feat(captcha): SetSecret for live HMAC secret rotation

Server now holds the secret in an atomic.Pointer so a running instance can
swap it; outstanding challenge and verification tokens signed with the old
secret immediately fail verification.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

AGENTS.md

@@ -1,9 +1,44 @@
 # Core SDK
 
-Go module `git.dev.alexdunmow.com/block/core`. Shared Go code between the **CMS and the orchestrator** — template engine, block registry, shared types, proto definitions.
+Go module `git.dev.alexdunmow.com/block/core`.
+
+**Purpose: core exists ONLY for code that must be shared between first-party
+BlockNinja entities** — the **CMS**, the **orchestrator**, the **ninja CLI**,
+and any future entity that genuinely needs to share code with the others.
+
+## Admission test
+
+Before adding anything here, ask: **do two or more first-party entities need
+this code?**
+
+- Needed by only one entity → it belongs in that entity's repo, not core.
+- Needed by plugins → it does NOT belong here (see below); plugins build
+  against the wasm ABI, whose contract the CMS owns (`cms/backend/abi/`,
+  `cms/docs/abi/`).
+
+The standing direction (Captain, 2026-07-07) is to **shrink core**: prefer
+moving code out to its single consumer over adding more in. When a package's
+consumer count drops to one, migrate it out.
 
 ## Critical Rules
 
-- **Core is NOT for plugins.** Its only consumers are the CMS and the orchestrator; it exists purely to share code between those two. Plugins must not import `block/core` — in the wasm-plugin era they are standalone artifacts built against the wasm ABI, not this module. (Core was previously the plugin SDK; that role is gone.)
-- **NEVER use `replace` directives in go.mod** — not in this repo, not in any consumer. All module resolution goes through the Gitea module proxy. If you need to test local changes, tag and push a version.
-- All consumers are in-house — no backwards compatibility shims needed. Just change the API and update consumers.
+- **Core is NOT for plugins.** Plugins are standalone wasm artifacts built
+  against the wasm ABI, not this module. (Core was previously the plugin SDK;
+  that role is gone, and remaining plugin-era surface is legacy to be worked
+  off, not a precedent.)
+- **NEVER use `replace` directives in go.mod** — not in this repo, not in any
+  consumer. All module resolution goes through the Gitea module proxy. If you
+  need to test local changes, tag and push a version.
+- All consumers are in-house — no backwards compatibility shims needed. Just
+  change the API and update consumers.
+
+## Special case: `templates/bn/` is a synced copy, do not author here
+
+The bn page chrome (head / toolbar / engagement / asset_hooks) is **authored
+in `cms/backend/templates/bn`** and mechanically copied here (`make
+sync-templates` in cms) solely so guest-side plugin templates can compile it
+into their wasm. check-safety check 31 fails cms commits while the copies
+drift. Never edit these files here directly — change them in cms and sync.
+`templates/bn/validation.go` is intentionally divergent (cms's version bridges
+the SDK ValidationTracker under both context keys) and is NOT part of the sync
+set. Spec: cms `docs/superpowers/specs/2026-07-07-bn-chrome-single-source-design.md`.

README.md

@@ -1,8 +1,19 @@
 # BlockNinja Core
 
-Shared Go code between the BlockNinja CMS and the orchestrator: types, interfaces, and utilities both need.
+Go code shared between first-party BlockNinja entities: the **CMS**, the
+**orchestrator**, the **ninja CLI**, and any future entity that genuinely
+needs to share code with the others.
 
-> **Not a plugin SDK.** Core is purely for sharing code between the CMS and the orchestrator. Plugins must **not** import `block/core` — in the wasm-plugin era they are standalone artifacts built against the wasm ABI. (Core previously served as the plugin SDK; that role is gone.)
+> **Scope rule:** core is ONLY for code needed by **two or more** of those
+> entities. Code with a single consumer belongs in that consumer's repo. The
+> standing direction is to shrink core — when a package's consumer count drops
+> to one, it gets migrated out.
+
+> **Not a plugin SDK.** Plugins must **not** treat `block/core` as their SDK —
+> in the wasm-plugin era they are standalone artifacts built against the wasm
+> ABI (owned by the CMS: `cms/backend/abi/`, `cms/docs/abi/`). Core previously
+> served as the plugin SDK; that role is gone, and remaining plugin-era
+> surface here is legacy to be worked off, not a precedent.
 
 ## Package Structure
 
@@ -12,7 +23,7 @@ Shared Go code between the BlockNinja CMS and the orchestrator: types, interface
 | `blocks/` | BlockMeta, BlockFunc, BlockRegistry interface, BlockContext |
 | `blocks/builtin/` | Reusable block implementations (HTMLBlock) |
 | `templates/` | TemplateRegistry interface |
-| `templates/bn/` | Shared templ components (head, engagement, toolbar) |
+| `templates/bn/` | Synced copy of the cms-authored bn chrome (see below) |
 | `auth/` | Claims types, context extractors |
 | `content/` | Content access interface |
 | `settings/` | Settings access interface |
@@ -23,10 +34,20 @@ Shared Go code between the BlockNinja CMS and the orchestrator: types, interface
 | `ai/` | AI tool registry interface and types |
 | `rbac/` | Role type definition |
 
+### `templates/bn/` is a synced copy — do not edit here
+
+The bn page chrome (head / toolbar / engagement / asset_hooks) is authored in
+`cms/backend/templates/bn` and copied here via the cms `make sync-templates`
+target, solely so guest-side plugin templates can compile it into their wasm.
+check-safety (check 31) fails cms commits while the copies drift. Change the
+chrome in cms, sync, then commit + tag + push here.
+
 ## Usage
 
-Consumers are the CMS and the orchestrator only.
-
 ```go
-import "git.dev.alexdunmow.com/block/core/plugin"
+import "git.dev.alexdunmow.com/block/core/blocks"
 ```
+
+Versioned via git tags through the Gitea module proxy — never `replace`
+directives. All consumers are in-house; no backwards-compatibility shims —
+change the API and update the consumers.

captcha/captcha.go

@@ -10,6 +10,7 @@ import (
 	"encoding/hex"
 	"net/http"
 	"strconv"
+	"sync/atomic"
 	"time"
 )
 
@@ -34,7 +35,7 @@ type RedeemResponse struct {
 }
 
 type Server struct {
-	secret         []byte
+	secret         atomic.Pointer[[]byte]
 	count, size, d int
 	challengeTTL   time.Duration
 	tokenTTL       time.Duration
@@ -59,7 +60,6 @@ func WithUsedTokenStore(ns NonceStore) Option { return func(sv *Server) { sv.use
 // 32-char salts, difficulty 4, 10-min challenge / 5-min token expiry.
 func New(secret []byte, opts ...Option) *Server {
 	s := &Server{
-		secret:       secret,
 		count:        50,
 		size:         32,
 		d:            4,
@@ -68,12 +68,20 @@ func New(secret []byte, opts ...Option) *Server {
 		nonces:       NewMemoryNonceStore(),
 		usedTokens:   NewMemoryNonceStore(),
 	}
+	s.secret.Store(&secret)
 	for _, o := range opts {
 		o(s)
 	}
 	return s
 }
 
+func (s *Server) secretBytes() []byte { return *s.secret.Load() }
+
+// SetSecret swaps the HMAC secret at runtime. Outstanding challenge and
+// verification tokens signed with the old secret immediately fail
+// verification, so callers can use this to invalidate all issued tokens.
+func (s *Server) SetSecret(secret []byte) { s.secret.Store(&secret) }
+
 func (s *Server) CreateChallenge() (ChallengeResponse, error) {
 	buf := make([]byte, 25)
 	if _, err := rand.Read(buf); err != nil {
@@ -81,7 +89,7 @@ func (s *Server) CreateChallenge() (ChallengeResponse, error) {
 	}
 	nonce := hex.EncodeToString(buf)
 	expires := nowMs() + s.challengeTTL.Milliseconds()
-	token := makeChallengeToken(s.secret, nonce, expires, s.count, s.size, s.d)
+	token := makeChallengeToken(s.secretBytes(), nonce, expires, s.count, s.size, s.d)
 	return ChallengeResponse{
 		Challenge: Challenge{C: s.count, S: s.size, D: s.d},
 		Token:     token,
@@ -90,7 +98,7 @@ func (s *Server) CreateChallenge() (ChallengeResponse, error) {
 }
 
 func (s *Server) Redeem(token string, solutions []string) RedeemResponse {
-	claims := verifyChallengeToken(s.secret, token)
+	claims := verifyChallengeToken(s.secretBytes(), token)
 	if claims == nil {
 		return RedeemResponse{Success: false}
 	}
@@ -111,7 +119,7 @@ func (s *Server) Redeem(token string, solutions []string) RedeemResponse {
 		}
 	}
 	expires := nowMs() + s.tokenTTL.Milliseconds()
-	vt, err := makeVerificationToken(s.secret, expires)
+	vt, err := makeVerificationToken(s.secretBytes(), expires)
 	if err != nil {
 		return RedeemResponse{Success: false}
 	}
@@ -132,7 +140,7 @@ func (s *Server) Redeem(token string, solutions []string) RedeemResponse {
 // fragment that still carries the widget (with its reset flow) lets the visitor
 // re-solve and retry — callers MUST keep the widget present on rejection paths.
 func (s *Server) VerifyToken(token string) bool {
-	claims := parseVerificationToken(s.secret, token)
+	claims := parseVerificationToken(s.secretBytes(), token)
 	if claims == nil {
 		return false
 	}

templates/bn/asset_hooks.go

@@ -0,0 +1,11 @@
+package bn
+
+// VersionedAssetURL resolves an asset URL to a cache-versioned form. The
+// default is the identity function; the CMS host wires it to
+// internal/assets.VersionedURL at startup so plugin stylesheet links get
+// content-hash ?v= params. Guest-side (wasm) renders keep the identity
+// default — asset hashing is a host concern.
+//
+// This file is part of the cms→core template sync set (make sync-templates);
+// it must stay SDK-clean (no cms imports).
+var VersionedAssetURL = func(url string) string { return url }

templates/bn/engagement_templ.go

@@ -62,7 +62,7 @@ func EngagementScript(config EngagementConfig) templ.Component {
 			var templ_7745c5c3_Var2 string
 			templ_7745c5c3_Var2, templ_7745c5c3_Err = templ.ResolveAttributeValue(engagementConfigJSON(config))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/engagement.templ`, Line: 30, Col: 63}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `engagement.templ`, Line: 30, Col: 63}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var2)
 			if templ_7745c5c3_Err != nil {

templates/bn/head.templ

@@ -16,22 +16,56 @@ func resolveMediaURL(url string) string {
 	return url
 }
 
+// canonicalURL resolves the canonical link. An admin-set value wins (made absolute
+// against the page's own origin when it is root-relative); otherwise the page's own
+// absolute URL is used as a self-referencing canonical. Returns "" only when neither
+// is available.
+func canonicalURL(canonical, pageURL string) string {
+	if canonical == "" {
+		return pageURL
+	}
+	if strings.HasPrefix(canonical, "http://") || strings.HasPrefix(canonical, "https://") {
+		return canonical
+	}
+	if strings.HasPrefix(canonical, "/") && pageURL != "" {
+		if i := strings.Index(pageURL, "://"); i >= 0 {
+			if j := strings.IndexByte(pageURL[i+3:], '/'); j >= 0 {
+				return pageURL[:i+3+j] + canonical
+			}
+			return pageURL + canonical
+		}
+	}
+	return canonical
+}
+
 // BrandingData contains generated favicon/icon URLs
 type BrandingData struct {
-	FaviconICO     string // /brand/{id}/favicon.ico
-	Favicon16      string // /brand/{id}/favicon-16x16.png
-	Favicon32      string // /brand/{id}/favicon-32x32.png
-	AppleTouchIcon string // /brand/{id}/apple-touch-icon.png (180x180)
-	Android192     string // /brand/{id}/android-chrome-192x192.png
-	Android512     string // /brand/{id}/android-chrome-512x512.png
-	Maskable512    string // /brand/{id}/maskable-512x512.png
-	Master1024     string // /brand/{id}/icon-1024x1024.png
-	ManifestURL    string // /brand/{id}/site.webmanifest
+	FaviconICO     string // /.brand/{id}/favicon.ico
+	Favicon16      string // /.brand/{id}/favicon-16x16.png
+	Favicon32      string // /.brand/{id}/favicon-32x32.png
+	Favicon96      string // /.brand/{id}/favicon-96x96.png
+	AppleTouchIcon string // /.brand/{id}/apple-touch-icon.png (180x180)
+	Android192     string // /.brand/{id}/android-chrome-192x192.png
+	Android512     string // /.brand/{id}/android-chrome-512x512.png
+	Maskable512    string // /.brand/{id}/maskable-512x512.png
+	Master1024     string // /.brand/{id}/icon-1024x1024.png
+	ManifestURL    string // /.brand/{id}/site.webmanifest
+	MaskIcon       string // /.brand/{id}/mask-icon.svg
+	MSTile150      string // /.brand/{id}/mstile-150x150.png
+	BrowserConfig  string // /.brand/{id}/browserconfig.xml
 	ThemeColor     string
 	SVG            string // Optional SVG pass-through
 	IsGenerated    bool
 }
 
+// CustomScriptEntry represents a single custom script with placement control
+type CustomScriptEntry struct {
+	Name      string
+	Placement string // "head" or "body"
+	Code      string
+	Enabled   bool
+}
+
 // SiteSettingsData contains site-wide settings for head injection
 type SiteSettingsData struct {
 	Title                        string
@@ -41,8 +75,9 @@ type SiteSettingsData struct {
 	LogoAlt                      string
 	AppleTouchIcon               string
 	GoogleAnalyticsID            string
-	CustomHeadScripts string
-	CustomBodyScripts string
+	CustomScripts                []CustomScriptEntry
+	GoogleAnalyticsEnabled       bool
+	GoogleAnalyticsExplicitlySet bool // true if the enabled flag was explicitly set in JSON (not nil)
 	MetaDescription              string
 	DefaultOGImage    string
 	TwitterHandle     string
@@ -67,6 +102,10 @@ type PageMeta struct {
 	TwitterImage       string // Twitter card image URL
 	CanonicalURL       string // Canonical URL for this page
 	RobotsDirective    string // Robots directive (e.g., "noindex, nofollow")
+	OGType             string // Open Graph type ("article" for posts, else "website")
+	PageURL            string // Absolute URL of this page (og:url + auto-canonical)
+	ArticlePublishedTime string // ISO 8601 published time (articles only)
+	ArticleAuthor        string // Author name (articles only)
 }
 
 // HeadData contains all data needed to render the <head> element
@@ -159,15 +198,75 @@ func ParseSiteSettings(doc map[string]any) SiteSettingsData {
 	}
 
 	// Analytics
+	var legacyHeadScripts, legacyBodyScripts string
 	if analyticsData, ok := siteData["analytics"].(map[string]any); ok {
 		if v, ok := analyticsData["google_analytics_id"].(string); ok {
 			settings.GoogleAnalyticsID = v
 		}
+		// Read GA enabled flag — if present, use it; if absent but ID is set, default to enabled (backward compat)
+		if v, ok := analyticsData["google_analytics_enabled"].(bool); ok {
+			settings.GoogleAnalyticsEnabled = v
+			settings.GoogleAnalyticsExplicitlySet = true
+		} else if settings.GoogleAnalyticsID != "" {
+			settings.GoogleAnalyticsEnabled = true
+		}
+		// Preserve legacy flat fields for fallback
 		if v, ok := analyticsData["custom_head_scripts"].(string); ok {
-			settings.CustomHeadScripts = v
+			legacyHeadScripts = v
 		}
 		if v, ok := analyticsData["custom_body_scripts"].(string); ok {
-			settings.CustomBodyScripts = v
+			legacyBodyScripts = v
+		}
+	}
+
+	// Structured custom scripts
+	if scriptsArr, ok := siteData["custom_scripts"].([]any); ok && len(scriptsArr) > 0 {
+		for _, item := range scriptsArr {
+			entry, ok := item.(map[string]any)
+			if !ok {
+				continue
+			}
+			cs := CustomScriptEntry{}
+			if v, ok := entry["name"].(string); ok {
+				cs.Name = v
+			}
+			// Placement: proto enum stored as float64 (1=head, 2=body) or string
+			switch p := entry["placement"].(type) {
+			case float64:
+				if p == 1 {
+					cs.Placement = "head"
+				} else if p == 2 {
+					cs.Placement = "body"
+				}
+			case string:
+				cs.Placement = p
+			}
+			if v, ok := entry["code"].(string); ok {
+				cs.Code = v
+			}
+			if v, ok := entry["enabled"].(bool); ok {
+				cs.Enabled = v
+			}
+			settings.CustomScripts = append(settings.CustomScripts, cs)
+		}
+	}
+	// Fallback: if no structured scripts, migrate old flat fields
+	if len(settings.CustomScripts) == 0 {
+		if legacyHeadScripts != "" {
+			settings.CustomScripts = append(settings.CustomScripts, CustomScriptEntry{
+				Name:      "Legacy Head Scripts",
+				Placement: "head",
+				Code:      legacyHeadScripts,
+				Enabled:   true,
+			})
+		}
+		if legacyBodyScripts != "" {
+			settings.CustomScripts = append(settings.CustomScripts, CustomScriptEntry{
+				Name:      "Legacy Body Scripts",
+				Placement: "body",
+				Code:      legacyBodyScripts,
+				Enabled:   true,
+			})
 		}
 	}
 
@@ -209,6 +308,18 @@ func ParseSiteSettings(doc map[string]any) SiteSettingsData {
 		if v, ok := brandingData["svg"].(string); ok {
 			settings.Branding.SVG = v
 		}
+		if v, ok := brandingData["favicon_96"].(string); ok {
+			settings.Branding.Favicon96 = v
+		}
+		if v, ok := brandingData["mask_icon"].(string); ok {
+			settings.Branding.MaskIcon = v
+		}
+		if v, ok := brandingData["mstile_150"].(string); ok {
+			settings.Branding.MSTile150 = v
+		}
+		if v, ok := brandingData["browserconfig"].(string); ok {
+			settings.Branding.BrowserConfig = v
+		}
 	}
 
 	// Admin bypass mode (for showing banner when admin bypasses maintenance/coming_soon)
@@ -276,6 +387,18 @@ func ParsePageMeta(doc map[string]any) PageMeta {
 	if v, ok := doc["robotsDirective"].(string); ok {
 		meta.RobotsDirective = v
 	}
+	if v, ok := doc["ogType"].(string); ok {
+		meta.OGType = v
+	}
+	if v, ok := doc["pageUrl"].(string); ok {
+		meta.PageURL = v
+	}
+	if v, ok := doc["articlePublishedTime"].(string); ok {
+		meta.ArticlePublishedTime = v
+	}
+	if v, ok := doc["articleAuthor"].(string); ok {
+		meta.ArticleAuthor = v
+	}
 
 	return meta
 }
@@ -310,6 +433,12 @@ func ParseToolbarData(data map[string]any) ToolbarData {
 	if v, ok := data["preview_mode"].(string); ok {
 		toolbar.PreviewMode = v
 	}
+	if v, ok := data["hide_preview_toggle"].(bool); ok {
+		toolbar.HidePreviewToggle = v
+	}
+	if v, ok := data["animate"].(bool); ok {
+		toolbar.Animate = v
+	}
 	if v, ok := data["position"].(string); ok {
 		toolbar.Position = v
 	}
@@ -390,15 +519,30 @@ templ Head(data HeadData) {
 		@themeInitScript(data.ThemeMode)
 		<script src="https://unpkg.com/htmx.org@2.0.4"></script>
 		if data.Settings.Branding.IsGenerated {
-			// Use generated brand assets
-			<link rel="icon" type="image/x-icon" href={ data.Settings.Branding.FaviconICO }/>
-			<link rel="icon" type="image/png" sizes="16x16" href={ data.Settings.Branding.Favicon16 }/>
+			// Use generated brand assets (modern RFG-parity set; SVG first)
+			if data.Settings.Branding.SVG != "" {
+				<link rel="icon" type="image/svg+xml" href={ data.Settings.Branding.SVG }/>
+			}
+			if data.Settings.Branding.Favicon96 != "" {
+				<link rel="icon" type="image/png" sizes="96x96" href={ data.Settings.Branding.Favicon96 }/>
+			}
 			<link rel="icon" type="image/png" sizes="32x32" href={ data.Settings.Branding.Favicon32 }/>
+			<link rel="icon" type="image/png" sizes="16x16" href={ data.Settings.Branding.Favicon16 }/>
+			<link rel="icon" type="image/x-icon" href={ data.Settings.Branding.FaviconICO }/>
 			<link rel="apple-touch-icon" sizes="180x180" href={ data.Settings.Branding.AppleTouchIcon }/>
+			if data.Settings.Branding.MaskIcon != "" {
+				<link rel="mask-icon" href={ data.Settings.Branding.MaskIcon } color={ data.Settings.Branding.ThemeColor }/>
+			}
 			<link rel="manifest" href={ data.Settings.Branding.ManifestURL }/>
 			if data.Settings.Branding.ThemeColor != "" {
 				<meta name="theme-color" content={ data.Settings.Branding.ThemeColor }/>
 			}
+			if data.Settings.Branding.BrowserConfig != "" {
+				<meta name="msapplication-config" content={ data.Settings.Branding.BrowserConfig }/>
+			}
+			if data.Title != "" {
+				<meta name="apple-mobile-web-app-title" content={ data.Title }/>
+			}
 		} else {
 			// Legacy fallback - manual favicon uploads
 			if data.Settings.Favicon != "" {
@@ -418,9 +562,9 @@ templ Head(data HeadData) {
 			<meta name="description" content={ data.Settings.MetaDescription }/>
 		}
 
-		// Canonical URL (page-level only, no site default)
-		if data.PageMeta.CanonicalURL != "" {
-			<link rel="canonical" href={ data.PageMeta.CanonicalURL }/>
+		// Canonical URL: admin override (resolved to absolute) → auto self-canonical (M8)
+		if canonical := canonicalURL(data.PageMeta.CanonicalURL, data.PageMeta.PageURL); canonical != "" {
+			<link rel="canonical" href={ canonical }/>
 		}
 
 		// Robots directive (page-level only - defaults to index,follow if not set)
@@ -459,8 +603,25 @@ templ Head(data HeadData) {
 			<meta property="og:image" content={ resolveMediaURL(data.Settings.DefaultOGImage) }/>
 		}
 
-		// og:type - default to website
+		// og:type: article for posts, website otherwise (M5)
+		if data.PageMeta.OGType != "" {
+			<meta property="og:type" content={ data.PageMeta.OGType }/>
+		} else {
 			<meta property="og:type" content="website"/>
+		}
+		// og:url: absolute URL of this page (M6)
+		if data.PageMeta.PageURL != "" {
+			<meta property="og:url" content={ data.PageMeta.PageURL }/>
+		}
+		// article:* metadata for posts (M5)
+		if data.PageMeta.OGType == "article" {
+			if data.PageMeta.ArticlePublishedTime != "" {
+				<meta property="article:published_time" content={ data.PageMeta.ArticlePublishedTime }/>
+			}
+			if data.PageMeta.ArticleAuthor != "" {
+				<meta property="article:author" content={ data.PageMeta.ArticleAuthor }/>
+			}
+		}
 
 		// === TWITTER CARD META TAGS ===
 		if data.Settings.TwitterHandle != "" {
@@ -512,7 +673,7 @@ templ Head(data HeadData) {
 			<link rel="alternate" type="application/atom+xml" title={ data.Settings.RSSFeedTitle + " (Atom)" } href={ data.Settings.RSSFeedURL + "/atom" }/>
 		}
 
-		if data.Settings.GoogleAnalyticsID != "" {
+		if data.Settings.GoogleAnalyticsID != "" && (data.Settings.GoogleAnalyticsEnabled || !data.Settings.GoogleAnalyticsExplicitlySet) {
 			<script async src={ "https://www.googletagmanager.com/gtag/js?id=" + data.Settings.GoogleAnalyticsID }></script>
 			@googleAnalyticsScript(data.Settings.GoogleAnalyticsID)
 		}
@@ -521,14 +682,16 @@ templ Head(data HeadData) {
 		// Blog post engagement tracking (only rendered for posts with engagement config)
 		@EngagementScript(data.EngagementConfig)
 		for _, style := range data.PluginStyles {
-			<link rel="stylesheet" href={ style }/>
+			<link rel="stylesheet" href={ VersionedAssetURL(style) }/>
 		}
 		// Theme CSS injected AFTER plugin styles to take precedence
 		if data.ThemeCSS != "" {
 			@themeStyle(data.ThemeCSS)
 		}
-		if data.Settings.CustomHeadScripts != "" {
-			@templ.Raw(data.Settings.CustomHeadScripts)
+		for _, script := range data.Settings.CustomScripts {
+			if script.Enabled && script.Placement == "head" {
+				@templ.Raw(script.Code)
+			}
 		}
 		if data.StructuredData != "" {
 			@structuredDataScript(data.StructuredData)
@@ -570,8 +733,10 @@ templ AdminBypassBanner(settings SiteSettingsData) {
 // BodyEnd renders custom scripts and admin toolbar before </body>
 templ BodyEnd(settings SiteSettingsData) {
 	@recordValidationCall(ctx, "BodyEnd")
-	if settings.CustomBodyScripts != "" {
-		@templ.Raw(settings.CustomBodyScripts)
+	for _, script := range settings.CustomScripts {
+		if script.Enabled && script.Placement == "body" {
+			@templ.Raw(script.Code)
+		}
 	}
 	// Render admin editor toolbar if enabled (auto-injects for all templates)
 	@AdminEditorToolbar(settings.Toolbar)
@@ -779,7 +944,6 @@ func themeInitScript(themeMode string) templ.Component {
 	// preference (bn-theme cookie/localStorage) → site default → system.
 	// Exposed as window.bnApplyTheme so the toolbar theme tester can re-apply
 	// after changing the override without duplicating this resolution.
-	// KEEP IN SYNC with cms backend/templates/bn/head.templ.
 	return templ.Raw(`<script>
         window.bnApplyTheme=function(){
             var t=null;try{t=sessionStorage.getItem('bn-theme-override')}catch(e){}

templates/bn/toolbar_templ.go

@@ -242,7 +242,7 @@ func AdminEditorToolbar(data ToolbarData) templ.Component {
 			var templ_7745c5c3_Var3 string
 			templ_7745c5c3_Var3, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var2).String())
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 1, Col: 0}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 1, Col: 0}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var3)
 			if templ_7745c5c3_Err != nil {
@@ -255,7 +255,7 @@ func AdminEditorToolbar(data ToolbarData) templ.Component {
 			var templ_7745c5c3_Var4 templ.SafeURL
 			templ_7745c5c3_Var4, templ_7745c5c3_Err = templ.JoinURLErrs(templ.SafeURL(data.EditURL))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 301, Col: 38}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 301, Col: 38}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var4))
 			if templ_7745c5c3_Err != nil {
@@ -268,7 +268,7 @@ func AdminEditorToolbar(data ToolbarData) templ.Component {
 			var templ_7745c5c3_Var5 string
 			templ_7745c5c3_Var5, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.StatusLabel())
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 311, Col: 73}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 311, Col: 73}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var5)
 			if templ_7745c5c3_Err != nil {
@@ -290,7 +290,7 @@ func AdminEditorToolbar(data ToolbarData) templ.Component {
 			var templ_7745c5c3_Var7 string
 			templ_7745c5c3_Var7, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var6).String())
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 1, Col: 0}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 1, Col: 0}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var7)
 			if templ_7745c5c3_Err != nil {
@@ -303,7 +303,7 @@ func AdminEditorToolbar(data ToolbarData) templ.Component {
 			var templ_7745c5c3_Var8 string
 			templ_7745c5c3_Var8, templ_7745c5c3_Err = templ.JoinStringErrs(data.StatusLabel())
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 313, Col: 80}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 313, Col: 80}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var8))
 			if templ_7745c5c3_Err != nil {
@@ -334,7 +334,7 @@ func AdminEditorToolbar(data ToolbarData) templ.Component {
 				var templ_7745c5c3_Var10 string
 				templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var9).String())
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 1, Col: 0}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 1, Col: 0}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var10)
 				if templ_7745c5c3_Err != nil {
@@ -362,7 +362,7 @@ func AdminEditorToolbar(data ToolbarData) templ.Component {
 					}
 				}())
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 323, Col: 170}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 323, Col: 170}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var12)
 				if templ_7745c5c3_Err != nil {
@@ -400,7 +400,7 @@ func AdminEditorToolbar(data ToolbarData) templ.Component {
 				var templ_7745c5c3_Var13 string
 				templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d min", data.ReadingTime))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 435, Col: 46}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 435, Col: 46}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var13))
 				if templ_7745c5c3_Err != nil {
@@ -423,7 +423,7 @@ func AdminEditorToolbar(data ToolbarData) templ.Component {
 				var templ_7745c5c3_Var14 string
 				templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("/toolbar/publish/%s", data.PageID))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 443, Col: 62}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 443, Col: 62}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var14)
 				if templ_7745c5c3_Err != nil {
@@ -441,7 +441,7 @@ func AdminEditorToolbar(data ToolbarData) templ.Component {
 			var templ_7745c5c3_Var15 string
 			templ_7745c5c3_Var15, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("/toolbar/page-info/%s", data.PageID))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 460, Col: 63}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 460, Col: 63}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var15)
 			if templ_7745c5c3_Err != nil {
@@ -454,7 +454,7 @@ func AdminEditorToolbar(data ToolbarData) templ.Component {
 			var templ_7745c5c3_Var16 string
 			templ_7745c5c3_Var16, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.DropdownDirection())
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 473, Col: 46}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 473, Col: 46}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var16)
 			if templ_7745c5c3_Err != nil {
@@ -467,7 +467,7 @@ func AdminEditorToolbar(data ToolbarData) templ.Component {
 			var templ_7745c5c3_Var17 string
 			templ_7745c5c3_Var17, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.DropdownAlign())
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 474, Col: 38}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 474, Col: 38}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var17)
 			if templ_7745c5c3_Err != nil {
@@ -516,7 +516,7 @@ func PageInfoDropdown(data ToolbarData) templ.Component {
 			var templ_7745c5c3_Var19 string
 			templ_7745c5c3_Var19, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.TodayPageviews))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 515, Col: 91}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 515, Col: 91}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var19))
 			if templ_7745c5c3_Err != nil {
@@ -539,7 +539,7 @@ func PageInfoDropdown(data ToolbarData) templ.Component {
 				var templ_7745c5c3_Var21 string
 				templ_7745c5c3_Var21, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var20).String())
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 1, Col: 0}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 1, Col: 0}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var21)
 				if templ_7745c5c3_Err != nil {
@@ -552,7 +552,7 @@ func PageInfoDropdown(data ToolbarData) templ.Component {
 				var templ_7745c5c3_Var22 string
 				templ_7745c5c3_Var22, templ_7745c5c3_Err = templ.JoinStringErrs(data.TrendIcon())
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 519, Col: 25}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 519, Col: 25}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var22))
 				if templ_7745c5c3_Err != nil {
@@ -565,7 +565,7 @@ func PageInfoDropdown(data ToolbarData) templ.Component {
 				var templ_7745c5c3_Var23 string
 				templ_7745c5c3_Var23, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d%%", abs(data.TrendPercent)))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 519, Col: 73}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 519, Col: 73}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var23))
 				if templ_7745c5c3_Err != nil {
@@ -603,7 +603,7 @@ func PageInfoDropdown(data ToolbarData) templ.Component {
 					var templ_7745c5c3_Var24 templ.SafeURL
 					templ_7745c5c3_Var24, templ_7745c5c3_Err = templ.JoinURLErrs(templ.SafeURL("/author/" + data.AuthorSlug))
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 535, Col: 61}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 535, Col: 61}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var24))
 					if templ_7745c5c3_Err != nil {
@@ -616,7 +616,7 @@ func PageInfoDropdown(data ToolbarData) templ.Component {
 					var templ_7745c5c3_Var25 string
 					templ_7745c5c3_Var25, templ_7745c5c3_Err = templ.JoinStringErrs(data.AuthorName)
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 535, Col: 100}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 535, Col: 100}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var25))
 					if templ_7745c5c3_Err != nil {
@@ -634,7 +634,7 @@ func PageInfoDropdown(data ToolbarData) templ.Component {
 					var templ_7745c5c3_Var26 string
 					templ_7745c5c3_Var26, templ_7745c5c3_Err = templ.JoinStringErrs(data.AuthorName)
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 537, Col: 50}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 537, Col: 50}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var26))
 					if templ_7745c5c3_Err != nil {
@@ -658,7 +658,7 @@ func PageInfoDropdown(data ToolbarData) templ.Component {
 				var templ_7745c5c3_Var27 string
 				templ_7745c5c3_Var27, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d min read", data.ReadingTime))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 542, Col: 86}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 542, Col: 86}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var27))
 				if templ_7745c5c3_Err != nil {
@@ -681,7 +681,7 @@ func PageInfoDropdown(data ToolbarData) templ.Component {
 				var templ_7745c5c3_Var28 string
 				templ_7745c5c3_Var28, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d words", data.WordCount))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 546, Col: 84}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 546, Col: 84}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var28))
 				if templ_7745c5c3_Err != nil {
@@ -704,7 +704,7 @@ func PageInfoDropdown(data ToolbarData) templ.Component {
 		var templ_7745c5c3_Var29 string
 		templ_7745c5c3_Var29, templ_7745c5c3_Err = templ.JoinStringErrs(data.TemplateName)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 554, Col: 48}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 554, Col: 48}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var29))
 		if templ_7745c5c3_Err != nil {
@@ -717,7 +717,7 @@ func PageInfoDropdown(data ToolbarData) templ.Component {
 		var templ_7745c5c3_Var30 string
 		templ_7745c5c3_Var30, templ_7745c5c3_Err = templ.JoinStringErrs(data.LastModifiedFormatted())
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 558, Col: 59}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 558, Col: 59}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var30))
 		if templ_7745c5c3_Err != nil {
@@ -730,7 +730,7 @@ func PageInfoDropdown(data ToolbarData) templ.Component {
 		var templ_7745c5c3_Var31 templ.SafeURL
 		templ_7745c5c3_Var31, templ_7745c5c3_Err = templ.JoinURLErrs(templ.SafeURL(data.SettingsURL))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 563, Col: 44}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 563, Col: 44}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var31))
 		if templ_7745c5c3_Err != nil {
@@ -743,7 +743,7 @@ func PageInfoDropdown(data ToolbarData) templ.Component {
 		var templ_7745c5c3_Var32 templ.SafeURL
 		templ_7745c5c3_Var32, templ_7745c5c3_Err = templ.JoinURLErrs(templ.SafeURL(data.HistoryURL))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 569, Col: 43}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 569, Col: 43}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var32))
 		if templ_7745c5c3_Err != nil {
@@ -756,7 +756,7 @@ func PageInfoDropdown(data ToolbarData) templ.Component {
 		var templ_7745c5c3_Var33 templ.SafeURL
 		templ_7745c5c3_Var33, templ_7745c5c3_Err = templ.JoinURLErrs(templ.SafeURL(data.AnalyticsURL))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 575, Col: 45}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 575, Col: 45}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var33))
 		if templ_7745c5c3_Err != nil {
@@ -786,7 +786,7 @@ func PageInfoDropdown(data ToolbarData) templ.Component {
 		var templ_7745c5c3_Var35 string
 		templ_7745c5c3_Var35, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("/toolbar/share-preview/%s", data.PageID))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 597, Col: 67}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 597, Col: 67}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var35)
 		if templ_7745c5c3_Err != nil {
@@ -832,7 +832,7 @@ func PageInfoDropdown(data ToolbarData) templ.Component {
 			var templ_7745c5c3_Var36 string
 			templ_7745c5c3_Var36, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("/toolbar/discard/%s", data.PageID))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 625, Col: 62}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 625, Col: 62}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var36)
 			if templ_7745c5c3_Err != nil {
@@ -886,7 +886,7 @@ func positionButton(pageID uuid.UUID, pos string, currentPos string, label strin
 		var templ_7745c5c3_Var39 string
 		templ_7745c5c3_Var39, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var38).String())
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 1, Col: 0}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 1, Col: 0}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var39)
 		if templ_7745c5c3_Err != nil {
@@ -899,7 +899,7 @@ func positionButton(pageID uuid.UUID, pos string, currentPos string, label strin
 		var templ_7745c5c3_Var40 string
 		templ_7745c5c3_Var40, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("/toolbar/set-position/%s?pos=%s", pageID, pos))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 646, Col: 71}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 646, Col: 71}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var40)
 		if templ_7745c5c3_Err != nil {
@@ -912,7 +912,7 @@ func positionButton(pageID uuid.UUID, pos string, currentPos string, label strin
 		var templ_7745c5c3_Var41 string
 		templ_7745c5c3_Var41, templ_7745c5c3_Err = templ.ResolveAttributeValue(label)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 649, Col: 15}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 649, Col: 15}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var41)
 		if templ_7745c5c3_Err != nil {
@@ -934,7 +934,7 @@ func positionButton(pageID uuid.UUID, pos string, currentPos string, label strin
 		var templ_7745c5c3_Var43 string
 		templ_7745c5c3_Var43, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var42).String())
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `templates/bn/toolbar.templ`, Line: 1, Col: 0}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `toolbar.templ`, Line: 1, Col: 0}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var43)
 		if templ_7745c5c3_Err != nil {