The sites declared no icon and /favicon.ico answered 404, so search
engines and assistants that show a site's icon (DuckDuckGo, ChatGPT)
fell back to a gray placeholder; the only copy of the mark was the BIMI
logo for mail.

The app now has the Next.js icon files, so every page links them:

- app/icon.svg: the four squares of the BIMI logo, cropped to the mark
  so it fills a browser tab, on a transparent field.
- app/favicon.ico: the same mark at 16, 32 and 48 pixels (PNG entries),
  for clients that ask for /favicon.ico without reading the page.
- app/apple-icon.png: 180 pixels on the white field of the BIMI logo,
  since iOS fills transparency with black.

The proxy rewrites paths per host, which would send /icon.svg on the
account, ViGet and the other hosts into their own page trees; the
matcher now skips the two new files as it already skipped favicon.ico,
so every Progmasoft host serves the same icons.

The API of the previous commit holds the catalog; this adds what people and
Tazel reach.

Pages:
- /dslplugins/tazel lists the published plugins, read from the API on its
  loopback address, and says when there is none.
- /dslplugins/tazel/<Publisher>/<Name> is the page of a plugin: its
  description, publisher, latest version, license, authors, homepage and
  repository, the plugins block that uses it, and every version with its
  date, plugin API, size, SHA-256, yanked mark and JAR.
- /dslplugins/gradle opens the Gradle catalog. It only lists: Gradle takes
  com.progmasoft.tazel.plugin from the Gradle Plugin Portal.
- The availability note says that Progmasoft publishes first and every
  account later. Texts are in the four languages of the site.

Nginx (ops/nginx/progmaweb.conf):
- On viget.progmasoft.com, index.json of a plugin goes to the API and the
  JARs come from /srv/viget/files with immutable caching; /api/ stays
  closed.
- maven.progmasoft.com serves /srv/maven, whose /tazel holds tazel-api.

ops/README.md describes the directories, their SELinux labels, the publish
and yank commands, and how a release of Tazel copies the API into the Maven
repository.

Tests cover the texts in every language, the plugins block, the Gradle list,
and that a page asks the API only for identifiers.

The standalone server, which production runs, invokes the proxy again for
the rewritten path with the original host. A path already inside the
site's internal tree (/authorize/signin on authorize.progmasoft.com) did
not match the public routes and became the site's not-found page, so
every OAuth, console and product page answered 404 in production while
next start, which runs the proxy once, served them. A path under the
site's own root now passes unchanged; internal trees stay closed on every
other host. Checked against the standalone build for all hosts.

The catalog said talalint reads talalint.kts. Its Kotlin module defines
the configuration model but does not yet discover or evaluate the script,
so the page now lists what the linter does today: the diagnostics of the
Tala compiler under the compiler check, its own checks of trailing
whitespace, mixed line endings and the final newline, and --fix limited
to safe physical-source fixes.

progmasoft.com presents Progmasoft as a pool of technology areas instead
of a list of products: languages and compilers, build and packages,
developer tools, quality and testing, identity and access, and
infrastructure. The page has a new hero, a bento of areas, principles and
a developers band that leads to the Progmasoft Console; the products are
one link away in their own catalog.

product.progmasoft.com lists Tala, talac, talafmt, talalint, Tazel, Xide
and Catch3, each with its own page (/tala-lang, /talac, ...) that leads
to the product's site and source. ides.progmasoft.com lists the IDEs and
hosts the Xide site at /xide; catch3.progmasoft.com is the Catch3 site.
The facts follow the READMEs and documentation of the product
repositories: Xide is marked as early work, and Catch3 states that it is
not an official Catch2 release.

The theme switch no longer freezes or flickers. The layout rendered
data-theme="light" on <html>, so every server re-render of the layout
(a language switch) set it back. The control also applied the theme in
an effect after the render while buttons animated their colours. The
attribute now belongs to the bootstrap script and the control alone; the
control applies the theme in the click, and transitions are off for the
two frames of the change.

All new text is in en-US, de-DE, ru-RU and he-IL. The old home messages
leave localization.ts. The proxy maps the new hosts through one table, and
nginx gains their virtual hosts.

Progmasoft OAuth now runs on three hosts:

- credentials.progmasoft.com stays the issuer: discovery documents, key
  set, token, user information, revocation and introspection.
- authorize.progmasoft.com serves the pages people see: the
  authorization and end session endpoints (registered with OpenIddict as
  absolute URIs on that host), sign-in, the consent screen and the
  applications an account has allowed.
- console.progmasoft.com is the Progmasoft Console. Its overview links
  the areas; OAuth 2.1 tokens live under /credentials, with New token,
  then the application type, then its form.

The console has no sign-in of its own and never redirects. It uses the
Progmasoft account session, so production now shares that cookie with
progmasoft.com (__Secure-ProgmasoftSession, Domain=progmasoft.com,
HttpOnly, Secure, SameSite=Lax). Without AccountSessions:CookieDomain the
cookie stays host-only with the __Host- name, as in development and tests.

Application types replace the confidential/public switch: web,
single-page, desktop, mobile and service. Each type has its redirection
rules (RFC 8252), its secret or none, and its grants; only a service
uses client credentials and it registers no address or scope. The type is
kept as an application property and cannot change.

The HTML pages of the API are gone. The pages are Next.js pages in four
languages (en-US, de-DE, ru-RU, he-IL) that call JSON endpoints under
/api/v1/oauth. Requests that change state must come from the page's own
origin; antiforgery forms are no longer needed. The token, revocation and
user information endpoints answer CORS requests from the origins of
single-page applications, without credentials; the discovery documents
and the key set answer every origin.

The host filter keeps every path on its host. Nginx gains the authorize
and console virtual hosts, and the docs describe the hosts, the types and
the shared session.

pnpm audit reports a critical advisory for next >=16.0.0 <=16.4.0:
unauthenticated remote code execution through the Image Optimization
API when SVG files are used. progmasoft.com runs 16.3.8. The site sets
no images option and the optimizer refused an SVG request in a check
from outside, but the version is in the affected range, so it moves to
16.4.2, the latest patch release; eslint-config-next follows.

Verified: pnpm check, pnpm test:coverage, pnpm lint and pnpm build
pass; pnpm audit --audit-level high reports nothing beyond the one
advisory already ignored.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

BIMI lets mail clients show a sender's logo next to messages from a
domain whose DMARC policy is enforced; progmasoft.com already publishes
p=quarantine with pct=100. The BIMI record points at an SVG on the
domain, so the site now serves one at /bimi/logo.svg.

The file is SVG Tiny Portable/Secure, as BIMI requires: version 1.2,
baseProfile tiny-ps, a title, no scripts, no external references and
no x or y on the root. It draws the same four tiles as the Brand
component, in the same colours (#3b4658, #1e7188, #7655fa, #dc7644)
and the same tile-to-gap ratio (11:2, here 132 and 24 on a 512 grid),
on a white square. The mark stays inside the circle that clients crop
the logo to.

Next.js serves files from apps/web/public before the dynamic routes;
the deployment already copies public/ next to the standalone server.

A Tazel project file may be called BUILD.kts, BUILD.tzl, BUILD.tazel,
BUILD or Tazel.build, so ViGet no longer names one of them. The plugin
texts in all four locales speak of the project file of Tazel.

viget.progmasoft.com now shows, from the top:

1. The state of the registry: what it holds today, the package format,
   the publisher identity and that publishing is not open yet.
2. LANGUAGES: Tala links to viget.progmasoft.com/langs/tala; C++ is a
   gray, disabled button that leads nowhere.
3. BUILD SYSTEM DSL PLUGINS: Tazel links to
   viget.progmasoft.com/dslplugins/tazel; Gradle is a gray, disabled
   button that leads nowhere.

/langs/tala is the catalog of Tala packages and /dslplugins/tazel the
catalog of Kotlin DSL plugins for Tazel, both honestly empty. /langs and
/dslplugins redirect to them. The header, the footer and the sitemap
link the two catalogs, and the coordinates they show begin with the
catalog: /langs/tala/<Publisher>/<Name>/ and
/dslplugins/tazel/<Publisher>/<Name>/.

The text of the catalogs lives in lib/viget-catalogs.ts in all four
locales; localization.ts is close to the size limit of a file. The
two section headings are the registry's names and stay in English.

The language links of the ViGet and Progmasoft pages point at tala.run.