 −0

docs/decisions.md +37 −0

flake.nix +6 −4

src/main.rs +6 −3

src/serve.rs +61 −0

 path = "src/main.rs"
 [dependencies]
+# The binary wires the servers together: `cli` owns the command tree and hands
+# `serve` back to us so that no library crate has to depend on `web`.
 cli = { path = "crates/cli" }
+web = { path = "crates/web" }
+config = { path = "crates/config" }
+store = { path = "crates/store" }
+anyhow = { workspace = true }
+tokio = { workspace = true }
 [lints]
 workspace = true
     "macros",
 ] }
 ulid = "1"
-tokio = { version = "1", features = ["macros", "rt-multi-thread"] }
+tokio = { version = "1", features = [
+    "macros",
+    "rt-multi-thread",
+    "signal",
+    "net",
+    "time",
+    "fs",
+] }
 tempfile = "3"
 # Git object model (refs, trees, blobs, commits, diffs, signatures). Linked
 # against the system libgit2 (1.9) via pkg-config; the Nix build sets
     "tokio1-native-tls",
     "hostname",
 ] }
+# Web stack. No TLS/rustls features anywhere (TLS terminates at a reverse proxy),
+# so `ring` stays out of the graph. Versions are the current mutually-compatible
+# axum 0.8 set.
+axum = "0.8"
+axum-extra = { version = "0.12", features = ["cookie"] }
+maud = { version = "0.27", features = ["axum"] }
+tower = { version = "0.5", features = ["util"] }
+tower-http = { version = "0.6", features = [
+    "compression-gzip",
+    "trace",
+    "request-id",
+    "timeout",
+] }
+rust-embed = "8"
+mime_guess = "2"
+time = "0.3"
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt", "json"] }
 [workspace.lints.rust]
 unsafe_code = "forbid"

+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+//
+// Progressive enhancement only. Every interactive element works without this
+// file; it adds the mobile drawer, the theme picker, clipboard buttons, and a
+// couple of keyboard shortcuts. Kept small and dependency-free (< 200 lines).
+(function () {
+  "use strict";
+  // ---- Mobile nav drawer ----
+  function toggleDrawer(open) {
+    var body = document.body;
+    var isOpen = open === undefined ? !body.classList.contains("drawer-open") : open;
+    body.classList.toggle("drawer-open", isOpen);
+    var toggle = document.querySelector("[data-drawer-toggle]");
+    if (toggle) toggle.setAttribute("aria-expanded", isOpen ? "true" : "false");
+  }
+  document.addEventListener("click", function (e) {
+    var toggle = e.target.closest("[data-drawer-toggle]");
+    if (toggle) {
+      e.preventDefault();
+      toggleDrawer();
+      return;
+    }
+    if (e.target.closest("[data-drawer-close]") || e.target.classList.contains("drawer-backdrop")) {
+      toggleDrawer(false);
+    }
+  });
+  // ---- Theme picker ----
+  // Apply the chosen theme instantly for feedback, then submit the picker's form
+  // so the server persists the cookie and serves the matching stylesheet. Without
+  // JS the form's submit button does the same thing.
+  document.addEventListener("change", function (e) {
+    var picker = e.target.closest("[data-theme-picker]");
+    if (!picker) return;
+    var opt = picker.options[picker.selectedIndex];
+    var root = document.documentElement;
+    root.setAttribute("data-theme", picker.value);
+    if (opt && opt.getAttribute("data-scheme")) {
+      root.style.colorScheme = opt.getAttribute("data-scheme");
+    }
+    if (picker.form) picker.form.submit();
+  });
+  // ---- Clipboard buttons ----
+  document.addEventListener("click", function (e) {
+    var btn = e.target.closest("[data-clipboard]");
+    if (!btn) return;
+    e.preventDefault();
+    var text = btn.getAttribute("data-clipboard");
+    if (navigator.clipboard) {
+      navigator.clipboard.writeText(text).then(function () {
+        var old = btn.getAttribute("aria-label") || btn.textContent;
+        btn.setAttribute("aria-label", "Copied");
+        btn.classList.add("copied");
+        setTimeout(function () {
+          btn.setAttribute("aria-label", old);
+          btn.classList.remove("copied");
+        }, 1200);
+      });
+    }
+  });
+  // ---- Keyboard shortcuts ----
+  document.addEventListener("keydown", function (e) {
+    // Ignore when typing in a field.
+    var tag = (e.target.tagName || "").toLowerCase();
+    if (tag === "input" || tag === "textarea" || tag === "select" || e.target.isContentEditable) {
+      if (e.key === "Escape") e.target.blur();
+      return;
+    }
+    if (e.key === "/") {
+      var search = document.querySelector('input[type="search"], [data-search-input]');
+      if (search) {
+        e.preventDefault();
+        search.focus();
+      }
+    } else if (e.key === "Escape") {
+      toggleDrawer(false);
+    }
+  });
+})();

+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * dark — the default theme. Defines every documented --fb-* token; base.css is
+ * structure-only and reads exclusively from these. See docs/theming.md. */
+:root {
+  --fb-color-scheme: dark;
+  /* Surfaces & text */
+  --fb-bg: #0d1117;
+  --fb-bg-raised: #161b22;
+  --fb-bg-inset: #21262d;
+  --fb-border: #30363d;
+  --fb-fg: #e6edf3;
+  --fb-fg-muted: #8b949e;
+  /* Accents & status */
+  --fb-accent: #4493f8;
+  --fb-accent-fg: #ffffff;
+  --fb-success: #3fb950;
+  --fb-warning: #d29922;
+  --fb-danger: #f85149;
+  /* Diff row backgrounds & gutters */
+  --fb-diff-add-bg: rgba(63, 185, 80, 0.15);
+  --fb-diff-del-bg: rgba(248, 81, 73, 0.15);
+  --fb-diff-add-fg: #3fb950;
+  --fb-diff-del-fg: #f85149;
+  /* Syntax highlighting */
+  --fb-hl-keyword: #ff7b72;
+  --fb-hl-function: #d2a8ff;
+  --fb-hl-type: #7ee787;
+  --fb-hl-string: #a5d6ff;
+  --fb-hl-number: #79c0ff;
+  --fb-hl-comment: #8b949e;
+  --fb-hl-constant: #79c0ff;
+  --fb-hl-variable: #ffa657;
+  --fb-hl-operator: #ff7b72;
+  --fb-hl-punctuation: #c9d1d9;
+  --fb-hl-attribute: #7ee787;
+  --fb-hl-tag: #7ee787;
+}

+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * light — the embedded light theme. Defines every documented --fb-* token. */
+:root {
+  --fb-color-scheme: light;
+  /* Surfaces & text */
+  --fb-bg: #ffffff;
+  --fb-bg-raised: #f6f8fa;
+  --fb-bg-inset: #eaeef2;
+  --fb-border: #d0d7de;
+  --fb-fg: #1f2328;
+  --fb-fg-muted: #656d76;
+  /* Accents & status */
+  --fb-accent: #0969da;
+  --fb-accent-fg: #ffffff;
+  --fb-success: #1a7f37;
+  --fb-warning: #9a6700;
+  --fb-danger: #cf222e;
+  /* Diff row backgrounds & gutters */
+  --fb-diff-add-bg: rgba(26, 127, 55, 0.12);
+  --fb-diff-del-bg: rgba(207, 34, 46, 0.12);
+  --fb-diff-add-fg: #1a7f37;
+  --fb-diff-del-fg: #cf222e;
+  /* Syntax highlighting */
+  --fb-hl-keyword: #cf222e;
+  --fb-hl-function: #8250df;
+  --fb-hl-type: #1a7f37;
+  --fb-hl-string: #0a3069;
+  --fb-hl-number: #0550ae;
+  --fb-hl-comment: #6e7781;
+  --fb-hl-constant: #0550ae;
+  --fb-hl-variable: #953800;
+  --fb-hl-operator: #cf222e;
+  --fb-hl-punctuation: #24292f;
+  --fb-hl-attribute: #1a7f37;
+  --fb-hl-tag: #116329;
+}

         #[command(subcommand)]
         command: token_cmd::TokenCommand,
     },
+    /// Run the HTTPS and SSH servers in the foreground.
+    Serve {
+        /// Double-fork into the background and write a pid file. (Not yet
+        /// implemented — systemd/Docker manage the foreground process.)
+        #[arg(long)]
+        detach: bool,
+        /// Skip applying pending migrations on startup.
+        #[arg(long)]
+        no_migrate: bool,
+    },
     /// Apply pending database migrations.
     Migrate,
     /// Check that the environment fabrica needs is present and healthy.
     },
+}
+/// The parsed request to run `fabrica serve`, handed to the serve callback the
+/// root binary supplies. This keeps `cli` free of any dependency on `web`/`ssh`
+/// (no crate may depend on `web`); the binary wires the servers together.
+#[derive(Debug, Clone)]
+pub struct ServeRequest {
+    /// The `--config` path.
+    pub config_path: Option<PathBuf>,
+    /// Double-fork into the background.
+    pub detach: bool,
+    /// Skip startup migrations.
+    pub no_migrate: bool,
+}
+/// Resolve the instance signing secret (generating and persisting it on first
+/// use), for the binary's serve wiring.
+///
+/// # Errors
+///
+/// Returns an error if the secret file cannot be read or written.
+pub fn resolve_secret(config: &config::Config) -> anyhow::Result<String> {
+    context::ensure_secret(config)
+}
 /// Parse arguments and dispatch to the requested subcommand.
 ///
-/// Returns the process exit code. Argument-parse failures are handled by clap
+/// `serve` handles the `fabrica serve` command; the root binary supplies it so
-/// (which prints usage and exits); any other error is printed to stderr and
+/// the servers (which live in `web`/`ssh`) are wired without `cli` depending on
-/// mapped to [`ExitCode::FAILURE`].
+/// them. Returns the process exit code. Argument-parse failures are handled by
-#[must_use]
+/// clap; any other error is printed to stderr and mapped to
-pub fn run() -> ExitCode {
+/// [`ExitCode::FAILURE`].
+pub fn run<F>(serve: F) -> ExitCode
+where
+    F: FnOnce(ServeRequest) -> anyhow::Result<ExitCode>,
+{
     let cli = Cli::parse();
-    match dispatch(&cli) {
+    match dispatch(&cli, serve) {
         Ok(code) => code,
         Err(err) => {
             eprintln!("error: {err:#}");
+}
 /// Route a parsed [`Cli`] to its handler.
-fn dispatch(cli: &Cli) -> anyhow::Result<ExitCode> {
+fn dispatch<F>(cli: &Cli, serve: F) -> anyhow::Result<ExitCode>
+where
+    F: FnOnce(ServeRequest) -> anyhow::Result<ExitCode>,
+{
     match &cli.command {
+        Command::Serve { detach, no_migrate } => serve(ServeRequest {
+            config_path: cli.config.clone(),
+            detach: *detach,
+            no_migrate: *no_migrate,
+        }),
         Command::Config { command } => config_cmd::run(command, cli.config.as_deref(), cli.json),
         Command::User { command } => user_cmd::run(command, cli.config.as_deref(), cli.json),
         Command::Key { command } => key_cmd::run(command, cli.config.as_deref(), cli.json),

+]
 [[package]]
+name = "async-compression"
+version = "0.4.42"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e79b3f8a79cccc2898f31920fc69f304859b3bd567490f75ebf51ae1c792a9ac"
+dependencies = [
+ "compression-codecs",
+ "compression-core",
+ "pin-project-lite",
+ "tokio",
+]
+[[package]]
 name = "async-trait"
 version = "0.1.91"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+[[package]]
 name = "auth"
 version = "0.1.0"
 dependencies = [
 checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 [[package]]
+name = "axum"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
+dependencies = [
+ "axum-core",
+ "bytes",
+ "form_urlencoded",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "itoa",
+ "matchit",
+ "memchr",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "serde_core",
+ "serde_json",
+ "serde_path_to_error",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+[[package]]
+name = "axum-core"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+[[package]]
+name = "axum-extra"
+version = "0.12.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be44683b41ccb9ab2d23a5230015c9c3c55be97a25e4428366de8873103f7970"
+dependencies = [
+ "axum",
+ "axum-core",
+ "bytes",
+ "cookie",
+ "futures-core",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+[[package]]
 name = "base16ct"
 version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
 [[package]]
+name = "compression-codecs"
+version = "0.4.38"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce2548391e9c1929c21bf6aa2680af86fe4c1b33e6cea9ac1cfeec0bd11218cf"
+dependencies = [
+ "compression-core",
+ "flate2",
+ "memchr",
+]
+[[package]]
+name = "compression-core"
+version = "0.4.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc14f565cf027a105f7a44ccf9e5b424348421a1d8952a8fc9d499d313107789"
+[[package]]
 name = "concurrent-queue"
 version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
 [[package]]
+name = "const-oid"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
+[[package]]
 name = "convert_case"
 version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "cookie"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ddef33a339a91ea89fb53151bd0a4689cfce27055c291dfa69945475d22c747"
+dependencies = [
+ "percent-encoding",
+ "time",
+ "version_check",
+]
+[[package]]
 name = "core-foundation"
 version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fd121741cf3eb82c08dd3023eb55bf2665e5f60ec20f89760cf836ae4562e6a0"
 [[package]]
+name = "crc32fast"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
+dependencies = [
+ "cfg-if",
+]
+[[package]]
 name = "crossbeam-channel"
 version = "0.5.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
 dependencies = [
- "const-oid",
+ "const-oid 0.9.6",
  "pem-rfc7468",
  "zeroize",
+]
 [[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+dependencies = [
+ "powerfmt",
+]
+[[package]]
 name = "derive_builder"
 version = "0.20.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
  "block-buffer 0.10.4",
- "const-oid",
+ "const-oid 0.9.6",
  "crypto-common 0.1.6",
  "subtle",
+]
 checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
 dependencies = [
  "block-buffer 0.12.1",
+ "const-oid 0.10.2",
  "crypto-common 0.2.2",
  "ctutils",
+]
 name = "fabrica"
 version = "0.1.0"
 dependencies = [
+ "anyhow",
  "cli",
+ "config",
+ "store",
+ "tokio",
+ "web",
+]
 [[package]]
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
 dependencies = [
+ "crc32fast",
  "miniz_oxide",
  "zlib-rs",
+]
+]
 [[package]]
+name = "http"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+[[package]]
+name = "http-body"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
+dependencies = [
+ "bytes",
+ "http",
+]
+[[package]]
+name = "http-body-util"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9f41fd6a08e4d4ec69df65976da761afd5ad5e58a9d4acb46bd1c953a9e3ff2"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+[[package]]
 name = "httpdate"
 version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "hyper"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d22053281f852e11534f5198498373cbb59295120a20771d90f7ed1897490a72"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "http",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+]
+[[package]]
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = [
+ "bytes",
+ "http",
+ "http-body",
+ "hyper",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+[[package]]
 name = "icu_collections"
 version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "matchers"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
+dependencies = [
+ "regex-automata",
+]
+[[package]]
+name = "matchit"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
+[[package]]
+name = "maud"
+version = "0.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8156733e27020ea5c684db5beac5d1d611e1272ab17901a49466294b84fc217e"
+dependencies = [
+ "axum-core",
+ "http",
+ "itoa",
+ "maud_macros",
+]
+[[package]]
+name = "maud_macros"
+version = "0.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7261b00f3952f617899bc012e3dbd56e4f0110a038175929fa5d18e5a19913ca"
+dependencies = [
+ "proc-macro2",
+ "proc-macro2-diagnostics",
+ "quote",
+ "syn 2.0.119",
+]
+[[package]]
 name = "md-5"
 version = "0.10.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 [[package]]
+name = "mime_guess"
+version = "2.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7c44f8e672c00fe5308fa235f821cb4198414e1c77935c1ab6948d3fd78550e"
+dependencies = [
+ "mime",
+ "unicase",
+]
+[[package]]
 name = "miniz_oxide"
 version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "nu-ansi-term"
+version = "0.50.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+[[package]]
 name = "num-bigint-dig"
 version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+[[package]]
 name = "num-integer"
 version = "0.1.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
  "cast5",
  "cfb-mode",
  "cipher",
- "const-oid",
+ "const-oid 0.9.6",
  "crc24",
  "curve25519-dalek",
  "cx448",
+]
 [[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+[[package]]
 name = "ppv-lite86"
 version = "0.2.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
 dependencies = [
- "const-oid",
+ "const-oid 0.9.6",
  "digest 0.10.7",
  "num-bigint-dig",
  "num-integer",
+]
 [[package]]
+name = "rust-embed"
+version = "8.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9e7760e252aaba7b09f4be00e36476cf585bdb68a53552ac954cdf504ab4bc9"
+dependencies = [
+ "rust-embed-impl",
+ "rust-embed-utils",
+ "walkdir",
+]
+[[package]]
+name = "rust-embed-impl"
+version = "8.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3bcfc4d6f53af43755f7a723e4b6b8794fcce052a178dd8c6c1dadc5f5343097"
+dependencies = [
+ "mime_guess",
+ "proc-macro2",
+ "quote",
+ "rust-embed-utils",
+ "syn 2.0.119",
+ "walkdir",
+]
+[[package]]
+name = "rust-embed-utils"
+version = "8.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42ffa149f6aa81b58a5b3011d01a857c4ed12c7a732d2c51947a4c7c692185f0"
+dependencies = [
+ "sha2 0.11.0",
+ "walkdir",
+]
+[[package]]
 name = "rustc_version"
 version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
 [[package]]
+name = "ryu"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+[[package]]
 name = "schannel"
 version = "0.1.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "serde_path_to_error"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10a9ff822e371bb5403e391ecd83e182e0e77ba7f6fe0160b795797109d1b457"
+dependencies = [
+ "itoa",
+ "serde",
+ "serde_core",
+]
+[[package]]
 name = "serde_spanned"
 version = "0.6.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+[[package]]
 name = "serdect"
 version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+[[package]]
 name = "shlex"
 version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 [[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+[[package]]
 name = "signature"
 version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+[[package]]
 name = "synstructure"
 version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "thread_local"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ad99c4c6d32803332c548b1af0540b357b3f5fc0be8f6c6bfe8b2e6ae784070"
+dependencies = [
+ "cfg-if",
+]
+[[package]]
+name = "time"
+version = "0.3.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9e442fc33d7fdb45aa9bfeb312c095964abdf596f7567261062b2a7107aaabd"
+dependencies = [
+ "deranged",
+ "itoa",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+[[package]]
+name = "time-core"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b36ee98fd31ec7426d599183e8fe26932a8dc1fb76ddb6214d05493377d34ca"
+[[package]]
+name = "time-macros"
+version = "0.2.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71e552d1249bf61ac2a52db88179fd0673def1e1ad8243a00d9ec9ed71fee3dd"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+[[package]]
 name = "tinystr"
 version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
  "libc",
  "mio",
  "pin-project-lite",
+ "signal-hook-registry",
  "socket2",
  "tokio-macros",
  "windows-sys 0.61.2",
+]
 [[package]]
+name = "tokio-util"
+version = "0.7.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "494815d09bf52b5548659851081238f0ca39ff638363907596da739561c62c52"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+]
+[[package]]
 name = "toml"
 version = "0.8.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
 [[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+[[package]]
+name = "tower-http"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
+dependencies = [
+ "async-compression",
+ "bitflags",
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+ "tokio",
+ "tokio-util",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+ "uuid",
+]
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+[[package]]
 name = "tracing"
 version = "0.1.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
 dependencies = [
  "once_cell",
+ "valuable",
+]
+[[package]]
+name = "tracing-log"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
+dependencies = [
+ "log",
+ "once_cell",
+ "tracing-core",
+]
+[[package]]
+name = "tracing-serde"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "704b1aeb7be0d0a84fc9828cae51dab5970fee5088f83d1dd7ee6f6246fc6ff1"
+dependencies = [
+ "serde",
+ "tracing-core",
+]
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
+dependencies = [
+ "matchers",
+ "nu-ansi-term",
+ "once_cell",
+ "regex-automata",
+ "serde",
+ "serde_json",
+ "sharded-slab",
+ "smallvec",
+ "thread_local",
+ "tracing",
+ "tracing-core",
+ "tracing-log",
+ "tracing-serde",
+]
 [[package]]
+]
 [[package]]
+name = "unicase"
+version = "2.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
+[[package]]
 name = "unicode-bidi"
 version = "0.3.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4e8257fbc510f0a46eb602c10215901938b5c2a7d5e70fc11483b1d3c9b5b18c"
 [[package]]
+name = "valuable"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
+[[package]]
 name = "vcpkg"
 version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 [[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+[[package]]
 name = "wasi"
 version = "0.11.1+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 [[package]]
 name = "web"
 version = "0.1.0"
+dependencies = [
+ "auth",
+ "axum",
+ "axum-extra",
+ "config",
+ "git",
+ "highlight",
+ "mail",
+ "maud",
+ "mime_guess",
+ "model",
+ "rust-embed",
+ "serde",
+ "serde_json",
+ "store",
+ "thiserror 2.0.19",
+ "time",
+ "tokio",
+ "tower",
+ "tower-http",
+ "tracing",
+ "tracing-subscriber",
+]
 [[package]]
 name = "web-time"
 checksum = "998767ef88740d1f5b0682a9c53c24431453923962269c2db68ee43788c5a40d"
 [[package]]
+name = "winapi-util"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+[[package]]
 name = "windows-link"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"

+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * base.css — structure only. No literal colours: every colour is a `--fb-*`
+ * custom property a theme supplies. A theme that sets only the documented tokens
+ * yields a complete UI (docs/theming.md). System font stacks; no web fonts. */
+:root {
+  --fb-font-sans: system-ui, -apple-system, "Segoe UI", Roboto, Helvetica, Arial,
+    sans-serif;
+  --fb-font-mono: ui-monospace, "SF Mono", "JetBrains Mono", "Fira Code",
+    Menlo, Consolas, monospace;
+  --fb-radius: 6px;
+  --fb-gap: 1rem;
+  --fb-topbar-h: 3rem;
+}
+* {
+  box-sizing: border-box;
+}
+html {
+  color-scheme: var(--fb-color-scheme, dark);
+}
+body {
+  margin: 0;
+  font-family: var(--fb-font-sans);
+  font-size: 14px;
+  line-height: 1.5;
+  color: var(--fb-fg);
+  background: var(--fb-bg);
+  -webkit-font-smoothing: antialiased;
+}
+a {
+  color: var(--fb-accent);
+  text-decoration: none;
+}
+a:hover {
+  text-decoration: underline;
+}
+h1, h2, h3, h4 {
+  line-height: 1.25;
+  margin: 0 0 0.5em;
+}
+code, pre, .mono {
+  font-family: var(--fb-font-mono);
+}
+/* Accessibility: visible focus, skip link. */
+:focus-visible {
+  outline: 2px solid var(--fb-accent);
+  outline-offset: 2px;
+}
+.skip-link {
+  position: absolute;
+  left: -999px;
+  top: 0;
+  z-index: 100;
+  padding: 0.5rem 1rem;
+  background: var(--fb-bg-raised);
+  border: 1px solid var(--fb-border);
+}
+.skip-link:focus {
+  left: 0.5rem;
+  top: 0.5rem;
+}
+/* ---- Top bar ---- */
+.topbar {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  height: var(--fb-topbar-h);
+  padding: 0 0.75rem;
+  border-bottom: 1px solid var(--fb-border);
+  background: var(--fb-bg-raised);
+  position: sticky;
+  top: 0;
+  z-index: 20;
+}
+.topbar .slug {
+  font-weight: 600;
+}
+.topbar .slug a {
+  color: var(--fb-fg);
+}
+.topbar .tabs {
+  display: flex;
+  gap: 0.25rem;
+  margin: 0 auto;
+  overflow-x: auto;
+}
+.topbar .tabs a {
+  padding: 0.35rem 0.7rem;
+  border-radius: var(--fb-radius);
+  color: var(--fb-fg-muted);
+  white-space: nowrap;
+}
+.topbar .tabs a:hover {
+  background: var(--fb-bg-inset);
+  text-decoration: none;
+}
+.topbar .tabs a[aria-current="page"] {
+  color: var(--fb-fg);
+  background: var(--fb-bg-inset);
+}
+.icon-btn {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 2rem;
+  height: 2rem;
+  padding: 0;
+  border: none;
+  border-radius: var(--fb-radius);
+  background: transparent;
+  color: var(--fb-fg);
+  cursor: pointer;
+}
+.icon-btn:hover {
+  background: var(--fb-bg-inset);
+}
+/* ---- Drawer (off-canvas nav) ---- */
+.drawer-backdrop {
+  display: none;
+  position: fixed;
+  inset: 0;
+  background: rgba(0, 0, 0, 0.5);
+  z-index: 30;
+}
+.drawer {
+  position: fixed;
+  top: 0;
+  left: 0;
+  bottom: 0;
+  width: 16rem;
+  max-width: 85vw;
+  transform: translateX(-100%);
+  transition: transform 0.15s ease;
+  background: var(--fb-bg-raised);
+  border-right: 1px solid var(--fb-border);
+  z-index: 40;
+  padding: 1rem;
+  overflow-y: auto;
+}
+body.drawer-open .drawer {
+  transform: translateX(0);
+}
+body.drawer-open .drawer-backdrop {
+  display: block;
+}
+.drawer h2 {
+  font-size: 1rem;
+}
+.drawer nav a,
+.drawer .drawer-item {
+  display: block;
+  padding: 0.4rem 0.5rem;
+  border-radius: var(--fb-radius);
+  color: var(--fb-fg);
+}
+.drawer nav a:hover {
+  background: var(--fb-bg-inset);
+  text-decoration: none;
+}
+.drawer hr {
+  border: none;
+  border-top: 1px solid var(--fb-border);
+  margin: 0.75rem 0;
+}
+/* ---- Layout ---- */
+.page {
+  max-width: 76rem;
+  margin: 0 auto;
+  padding: var(--fb-gap);
+}
+.card {
+  background: var(--fb-bg-raised);
+  border: 1px solid var(--fb-border);
+  border-radius: var(--fb-radius);
+  padding: 1rem;
+}
+.muted {
+  color: var(--fb-fg-muted);
+}
+/* ---- Buttons & forms ---- */
+.btn {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.4rem;
+  padding: 0.4rem 0.8rem;
+  border: 1px solid var(--fb-border);
+  border-radius: var(--fb-radius);
+  background: var(--fb-bg-inset);
+  color: var(--fb-fg);
+  font: inherit;
+  cursor: pointer;
+}
+.btn:hover {
+  border-color: var(--fb-accent);
+  text-decoration: none;
+}
+.btn-primary {
+  background: var(--fb-accent);
+  border-color: var(--fb-accent);
+  color: var(--fb-accent-fg, #fff);
+}
+.btn-danger {
+  border-color: var(--fb-danger);
+  color: var(--fb-danger);
+}
+label {
+  display: block;
+  margin: 0.75rem 0 0.25rem;
+  font-weight: 600;
+}
+input[type="text"],
+input[type="password"],
+input[type="email"],
+input[type="search"],
+textarea,
+select {
+  width: 100%;
+  padding: 0.5rem;
+  font: inherit;
+  color: var(--fb-fg);
+  background: var(--fb-bg-inset);
+  border: 1px solid var(--fb-border);
+  border-radius: var(--fb-radius);
+}
+input:focus,
+textarea:focus,
+select:focus {
+  border-color: var(--fb-accent);
+  outline: none;
+}
+.form-narrow {
+  max-width: 24rem;
+  margin: 3rem auto;
+}
+/* ---- Flash / notices ---- */
+.notice {
+  padding: 0.6rem 0.8rem;
+  border-radius: var(--fb-radius);
+  border: 1px solid var(--fb-border);
+  background: var(--fb-bg-inset);
+  margin-bottom: 0.75rem;
+}
+.notice-error {
+  border-color: var(--fb-danger);
+}
+.notice-success {
+  border-color: var(--fb-success);
+}
+/* ---- Badges ---- */
+.badge {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.25rem;
+  padding: 0.05rem 0.45rem;
+  font-size: 0.8em;
+  border-radius: 999px;
+  border: 1px solid var(--fb-border);
+}
+.badge-verified {
+  color: var(--fb-success);
+  border-color: var(--fb-success);
+}
+.badge-unverified {
+  color: var(--fb-warning);
+  border-color: var(--fb-warning);
+}
+.badge-private {
+  color: var(--fb-fg-muted);
+}
+/* ---- Repo/list rows ---- */
+.repo-list {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+}
+.repo-list li {
+  padding: 0.75rem 0;
+  border-bottom: 1px solid var(--fb-border);
+}
+.repo-list .name {
+  font-weight: 600;
+  font-size: 1.05em;
+}
+/* ---- Tables ---- */
+table.list {
+  width: 100%;
+  border-collapse: collapse;
+}
+table.list th,
+table.list td {
+  text-align: left;
+  padding: 0.5rem 0.6rem;
+  border-bottom: 1px solid var(--fb-border);
+}
+table.list th {
+  color: var(--fb-fg-muted);
+  font-weight: 600;
+}
+/* ---- Code ---- */
+pre.code {
+  margin: 0;
+  padding: 0.75rem 1rem;
+  overflow-x: auto;
+  background: var(--fb-bg-inset);
+  border-radius: var(--fb-radius);
+}
+/* Highlight classes — coloured entirely by the theme's --fb-hl-* tokens. */
+.hl-keyword { color: var(--fb-hl-keyword); }
+.hl-function { color: var(--fb-hl-function); }
+.hl-type { color: var(--fb-hl-type); }
+.hl-string { color: var(--fb-hl-string); }
+.hl-number { color: var(--fb-hl-number); }
+.hl-comment { color: var(--fb-hl-comment); font-style: italic; }
+.hl-constant { color: var(--fb-hl-constant); }
+.hl-variable { color: var(--fb-hl-variable); }
+.hl-operator { color: var(--fb-hl-operator); }
+.hl-punctuation { color: var(--fb-hl-punctuation); }
+.hl-attribute { color: var(--fb-hl-attribute); }
+.hl-tag { color: var(--fb-hl-tag); }
+/* ---- Error page ---- */
+.error-page {
+  text-align: center;
+  padding: 5rem 1rem;
+}
+.error-page .code {
+  font-size: 4rem;
+  font-weight: 700;
+  color: var(--fb-fg-muted);
+}
+.error-page .req-id {
+  font-size: 0.85em;
+  color: var(--fb-fg-muted);
+}
+/* ---- Footer ---- */
+.footer {
+  max-width: 76rem;
+  margin: 2rem auto 1rem;
+  padding: 1rem var(--fb-gap) 0;
+  border-top: 1px solid var(--fb-border);
+  color: var(--fb-fg-muted);
+  font-size: 0.85em;
+}
+/* ---- Responsive: single breakpoint at 48rem ---- */
+@media (max-width: 48rem) {
+  .topbar .tabs {
+    margin: 0;
+  }
+  .page {
+    padding: 0.75rem;
+  }
+}

 //! filters on `expires_at` so an expired row is treated as absent.
 use model::User;
-use sqlx::Row;
 use crate::users::USER_COLUMNS;
 use crate::{Store, StoreError, now_ms};

 publish.workspace = true
 [dependencies]
+config = { workspace = true }
+store = { workspace = true }
+model = { workspace = true }
+auth = { workspace = true }
+mail = { workspace = true }
+git = { workspace = true }
+highlight = { workspace = true }
+axum = { workspace = true }
+axum-extra = { workspace = true }
+maud = { workspace = true }
+tower = { workspace = true }
+tower-http = { workspace = true }
+rust-embed = { workspace = true }
+mime_guess = { workspace = true }
+time = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+thiserror = { workspace = true }
+tokio = { workspace = true }
+tracing = { workspace = true }
+tracing-subscriber = { workspace = true }
+[dev-dependencies]
+tower = { workspace = true, features = ["util"] }
 [lints]
 workspace = true

+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+//! Embedded assets, disk overrides, and the theme registry.
+//!
+//! `base.css`, `fabrica.js`, `htmx.min.js`, and the embedded themes are compiled
+//! into the binary with `rust-embed`. Any of them can be overridden by dropping a
+//! file of the same path in `ui.assets_dir`; themes additionally come from
+//! `ui.themes_dir`. Disk always wins over embedded, and path traversal is rejected.
+use std::path::{Path, PathBuf};
+use rust_embed::RustEmbed;
+/// The compiled-in assets, rooted at the repository `assets/` directory
+/// (relative to this crate's manifest).
+#[derive(RustEmbed)]
+#[folder = "../../assets"]
+struct Embedded;
+/// Whether a theme is light or dark, for the `color-scheme` hint and the picker.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Scheme {
+    /// A dark theme.
+    Dark,
+    /// A light theme.
+    Light,
+}
+impl Scheme {
+    /// The CSS `color-scheme` keyword.
+    #[must_use]
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Dark => "dark",
+            Self::Light => "light",
+        }
+    }
+}
+/// A theme available for selection.
+#[derive(Debug, Clone)]
+pub struct ThemeInfo {
+    /// The theme name (its file stem).
+    pub name: String,
+    /// Light or dark.
+    pub scheme: Scheme,
+}
+/// Resolves assets and themes from disk (override) then the embedded set.
+#[derive(Clone)]
+#[allow(clippy::struct_field_names)] // `assets_dir` mirrors the `ui.assets_dir` config key.
+pub struct Assets {
+    assets_dir: PathBuf,
+    themes_dir: PathBuf,
+    themes: Vec<ThemeInfo>,
+}
+impl Assets {
+    /// Build the registry, scanning `themes_dir` and the embedded themes once.
+    #[must_use]
+    pub fn new(assets_dir: PathBuf, themes_dir: PathBuf) -> Self {
+        let mut this = Self {
+            assets_dir,
+            themes_dir,
+            themes: Vec::new(),
+        };
+        this.rescan();
+        this
+    }
+    /// Re-scan the themes directory (called on `SIGHUP`).
+    pub fn rescan(&mut self) {
+        let mut names: std::collections::BTreeMap<String, Scheme> =
+            std::collections::BTreeMap::new();
+        // Embedded themes first (lower priority).
+        for path in Embedded::iter() {
+            if let Some(name) = theme_name(&path) {
+                let scheme = Embedded::get(&path).map_or(Scheme::Dark, |f| scheme_of(&f.data));
+                names.insert(name, scheme);
+            }
+        }
+        // Disk themes override by name.
+        if let Ok(entries) = std::fs::read_dir(&self.themes_dir) {
+            for entry in entries.flatten() {
+                let path = entry.path();
+                if path.extension().and_then(|e| e.to_str()) == Some("css")
+                    && let Some(stem) = path.file_stem().and_then(|s| s.to_str())
+                {
+                    let scheme = std::fs::read(&path).map_or(Scheme::Dark, |d| scheme_of(&d));
+                    names.insert(stem.to_string(), scheme);
+                }
+            }
+        }
+        self.themes = names
+            .into_iter()
+            .map(|(name, scheme)| ThemeInfo { name, scheme })
+            .collect();
+    }
+    /// The selectable themes, sorted by name.
+    #[must_use]
+    pub fn themes(&self) -> &[ThemeInfo] {
+        &self.themes
+    }
+    /// Look up a theme by name, returning its info.
+    #[must_use]
+    pub fn theme(&self, name: &str) -> Option<&ThemeInfo> {
+        self.themes.iter().find(|t| t.name == name)
+    }
+    /// The CSS bytes for a theme, disk overriding embedded.
+    #[must_use]
+    pub fn theme_css(&self, name: &str) -> Option<Vec<u8>> {
+        if !is_safe_component(name) {
+            return None;
+        }
+        let disk = self.themes_dir.join(format!("{name}.css"));
+        if let Ok(bytes) = std::fs::read(&disk) {
+            return Some(bytes);
+        }
+        Embedded::get(&format!("themes/{name}.css")).map(|f| f.data.into_owned())
+    }
+    /// Resolve a general asset by its request path (e.g. `base.css`,
+    /// `htmx.min.js`, `logo.svg`), disk overriding embedded. Returns the bytes and
+    /// a content type. Path traversal is rejected.
+    #[must_use]
+    pub fn asset(&self, rel: &str) -> Option<(Vec<u8>, &'static str)> {
+        let rel = rel.trim_start_matches('/');
+        if !is_safe_path(rel) {
+            return None;
+        }
+        let content_type = content_type_of(rel);
+        let disk = self.assets_dir.join(rel);
+        if disk.starts_with(&self.assets_dir)
+            && let Ok(bytes) = std::fs::read(&disk)
+        {
+            return Some((bytes, content_type));
+        }
+        Embedded::get(rel).map(|f| (f.data.into_owned(), content_type))
+    }
+}
+/// The theme name for an embedded path like `themes/dark.css`, or `None`.
+fn theme_name(path: &str) -> Option<String> {
+    let rest = path.strip_prefix("themes/")?;
+    let stem = rest.strip_suffix(".css")?;
+    (!stem.is_empty() && !stem.contains('/')).then(|| stem.to_string())
+}
+/// Read the `--fb-color-scheme` declaration from theme CSS, defaulting to dark.
+fn scheme_of(css: &[u8]) -> Scheme {
+    let text = String::from_utf8_lossy(css);
+    if let Some(idx) = text.find("--fb-color-scheme:") {
+        let after = text[idx + "--fb-color-scheme:".len()..].trim_start();
+        if after.starts_with("light") {
+            return Scheme::Light;
+        }
+    }
+    Scheme::Dark
+}
+/// Whether a single path component is safe (no separators, no `..`, non-empty).
+fn is_safe_component(name: &str) -> bool {
+    !name.is_empty() && !name.contains('/') && !name.contains('\\') && name != ".." && name != "."
+}
+/// Whether a relative asset path is safe (no traversal, no absolute, no `..`).
+fn is_safe_path(rel: &str) -> bool {
+    if rel.is_empty() {
+        return false;
+    }
+    !Path::new(rel).components().any(|c| {
+        matches!(
+            c,
+            std::path::Component::ParentDir
+                | std::path::Component::RootDir
+                | std::path::Component::Prefix(_)
+        )
+    })
+}
+/// A content type for a file, by extension.
+fn content_type_of(path: &str) -> &'static str {
+    match path.rsplit('.').next() {
+        Some("css") => "text/css; charset=utf-8",
+        Some("js") => "text/javascript; charset=utf-8",
+        Some("svg") => "image/svg+xml",
+        Some("ico") => "image/x-icon",
+        Some("png") => "image/png",
+        Some("woff2") => "font/woff2",
+        Some("json") => "application/json",
+        _ => "application/octet-stream",
+    }
+}
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used)]
+    use super::*;
+    fn assets() -> Assets {
+        Assets::new(
+            PathBuf::from("/nonexistent-assets"),
+            PathBuf::from("/nonexistent-themes"),
+        )
+    }
+    #[test]
+    fn embedded_themes_are_registered_with_schemes() {
+        let a = assets();
+        let names: Vec<&str> = a.themes().iter().map(|t| t.name.as_str()).collect();
+        assert!(names.contains(&"dark"), "themes: {names:?}");
+        assert!(names.contains(&"light"));
+        assert_eq!(a.theme("dark").unwrap().scheme, Scheme::Dark);
+        assert_eq!(a.theme("light").unwrap().scheme, Scheme::Light);
+    }
+    #[test]
+    fn embedded_assets_resolve_with_content_types() {
+        let a = assets();
+        let (css, ct) = a.asset("base.css").unwrap();
+        assert!(!css.is_empty());
+        assert_eq!(ct, "text/css; charset=utf-8");
+        let (js, ct) = a.asset("htmx.min.js").unwrap();
+        assert!(!js.is_empty());
+        assert_eq!(ct, "text/javascript; charset=utf-8");
+        assert!(a.theme_css("dark").is_some());
+    }
+    #[test]
+    fn path_traversal_is_rejected() {
+        let a = assets();
+        assert!(a.asset("../Cargo.toml").is_none());
+        assert!(a.asset("/etc/passwd").is_none());
+        assert!(a.theme_css("../secret").is_none());
+    }
+}

+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+//! The application error type and its themed error pages.
+//!
+//! User-facing pages never expose internals: an internal error logs its detail
+//! (with a correlation id via `tracing`) and the page shows only the id. Error
+//! pages are self-contained — they link `base.css` and the default theme by stable
+//! URL, so they render even when produced by an extractor rejection with no access
+//! to application state.
+use axum::http::StatusCode;
+use axum::response::{Html, IntoResponse, Response};
+use maud::{DOCTYPE, Markup, html};
+/// A web-layer error mapped to a themed HTTP response.
+#[derive(Debug)]
+pub enum AppError {
+    /// 404 — also the "does not exist" response for private resources, so their
+    /// existence never leaks.
+    NotFound,
+    /// 401 — authentication required.
+    Unauthorized,
+    /// 403 — authenticated but not permitted.
+    Forbidden,
+    /// 400 — a malformed or invalid request.
+    BadRequest(String),
+    /// 500 — an unexpected internal failure. The detail is logged, never shown.
+    Internal(String),
+}
+/// A convenient result alias for handlers.
+pub type AppResult<T> = Result<T, AppError>;
+impl AppError {
+    /// Build an internal error from any displayable error, for `map_err`.
+    pub fn internal(err: impl std::fmt::Display) -> Self {
+        Self::Internal(err.to_string())
+    }
+}
+impl From<store::StoreError> for AppError {
+    fn from(err: store::StoreError) -> Self {
+        Self::Internal(err.to_string())
+    }
+}
+impl From<git::GitError> for AppError {
+    fn from(err: git::GitError) -> Self {
+        Self::internal(err)
+    }
+}
+impl IntoResponse for AppError {
+    fn into_response(self) -> Response {
+        let (status, heading, detail): (StatusCode, &str, String) = match self {
+            AppError::NotFound => (
+                StatusCode::NOT_FOUND,
+                "Not found",
+                "The page you were looking for does not exist.".to_string(),
+            ),
+            AppError::Unauthorized => (
+                StatusCode::UNAUTHORIZED,
+                "Sign in required",
+                "You need to sign in to view this page.".to_string(),
+            ),
+            AppError::Forbidden => (
+                StatusCode::FORBIDDEN,
+                "Forbidden",
+                "You do not have access to this page.".to_string(),
+            ),
+            AppError::BadRequest(msg) => (StatusCode::BAD_REQUEST, "Bad request", msg),
+            AppError::Internal(detail) => {
+                // Log the real detail with a short correlation id; show only the id.
+                let id = correlation_id();
+                tracing::error!(error.id = %id, error.detail = %detail, "internal error");
+                (
+                    StatusCode::INTERNAL_SERVER_ERROR,
+                    "Something went wrong",
+                    format!("An internal error occurred. Reference: {id}"),
+                )
+            }
+        };
+        (
+            status,
+            Html(error_page(status.as_u16(), heading, &detail).into_string()),
+        )
+            .into_response()
+    }
+}
+/// A short, log-correlatable id. Derived from the monotonic-ish wall clock; it only
+/// needs to be unique enough to find the matching log line.
+fn correlation_id() -> String {
+    use std::time::{SystemTime, UNIX_EPOCH};
+    let nanos = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map_or(0, |d| d.as_nanos());
+    format!("{nanos:x}")
+}
+/// A minimal, self-contained themed error page.
+fn error_page(code: u16, heading: &str, detail: &str) -> Markup {
+    html! {
+        (DOCTYPE)
+        html lang="en" {
+            head {
+                meta charset="utf-8";
+                meta name="viewport" content="width=device-width, initial-scale=1";
+                title { (code) " — " (heading) }
+                link rel="stylesheet" href="/assets/base.css";
+                link rel="stylesheet" href="/theme.css";
+            }
+            body {
+                div class="error-page" {
+                    div class="code" { (code) }
+                    h1 { (heading) }
+                    p class="muted" { (detail) }
+                    p { a href="/" { "Return home" } }
+                }
+            }
+        }
+    }
+}

+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+//! The page shell: `<head>`, top bar, off-canvas drawer, theme picker, footer.
+//!
+//! Every full page is wrapped by [`page`]; htmx partials return fragments instead.
+//! Structure is server-rendered and works without JavaScript — the drawer is a
+//! `:target`-free CSS class toggled by `fabrica.js`, the theme picker is a real
+//! form, and every action is a link or form.
+use maud::{DOCTYPE, Markup, html};
+use model::User;
+use crate::assets::{Scheme, ThemeInfo};
+/// The per-request chrome data the shell needs.
+pub struct Chrome {
+    /// The instance name shown in the header and titles.
+    pub instance_name: String,
+    /// The current viewer, if signed in.
+    pub user: Option<User>,
+    /// The active theme name and scheme.
+    pub active_theme: String,
+    /// The active theme's light/dark scheme.
+    pub active_scheme: Scheme,
+    /// The themes offered by the picker.
+    pub themes: Vec<ThemeInfo>,
+    /// Whether the theme picker is shown.
+    pub allow_theme_choice: bool,
+    /// The current request path, for the theme form's return and nav highlighting.
+    pub path: String,
+    /// The CSRF token for this session, injected into htmx and forms.
+    pub csrf: String,
+}
+/// Wrap `body` in the full page shell with `title`.
+#[must_use]
+#[allow(clippy::needless_pass_by_value)] // `body` is an owned fragment the shell embeds.
+pub fn page(chrome: &Chrome, title: &str, body: Markup) -> Markup {
+    html! {
+        (DOCTYPE)
+        html lang="en" data-theme=(chrome.active_theme)
+             style={ "color-scheme: " (chrome.active_scheme.as_str()) } {
+            head {
+                meta charset="utf-8";
+                meta name="viewport" content="width=device-width, initial-scale=1";
+                title { (title) " · " (chrome.instance_name) }
+                link rel="stylesheet" href="/assets/base.css";
+                link rel="stylesheet" href={ "/theme/" (chrome.active_theme) ".css" };
+                // Operator-supplied overrides, injected after the theme.
+                link rel="stylesheet" href="/assets/custom.css";
+                script src="/assets/htmx.min.js" defer {}
+                script src="/assets/fabrica.js" defer {}
+            }
+            body hx-headers=(format!(r#"{{"X-CSRF-Token":"{}"}}"#, chrome.csrf)) {
+                a class="skip-link" href="#main" { "Skip to content" }
+                (topbar(chrome))
+                (drawer(chrome))
+                div class="drawer-backdrop" {}
+                main id="main" class="page" { (body) }
+                (footer(chrome))
+            }
+        }
+    }
+}
+/// The slim top bar.
+fn topbar(chrome: &Chrome) -> Markup {
+    html! {
+        header class="topbar" {
+            button class="icon-btn" type="button" data-drawer-toggle aria-label="Menu"
+                   aria-expanded="false" { "☰" }
+            span class="slug" { a href="/" { (chrome.instance_name) } }
+            nav class="tabs" aria-label="Primary" {}
+            a class="icon-btn" href="/" aria-label="Home" { "⌂" }
+        }
+    }
+}
+/// The off-canvas navigation drawer.
+fn drawer(chrome: &Chrome) -> Markup {
+    html! {
+        aside class="drawer" aria-label="Navigation" {
+            h2 { (chrome.instance_name) }
+            nav {
+                a href="/" { "Home" }
+                @if let Some(user) = &chrome.user {
+                    a href={ "/" (user.username) } { "Your repositories" }
+                }
+            }
+            hr;
+            @if chrome.allow_theme_choice && !chrome.themes.is_empty() {
+                (theme_picker(chrome))
+                hr;
+            }
+            nav {
+                @if chrome.user.is_some() {
+                    a href="/settings" { "Settings" }
+                    form method="post" action="/logout" {
+                        input type="hidden" name="_csrf" value=(chrome.csrf);
+                        button class="drawer-item" type="submit"
+                               style="width:100%;text-align:left;border:none;background:none;color:inherit;cursor:pointer" {
+                            "Log out"
+                        }
+                    }
+                } @else {
+                    a href="/login" { "Sign in" }
+                }
+            }
+        }
+    }
+}
+/// The theme picker form (works without JS via the submit button).
+fn theme_picker(chrome: &Chrome) -> Markup {
+    html! {
+        form method="get" action="/settings/theme" {
+            label for="theme-select" { "Theme" }
+            input type="hidden" name="return" value=(chrome.path);
+            select id="theme-select" name="name" data-theme-picker {
+                @for theme in &chrome.themes {
+                    option value=(theme.name)
+                            data-scheme=(theme.scheme.as_str())
+                            selected[theme.name == chrome.active_theme] {
+                        (theme.name)
+                    }
+                }
+            }
+            noscript { button class="btn" type="submit" { "Apply" } }
+        }
+    }
+}
+/// The page footer.
+fn footer(chrome: &Chrome) -> Markup {
+    html! {
+        footer class="footer" {
+            span { (chrome.instance_name) }
+            " · "
+            a href="/version" { "version" }
+        }
+    }
+}

 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
-//! The web UI: server-rendered maud templates enhanced with htmx.
+//! The web UI: server-rendered `maud` templates enhanced with htmx.
+//!
+//! [`AppState`] is the shared handle every route clones cheaply. [`serve`] builds
+//! the router, wires the tower-http middleware, and runs the server with graceful
+//! shutdown and a `SIGHUP` theme re-scan. Handlers live in [`pages`] (HTML) and
+//! [`serve`](mod@serve_assets) (assets/health). Every interactive element works
+//! without JavaScript; htmx only enhances.
+mod assets;
+mod error;
+mod layout;
+mod pages;
+#[path = "serve.rs"]
+mod serve_assets;
+mod session;
+#[cfg(test)]
+mod tests;
+use std::net::SocketAddr;
+use std::sync::{Arc, PoisonError, RwLock, RwLockReadGuard};
+use axum::Router;
+use axum::http::header::HeaderName;
+use axum::routing::{get, post};
+use config::Config;
+use mail::Mailer;
+use store::Store;
+use tower::ServiceBuilder;
+use tower_http::compression::CompressionLayer;
+use tower_http::request_id::{MakeRequestUuid, PropagateRequestIdLayer, SetRequestIdLayer};
+use tower_http::trace::TraceLayer;
+use crate::assets::Assets;
+pub use crate::error::{AppError, AppResult};
+/// An error building or running the web server.
+#[derive(Debug, thiserror::Error)]
+pub enum WebError {
+    /// The mailer could not be constructed from configuration.
+    #[error("mail configuration error: {0}")]
+    Mail(String),
+    /// The server socket failed to bind or serve.
+    #[error(transparent)]
+    Io(#[from] std::io::Error),
+}
+/// The shared application state, cloned into every request. All fields are cheap
+/// to clone (reference-counted or pooled).
+#[derive(Clone)]
+pub struct AppState {
+    /// The effective configuration.
+    pub config: Arc<Config>,
+    /// The database handle.
+    pub store: Store,
+    /// The configured mailer (invite emails).
+    pub mailer: Arc<Mailer>,
+    /// The instance signing secret (API tokens, future session signing).
+    pub secret: Arc<String>,
+    /// Theme/asset registry, behind a lock so `SIGHUP` can re-scan it.
+    assets: Arc<RwLock<Assets>>,
+}
+impl AppState {
+    /// Build the shared state from configuration and an open store.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`WebError::Mail`] if the mailer cannot be constructed.
+    pub fn build(config: Arc<Config>, store: Store, secret: String) -> Result<Self, WebError> {
+        let mailer = Mailer::build(&config.mail).map_err(|e| WebError::Mail(e.to_string()))?;
+        let assets = Assets::new(config.ui.assets_dir.clone(), config.ui.themes_dir.clone());
+        Ok(Self {
+            config,
+            store,
+            mailer: Arc::new(mailer),
+            secret: Arc::new(secret),
+            assets: Arc::new(RwLock::new(assets)),
+        })
+    }
+    /// A read guard over the asset registry, recovering from a poisoned lock.
+    fn assets(&self) -> RwLockReadGuard<'_, Assets> {
+        self.assets.read().unwrap_or_else(PoisonError::into_inner)
+    }
+    /// Re-scan the themes directory (invoked on `SIGHUP`).
+    fn rescan_assets(&self) {
+        let mut guard = self.assets.write().unwrap_or_else(PoisonError::into_inner);
+        guard.rescan();
+    }
+}
+/// Build the application router with all middleware wired.
+pub fn build_router(state: AppState) -> Router {
+    let x_request_id = HeaderName::from_static("x-request-id");
+    Router::new()
+        .route("/", get(pages::home))
+        .route("/login", get(pages::login_form).post(pages::login_submit))
+        .route("/logout", post(pages::logout))
+        .route(
+            "/invite/{token}",
+            get(pages::invite_form).post(pages::invite_submit),
+        )
+        .route("/settings", get(pages::settings))
+        .route("/settings/theme", get(pages::set_theme))
+        .route("/healthz", get(serve_assets::healthz))
+        .route("/version", get(serve_assets::version))
+        .route("/theme.css", get(serve_assets::theme_default))
+        .route("/theme/{file}", get(serve_assets::theme_named))
+        .route("/assets/{*path}", get(serve_assets::assets))
+        .layer(
+            ServiceBuilder::new()
+                .layer(SetRequestIdLayer::new(
+                    x_request_id.clone(),
+                    MakeRequestUuid,
+                ))
+                .layer(TraceLayer::new_for_http())
+                .layer(PropagateRequestIdLayer::new(x_request_id))
+                // No global request timeout: pack-transport routes (§3.3) stream
+                // arbitrarily long clones and must never be cut off. Per-route
+                // timeouts on non-git routes land in the polish phase.
+                .layer(CompressionLayer::new()),
+        )
+        .with_state(state)
+}
+/// Run the web server on `addr` until a shutdown signal arrives.
+///
+/// Installs a `SIGHUP` handler that re-scans the themes directory, and drains
+/// in-flight requests on `SIGTERM`/`SIGINT`.
+///
+/// # Errors
+///
+/// Returns [`WebError::Io`] if the listener cannot bind or serving fails.
+pub async fn serve(state: AppState, addr: SocketAddr) -> Result<(), WebError> {
+    init_tracing(&state.config);
+    spawn_sighup_rescan(state.clone());
+    let router = build_router(state);
+    let listener = tokio::net::TcpListener::bind(addr).await?;
+    tracing::info!(%addr, "fabrica web server listening");
+    axum::serve(listener, router)
+        .with_graceful_shutdown(shutdown_signal())
+        .await?;
+    Ok(())
+}
+/// Initialize the global tracing subscriber from the log configuration. Honours
+/// `RUST_LOG` when set; idempotent (a second call is a no-op).
+fn init_tracing(config: &Config) {
+    use config::LogFormat;
+    use tracing_subscriber::EnvFilter;
+    let level = match config.log.level {
+        config::LogLevel::Trace => "trace",
+        config::LogLevel::Debug => "debug",
+        config::LogLevel::Info => "info",
+        config::LogLevel::Warn => "warn",
+        config::LogLevel::Error => "error",
+    };
+    let filter = EnvFilter::try_from_default_env().unwrap_or_else(|_| EnvFilter::new(level));
+    let builder = tracing_subscriber::fmt().with_env_filter(filter);
+    // `try_init` returns Err if a subscriber is already set; ignore it.
+    match config.log.format {
+        LogFormat::Json => {
+            let _ = builder.json().try_init();
+        }
+        LogFormat::Pretty => {
+            let _ = builder.try_init();
+        }
+    }
+}
+/// Spawn a task that re-scans themes on every `SIGHUP` (no-op off Unix).
+fn spawn_sighup_rescan(state: AppState) {
+    #[cfg(unix)]
+    tokio::spawn(async move {
+        use tokio::signal::unix::{SignalKind, signal};
+        let Ok(mut hup) = signal(SignalKind::hangup()) else {
+            tracing::warn!("could not install SIGHUP handler; theme re-scan disabled");
+            return;
+        };
+        while hup.recv().await.is_some() {
+            tracing::info!("SIGHUP: re-scanning themes");
+            state.rescan_assets();
+        }
+    });
+    #[cfg(not(unix))]
+    let _ = state;
+}
+/// A future that resolves on `SIGINT` or `SIGTERM`.
+async fn shutdown_signal() {
+    let ctrl_c = async {
+        let _ = tokio::signal::ctrl_c().await;
+    };
+    #[cfg(unix)]
+    let terminate = async {
+        use tokio::signal::unix::{SignalKind, signal};
+        match signal(SignalKind::terminate()) {
+            Ok(mut term) => {
+                term.recv().await;
+            }
+            Err(_) => std::future::pending::<()>().await,
+        }
+    };
+    #[cfg(not(unix))]
+    let terminate = std::future::pending::<()>();
+    tokio::select! {
+        () = ctrl_c => {},
+        () = terminate => {},
+    }
+    tracing::info!("shutdown signal received; draining");
+}

+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+//! The HTML page handlers of the shell: home, sign-in/out, invite completion,
+//! settings, and the theme switch.
+use std::collections::HashMap;
+use axum::Form;
+use axum::extract::{Path, State};
+use axum::http::{HeaderMap, Uri, header};
+use axum::response::{IntoResponse, Redirect, Response};
+use axum_extra::extract::cookie::{Cookie, CookieJar, SameSite};
+use maud::{Markup, html};
+use model::User;
+use serde::Deserialize;
+use crate::AppState;
+use crate::assets::Scheme;
+use crate::error::{AppError, AppResult};
+use crate::layout::{Chrome, page};
+use crate::session::{
+    MaybeUser, RequireUser, THEME_COOKIE, clear_cookie, ensure_csrf, session_cookie, verify_csrf,
+};
+/// Assemble the page chrome, ensuring the CSRF cookie and resolving the active
+/// theme from the visitor's cookie (falling back to the instance default).
+fn build_chrome(
+    state: &AppState,
+    jar: CookieJar,
+    user: Option<User>,
+    path: String,
+) -> (CookieJar, Chrome) {
+    let (jar, csrf) = ensure_csrf(jar, state.config.auth.cookie_secure);
+    let assets = state.assets();
+    let themes = assets.themes().to_vec();
+    let active = jar
+        .get(THEME_COOKIE)
+        .map(|c| c.value().to_string())
+        .filter(|name| assets.theme(name).is_some())
+        .unwrap_or_else(|| state.config.ui.theme.clone());
+    let scheme = assets.theme(&active).map_or(Scheme::Dark, |t| t.scheme);
+    drop(assets);
+    let chrome = Chrome {
+        instance_name: state.config.instance.name.clone(),
+        user,
+        active_theme: active,
+        active_scheme: scheme,
+        themes,
+        allow_theme_choice: state.config.ui.allow_theme_choice,
+        path,
+        csrf,
+    };
+    (jar, chrome)
+}
+/// `GET /` — your repositories and the public ones.
+pub async fn home(
+    State(state): State<AppState>,
+    MaybeUser(user): MaybeUser,
+    jar: CookieJar,
+    uri: Uri,
+) -> AppResult<Response> {
+    let (jar, chrome) = build_chrome(&state, jar, user.clone(), uri.path().to_string());
+    let body = home_body(&state, user.as_ref()).await?;
+    Ok((jar, page(&chrome, "Home", body)).into_response())
+}
+/// Render the home content: the viewer's own repos, plus public repos.
+async fn home_body(state: &AppState, user: Option<&User>) -> AppResult<Markup> {
+    let mine = match user {
+        Some(u) => state.store.repos_by_owner(&u.id).await?,
+        None => Vec::new(),
+    };
+    // Public repos, with owner names resolved for their links.
+    let all = state.store.list_repos().await?;
+    let public: Vec<_> = all.into_iter().filter(|r| !r.is_private).collect();
+    let mut owners: HashMap<String, String> = HashMap::new();
+    for repo in &public {
+        if !owners.contains_key(&repo.owner_id) {
+            let name = state
+                .store
+                .user_by_id(&repo.owner_id)
+                .await?
+                .map_or_else(|| repo.owner_id.clone(), |u| u.username);
+            owners.insert(repo.owner_id.clone(), name);
+        }
+    }
+    Ok(html! {
+        @if let Some(u) = user {
+            h1 { "Welcome, " (u.display_name.clone().unwrap_or_else(|| u.username.clone())) }
+            section {
+                h2 { "Your repositories" }
+                @if mine.is_empty() {
+                    p class="muted" { "You have no repositories yet." }
+                } @else {
+                    ul class="repo-list" {
+                        @for repo in &mine {
+                            li {
+                                div class="name" {
+                                    a href={ "/" (u.username) "/" (repo.path) } { (repo.path) }
+                                    @if repo.is_private { " " span class="badge badge-private" { "private" } }
+                                }
+                                @if let Some(desc) = &repo.description { p class="muted" { (desc) } }
+                            }
+                        }
+                    }
+                }
+            }
+        } @else {
+            h1 { "Welcome to " (state.config.instance.name) }
+            p { a class="btn btn-primary" href="/login" { "Sign in" } }
+        }
+        section {
+            h2 { "Public repositories" }
+            @if public.is_empty() {
+                p class="muted" { "No public repositories." }
+            } @else {
+                ul class="repo-list" {
+                    @for repo in &public {
+                        @let owner = owners.get(&repo.owner_id).cloned().unwrap_or_default();
+                        li {
+                            div class="name" {
+                                a href={ "/" (owner) "/" (repo.path) } { (owner) "/" (repo.path) }
+                            }
+                            @if let Some(desc) = &repo.description { p class="muted" { (desc) } }
+                        }
+                    }
+                }
+            }
+        }
+    })
+}
+/// Sign-in form fields.
+#[derive(Debug, Deserialize)]
+pub struct LoginForm {
+    /// Username.
+    username: String,
+    /// Password.
+    password: String,
+    /// CSRF token (`_csrf`).
+    #[serde(rename = "_csrf")]
+    csrf: String,
+}
+/// `GET /login` — the sign-in form.
+pub async fn login_form(
+    State(state): State<AppState>,
+    MaybeUser(user): MaybeUser,
+    jar: CookieJar,
+    uri: Uri,
+) -> Response {
+    if user.is_some() {
+        return Redirect::to("/").into_response();
+    }
+    let (jar, chrome) = build_chrome(&state, jar, None, uri.path().to_string());
+    let body = login_body(&chrome.csrf, None);
+    (jar, page(&chrome, "Sign in", body)).into_response()
+}
+/// Render the login form with an optional error notice.
+fn login_body(csrf: &str, error: Option<&str>) -> Markup {
+    html! {
+        div class="form-narrow" {
+            h1 { "Sign in" }
+            @if let Some(err) = error {
+                div class="notice notice-error" { (err) }
+            }
+            form method="post" action="/login" {
+                input type="hidden" name="_csrf" value=(csrf);
+                label for="username" { "Username" }
+                input type="text" id="username" name="username" autocomplete="username" required;
+                label for="password" { "Password" }
+                input type="password" id="password" name="password"
+                      autocomplete="current-password" required;
+                p { button class="btn btn-primary" type="submit" { "Sign in" } }
+            }
+        }
+    }
+}
+/// `POST /login` — verify credentials and open a session.
+pub async fn login_submit(
+    State(state): State<AppState>,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Form(form): Form<LoginForm>,
+) -> Response {
+    if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
+        return AppError::Forbidden.into_response();
+    }
+    let user = state
+        .store
+        .user_by_username(&form.username)
+        .await
+        .ok()
+        .flatten();
+    let hash = user.as_ref().and_then(|u| u.password_hash.clone());
+    // Constant-time verify; a missing user still runs a dummy hash inside.
+    let ok = auth::verify_password(&form.password, hash.as_deref())
+        && user
+            .as_ref()
+            .is_some_and(|u| u.disabled_at.is_none() && u.password_hash.is_some());
+    let Some(user) = user.filter(|_| ok) else {
+        // Re-render the form with a generic error (no username enumeration).
+        let (jar, chrome) = build_chrome(&state, jar, None, "/login".to_string());
+        let body = login_body(&chrome.csrf, Some("Incorrect username or password."));
+        return (
+            axum::http::StatusCode::UNAUTHORIZED,
+            jar,
+            page(&chrome, "Sign in", body),
+        )
+            .into_response();
+    };
+    match open_session(&state, &jar, &user, &headers).await {
+        Ok(jar) => (jar, Redirect::to("/")).into_response(),
+        Err(err) => err.into_response(),
+    }
+}
+/// Mint a session, persist it, and return the jar with the session cookie set.
+async fn open_session(
+    state: &AppState,
+    jar: &CookieJar,
+    user: &User,
+    headers: &HeaderMap,
+) -> AppResult<CookieJar> {
+    let token = auth::new_session_token();
+    let ttl_ms = i64::from(state.config.auth.session_ttl_days).saturating_mul(86_400_000);
+    let user_agent = headers
+        .get(header::USER_AGENT)
+        .and_then(|v| v.to_str().ok())
+        .map(str::to_string);
+    state
+        .store
+        .create_session(store::NewSession {
+            id: token.id,
+            user_id: user.id.clone(),
+            user_agent,
+            ip: None,
+            expires_at: now_ms().saturating_add(ttl_ms),
+        })
+        .await?;
+    let cookie = session_cookie(
+        &state.config.auth.cookie_name,
+        token.cookie,
+        state.config.auth.session_ttl_days,
+        state.config.auth.cookie_secure,
+    );
+    Ok(jar.clone().add(cookie))
+}
+/// Logout form field.
+#[derive(Debug, Deserialize)]
+pub struct CsrfForm {
+    /// CSRF token (`_csrf`).
+    #[serde(rename = "_csrf")]
+    csrf: String,
+}
+/// `POST /logout` — destroy the session.
+pub async fn logout(
+    State(state): State<AppState>,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Form(form): Form<CsrfForm>,
+) -> Response {
+    if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
+        return AppError::Forbidden.into_response();
+    }
+    if let Some(cookie) = jar.get(&state.config.auth.cookie_name) {
+        let session_id = auth::session_id(cookie.value());
+        let _ = state.store.delete_session(&session_id).await;
+    }
+    let jar = jar.add(clear_cookie(&state.config.auth.cookie_name));
+    (jar, Redirect::to("/login")).into_response()
+}
+/// Invite set-password form.
+#[derive(Debug, Deserialize)]
+pub struct InviteForm {
+    /// New password.
+    password: String,
+    /// Confirmation.
+    confirm: String,
+    /// CSRF token (`_csrf`).
+    #[serde(rename = "_csrf")]
+    csrf: String,
+}
+/// `GET /invite/{token}` — show the activation form, or an error if the invite is
+/// invalid, used, or expired.
+pub async fn invite_form(
+    State(state): State<AppState>,
+    jar: CookieJar,
+    uri: Uri,
+    Path(token): Path<String>,
+) -> AppResult<Response> {
+    let invite = live_invite(&state, &token).await?;
+    let _ = invite;
+    let (jar, chrome) = build_chrome(&state, jar, None, uri.path().to_string());
+    let body = html! {
+        div class="form-narrow" {
+            h1 { "Set your password" }
+            p class="muted" { "Choose a password to activate your account." }
+            form method="post" action={ "/invite/" (token) } {
+                input type="hidden" name="_csrf" value=(chrome.csrf);
+                label for="password" { "Password" }
+                input type="password" id="password" name="password"
+                      autocomplete="new-password" required minlength="8";
+                label for="confirm" { "Confirm password" }
+                input type="password" id="confirm" name="confirm"
+                      autocomplete="new-password" required;
+                p { button class="btn btn-primary" type="submit" { "Activate account" } }
+            }
+        }
+    };
+    Ok((jar, page(&chrome, "Activate", body)).into_response())
+}
+/// `POST /invite/{token}` — set the password, redeem the invite, and sign in.
+pub async fn invite_submit(
+    State(state): State<AppState>,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Path(token): Path<String>,
+    Form(form): Form<InviteForm>,
+) -> Response {
+    if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
+        return AppError::Forbidden.into_response();
+    }
+    if form.password != form.confirm {
+        return AppError::BadRequest("Passwords do not match.".to_string()).into_response();
+    }
+    if form.password.len() < 8 {
+        return AppError::BadRequest("Password must be at least 8 characters.".to_string())
+            .into_response();
+    }
+    let result = async {
+        let invite = live_invite(&state, &token).await?;
+        let params = auth::HashParams {
+            m_cost: state.config.auth.argon2_m_cost,
+            t_cost: state.config.auth.argon2_t_cost,
+            p_cost: state.config.auth.argon2_p_cost,
+        };
+        let hash = auth::hash_password(&form.password, params).map_err(AppError::internal)?;
+        state
+            .store
+            .set_password(&invite.user_id, Some(&hash))
+            .await?;
+        state.store.mark_invite_used(&invite.id).await?;
+        let user = state
+            .store
+            .user_by_id(&invite.user_id)
+            .await?
+            .ok_or(AppError::NotFound)?;
+        open_session(&state, &jar, &user, &headers).await
+    }
+    .await;
+    match result {
+        Ok(jar) => (jar, Redirect::to("/")).into_response(),
+        Err(err) => err.into_response(),
+    }
+}
+/// Resolve a live (unredeemed, unexpired) invite for a raw token, or a themed
+/// error.
+async fn live_invite(state: &AppState, token: &str) -> AppResult<model::Invite> {
+    let hash = auth::session_id(token);
+    let invite = state
+        .store
+        .invite_by_token_hash(&hash)
+        .await?
+        .ok_or(AppError::NotFound)?;
+    if invite.used_at.is_some() {
+        return Err(AppError::BadRequest(
+            "This invite has already been used.".to_string(),
+        ));
+    }
+    if invite.expires_at <= now_ms() {
+        return Err(AppError::BadRequest("This invite has expired.".to_string()));
+    }
+    Ok(invite)
+}
+/// `GET /settings` — the viewer's profile summary.
+pub async fn settings(
+    State(state): State<AppState>,
+    RequireUser(user): RequireUser,
+    jar: CookieJar,
+    uri: Uri,
+) -> Response {
+    let (jar, chrome) = build_chrome(&state, jar, Some(user.clone()), uri.path().to_string());
+    let body = html! {
+        h1 { "Settings" }
+        div class="card" {
+            table class="list" {
+                tr { th { "Username" } td { (user.username) } }
+                tr { th { "Email" } td { (user.email) } }
+                tr { th { "Display name" } td { (user.display_name.clone().unwrap_or_default()) } }
+                tr { th { "Administrator" } td { (if user.is_admin { "yes" } else { "no" }) } }
+            }
+        }
+        p class="muted" { "Key and token management arrive with the settings pages." }
+    };
+    (jar, page(&chrome, "Settings", body)).into_response()
+}
+/// Theme-switch query.
+#[derive(Debug, Deserialize)]
+pub struct ThemeQuery {
+    /// The chosen theme name.
+    name: String,
+    /// Where to return afterwards (a local path).
+    #[serde(default)]
+    r#return: Option<String>,
+}
+/// `GET /settings/theme` — persist the chosen theme in a cookie and return. A
+/// preference, so a GET that sets a cookie is acceptable and works without JS.
+pub async fn set_theme(
+    State(state): State<AppState>,
+    jar: CookieJar,
+    axum::extract::Query(q): axum::extract::Query<ThemeQuery>,
+) -> Response {
+    // Only accept a known theme name.
+    if state.assets().theme(&q.name).is_none() {
+        return AppError::BadRequest("Unknown theme.".to_string()).into_response();
+    }
+    let cookie = Cookie::build((THEME_COOKIE, q.name))
+        .http_only(false)
+        .same_site(SameSite::Lax)
+        .secure(state.config.auth.cookie_secure)
+        .path("/")
+        .max_age(time::Duration::days(365))
+        .build();
+    // Only redirect to a local path, never an absolute URL (open-redirect guard).
+    let dest = q
+        .r#return
+        .filter(|r| r.starts_with('/') && !r.starts_with("//"))
+        .unwrap_or_else(|| "/".to_string());
+    (jar.add(cookie), Redirect::to(&dest)).into_response()
+}
+/// The current time in Unix milliseconds.
+fn now_ms() -> i64 {
+    use std::time::{SystemTime, UNIX_EPOCH};
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map_or(0, |d| i64::try_from(d.as_millis()).unwrap_or(i64::MAX))
+}

+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+//! Static-asset, theme, and operational endpoints (`/assets`, `/theme`,
+//! `/healthz`, `/version`).
+use std::process::Command;
+use axum::Json;
+use axum::extract::{Path, State};
+use axum::http::{StatusCode, header};
+use axum::response::{IntoResponse, Response};
+use crate::AppState;
+/// Serve an embedded or disk-overridden asset by path.
+pub async fn assets(State(state): State<AppState>, Path(path): Path<String>) -> Response {
+    match state.assets().asset(&path) {
+        Some((bytes, content_type)) => (
+            [
+                (header::CONTENT_TYPE, content_type),
+                (header::CACHE_CONTROL, "public, max-age=3600"),
+            ],
+            bytes,
+        )
+            .into_response(),
+        None => StatusCode::NOT_FOUND.into_response(),
+    }
+}
+/// Serve a named theme stylesheet (`/theme/dark.css`).
+pub async fn theme_named(State(state): State<AppState>, Path(file): Path<String>) -> Response {
+    let name = file.strip_suffix(".css").unwrap_or(&file);
+    theme_response(&state, name)
+}
+/// Serve the instance default theme (`/theme.css`), used by self-contained error
+/// pages that do not know the visitor's chosen theme.
+pub async fn theme_default(State(state): State<AppState>) -> Response {
+    let name = state.config.ui.theme.clone();
+    theme_response(&state, &name)
+}
+/// Build a CSS response for theme `name`, or 404.
+fn theme_response(state: &AppState, name: &str) -> Response {
+    match state.assets().theme_css(name) {
+        Some(bytes) => (
+            [
+                (header::CONTENT_TYPE, "text/css; charset=utf-8"),
+                (header::CACHE_CONTROL, "public, max-age=3600"),
+            ],
+            bytes,
+        )
+            .into_response(),
+        None => StatusCode::NOT_FOUND.into_response(),
+    }
+}
+/// `/healthz` — liveness plus the git plumbing and database status.
+pub async fn healthz(State(state): State<AppState>) -> Response {
+    let git = git_version(&state.config.git.binary);
+    let db_ok = state.store.migrate().await.is_ok();
+    let healthy = git.is_some() && db_ok;
+    let body = serde_json::json!({
+        "status": if healthy { "ok" } else { "degraded" },
+        "git": git,
+        "git_binary": state.config.git.binary,
+        "database": if db_ok { "ok" } else { "error" },
+    });
+    let status = if healthy {
+        StatusCode::OK
+    } else {
+        StatusCode::SERVICE_UNAVAILABLE
+    };
+    (status, Json(body)).into_response()
+}
+/// `/version` — the instance name and build version.
+pub async fn version(State(state): State<AppState>) -> Json<serde_json::Value> {
+    Json(serde_json::json!({
+        "name": state.config.instance.name,
+        "version": env!("CARGO_PKG_VERSION"),
+    }))
+}
+/// Return the `git --version` string, or `None` if it cannot be run.
+fn git_version(binary: &str) -> Option<String> {
+    let output = Command::new(binary).arg("--version").output().ok()?;
+    output
+        .status
+        .success()
+        .then(|| String::from_utf8_lossy(&output.stdout).trim().to_string())
+}

@@ -0,0 +1 @@
0	\ No newline at end of file	1	var htmx=function(){"use strict";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t\|\|"post");return n.values},remove:null,addClass:null,removeClass:null,toggleClass:null,takeClass:null,swap:null,defineExtension:null,removeExtension:null,logAll:null,logNone:null,logger:null,config:{historyEnabled:true,historyCacheSize:10,refreshOnHistoryMiss:false,defaultSwapStyle:"innerHTML",defaultSwapDelay:0,defaultSettleDelay:20,includeIndicatorStyles:true,indicatorClass:"htmx-indicator",requestClass:"htmx-request",addedClass:"htmx-added",settlingClass:"htmx-settling",swappingClass:"htmx-swapping",allowEval:true,allowScriptTags:true,inlineScriptNonce:"",inlineStyleNonce:"",attributesToSettle:["class","style","width","height"],withCredentials:false,timeout:0,wsReconnectDelay:"full-jitter",wsBinaryType:"blob",disableSelector:"[hx-disable], [data-hx-disable]",scrollBehavior:"instant",defaultFocusScroll:false,getCacheBusterParam:false,globalViewTransitions:false,methodsThatUseUrlParams:["get","delete"],selfRequestsOnly:true,ignoreTitle:false,scrollIntoViewOnBoost:true,triggerSpecsCache:null,disableInheritance:false,responseHandling:[{code:"204",swap:false},{code:"[23]..",swap:true},{code:"[45]..",swap:false,error:true}],allowNestedOobSwaps:true},parseInterval:null,_:null,version:"2.0.4"};Q.onLoad=j;Q.process=kt;Q.on=ye;Q.off=be;Q.trigger=he;Q.ajax=Rn;Q.find=u;Q.findAll=x;Q.closest=g;Q.remove=z;Q.addClass=K;Q.removeClass=G;Q.toggleClass=W;Q.takeClass=Z;Q.swap=$e;Q.defineExtension=Fn;Q.removeExtension=Bn;Q.logAll=V;Q.logNone=_;Q.parseInterval=d;Q._=e;const n={addTriggerHandler:St,bodyContains:le,canAccessLocalStorage:B,findThisElement:Se,filterValues:hn,swap:$e,hasAttribute:s,getAttributeValue:te,getClosestAttributeValue:re,getClosestMatch:o,getExpressionVars:En,getHeaders:fn,getInputValues:cn,getInternalData:ie,getSwapSpecification:gn,getTriggerSpecs:st,getTarget:Ee,makeFragment:P,mergeObjects:ce,makeSettleInfo:xn,oobSwap:He,querySelectorExt:ae,settleImmediately:Kt,shouldCancel:ht,triggerEvent:he,triggerErrorEvent:fe,withExtensions:Ft};const r=["get","post","put","delete","patch"];const H=r.map(function(e){return"[hx-"+e+"], [data-hx-"+e+"]"}).join(", ");function d(e){if(e==undefined){return undefined}let t=NaN;if(e.slice(-2)=="ms"){t=parseFloat(e.slice(0,-2))}else if(e.slice(-1)=="s"){t=parseFloat(e.slice(0,-1))1e3}else if(e.slice(-1)=="m"){t=parseFloat(e.slice(0,-1))1e360}else{t=parseFloat(e)}return isNaN(t)?undefined:t}function ee(e,t){return e instanceof Element&&e.getAttribute(t)}function s(e,t){return!!e.hasAttribute&&(e.hasAttribute(t)\|\|e.hasAttribute("data-"+t))}function te(e,t){return ee(e,t)\|\|ee(e,"data-"+t)}function c(e){const t=e.parentElement;if(!t&&e.parentNode instanceof ShadowRoot)return e.parentNode;return t}function ne(){return document}function m(e,t){return e.getRootNode?e.getRootNode({composed:t}):ne()}function o(e,t){while(e&&!t(e)){e=c(e)}return e\|\|null}function i(e,t,n){const r=te(t,n);const o=te(t,"hx-disinherit");var i=te(t,"hx-inherit");if(e!==t){if(Q.config.disableInheritance){if(i&&(i===""\|\|i.split(" ").indexOf(n)>=0)){return r}else{return null}}if(o&&(o===""\|\|o.split(" ").indexOf(n)>=0)){return"unset"}}return r}function re(t,n){let r=null;o(t,function(e){return!!(r=i(t,ue(e),n))});if(r!=="unset"){return r}}function h(e,t){const n=e instanceof Element&&(e.matches\|\|e.matchesSelector\|\|e.msMatchesSelector\|\|e.mozMatchesSelector\|\|e.webkitMatchesSelector\|\|e.oMatchesSelector);return!!n&&n.call(e,t)}function T(e){const t=/<([a-z][^\/\0>\x20\t\r\n\f])/i;const n=t.exec(e);if(n){return n[1].toLowerCase()}else{return""}}function q(e){const t=new DOMParser;return t.parseFromString(e,"text/html")}function L(e,t){while(t.childNodes.length>0){e.append(t.childNodes[0])}}function A(e){const t=ne().createElement("script");se(e.attributes,function(e){t.setAttribute(e.name,e.value)});t.textContent=e.textContent;t.async=false;if(Q.config.inlineScriptNonce){t.nonce=Q.config.inlineScriptNonce}return t}function N(e){return e.matches("script")&&(e.type==="text/javascript"\|\|e.type==="module"\|\|e.type==="")}function I(e){Array.from(e.querySelectorAll("script")).forEach(e=>{if(N(e)){const t=A(e);const n=e.parentNode;try{n.insertBefore(t,e)}catch(e){O(e)}finally{e.remove()}}})}function P(e){const t=e.replace(/<head(\s[^>])?>[\s\S]?<\/head>/i,"");const n=T(t);let r;if(n==="html"){r=new DocumentFragment;const i=q(e);L(r,i.body);r.title=i.title}else if(n==="body"){r=new DocumentFragment;const i=q(t);L(r,i.body);r.title=i.title}else{const i=q('<body><template class="internal-htmx-wrapper">'+t+"</template></body>");r=i.querySelector("template").content;r.title=i.title;var o=r.querySelector("title");if(o&&o.parentNode===r){o.remove();r.title=o.innerText}}if(r){if(Q.config.allowScriptTags){I(r)}else{r.querySelectorAll("script").forEach(e=>e.remove())}}return r}function oe(e){if(e){e()}}function t(e,t){return Object.prototype.toString.call(e)==="[object "+t+"]"}function k(e){return typeof e==="function"}function D(e){return t(e,"Object")}function ie(e){const t="htmx-internal-data";let n=e[t];if(!n){n=e[t]={}}return n}function M(t){const n=[];if(t){for(let e=0;e<t.length;e++){n.push(t[e])}}return n}function se(t,n){if(t){for(let e=0;e<t.length;e++){n(t[e])}}}function X(e){const t=e.getBoundingClientRect();const n=t.top;const r=t.bottom;return n<window.innerHeight&&r>=0}function le(e){return e.getRootNode({composed:true})===document}function F(e){return e.trim().split(/\s+/)}function ce(e,t){for(const n in t){if(t.hasOwnProperty(n)){e[n]=t[n]}}return e}function S(e){try{return JSON.parse(e)}catch(e){O(e);return null}}function B(){const e="htmx:localStorageTest";try{localStorage.setItem(e,e);localStorage.removeItem(e);return true}catch(e){return false}}function U(t){try{const e=new URL(t);if(e){t=e.pathname+e.search}if(!/^\/$/.test(t)){t=t.replace(/\/+$/,"")}return t}catch(e){return t}}function e(e){return vn(ne().body,function(){return eval(e)})}function j(t){const e=Q.on("htmx:load",function(e){t(e.detail.elt)});return e}function V(){Q.logger=function(e,t,n){if(console){console.log(t,e,n)}}}function _(){Q.logger=null}function u(e,t){if(typeof e!=="string"){return e.querySelector(t)}else{return u(ne(),e)}}function x(e,t){if(typeof e!=="string"){return e.querySelectorAll(t)}else{return x(ne(),e)}}function E(){return window}function z(e,t){e=y(e);if(t){E().setTimeout(function(){z(e);e=null},t)}else{c(e).removeChild(e)}}function ue(e){return e instanceof Element?e:null}function $(e){return e instanceof HTMLElement?e:null}function J(e){return typeof e==="string"?e:null}function f(e){return e instanceof Element\|\|e instanceof Document\|\|e instanceof DocumentFragment?e:null}function K(e,t,n){e=ue(y(e));if(!e){return}if(n){E().setTimeout(function(){K(e,t);e=null},n)}else{e.classList&&e.classList.add(t)}}function G(e,t,n){let r=ue(y(e));if(!r){return}if(n){E().setTimeout(function(){G(r,t);r=null},n)}else{if(r.classList){r.classList.remove(t);if(r.classList.length===0){r.removeAttribute("class")}}}}function W(e,t){e=y(e);e.classList.toggle(t)}function Z(e,t){e=y(e);se(e.parentElement.children,function(e){G(e,t)});K(ue(e),t)}function g(e,t){e=ue(y(e));if(e&&e.closest){return e.closest(t)}else{do{if(e==null\|\|h(e,t)){return e}}while(e=e&&ue(c(e)));return null}}function l(e,t){return e.substring(0,t.length)===t}function Y(e,t){return e.substring(e.length-t.length)===t}function ge(e){const t=e.trim();if(l(t,"<")&&Y(t,"/>")){return t.substring(1,t.length-2)}else{return t}}function p(t,r,n){if(r.indexOf("global ")===0){return p(t,r.slice(7),true)}t=y(t);const o=[];{let t=0;let n=0;for(let e=0;e<r.length;e++){const l=r[e];if(l===","&&t===0){o.push(r.substring(n,e));n=e+1;continue}if(l==="<"){t++}else if(l==="/"&&e<r.length-1&&r[e+1]===">"){t--}}if(n<r.length){o.push(r.substring(n))}}const i=[];const s=[];while(o.length>0){const r=ge(o.shift());let e;if(r.indexOf("closest ")===0){e=g(ue(t),ge(r.substr(8)))}else if(r.indexOf("find ")===0){e=u(f(t),ge(r.substr(5)))}else if(r==="next"\|\|r==="nextElementSibling"){e=ue(t).nextElementSibling}else if(r.indexOf("next ")===0){e=pe(t,ge(r.substr(5)),!!n)}else if(r==="previous"\|\|r==="previousElementSibling"){e=ue(t).previousElementSibling}else if(r.indexOf("previous ")===0){e=me(t,ge(r.substr(9)),!!n)}else if(r==="document"){e=document}else if(r==="window"){e=window}else if(r==="body"){e=document.body}else if(r==="root"){e=m(t,!!n)}else if(r==="host"){e=t.getRootNode().host}else{s.push(r)}if(e){i.push(e)}}if(s.length>0){const e=s.join(",");const c=f(m(t,!!n));i.push(...M(c.querySelectorAll(e)))}return i}var pe=function(t,e,n){const r=f(m(t,n)).querySelectorAll(e);for(let e=0;e<r.length;e++){const o=r[e];if(o.compareDocumentPosition(t)===Node.DOCUMENT_POSITION_PRECEDING){return o}}};var me=function(t,e,n){const r=f(m(t,n)).querySelectorAll(e);for(let e=r.length-1;e>=0;e--){const o=r[e];if(o.compareDocumentPosition(t)===Node.DOCUMENT_POSITION_FOLLOWING){return o}}};function ae(e,t){if(typeof e!=="string"){return p(e,t)[0]}else{return p(ne().body,e)[0]}}function y(e,t){if(typeof e==="string"){return u(f(t)\|\|document,e)}else{return e}}function xe(e,t,n,r){if(k(t)){return{target:ne().body,event:J(e),listener:t,options:n}}else{return{target:y(e),event:J(t),listener:n,options:r}}}function ye(t,n,r,o){Vn(function(){const e=xe(t,n,r,o);e.target.addEventListener(e.event,e.listener,e.options)});const e=k(n);return e?n:r}function be(t,n,r){Vn(function(){const e=xe(t,n,r);e.target.removeEventListener(e.event,e.listener)});return k(n)?n:r}const ve=ne().createElement("output");function we(e,t){const n=re(e,t);if(n){if(n==="this"){return[Se(e,t)]}else{const r=p(e,n);if(r.length===0){O('The selector "'+n+'" on '+t+" returned no matches!");return[ve]}else{return r}}}}function Se(e,t){return ue(o(e,function(e){return te(ue(e),t)!=null}))}function Ee(e){const t=re(e,"hx-target");if(t){if(t==="this"){return Se(e,"hx-target")}else{return ae(e,t)}}else{const n=ie(e);if(n.boosted){return ne().body}else{return e}}}function Ce(t){const n=Q.config.attributesToSettle;for(let e=0;e<n.length;e++){if(t===n[e]){return true}}return false}function Oe(t,n){se(t.attributes,function(e){if(!n.hasAttribute(e.name)&&Ce(e.name)){t.removeAttribute(e.name)}});se(n.attributes,function(e){if(Ce(e.name)){t.setAttribute(e.name,e.value)}})}function Re(t,e){const n=Un(e);for(let e=0;e<n.length;e++){const r=n[e];try{if(r.isInlineSwap(t)){return true}}catch(e){O(e)}}return t==="outerHTML"}function He(e,o,i,t){t=t\|\|ne();let n="#"+ee(o,"id");let s="outerHTML";if(e==="true"){}else if(e.indexOf(":")>0){s=e.substring(0,e.indexOf(":"));n=e.substring(e.indexOf(":")+1)}else{s=e}o.removeAttribute("hx-swap-oob");o.removeAttribute("data-hx-swap-oob");const r=p(t,n,false);if(r){se(r,function(e){let t;const n=o.cloneNode(true);t=ne().createDocumentFragment();t.appendChild(n);if(!Re(s,e)){t=f(n)}const r={shouldSwap:true,target:e,fragment:t};if(!he(e,"htmx:oobBeforeSwap",r))return;e=r.target;if(r.shouldSwap){qe(t);_e(s,e,e,t,i);Te()}se(i.elts,function(e){he(e,"htmx:oobAfterSwap",r)})});o.parentNode.removeChild(o)}else{o.parentNode.removeChild(o);fe(ne().body,"htmx:oobErrorNoTarget",{content:o})}return e}function Te(){const e=u("#--htmx-preserve-pantry--");if(e){for(const t of[...e.children]){const n=u("#"+t.id);n.parentNode.moveBefore(t,n);n.remove()}e.remove()}}function qe(e){se(x(e,"[hx-preserve], [data-hx-preserve]"),function(e){const t=te(e,"id");const n=ne().getElementById(t);if(n!=null){if(e.moveBefore){let e=u("#--htmx-preserve-pantry--");if(e==null){ne().body.insertAdjacentHTML("afterend","<div id='--htmx-preserve-pantry--'></div>");e=u("#--htmx-preserve-pantry--")}e.moveBefore(n,null)}else{e.parentNode.replaceChild(n,e)}}})}function Le(l,e,c){se(e.querySelectorAll("[id]"),function(t){const n=ee(t,"id");if(n&&n.length>0){const r=n.replace("'","\\'");const o=t.tagName.replace(":","\\:");const e=f(l);const i=e&&e.querySelector(o+"[id='"+r+"']");if(i&&i!==e){const s=t.cloneNode();Oe(t,i);c.tasks.push(function(){Oe(t,s)})}}})}function Ae(e){return function(){G(e,Q.config.addedClass);kt(ue(e));Ne(f(e));he(e,"htmx:load")}}function Ne(e){const t="[autofocus]";const n=$(h(e,t)?e:e.querySelector(t));if(n!=null){n.focus()}}function a(e,t,n,r){Le(e,n,r);while(n.childNodes.length>0){const o=n.firstChild;K(ue(o),Q.config.addedClass);e.insertBefore(o,t);if(o.nodeType!==Node.TEXT_NODE&&o.nodeType!==Node.COMMENT_NODE){r.tasks.push(Ae(o))}}}function Ie(e,t){let n=0;while(n<e.length){t=(t<<5)-t+e.charCodeAt(n++)\|0}return t}function Pe(t){let n=0;if(t.attributes){for(let e=0;e<t.attributes.length;e++){const r=t.attributes[e];if(r.value){n=Ie(r.name,n);n=Ie(r.value,n)}}}return n}function ke(t){const n=ie(t);if(n.onHandlers){for(let e=0;e<n.onHandlers.length;e++){const r=n.onHandlers[e];be(t,r.event,r.listener)}delete n.onHandlers}}function De(e){const t=ie(e);if(t.timeout){clearTimeout(t.timeout)}if(t.listenerInfos){se(t.listenerInfos,function(e){if(e.on){be(e.on,e.trigger,e.listener)}})}ke(e);se(Object.keys(t),function(e){if(e!=="firstInitCompleted")delete t[e]})}function b(e){he(e,"htmx:beforeCleanupElement");De(e);if(e.children){se(e.children,function(e){b(e)})}}function Me(t,e,n){if(t instanceof Element&&t.tagName==="BODY"){return Ve(t,e,n)}let r;const o=t.previousSibling;const i=c(t);if(!i){return}a(i,t,e,n);if(o==null){r=i.firstChild}else{r=o.nextSibling}n.elts=n.elts.filter(function(e){return e!==t});while(r&&r!==t){if(r instanceof Element){n.elts.push(r)}r=r.nextSibling}b(t);if(t instanceof Element){t.remove()}else{t.parentNode.removeChild(t)}}function Xe(e,t,n){return a(e,e.firstChild,t,n)}function Fe(e,t,n){return a(c(e),e,t,n)}function Be(e,t,n){return a(e,null,t,n)}function Ue(e,t,n){return a(c(e),e.nextSibling,t,n)}function je(e){b(e);const t=c(e);if(t){return t.removeChild(e)}}function Ve(e,t,n){const r=e.firstChild;a(e,r,t,n);if(r){while(r.nextSibling){b(r.nextSibling);e.removeChild(r.nextSibling)}b(r);e.removeChild(r)}}function _e(t,e,n,r,o){switch(t){case"none":return;case"outerHTML":Me(n,r,o);return;case"afterbegin":Xe(n,r,o);return;case"beforebegin":Fe(n,r,o);return;case"beforeend":Be(n,r,o);return;case"afterend":Ue(n,r,o);return;case"delete":je(n);return;default:var i=Un(e);for(let e=0;e<i.length;e++){const s=i[e];try{const l=s.handleSwap(t,n,r,o);if(l){if(Array.isArray(l)){for(let e=0;e<l.length;e++){const c=l[e];if(c.nodeType!==Node.TEXT_NODE&&c.nodeType!==Node.COMMENT_NODE){o.tasks.push(Ae(c))}}}return}}catch(e){O(e)}}if(t==="innerHTML"){Ve(n,r,o)}else{_e(Q.config.defaultSwapStyle,e,n,r,o)}}}function ze(e,n,r){var t=x(e,"[hx-swap-oob], [data-hx-swap-oob]");se(t,function(e){if(Q.config.allowNestedOobSwaps\|\|e.parentElement===null){const t=te(e,"hx-swap-oob");if(t!=null){He(t,e,n,r)}}else{e.removeAttribute("hx-swap-oob");e.removeAttribute("data-hx-swap-oob")}});return t.length>0}function $e(e,t,r,o){if(!o){o={}}e=y(e);const i=o.contextElement?m(o.contextElement,false):ne();const n=document.activeElement;let s={};try{s={elt:n,start:n?n.selectionStart:null,end:n?n.selectionEnd:null}}catch(e){}const l=xn(e);if(r.swapStyle==="textContent"){e.textContent=t}else{let n=P(t);l.title=n.title;if(o.selectOOB){const u=o.selectOOB.split(",");for(let t=0;t<u.length;t++){const a=u[t].split(":",2);let e=a[0].trim();if(e.indexOf("#")===0){e=e.substring(1)}const f=a[1]\|\|"true";const h=n.querySelector("#"+e);if(h){He(f,h,l,i)}}}ze(n,l,i);se(x(n,"template"),function(e){if(e.content&&ze(e.content,l,i)){e.remove()}});if(o.select){const d=ne().createDocumentFragment();se(n.querySelectorAll(o.select),function(e){d.appendChild(e)});n=d}qe(n);_e(r.swapStyle,o.contextElement,e,n,l);Te()}if(s.elt&&!le(s.elt)&&ee(s.elt,"id")){const g=document.getElementById(ee(s.elt,"id"));const p={preventScroll:r.focusScroll!==undefined?!r.focusScroll:!Q.config.defaultFocusScroll};if(g){if(s.start&&g.setSelectionRange){try{g.setSelectionRange(s.start,s.end)}catch(e){}}g.focus(p)}}e.classList.remove(Q.config.swappingClass);se(l.elts,function(e){if(e.classList){e.classList.add(Q.config.settlingClass)}he(e,"htmx:afterSwap",o.eventInfo)});if(o.afterSwapCallback){o.afterSwapCallback()}if(!r.ignoreTitle){kn(l.title)}const c=function(){se(l.tasks,function(e){e.call()});se(l.elts,function(e){if(e.classList){e.classList.remove(Q.config.settlingClass)}he(e,"htmx:afterSettle",o.eventInfo)});if(o.anchor){const e=ue(y("#"+o.anchor));if(e){e.scrollIntoView({block:"start",behavior:"auto"})}}yn(l.elts,r);if(o.afterSettleCallback){o.afterSettleCallback()}};if(r.settleDelay>0){E().setTimeout(c,r.settleDelay)}else{c()}}function Je(e,t,n){const r=e.getResponseHeader(t);if(r.indexOf("{")===0){const o=S(r);for(const i in o){if(o.hasOwnProperty(i)){let e=o[i];if(D(e)){n=e.target!==undefined?e.target:n}else{e={value:e}}he(n,i,e)}}}else{const s=r.split(",");for(let e=0;e<s.length;e++){he(n,s[e].trim(),[])}}}const Ke=/\s/;const v=/[\s,]/;const Ge=/[_$a-zA-Z]/;const We=/[_$a-zA-Z0-9]/;const Ze=['"',"'","/"];const w=/[^\s]/;const Ye=/[{(]/;const Qe=/[})]/;function et(e){const t=[];let n=0;while(n<e.length){if(Ge.exec(e.charAt(n))){var r=n;while(We.exec(e.charAt(n+1))){n++}t.push(e.substring(r,n+1))}else if(Ze.indexOf(e.charAt(n))!==-1){const o=e.charAt(n);var r=n;n++;while(n<e.length&&e.charAt(n)!==o){if(e.charAt(n)==="\\"){n++}n++}t.push(e.substring(r,n+1))}else{const i=e.charAt(n);t.push(i)}n++}return t}function tt(e,t,n){return Ge.exec(e.charAt(0))&&e!=="true"&&e!=="false"&&e!=="this"&&e!==n&&t!=="."}function nt(r,o,i){if(o[0]==="["){o.shift();let e=1;let t=" return (function("+i+"){ return (";let n=null;while(o.length>0){const s=o[0];if(s==="]"){e--;if(e===0){if(n===null){t=t+"true"}o.shift();t+=")})";try{const l=vn(r,function(){return Function(t)()},function(){return true});l.source=t;return l}catch(e){fe(ne().body,"htmx:syntax:error",{error:e,source:t});return null}}}else if(s==="["){e++}if(tt(s,n,i)){t+="(("+i+"."+s+") ? ("+i+"."+s+") : (window."+s+"))"}else{t=t+s}n=o.shift()}}}function C(e,t){let n="";while(e.length>0&&!t.test(e[0])){n+=e.shift()}return n}function rt(e){let t;if(e.length>0&&Ye.test(e[0])){e.shift();t=C(e,Qe).trim();e.shift()}else{t=C(e,v)}return t}const ot="input, textarea, select";function it(e,t,n){const r=[];const o=et(t);do{C(o,w);const l=o.length;const c=C(o,/[,\[\s]/);if(c!==""){if(c==="every"){const u={trigger:"every"};C(o,w);u.pollInterval=d(C(o,/[,\[\s]/));C(o,w);var i=nt(e,o,"event");if(i){u.eventFilter=i}r.push(u)}else{const a={trigger:c};var i=nt(e,o,"event");if(i){a.eventFilter=i}C(o,w);while(o.length>0&&o[0]!==","){const f=o.shift();if(f==="changed"){a.changed=true}else if(f==="once"){a.once=true}else if(f==="consume"){a.consume=true}else if(f==="delay"&&o[0]===":"){o.shift();a.delay=d(C(o,v))}else if(f==="from"&&o[0]===":"){o.shift();if(Ye.test(o[0])){var s=rt(o)}else{var s=C(o,v);if(s==="closest"\|\|s==="find"\|\|s==="next"\|\|s==="previous"){o.shift();const h=rt(o);if(h.length>0){s+=" "+h}}}a.from=s}else if(f==="target"&&o[0]===":"){o.shift();a.target=rt(o)}else if(f==="throttle"&&o[0]===":"){o.shift();a.throttle=d(C(o,v))}else if(f==="queue"&&o[0]===":"){o.shift();a.queue=C(o,v)}else if(f==="root"&&o[0]===":"){o.shift();a[f]=rt(o)}else if(f==="threshold"&&o[0]===":"){o.shift();a[f]=C(o,v)}else{fe(e,"htmx:syntax:error",{token:o.shift()})}C(o,w)}r.push(a)}}if(o.length===l){fe(e,"htmx:syntax:error",{token:o.shift()})}C(o,w)}while(o[0]===","&&o.shift());if(n){n[t]=r}return r}function st(e){const t=te(e,"hx-trigger");let n=[];if(t){const r=Q.config.triggerSpecsCache;n=r&&r[t]\|\|it(e,t,r)}if(n.length>0){return n}else if(h(e,"form")){return[{trigger:"submit"}]}else if(h(e,'input[type="button"], input[type="submit"]')){return[{trigger:"click"}]}else if(h(e,ot)){return[{trigger:"change"}]}else{return[{trigger:"click"}]}}function lt(e){ie(e).cancelled=true}function ct(e,t,n){const r=ie(e);r.timeout=E().setTimeout(function(){if(le(e)&&r.cancelled!==true){if(!gt(n,e,Mt("hx:poll:trigger",{triggerSpec:n,target:e}))){t(e)}ct(e,t,n)}},n.pollInterval)}function ut(e){return location.hostname===e.hostname&&ee(e,"href")&&ee(e,"href").indexOf("#")!==0}function at(e){return g(e,Q.config.disableSelector)}function ft(t,n,e){if(t instanceof HTMLAnchorElement&&ut(t)&&(t.target===""\|\|t.target==="_self")\|\|t.tagName==="FORM"&&String(ee(t,"method")).toLowerCase()!=="dialog"){n.boosted=true;let r,o;if(t.tagName==="A"){r="get";o=ee(t,"href")}else{const i=ee(t,"method");r=i?i.toLowerCase():"get";o=ee(t,"action");if(o==null\|\|o===""){o=ne().location.href}if(r==="get"&&o.includes("?")){o=o.replace(/\?[^#]+/,"")}}e.forEach(function(e){pt(t,function(e,t){const n=ue(e);if(at(n)){b(n);return}de(r,o,n,t)},n,e,true)})}}function ht(e,t){const n=ue(t);if(!n){return false}if(e.type==="submit"\|\|e.type==="click"){if(n.tagName==="FORM"){return true}if(h(n,'input[type="submit"], button')&&(h(n,"[form]")\|\|g(n,"form")!==null)){return true}if(n instanceof HTMLAnchorElement&&n.href&&(n.getAttribute("href")==="#"\|\|n.getAttribute("href").indexOf("#")!==0)){return true}}return false}function dt(e,t){return ie(e).boosted&&e instanceof HTMLAnchorElement&&t.type==="click"&&(t.ctrlKey\|\|t.metaKey)}function gt(e,t,n){const r=e.eventFilter;if(r){try{return r.call(t,n)!==true}catch(e){const o=r.source;fe(ne().body,"htmx:eventFilter:error",{error:e,source:o});return true}}return false}function pt(l,c,e,u,a){const f=ie(l);let t;if(u.from){t=p(l,u.from)}else{t=[l]}if(u.changed){if(!("lastValue"in f)){f.lastValue=new WeakMap}t.forEach(function(e){if(!f.lastValue.has(u)){f.lastValue.set(u,new WeakMap)}f.lastValue.get(u).set(e,e.value)})}se(t,function(i){const s=function(e){if(!le(l)){i.removeEventListener(u.trigger,s);return}if(dt(l,e)){return}if(a\|\|ht(e,l)){e.preventDefault()}if(gt(u,l,e)){return}const t=ie(e);t.triggerSpec=u;if(t.handledFor==null){t.handledFor=[]}if(t.handledFor.indexOf(l)<0){t.handledFor.push(l);if(u.consume){e.stopPropagation()}if(u.target&&e.target){if(!h(ue(e.target),u.target)){return}}if(u.once){if(f.triggeredOnce){return}else{f.triggeredOnce=true}}if(u.changed){const n=event.target;const r=n.value;const o=f.lastValue.get(u);if(o.has(n)&&o.get(n)===r){return}o.set(n,r)}if(f.delayed){clearTimeout(f.delayed)}if(f.throttle){return}if(u.throttle>0){if(!f.throttle){he(l,"htmx:trigger");c(l,e);f.throttle=E().setTimeout(function(){f.throttle=null},u.throttle)}}else if(u.delay>0){f.delayed=E().setTimeout(function(){he(l,"htmx:trigger");c(l,e)},u.delay)}else{he(l,"htmx:trigger");c(l,e)}}};if(e.listenerInfos==null){e.listenerInfos=[]}e.listenerInfos.push({trigger:u.trigger,listener:s,on:i});i.addEventListener(u.trigger,s)})}let mt=false;let xt=null;function yt(){if(!xt){xt=function(){mt=true};window.addEventListener("scroll",xt);window.addEventListener("resize",xt);setInterval(function(){if(mt){mt=false;se(ne().querySelectorAll("[hx-trigger='revealed'],[data-hx-trigger='revealed']"),function(e){bt(e)})}},200)}}function bt(e){if(!s(e,"data-hx-revealed")&&X(e)){e.setAttribute("data-hx-revealed","true");const t=ie(e);if(t.initHash){he(e,"revealed")}else{e.addEventListener("htmx:afterProcessNode",function(){he(e,"revealed")},{once:true})}}}function vt(e,t,n,r){const o=function(){if(!n.loaded){n.loaded=true;he(e,"htmx:trigger");t(e)}};if(r>0){E().setTimeout(o,r)}else{o()}}function wt(t,n,e){let i=false;se(r,function(r){if(s(t,"hx-"+r)){const o=te(t,"hx-"+r);i=true;n.path=o;n.verb=r;e.forEach(function(e){St(t,e,n,function(e,t){const n=ue(e);if(g(n,Q.config.disableSelector)){b(n);return}de(r,o,n,t)})})}});return i}function St(r,e,t,n){if(e.trigger==="revealed"){yt();pt(r,n,t,e);bt(ue(r))}else if(e.trigger==="intersect"){const o={};if(e.root){o.root=ae(r,e.root)}if(e.threshold){o.threshold=parseFloat(e.threshold)}const i=new IntersectionObserver(function(t){for(let e=0;e<t.length;e++){const n=t[e];if(n.isIntersecting){he(r,"intersect");break}}},o);i.observe(ue(r));pt(ue(r),n,t,e)}else if(!t.firstInitCompleted&&e.trigger==="load"){if(!gt(e,r,Mt("load",{elt:r}))){vt(ue(r),n,t,e.delay)}}else if(e.pollInterval>0){t.polling=true;ct(ue(r),n,e)}else{pt(r,n,t,e)}}function Et(e){const t=ue(e);if(!t){return false}const n=t.attributes;for(let e=0;e<n.length;e++){const r=n[e].name;if(l(r,"hx-on:")\|\|l(r,"data-hx-on:")\|\|l(r,"hx-on-")\|\|l(r,"data-hx-on-")){return true}}return false}const Ct=(new XPathEvaluator).createExpression('.//[@[ starts-with(name(), "hx-on:") or starts-with(name(), "data-hx-on:") or'+' starts-with(name(), "hx-on-") or starts-with(name(), "data-hx-on-") ]]');function Ot(e,t){if(Et(e)){t.push(ue(e))}const n=Ct.evaluate(e);let r=null;while(r=n.iterateNext())t.push(ue(r))}function Rt(e){const t=[];if(e instanceof DocumentFragment){for(const n of e.childNodes){Ot(n,t)}}else{Ot(e,t)}return t}function Ht(e){if(e.querySelectorAll){const n=", [hx-boost] a, [data-hx-boost] a, a[hx-boost], a[data-hx-boost]";const r=[];for(const i in Mn){const s=Mn[i];if(s.getSelectors){var t=s.getSelectors();if(t){r.push(t)}}}const o=e.querySelectorAll(H+n+", form, [type='submit'],"+" [hx-ext], [data-hx-ext], [hx-trigger], [data-hx-trigger]"+r.flat().map(e=>", "+e).join(""));return o}else{return[]}}function Tt(e){const t=g(ue(e.target),"button, input[type='submit']");const n=Lt(e);if(n){n.lastButtonClicked=t}}function qt(e){const t=Lt(e);if(t){t.lastButtonClicked=null}}function Lt(e){const t=g(ue(e.target),"button, input[type='submit']");if(!t){return}const n=y("#"+ee(t,"form"),t.getRootNode())\|\|g(t,"form");if(!n){return}return ie(n)}function At(e){e.addEventListener("click",Tt);e.addEventListener("focusin",Tt);e.addEventListener("focusout",qt)}function Nt(t,e,n){const r=ie(t);if(!Array.isArray(r.onHandlers)){r.onHandlers=[]}let o;const i=function(e){vn(t,function(){if(at(t)){return}if(!o){o=new Function("event",n)}o.call(t,e)})};t.addEventListener(e,i);r.onHandlers.push({event:e,listener:i})}function It(t){ke(t);for(let e=0;e<t.attributes.length;e++){const n=t.attributes[e].name;const r=t.attributes[e].value;if(l(n,"hx-on")\|\|l(n,"data-hx-on")){const o=n.indexOf("-on")+3;const i=n.slice(o,o+1);if(i==="-"\|\|i===":"){let e=n.slice(o+1);if(l(e,":")){e="htmx"+e}else if(l(e,"-")){e="htmx:"+e.slice(1)}else if(l(e,"htmx-")){e="htmx:"+e.slice(5)}Nt(t,e,r)}}}}function Pt(t){if(g(t,Q.config.disableSelector)){b(t);return}const n=ie(t);const e=Pe(t);if(n.initHash!==e){De(t);n.initHash=e;he(t,"htmx:beforeProcessNode");const r=st(t);const o=wt(t,n,r);if(!o){if(re(t,"hx-boost")==="true"){ft(t,n,r)}else if(s(t,"hx-trigger")){r.forEach(function(e){St(t,e,n,function(){})})}}if(t.tagName==="FORM"\|\|ee(t,"type")==="submit"&&s(t,"form")){At(t)}n.firstInitCompleted=true;he(t,"htmx:afterProcessNode")}}function kt(e){e=y(e);if(g(e,Q.config.disableSelector)){b(e);return}Pt(e);se(Ht(e),function(e){Pt(e)});se(Rt(e),It)}function Dt(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1-$2").toLowerCase()}function Mt(e,t){let n;if(window.CustomEvent&&typeof window.CustomEvent==="function"){n=new CustomEvent(e,{bubbles:true,cancelable:true,composed:true,detail:t})}else{n=ne().createEvent("CustomEvent");n.initCustomEvent(e,true,true,t)}return n}function fe(e,t,n){he(e,t,ce({error:t},n))}function Xt(e){return e==="htmx:afterProcessNode"}function Ft(e,t){se(Un(e),function(e){try{t(e)}catch(e){O(e)}})}function O(e){if(console.error){console.error(e)}else if(console.log){console.log("ERROR: ",e)}}function he(e,t,n){e=y(e);if(n==null){n={}}n.elt=e;const r=Mt(t,n);if(Q.logger&&!Xt(t)){Q.logger(e,t,n)}if(n.error){O(n.error);he(e,"htmx:error",{errorInfo:n})}let o=e.dispatchEvent(r);const i=Dt(t);if(o&&i!==t){const s=Mt(i,r.detail);o=o&&e.dispatchEvent(s)}Ft(ue(e),function(e){o=o&&(e.onEvent(t,r)!==false&&!r.defaultPrevented)});return o}let Bt=location.pathname+location.search;function Ut(){const e=ne().querySelector("[hx-history-elt],[data-hx-history-elt]");return e\|\|ne().body}function jt(t,e){if(!B()){return}const n=_t(e);const r=ne().title;const o=window.scrollY;if(Q.config.historyCacheSize<=0){localStorage.removeItem("htmx-history-cache");return}t=U(t);const i=S(localStorage.getItem("htmx-history-cache"))\|\|[];for(let e=0;e<i.length;e++){if(i[e].url===t){i.splice(e,1);break}}const s={url:t,content:n,title:r,scroll:o};he(ne().body,"htmx:historyItemCreated",{item:s,cache:i});i.push(s);while(i.length>Q.config.historyCacheSize){i.shift()}while(i.length>0){try{localStorage.setItem("htmx-history-cache",JSON.stringify(i));break}catch(e){fe(ne().body,"htmx:historyCacheError",{cause:e,cache:i});i.shift()}}}function Vt(t){if(!B()){return null}t=U(t);const n=S(localStorage.getItem("htmx-history-cache"))\|\|[];for(let e=0;e<n.length;e++){if(n[e].url===t){return n[e]}}return null}function _t(e){const t=Q.config.requestClass;const n=e.cloneNode(true);se(x(n,"."+t),function(e){G(e,t)});se(x(n,"[data-disabled-by-htmx]"),function(e){e.removeAttribute("disabled")});return n.innerHTML}function zt(){const e=Ut();const t=Bt\|\|location.pathname+location.search;let n;try{n=ne().querySelector('[hx-history="false" i],[data-hx-history="false" i]')}catch(e){n=ne().querySelector('[hx-history="false"],[data-hx-history="false"]')}if(!n){he(ne().body,"htmx:beforeHistorySave",{path:t,historyElt:e});jt(t,e)}if(Q.config.historyEnabled)history.replaceState({htmx:true},ne().title,window.location.href)}function $t(e){if(Q.config.getCacheBusterParam){e=e.replace(/org\.htmx\.cache-buster=[^&]&?/,"");if(Y(e,"&")\|\|Y(e,"?")){e=e.slice(0,-1)}}if(Q.config.historyEnabled){history.pushState({htmx:true},"",e)}Bt=e}function Jt(e){if(Q.config.historyEnabled)history.replaceState({htmx:true},"",e);Bt=e}function Kt(e){se(e,function(e){e.call(undefined)})}function Gt(o){const e=new XMLHttpRequest;const i={path:o,xhr:e};he(ne().body,"htmx:historyCacheMiss",i);e.open("GET",o,true);e.setRequestHeader("HX-Request","true");e.setRequestHeader("HX-History-Restore-Request","true");e.setRequestHeader("HX-Current-URL",ne().location.href);e.onload=function(){if(this.status>=200&&this.status<400){he(ne().body,"htmx:historyCacheMissLoad",i);const e=P(this.response);const t=e.querySelector("[hx-history-elt],[data-hx-history-elt]")\|\|e;const n=Ut();const r=xn(n);kn(e.title);qe(e);Ve(n,t,r);Te();Kt(r.tasks);Bt=o;he(ne().body,"htmx:historyRestore",{path:o,cacheMiss:true,serverResponse:this.response})}else{fe(ne().body,"htmx:historyCacheMissLoadError",i)}};e.send()}function Wt(e){zt();e=e\|\|location.pathname+location.search;const t=Vt(e);if(t){const n=P(t.content);const r=Ut();const o=xn(r);kn(t.title);qe(n);Ve(r,n,o);Te();Kt(o.tasks);E().setTimeout(function(){window.scrollTo(0,t.scroll)},0);Bt=e;he(ne().body,"htmx:historyRestore",{path:e,item:t})}else{if(Q.config.refreshOnHistoryMiss){window.location.reload(true)}else{Gt(e)}}}function Zt(e){let t=we(e,"hx-indicator");if(t==null){t=[e]}se(t,function(e){const t=ie(e);t.requestCount=(t.requestCount\|\|0)+1;e.classList.add.call(e.classList,Q.config.requestClass)});return t}function Yt(e){let t=we(e,"hx-disabled-elt");if(t==null){t=[]}se(t,function(e){const t=ie(e);t.requestCount=(t.requestCount\|\|0)+1;e.setAttribute("disabled","");e.setAttribute("data-disabled-by-htmx","")});return t}function Qt(e,t){se(e.concat(t),function(e){const t=ie(e);t.requestCount=(t.requestCount\|\|1)-1});se(e,function(e){const t=ie(e);if(t.requestCount===0){e.classList.remove.call(e.classList,Q.config.requestClass)}});se(t,function(e){const t=ie(e);if(t.requestCount===0){e.removeAttribute("disabled");e.removeAttribute("data-disabled-by-htmx")}})}function en(t,n){for(let e=0;e<t.length;e++){const r=t[e];if(r.isSameNode(n)){return true}}return false}function tn(e){const t=e;if(t.name===""\|\|t.name==null\|\|t.disabled\|\|g(t,"fieldset[disabled]")){return false}if(t.type==="button"\|\|t.type==="submit"\|\|t.tagName==="image"\|\|t.tagName==="reset"\|\|t.tagName==="file"){return false}if(t.type==="checkbox"\|\|t.type==="radio"){return t.checked}return true}function nn(t,e,n){if(t!=null&&e!=null){if(Array.isArray(e)){e.forEach(function(e){n.append(t,e)})}else{n.append(t,e)}}}function rn(t,n,r){if(t!=null&&n!=null){let e=r.getAll(t);if(Array.isArray(n)){e=e.filter(e=>n.indexOf(e)<0)}else{e=e.filter(e=>e!==n)}r.delete(t);se(e,e=>r.append(t,e))}}function on(t,n,r,o,i){if(o==null\|\|en(t,o)){return}else{t.push(o)}if(tn(o)){const s=ee(o,"name");let e=o.value;if(o instanceof HTMLSelectElement&&o.multiple){e=M(o.querySelectorAll("option:checked")).map(function(e){return e.value})}if(o instanceof HTMLInputElement&&o.files){e=M(o.files)}nn(s,e,n);if(i){sn(o,r)}}if(o instanceof HTMLFormElement){se(o.elements,function(e){if(t.indexOf(e)>=0){rn(e.name,e.value,n)}else{t.push(e)}if(i){sn(e,r)}});new FormData(o).forEach(function(e,t){if(e instanceof File&&e.name===""){return}nn(t,e,n)})}}function sn(e,t){const n=e;if(n.willValidate){he(n,"htmx:validation:validate");if(!n.checkValidity()){t.push({elt:n,message:n.validationMessage,validity:n.validity});he(n,"htmx:validation:failed",{message:n.validationMessage,validity:n.validity})}}}function ln(n,e){for(const t of e.keys()){n.delete(t)}e.forEach(function(e,t){n.append(t,e)});return n}function cn(e,t){const n=[];const r=new FormData;const o=new FormData;const i=[];const s=ie(e);if(s.lastButtonClicked&&!le(s.lastButtonClicked)){s.lastButtonClicked=null}let l=e instanceof HTMLFormElement&&e.noValidate!==true\|\|te(e,"hx-validate")==="true";if(s.lastButtonClicked){l=l&&s.lastButtonClicked.formNoValidate!==true}if(t!=="get"){on(n,o,i,g(e,"form"),l)}on(n,r,i,e,l);if(s.lastButtonClicked\|\|e.tagName==="BUTTON"\|\|e.tagName==="INPUT"&&ee(e,"type")==="submit"){const u=s.lastButtonClicked\|\|e;const a=ee(u,"name");nn(a,u.value,o)}const c=we(e,"hx-include");se(c,function(e){on(n,r,i,ue(e),l);if(!h(e,"form")){se(f(e).querySelectorAll(ot),function(e){on(n,r,i,e,l)})}});ln(r,o);return{errors:i,formData:r,values:An(r)}}function un(e,t,n){if(e!==""){e+="&"}if(String(n)==="[object Object]"){n=JSON.stringify(n)}const r=encodeURIComponent(n);e+=encodeURIComponent(t)+"="+r;return e}function an(e){e=qn(e);let n="";e.forEach(function(e,t){n=un(n,t,e)});return n}function fn(e,t,n){const r={"HX-Request":"true","HX-Trigger":ee(e,"id"),"HX-Trigger-Name":ee(e,"name"),"HX-Target":te(t,"id"),"HX-Current-URL":ne().location.href};bn(e,"hx-headers",false,r);if(n!==undefined){r["HX-Prompt"]=n}if(ie(e).boosted){r["HX-Boosted"]="true"}return r}function hn(n,e){const t=re(e,"hx-params");if(t){if(t==="none"){return new FormData}else if(t===""){return n}else if(t.indexOf("not ")===0){se(t.slice(4).split(","),function(e){e=e.trim();n.delete(e)});return n}else{const r=new FormData;se(t.split(","),function(t){t=t.trim();if(n.has(t)){n.getAll(t).forEach(function(e){r.append(t,e)})}});return r}}else{return n}}function dn(e){return!!ee(e,"href")&&ee(e,"href").indexOf("#")>=0}function gn(e,t){const n=t\|\|re(e,"hx-swap");const r={swapStyle:ie(e).boosted?"innerHTML":Q.config.defaultSwapStyle,swapDelay:Q.config.defaultSwapDelay,settleDelay:Q.config.defaultSettleDelay};if(Q.config.scrollIntoViewOnBoost&&ie(e).boosted&&!dn(e)){r.show="top"}if(n){const s=F(n);if(s.length>0){for(let e=0;e<s.length;e++){const l=s[e];if(l.indexOf("swap:")===0){r.swapDelay=d(l.slice(5))}else if(l.indexOf("settle:")===0){r.settleDelay=d(l.slice(7))}else if(l.indexOf("transition:")===0){r.transition=l.slice(11)==="true"}else if(l.indexOf("ignoreTitle:")===0){r.ignoreTitle=l.slice(12)==="true"}else if(l.indexOf("scroll:")===0){const c=l.slice(7);var o=c.split(":");const u=o.pop();var i=o.length>0?o.join(":"):null;r.scroll=u;r.scrollTarget=i}else if(l.indexOf("show:")===0){const a=l.slice(5);var o=a.split(":");const f=o.pop();var i=o.length>0?o.join(":"):null;r.show=f;r.showTarget=i}else if(l.indexOf("focus-scroll:")===0){const h=l.slice("focus-scroll:".length);r.focusScroll=h=="true"}else if(e==0){r.swapStyle=l}else{O("Unknown modifier in hx-swap: "+l)}}}}return r}function pn(e){return re(e,"hx-encoding")==="multipart/form-data"\|\|h(e,"form")&&ee(e,"enctype")==="multipart/form-data"}function mn(t,n,r){let o=null;Ft(n,function(e){if(o==null){o=e.encodeParameters(t,r,n)}});if(o!=null){return o}else{if(pn(n)){return ln(new FormData,qn(r))}else{return an(r)}}}function xn(e){return{tasks:[],elts:[e]}}function yn(e,t){const n=e[0];const r=e[e.length-1];if(t.scroll){var o=null;if(t.scrollTarget){o=ue(ae(n,t.scrollTarget))}if(t.scroll==="top"&&(n\|\|o)){o=o\|\|n;o.scrollTop=0}if(t.scroll==="bottom"&&(r\|\|o)){o=o\|\|r;o.scrollTop=o.scrollHeight}}if(t.show){var o=null;if(t.showTarget){let e=t.showTarget;if(t.showTarget==="window"){e="body"}o=ue(ae(n,e))}if(t.show==="top"&&(n\|\|o)){o=o\|\|n;o.scrollIntoView({block:"start",behavior:Q.config.scrollBehavior})}if(t.show==="bottom"&&(r\|\|o)){o=o\|\|r;o.scrollIntoView({block:"end",behavior:Q.config.scrollBehavior})}}}function bn(r,e,o,i){if(i==null){i={}}if(r==null){return i}const s=te(r,e);if(s){let e=s.trim();let t=o;if(e==="unset"){return null}if(e.indexOf("javascript:")===0){e=e.slice(11);t=true}else if(e.indexOf("js:")===0){e=e.slice(3);t=true}if(e.indexOf("{")!==0){e="{"+e+"}"}let n;if(t){n=vn(r,function(){return Function("return ("+e+")")()},{})}else{n=S(e)}for(const l in n){if(n.hasOwnProperty(l)){if(i[l]==null){i[l]=n[l]}}}}return bn(ue(c(r)),e,o,i)}function vn(e,t,n){if(Q.config.allowEval){return t()}else{fe(e,"htmx:evalDisallowedError");return n}}function wn(e,t){return bn(e,"hx-vars",true,t)}function Sn(e,t){return bn(e,"hx-vals",false,t)}function En(e){return ce(wn(e),Sn(e))}function Cn(t,n,r){if(r!==null){try{t.setRequestHeader(n,r)}catch(e){t.setRequestHeader(n,encodeURIComponent(r));t.setRequestHeader(n+"-URI-AutoEncoded","true")}}}function On(t){if(t.responseURL&&typeof URL!=="undefined"){try{const e=new URL(t.responseURL);return e.pathname+e.search}catch(e){fe(ne().body,"htmx:badResponseUrl",{url:t.responseURL})}}}function R(e,t){return t.test(e.getAllResponseHeaders())}function Rn(t,n,r){t=t.toLowerCase();if(r){if(r instanceof Element\|\|typeof r==="string"){return de(t,n,null,null,{targetOverride:y(r)\|\|ve,returnPromise:true})}else{let e=y(r.target);if(r.target&&!e\|\|r.source&&!e&&!y(r.source)){e=ve}return de(t,n,y(r.source),r.event,{handler:r.handler,headers:r.headers,values:r.values,targetOverride:e,swapOverride:r.swap,select:r.select,returnPromise:true})}}else{return de(t,n,null,null,{returnPromise:true})}}function Hn(e){const t=[];while(e){t.push(e);e=e.parentElement}return t}function Tn(e,t,n){let r;let o;if(typeof URL==="function"){o=new URL(t,document.location.href);const i=document.location.origin;r=i===o.origin}else{o=t;r=l(t,document.location.origin)}if(Q.config.selfRequestsOnly){if(!r){return false}}return he(e,"htmx:validateUrl",ce({url:o,sameHost:r},n))}function qn(e){if(e instanceof FormData)return e;const t=new FormData;for(const n in e){if(e.hasOwnProperty(n)){if(e[n]&&typeof e[n].forEach==="function"){e[n].forEach(function(e){t.append(n,e)})}else if(typeof e[n]==="object"&&!(e[n]instanceof Blob)){t.append(n,JSON.stringify(e[n]))}else{t.append(n,e[n])}}}return t}function Ln(r,o,e){return new Proxy(e,{get:function(t,e){if(typeof e==="number")return t[e];if(e==="length")return t.length;if(e==="push"){return function(e){t.push(e);r.append(o,e)}}if(typeof t[e]==="function"){return function(){t[e].apply(t,arguments);r.delete(o);t.forEach(function(e){r.append(o,e)})}}if(t[e]&&t[e].length===1){return t[e][0]}else{return t[e]}},set:function(e,t,n){e[t]=n;r.delete(o);e.forEach(function(e){r.append(o,e)});return true}})}function An(o){return new Proxy(o,{get:function(e,t){if(typeof t==="symbol"){const r=Reflect.get(e,t);if(typeof r==="function"){return function(){return r.apply(o,arguments)}}else{return r}}if(t==="toJSON"){return()=>Object.fromEntries(o)}if(t in e){if(typeof e[t]==="function"){return function(){return o[t].apply(o,arguments)}}else{return e[t]}}const n=o.getAll(t);if(n.length===0){return undefined}else if(n.length===1){return n[0]}else{return Ln(e,t,n)}},set:function(t,n,e){if(typeof n!=="string"){return false}t.delete(n);if(e&&typeof e.forEach==="function"){e.forEach(function(e){t.append(n,e)})}else if(typeof e==="object"&&!(e instanceof Blob)){t.append(n,JSON.stringify(e))}else{t.append(n,e)}return true},deleteProperty:function(e,t){if(typeof t==="string"){e.delete(t)}return true},ownKeys:function(e){return Reflect.ownKeys(Object.fromEntries(e))},getOwnPropertyDescriptor:function(e,t){return Reflect.getOwnPropertyDescriptor(Object.fromEntries(e),t)}})}function de(t,n,r,o,i,D){let s=null;let l=null;i=i!=null?i:{};if(i.returnPromise&&typeof Promise!=="undefined"){var e=new Promise(function(e,t){s=e;l=t})}if(r==null){r=ne().body}const M=i.handler\|\|Dn;const X=i.select\|\|null;if(!le(r)){oe(s);return e}const c=i.targetOverride\|\|ue(Ee(r));if(c==null\|\|c==ve){fe(r,"htmx:targetError",{target:te(r,"hx-target")});oe(l);return e}let u=ie(r);const a=u.lastButtonClicked;if(a){const L=ee(a,"formaction");if(L!=null){n=L}const A=ee(a,"formmethod");if(A!=null){if(A.toLowerCase()!=="dialog"){t=A}}}const f=re(r,"hx-confirm");if(D===undefined){const K=function(e){return de(t,n,r,o,i,!!e)};const G={target:c,elt:r,path:n,verb:t,triggeringEvent:o,etc:i,issueRequest:K,question:f};if(he(r,"htmx:confirm",G)===false){oe(s);return e}}let h=r;let d=re(r,"hx-sync");let g=null;let F=false;if(d){const N=d.split(":");const I=N[0].trim();if(I==="this"){h=Se(r,"hx-sync")}else{h=ue(ae(r,I))}d=(N[1]\|\|"drop").trim();u=ie(h);if(d==="drop"&&u.xhr&&u.abortable!==true){oe(s);return e}else if(d==="abort"){if(u.xhr){oe(s);return e}else{F=true}}else if(d==="replace"){he(h,"htmx:abort")}else if(d.indexOf("queue")===0){const W=d.split(" ");g=(W[1]\|\|"last").trim()}}if(u.xhr){if(u.abortable){he(h,"htmx:abort")}else{if(g==null){if(o){const P=ie(o);if(P&&P.triggerSpec&&P.triggerSpec.queue){g=P.triggerSpec.queue}}if(g==null){g="last"}}if(u.queuedRequests==null){u.queuedRequests=[]}if(g==="first"&&u.queuedRequests.length===0){u.queuedRequests.push(function(){de(t,n,r,o,i)})}else if(g==="all"){u.queuedRequests.push(function(){de(t,n,r,o,i)})}else if(g==="last"){u.queuedRequests=[];u.queuedRequests.push(function(){de(t,n,r,o,i)})}oe(s);return e}}const p=new XMLHttpRequest;u.xhr=p;u.abortable=F;const m=function(){u.xhr=null;u.abortable=false;if(u.queuedRequests!=null&&u.queuedRequests.length>0){const e=u.queuedRequests.shift();e()}};const B=re(r,"hx-prompt");if(B){var x=prompt(B);if(x===null\|\|!he(r,"htmx:prompt",{prompt:x,target:c})){oe(s);m();return e}}if(f&&!D){if(!confirm(f)){oe(s);m();return e}}let y=fn(r,c,x);if(t!=="get"&&!pn(r)){y["Content-Type"]="application/x-www-form-urlencoded"}if(i.headers){y=ce(y,i.headers)}const U=cn(r,t);let b=U.errors;const j=U.formData;if(i.values){ln(j,qn(i.values))}const V=qn(En(r));const v=ln(j,V);let w=hn(v,r);if(Q.config.getCacheBusterParam&&t==="get"){w.set("org.htmx.cache-buster",ee(c,"id")\|\|"true")}if(n==null\|\|n===""){n=ne().location.href}const S=bn(r,"hx-request");const _=ie(r).boosted;let E=Q.config.methodsThatUseUrlParams.indexOf(t)>=0;const C={boosted:_,useUrlParams:E,formData:w,parameters:An(w),unfilteredFormData:v,unfilteredParameters:An(v),headers:y,target:c,verb:t,errors:b,withCredentials:i.credentials\|\|S.credentials\|\|Q.config.withCredentials,timeout:i.timeout\|\|S.timeout\|\|Q.config.timeout,path:n,triggeringEvent:o};if(!he(r,"htmx:configRequest",C)){oe(s);m();return e}n=C.path;t=C.verb;y=C.headers;w=qn(C.parameters);b=C.errors;E=C.useUrlParams;if(b&&b.length>0){he(r,"htmx:validation:halted",C);oe(s);m();return e}const z=n.split("#");const $=z[0];const O=z[1];let R=n;if(E){R=$;const Z=!w.keys().next().done;if(Z){if(R.indexOf("?")<0){R+="?"}else{R+="&"}R+=an(w);if(O){R+="#"+O}}}if(!Tn(r,R,C)){fe(r,"htmx:invalidPath",C);oe(l);return e}p.open(t.toUpperCase(),R,true);p.overrideMimeType("text/html");p.withCredentials=C.withCredentials;p.timeout=C.timeout;if(S.noHeaders){}else{for(const k in y){if(y.hasOwnProperty(k)){const Y=y[k];Cn(p,k,Y)}}}const H={xhr:p,target:c,requestConfig:C,etc:i,boosted:_,select:X,pathInfo:{requestPath:n,finalRequestPath:R,responsePath:null,anchor:O}};p.onload=function(){try{const t=Hn(r);H.pathInfo.responsePath=On(p);M(r,H);if(H.keepIndicators!==true){Qt(T,q)}he(r,"htmx:afterRequest",H);he(r,"htmx:afterOnLoad",H);if(!le(r)){let e=null;while(t.length>0&&e==null){const n=t.shift();if(le(n)){e=n}}if(e){he(e,"htmx:afterRequest",H);he(e,"htmx:afterOnLoad",H)}}oe(s);m()}catch(e){fe(r,"htmx:onLoadError",ce({error:e},H));throw e}};p.onerror=function(){Qt(T,q);fe(r,"htmx:afterRequest",H);fe(r,"htmx:sendError",H);oe(l);m()};p.onabort=function(){Qt(T,q);fe(r,"htmx:afterRequest",H);fe(r,"htmx:sendAbort",H);oe(l);m()};p.ontimeout=function(){Qt(T,q);fe(r,"htmx:afterRequest",H);fe(r,"htmx:timeout",H);oe(l);m()};if(!he(r,"htmx:beforeRequest",H)){oe(s);m();return e}var T=Zt(r);var q=Yt(r);se(["loadstart","loadend","progress","abort"],function(t){se([p,p.upload],function(e){e.addEventListener(t,function(e){he(r,"htmx:xhr:"+t,{lengthComputable:e.lengthComputable,loaded:e.loaded,total:e.total})})})});he(r,"htmx:beforeSend",H);const J=E?null:mn(p,r,w);p.send(J);return e}function Nn(e,t){const n=t.xhr;let r=null;let o=null;if(R(n,/HX-Push:/i)){r=n.getResponseHeader("HX-Push");o="push"}else if(R(n,/HX-Push-Url:/i)){r=n.getResponseHeader("HX-Push-Url");o="push"}else if(R(n,/HX-Replace-Url:/i)){r=n.getResponseHeader("HX-Replace-Url");o="replace"}if(r){if(r==="false"){return{}}else{return{type:o,path:r}}}const i=t.pathInfo.finalRequestPath;const s=t.pathInfo.responsePath;const l=re(e,"hx-push-url");const c=re(e,"hx-replace-url");const u=ie(e).boosted;let a=null;let f=null;if(l){a="push";f=l}else if(c){a="replace";f=c}else if(u){a="push";f=s\|\|i}if(f){if(f==="false"){return{}}if(f==="true"){f=s\|\|i}if(t.pathInfo.anchor&&f.indexOf("#")===-1){f=f+"#"+t.pathInfo.anchor}return{type:a,path:f}}else{return{}}}function In(e,t){var n=new RegExp(e.code);return n.test(t.toString(10))}function Pn(e){for(var t=0;t<Q.config.responseHandling.length;t++){var n=Q.config.responseHandling[t];if(In(n,e.status)){return n}}return{swap:false}}function kn(e){if(e){const t=u("title");if(t){t.innerHTML=e}else{window.document.title=e}}}function Dn(o,i){const s=i.xhr;let l=i.target;const e=i.etc;const c=i.select;if(!he(o,"htmx:beforeOnLoad",i))return;if(R(s,/HX-Trigger:/i)){Je(s,"HX-Trigger",o)}if(R(s,/HX-Location:/i)){zt();let e=s.getResponseHeader("HX-Location");var t;if(e.indexOf("{")===0){t=S(e);e=t.path;delete t.path}Rn("get",e,t).then(function(){$t(e)});return}const n=R(s,/HX-Refresh:/i)&&s.getResponseHeader("HX-Refresh")==="true";if(R(s,/HX-Redirect:/i)){i.keepIndicators=true;location.href=s.getResponseHeader("HX-Redirect");n&&location.reload();return}if(n){i.keepIndicators=true;location.reload();return}if(R(s,/HX-Retarget:/i)){if(s.getResponseHeader("HX-Retarget")==="this"){i.target=o}else{i.target=ue(ae(o,s.getResponseHeader("HX-Retarget")))}}const u=Nn(o,i);const r=Pn(s);const a=r.swap;let f=!!r.error;let h=Q.config.ignoreTitle\|\|r.ignoreTitle;let d=r.select;if(r.target){i.target=ue(ae(o,r.target))}var g=e.swapOverride;if(g==null&&r.swapOverride){g=r.swapOverride}if(R(s,/HX-Retarget:/i)){if(s.getResponseHeader("HX-Retarget")==="this"){i.target=o}else{i.target=ue(ae(o,s.getResponseHeader("HX-Retarget")))}}if(R(s,/HX-Reswap:/i)){g=s.getResponseHeader("HX-Reswap")}var p=s.response;var m=ce({shouldSwap:a,serverResponse:p,isError:f,ignoreTitle:h,selectOverride:d,swapOverride:g},i);if(r.event&&!he(l,r.event,m))return;if(!he(l,"htmx:beforeSwap",m))return;l=m.target;p=m.serverResponse;f=m.isError;h=m.ignoreTitle;d=m.selectOverride;g=m.swapOverride;i.target=l;i.failed=f;i.successful=!f;if(m.shouldSwap){if(s.status===286){lt(o)}Ft(o,function(e){p=e.transformResponse(p,s,o)});if(u.type){zt()}var x=gn(o,g);if(!x.hasOwnProperty("ignoreTitle")){x.ignoreTitle=h}l.classList.add(Q.config.swappingClass);let n=null;let r=null;if(c){d=c}if(R(s,/HX-Reselect:/i)){d=s.getResponseHeader("HX-Reselect")}const y=re(o,"hx-select-oob");const b=re(o,"hx-select");let e=function(){try{if(u.type){he(ne().body,"htmx:beforeHistoryUpdate",ce({history:u},i));if(u.type==="push"){$t(u.path);he(ne().body,"htmx:pushedIntoHistory",{path:u.path})}else{Jt(u.path);he(ne().body,"htmx:replacedInHistory",{path:u.path})}}$e(l,p,x,{select:d\|\|b,selectOOB:y,eventInfo:i,anchor:i.pathInfo.anchor,contextElement:o,afterSwapCallback:function(){if(R(s,/HX-Trigger-After-Swap:/i)){let e=o;if(!le(o)){e=ne().body}Je(s,"HX-Trigger-After-Swap",e)}},afterSettleCallback:function(){if(R(s,/HX-Trigger-After-Settle:/i)){let e=o;if(!le(o)){e=ne().body}Je(s,"HX-Trigger-After-Settle",e)}oe(n)}})}catch(e){fe(o,"htmx:swapError",i);oe(r);throw e}};let t=Q.config.globalViewTransitions;if(x.hasOwnProperty("transition")){t=x.transition}if(t&&he(o,"htmx:beforeTransition",i)&&typeof Promise!=="undefined"&&document.startViewTransition){const v=new Promise(function(e,t){n=e;r=t});const w=e;e=function(){document.startViewTransition(function(){w();return v})}}if(x.swapDelay>0){E().setTimeout(e,x.swapDelay)}else{e()}}if(f){fe(o,"htmx:responseError",ce({error:"Response Status Error Code "+s.status+" from "+i.pathInfo.requestPath},i))}}const Mn={};function Xn(){return{init:function(e){return null},getSelectors:function(){return null},onEvent:function(e,t){return true},transformResponse:function(e,t,n){return e},isInlineSwap:function(e){return false},handleSwap:function(e,t,n,r){return false},encodeParameters:function(e,t,n){return null}}}function Fn(e,t){if(t.init){t.init(n)}Mn[e]=ce(Xn(),t)}function Bn(e){delete Mn[e]}function Un(e,n,r){if(n==undefined){n=[]}if(e==undefined){return n}if(r==undefined){r=[]}const t=te(e,"hx-ext");if(t){se(t.split(","),function(e){e=e.replace(/ /g,"");if(e.slice(0,7)=="ignore:"){r.push(e.slice(7));return}if(r.indexOf(e)<0){const t=Mn[e];if(t&&n.indexOf(t)<0){n.push(t)}}})}return Un(ue(c(e)),n,r)}var jn=false;ne().addEventListener("DOMContentLoaded",function(){jn=true});function Vn(e){if(jn\|\|ne().readyState==="complete"){e()}else{ne().addEventListener("DOMContentLoaded",e)}}function _n(){if(Q.config.includeIndicatorStyles!==false){const e=Q.config.inlineStyleNonce?` nonce="${Q.config.inlineStyleNonce}"`:"";ne().head.insertAdjacentHTML("beforeend","<style"+e+"> ."+Q.config.indicatorClass+"{opacity:0} ."+Q.config.requestClass+" ."+Q.config.indicatorClass+"{opacity:1; transition: opacity 200ms ease-in;} ."+Q.config.requestClass+"."+Q.config.indicatorClass+"{opacity:1; transition: opacity 200ms ease-in;} </style>")}}function zn(){const e=ne().querySelector('meta[name="htmx-config"]');if(e){return S(e.content)}else{return null}}function $n(){const e=zn();if(e){Q.config=ce(Q.config,e)}}Vn(function(){$n();_n();let e=ne().body;kt(e);const t=ne().querySelectorAll("[hx-trigger='restored'],[data-hx-trigger='restored']");e.addEventListener("htmx:abort",function(e){const t=e.target;const n=ie(t);if(n&&n.xhr){n.xhr.abort()}});const n=window.onpopstate?window.onpopstate.bind(window):null;window.onpopstate=function(e){if(e.state&&e.state.htmx){Wt();se(t,function(e){he(e,"htmx:restored",{document:ne(),triggerEvent:he})})}else{if(n){n(e)}}};E().setTimeout(function(){he(e,"htmx:load",{});e=null},0)});return Q}();

+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+//! Session cookies, viewer extraction, and CSRF.
+//!
+//! The session cookie carries an opaque 32-byte token; the database stores only
+//! its SHA-256, so lookup hashes the presented cookie and matches on the digest.
+//! CSRF uses the double-submit pattern: a non-`HttpOnly` `fabrica_csrf` cookie
+//! whose value must match an `X-CSRF-Token` header (injected into every htmx
+//! request by `hx-headers` on `<body>`) or a `_csrf` form field on non-GET routes.
+use axum::extract::FromRequestParts;
+use axum::http::HeaderMap;
+use axum::http::request::Parts;
+use axum::response::{IntoResponse, Redirect, Response};
+use axum_extra::extract::cookie::{Cookie, CookieJar, SameSite};
+use model::User;
+use crate::AppState;
+use crate::error::AppError;
+/// The CSRF double-submit cookie name (non-`HttpOnly` by design).
+pub const CSRF_COOKIE: &str = "fabrica_csrf";
+/// The per-visitor theme cookie name.
+pub const THEME_COOKIE: &str = "fabrica_theme";
+/// The current viewer, or `None` when signed out. Never rejects.
+pub struct MaybeUser(pub Option<User>);
+impl FromRequestParts<AppState> for MaybeUser {
+    type Rejection = std::convert::Infallible;
+    async fn from_request_parts(
+        parts: &mut Parts,
+        state: &AppState,
+    ) -> Result<Self, Self::Rejection> {
+        let jar = CookieJar::from_headers(&parts.headers);
+        let Some(cookie) = jar.get(&state.config.auth.cookie_name) else {
+            return Ok(Self(None));
+        };
+        let session_id = auth::session_id(cookie.value());
+        let user = state
+            .store
+            .user_for_session(&session_id)
+            .await
+            .ok()
+            .flatten();
+        if user.is_some() {
+            // Best-effort last-seen bump; never fail the request over it.
+            let _ = state.store.touch_session(&session_id).await;
+        }
+        Ok(Self(user))
+    }
+}
+/// A signed-in viewer; unauthenticated requests are redirected to `/login`.
+pub struct RequireUser(pub User);
+impl FromRequestParts<AppState> for RequireUser {
+    type Rejection = Response;
+    async fn from_request_parts(
+        parts: &mut Parts,
+        state: &AppState,
+    ) -> Result<Self, Self::Rejection> {
+        let MaybeUser(user) = MaybeUser::from_request_parts(parts, state)
+            .await
+            .unwrap_or(MaybeUser(None));
+        match user {
+            Some(user) => Ok(Self(user)),
+            None => Err(Redirect::to("/login").into_response()),
+        }
+    }
+}
+/// Ensure the CSRF cookie exists, returning the (possibly updated) jar and the
+/// token to embed in forms and htmx headers. A stable token avoids invalidating
+/// forms opened in other tabs.
+pub fn ensure_csrf(jar: CookieJar, secure: bool) -> (CookieJar, String) {
+    if let Some(cookie) = jar.get(CSRF_COOKIE) {
+        return (jar.clone(), cookie.value().to_string());
+    }
+    let token = auth::new_secret();
+    let cookie = Cookie::build((CSRF_COOKIE, token.clone()))
+        .http_only(false)
+        .same_site(SameSite::Lax)
+        .secure(secure)
+        .path("/")
+        .build();
+    (jar.add(cookie), token)
+}
+/// Verify a non-GET request's CSRF token: the `fabrica_csrf` cookie must match the
+/// `X-CSRF-Token` header or the `form_token` (`_csrf` form field).
+///
+/// # Errors
+///
+/// Returns [`AppError::Forbidden`] if the tokens are missing or do not match.
+pub fn verify_csrf(
+    jar: &CookieJar,
+    headers: &HeaderMap,
+    form_token: Option<&str>,
+) -> Result<(), AppError> {
+    let cookie = jar.get(CSRF_COOKIE).map(|c| c.value().to_string());
+    let submitted = headers
+        .get("x-csrf-token")
+        .and_then(|v| v.to_str().ok())
+        .map(str::to_string)
+        .or_else(|| form_token.map(str::to_string));
+    match (cookie, submitted) {
+        (Some(a), Some(b)) if !a.is_empty() && a == b => Ok(()),
+        _ => Err(AppError::Forbidden),
+    }
+}
+/// Build the session cookie for a freshly minted token.
+#[must_use]
+pub fn session_cookie(name: &str, value: String, ttl_days: u32, secure: bool) -> Cookie<'static> {
+    Cookie::build((name.to_string(), value))
+        .http_only(true)
+        .same_site(SameSite::Lax)
+        .secure(secure)
+        .path("/")
+        .max_age(time::Duration::days(i64::from(ttl_days)))
+        .build()
+}
+/// Build a removal cookie for logout (empty value, immediate expiry).
+#[must_use]
+pub fn clear_cookie(name: &str) -> Cookie<'static> {
+    Cookie::build((name.to_string(), String::new()))
+        .path("/")
+        .max_age(time::Duration::ZERO)
+        .build()
+}

+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+//! Handler tests via `tower::ServiceExt::oneshot` — no network, no external
+//! services. They assert the shell renders, static assets and themes serve,
+//! CSRF is enforced on state-changing routes, and sign-in opens a session.
+#![allow(clippy::unwrap_used, clippy::expect_used)]
+use std::sync::Arc;
+use axum::Router;
+use axum::body::Body;
+use axum::http::{Request, StatusCode, header};
+use config::Config;
+use store::{NewUser, Store};
+use tower::ServiceExt as _;
+use crate::AppState;
+/// Build an app over an in-memory store with one admin-less user `ada` whose
+/// password is `secret12`.
+async fn app() -> (AppState, Router) {
+    let store = Store::connect("sqlite::memory:", 1).await.unwrap();
+    store.migrate().await.unwrap();
+    let hash = auth::hash_password("secret12", auth::HashParams::default()).unwrap();
+    store
+        .create_user(NewUser {
+            username: "ada".to_string(),
+            email: "ada@example.com".to_string(),
+            display_name: Some("Ada".to_string()),
+            password_hash: Some(hash),
+            is_admin: false,
+            must_change_password: false,
+        })
+        .await
+        .unwrap();
+    let mut config = Config::default();
+    config.instance.name = "Forge".to_string();
+    // Not HTTPS in tests, so don't demand Secure cookies.
+    config.auth.cookie_secure = false;
+    let state = AppState::build(Arc::new(config), store, "test-secret".to_string()).unwrap();
+    let router = crate::build_router(state.clone());
+    (state, router)
+}
+async fn body_string(response: axum::response::Response) -> String {
+    let bytes = axum::body::to_bytes(response.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    String::from_utf8_lossy(&bytes).into_owned()
+}
+fn get(uri: &str) -> Request<Body> {
+    Request::builder().uri(uri).body(Body::empty()).unwrap()
+}
+#[tokio::test]
+async fn home_renders_the_shell() {
+    let (_state, app) = app().await;
+    let res = app.oneshot(get("/")).await.unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+    let html = body_string(res).await;
+    assert!(html.contains("<!DOCTYPE html>"));
+    assert!(html.contains("Forge"), "instance name should appear");
+    assert!(html.contains("/assets/base.css"));
+    assert!(html.contains("/assets/htmx.min.js"));
+}
+#[tokio::test]
+async fn assets_and_themes_serve() {
+    let (_state, app) = app().await;
+    let css = app.clone().oneshot(get("/assets/base.css")).await.unwrap();
+    assert_eq!(css.status(), StatusCode::OK);
+    assert_eq!(
+        css.headers().get(header::CONTENT_TYPE).unwrap(),
+        "text/css; charset=utf-8"
+    );
+    let theme = app.clone().oneshot(get("/theme/dark.css")).await.unwrap();
+    assert_eq!(theme.status(), StatusCode::OK);
+    let body = body_string(theme).await;
+    assert!(body.contains("--fb-bg"));
+    let default = app.clone().oneshot(get("/theme.css")).await.unwrap();
+    assert_eq!(default.status(), StatusCode::OK);
+    let traversal = app.oneshot(get("/assets/../Cargo.toml")).await.unwrap();
+    assert_ne!(traversal.status(), StatusCode::OK);
+}
+#[tokio::test]
+async fn healthz_and_version_report() {
+    let (_state, app) = app().await;
+    let health = app.clone().oneshot(get("/healthz")).await.unwrap();
+    // git may or may not be present in the test env; either way it is valid JSON.
+    let body = body_string(health).await;
+    assert!(body.contains("\"database\":\"ok\""));
+    let version = app.oneshot(get("/version")).await.unwrap();
+    assert_eq!(version.status(), StatusCode::OK);
+    assert!(body_string(version).await.contains("\"name\":\"Forge\""));
+}
+#[tokio::test]
+async fn login_form_renders_with_a_csrf_token() {
+    let (_state, app) = app().await;
+    let res = app.oneshot(get("/login")).await.unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+    // The CSRF cookie is set, and its token is embedded in the form.
+    let set_cookie = res
+        .headers()
+        .get(header::SET_COOKIE)
+        .map(|v| v.to_str().unwrap().to_string())
+        .unwrap_or_default();
+    assert!(
+        set_cookie.contains("fabrica_csrf="),
+        "csrf cookie: {set_cookie:?}"
+    );
+    let html = body_string(res).await;
+    assert!(html.contains("name=\"_csrf\""));
+}
+#[tokio::test]
+async fn post_without_csrf_is_forbidden() {
+    let (_state, app) = app().await;
+    let req = Request::builder()
+        .method("POST")
+        .uri("/login")
+        .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+        .body(Body::from("username=ada&password=secret12&_csrf=nope"))
+        .unwrap();
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::FORBIDDEN);
+}
+#[tokio::test]
+async fn login_with_matching_csrf_opens_a_session() {
+    let (_state, app) = app().await;
+    // First GET /login to obtain a CSRF cookie + token.
+    let form = app.clone().oneshot(get("/login")).await.unwrap();
+    let cookie = form
+        .headers()
+        .get(header::SET_COOKIE)
+        .unwrap()
+        .to_str()
+        .unwrap()
+        .to_string();
+    let token = cookie
+        .split("fabrica_csrf=")
+        .nth(1)
+        .and_then(|s| s.split(';').next())
+        .unwrap()
+        .to_string();
+    // POST with the cookie echoed and the token in the body → double-submit passes.
+    let req = Request::builder()
+        .method("POST")
+        .uri("/login")
+        .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+        .header(header::COOKIE, format!("fabrica_csrf={token}"))
+        .body(Body::from(format!(
+            "username=ada&password=secret12&_csrf={token}"
+        )))
+        .unwrap();
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::SEE_OTHER, "redirect on success");
+    let set = res
+        .headers()
+        .get_all(header::SET_COOKIE)
+        .iter()
+        .map(|v| v.to_str().unwrap().to_string())
+        .collect::<Vec<_>>()
+        .join("\n");
+    assert!(
+        set.contains("fabrica_session="),
+        "session cookie set: {set:?}"
+    );
+}
+#[tokio::test]
+async fn bad_password_re_renders_unauthorized() {
+    let (_state, app) = app().await;
+    let form = app.clone().oneshot(get("/login")).await.unwrap();
+    let cookie = form
+        .headers()
+        .get(header::SET_COOKIE)
+        .unwrap()
+        .to_str()
+        .unwrap()
+        .to_string();
+    let token = cookie
+        .split("fabrica_csrf=")
+        .nth(1)
+        .and_then(|s| s.split(';').next())
+        .unwrap()
+        .to_string();
+    let req = Request::builder()
+        .method("POST")
+        .uri("/login")
+        .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+        .header(header::COOKIE, format!("fabrica_csrf={token}"))
+        .body(Body::from(format!(
+            "username=ada&password=wrong&_csrf={token}"
+        )))
+        .unwrap();
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
+}
+#[tokio::test]
+async fn invite_with_unknown_token_is_not_found() {
+    let (_state, app) = app().await;
+    let res = app.oneshot(get("/invite/does-not-exist")).await.unwrap();
+    assert_eq!(res.status(), StatusCode::NOT_FOUND);
+}
+#[tokio::test]
+async fn settings_redirects_when_signed_out() {
+    let (_state, app) = app().await;
+    let res = app.oneshot(get("/settings")).await.unwrap();
+    assert_eq!(res.status(), StatusCode::SEE_OTHER);
+    assert_eq!(res.headers().get(header::LOCATION).unwrap(), "/login");
+}
+#[tokio::test]
+async fn unknown_theme_is_rejected() {
+    let (_state, app) = app().await;
+    let res = app.oneshot(get("/settings/theme?name=nope")).await.unwrap();
+    assert_eq!(res.status(), StatusCode::BAD_REQUEST);
+}

 `none` paths so `cargo test` needs no SMTP server. A **SHOULD** deviation logged
 here. The invite token reuses `auth::new_session_token`'s shape (32 bytes,
 base64url value emailed, SHA-256 stored).
+## 2026-07-25 — `serve` wired in the binary; `cli` never depends on `web`
+**Decision:** `fabrica serve` orchestration (load config → open store → build web
+state → run) lives in the root binary (`src/serve.rs`). `cli::run` takes a serve
+callback and hands back a `cli::ServeRequest`; the binary supplies the callback.
+`cli` exposes `resolve_secret` for the binary to reuse.
+**Alternatives:** Let `cli` depend on `web` and run the server directly.
+**Rationale:** The architecture rule is absolute — **no crate may depend on
+`web`** — and `serve` must start `web` (and later `ssh`/`api`). The only place
+those top-level crates can be tied together is the binary, which already depends on
+all of them. The callback keeps `cli` (the command tree) free of `web` while
+`main.rs` stays a thin wiring layer. `--detach` is accepted but not yet
+implemented (foreground is correct for systemd/Docker); deferred to deployment.
+## 2026-07-25 — Web stack: axum 0.8, plain cookies, no global timeout
+**Decision:** The web crate uses axum 0.8 + axum-extra cookies + maud + tower-http,
+with **no TLS/rustls feature anywhere** (TLS terminates at a reverse proxy), so
+`ring` stays out of the graph. Session and CSRF use **plain (unsigned) cookies**:
+the session cookie is an opaque 32-byte token validated by SHA-256 lookup in the
+`sessions` table; CSRF is double-submit (a non-`HttpOnly` `fabrica_csrf` cookie
+matched against the `X-CSRF-Token` header htmx injects, or a `_csrf` form field).
+There is **no global request timeout** layer.
+**Alternatives:** `SignedCookieJar` (needs a `Key` + `FromRef`); tower-cookies; a
+global `TimeoutLayer`.
+**Rationale:** The session token is already unguessable and DB-validated, so cookie
+signing adds machinery without materially improving security; double-submit CSRF
+needs a JS-readable cookie regardless. A global timeout is actively **wrong** for
+this app: pack-transport routes (§3.3) stream arbitrarily long clones and must
+never be cut off, so timeouts (if any) belong per-route on non-git paths, added in
+the polish phase. The theme picker is a real GET form (works without JS) that sets
+a `fabrica_theme` cookie; `SIGHUP` re-scans `themes_dir` via an `RwLock<Assets>`.

           craneLib = (inputs.crane.mkLib pkgs).overrideToolchain fenixToolchain;
-          # Keep `.sql` migration files (embedded by `store` via `sqlx::migrate!`)
+          # Keep files crane's default cargo-source filter would strip but the build
-          # and `.snap` insta snapshots (read by `highlight`'s snapshot tests) in
+          # needs: `.sql` migrations (embedded by `store` via `sqlx::migrate!`),
-          # the build source: crane's default cargo-source filter would strip both.
+          # `.snap` insta snapshots (read by `highlight`), and the web `assets/`
+          # (css/js/svg/… embedded by `web` via `rust-embed` at compile time).
           src = pkgs.lib.cleanSourceWith {
             src = ./.;
             name = "source";
             filter =
               path: type:
-              (builtins.match ".*\\.(sql|snap)$" path != null) || (craneLib.filterCargoSources path type);
+              (builtins.match ".*\\.(sql|snap|css|js|svg|ico|png|woff2)$" path != null)
+              || (craneLib.filterCargoSources path type);
           };
           commonArgs = {

 //! `fabrica` — a self-hosted git server.
 //!
-//! The binary is deliberately thin: it parses arguments and dispatches into the
+//! The binary parses arguments through [`cli`] and dispatches. The one thing it
-//! [`cli`] crate, and nothing else lives here.
+//! does beyond that is wire the servers together for `serve` (see [`serve`]), so
+//! that no library crate has to depend on `web`.
+mod serve;
 use std::process::ExitCode;
 fn main() -> ExitCode {
-    cli::run()
+    cli::run(serve::run)
+}

+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+//! The `fabrica serve` wiring.
+//!
+//! This is the one place the top-level server crates are tied together — kept in
+//! the binary so that no library crate depends on `web` (or, later, `ssh`/`api`).
+//! `cli` parses the command and hands us a [`cli::ServeRequest`]; we load config,
+//! open the store, and run the web server.
+use std::net::SocketAddr;
+use std::process::ExitCode;
+use std::sync::Arc;
+use cli::ServeRequest;
+/// Handle `fabrica serve`.
+///
+/// # Errors
+///
+/// Returns an error if configuration is invalid, the store cannot be opened, the
+/// bind address cannot be parsed, or the server fails to run.
+pub fn run(req: ServeRequest) -> anyhow::Result<ExitCode> {
+    let runtime = tokio::runtime::Builder::new_multi_thread()
+        .enable_all()
+        .build()?;
+    runtime.block_on(async move {
+        if req.detach {
+            anyhow::bail!(
+                "--detach is not yet implemented; run in the foreground \
+                 (systemd and Docker manage the process lifecycle)"
+            );
+        }
+        let loaded = config::load(req.config_path.as_deref())?;
+        for warning in &loaded.warnings {
+            eprintln!("warning: {warning}");
+        }
+        let store = store::Store::connect(
+            &loaded.config.database.url,
+            loaded.config.database.max_connections,
+        )
+        .await?;
+        if !req.no_migrate {
+            store.migrate().await?;
+        }
+        let secret = cli::resolve_secret(&loaded.config)?;
+        let addr: SocketAddr = format!(
+            "{}:{}",
+            loaded.config.server.address, loaded.config.server.port
+        )
+        .parse()?;
+        let state = web::AppState::build(Arc::new(loaded.config), store, secret)?;
+        web::serve(state, addr).await?;
+        Ok(ExitCode::SUCCESS)
+    })
+}