@glw907/cairn-cms 0.17.0 → 0.21.0

package/dist/sveltekit/content-routes.js

@@ -2,13 +2,16 @@
 // A factory closes over the composed runtime and the GitHub token mint, so the read and
 // commit paths are unit-testable against a fetch double with an injected token, mirroring the
 // email `send` injection in auth-routes. A shim stays one line: `export const load = routes.editLoad`.
-import { redirect, error } from '@sveltejs/kit';
+import { redirect, error, fail } from '@sveltejs/kit';
 import { findConcept } from '../content/concepts.js';
+import { extractCairnLinks, formatCairnToken } from '../content/links.js';
 import { frontmatterFromForm, parseMarkdown, dateInputValue, serializeMarkdown } from '../content/frontmatter.js';
-import { isValidId, slugify, filenameFromId, composeDatedId } from '../content/ids.js';
+import { isValidId, slugify, filenameFromId, composeDatedId, slugFromId, renameId } from '../content/ids.js';
+import { rewriteCairnLink } from '../components/markdown-format.js';
 import { appCredentials } from '../github/credentials.js';
-import { listMarkdown, readRaw, commitFile } from '../github/repo.js';
+import { listMarkdown, readRaw, commitFiles } from '../github/repo.js';
 import { cachedInstallationToken } from '../github/signing.js';
+import { emptyManifest, manifestEntryFromFile, parseManifest, serializeManifest, upsertEntry, removeEntry, inboundLinks } from '../content/manifest.js';
 import { CommitConflictError } from '../github/types.js';
 /** The signed-in editor the guard resolved, or a login redirect. Kept local to decouple event shapes. */
 function sessionOf(event) {
@@ -134,11 +137,30 @@ export function createContentRoutes(runtime, deps = {}) {
             throw error(400, 'Invalid entry id');
         const isNew = event.url.searchParams.get('new') === '1';
         const token = await mintToken(event.platform?.env ?? {});
-        const raw = await readRaw(runtime.backend, `${concept.dir}/${filenameFromId(id)}`, token);
+        const datePrefix = concept.routing.dated ? concept.datePrefix : null;
+        // The entry file and the manifest are independent reads sharing the token; fetch them together.
+        const [raw, manifestRaw] = await Promise.all([
+            readRaw(runtime.backend, `${concept.dir}/${filenameFromId(id)}`, token),
+            readRaw(runtime.backend, runtime.manifestPath, token),
+        ]);
         if (raw === null && !isNew)
             throw error(404, 'Entry not found');
         const parsed = raw === null ? { frontmatter: {}, body: '' } : parseMarkdown(raw);
         const title = typeof parsed.frontmatter.title === 'string' && parsed.frontmatter.title.trim() ? parsed.frontmatter.title : id;
+        let linkTargets = [];
+        let inbound = [];
+        if (manifestRaw !== null) {
+            const manifest = parseManifest(manifestRaw);
+            linkTargets = manifest.entries.map((e) => ({
+                concept: e.concept,
+                id: e.id,
+                permalink: e.permalink,
+                title: e.title,
+                date: e.date,
+                draft: e.draft,
+            }));
+            inbound = inboundLinks(manifest, concept.id, id);
+        }
         return {
             conceptId: concept.id,
             id,
@@ -149,7 +171,11 @@ export function createContentRoutes(runtime, deps = {}) {
             title,
             isNew,
             saved: event.url.searchParams.get('saved') === '1',
+            renamed: event.url.searchParams.get('renamed') === '1',
             error: event.url.searchParams.get('error'),
+            slug: slugFromId(id, datePrefix),
+            linkTargets,
+            inboundLinks: inbound,
         };
     }
     /** Match a commit conflict by class and by name (bundling can alias the class identity). */
@@ -177,8 +203,43 @@ export function createContentRoutes(runtime, deps = {}) {
         }
         const markdown = serializeMarkdown(result.data, body);
         const token = await mintToken(event.platform?.env ?? {});
+        // Read the committed manifest, upsert this entry's row, and commit content and manifest in one
+        // commit. A missing manifest starts empty (first save on a fresh repo). The build regenerates
+        // and verifies the manifest, so this incremental patch is the cheap request-time path. On a
+        // 422 retry commitFiles re-sends this manifest blob last-writer-wins. A concurrent save can then
+        // leave the committed manifest stale, which the next build rejects via verifyManifest; regenerate
+        // it with npm run cairn:manifest to recover.
+        const manifestRaw = await readRaw(runtime.backend, runtime.manifestPath, token);
+        const manifest = manifestRaw === null ? emptyManifest() : parseManifest(manifestRaw);
+        const row = manifestEntryFromFile(concept, { path, raw: markdown });
+        const upserted = upsertEntry(manifest, row);
+        const nextManifest = serializeManifest(upserted);
+        // Save guard: resolve the body's cairn links against the manifest with this entry upserted, so a
+        // self-link and a link to any existing target resolves. A link to an absent target hard-blocks
+        // the save (it would red the deploy build and the author would not see it); a link to a draft
+        // target commits with a warning, since it is valid and resolves once the target is published.
+        const byKey = new Map(upserted.entries.map((e) => [`${e.concept}/${e.id}`, e]));
+        const absent = [];
+        const draft = [];
+        for (const ref of extractCairnLinks(body)) {
+            // A self-link is valid by construction (the upserted manifest holds this very entry), so
+            // skip it before classifying. Mirrors inboundLinks's self-exclusion.
+            if (ref.concept === concept.id && ref.id === id)
+                continue;
+            const target = byKey.get(`${ref.concept}/${ref.id}`);
+            if (!target)
+                absent.push(formatCairnToken(ref));
+            else if (target.draft)
+                draft.push(formatCairnToken(ref));
+        }
+        if (absent.length) {
+            return fail(400, { brokenLinks: absent, body });
+        }
         try {
-            await commitFile(runtime.backend, path, markdown, { message: `Update ${concept.label.toLowerCase()}: ${id}`, author: { name: editor.displayName, email: editor.email } }, token);
+            await commitFiles(runtime.backend, [
+                { path, content: markdown },
+                { path: runtime.manifestPath, content: nextManifest },
+            ], { message: `Update ${concept.label.toLowerCase()}: ${id}`, author: { name: editor.displayName, email: editor.email } }, token);
         }
         catch (err) {
             if (isConflict(err)) {
@@ -187,7 +248,121 @@ export function createContentRoutes(runtime, deps = {}) {
             }
             throw err;
         }
-        throw redirect(303, `/admin/${concept.id}/${id}?saved=1`);
+        const savedQuery = draft.length ? `saved=1&drafts=${encodeURIComponent(draft.join(','))}` : 'saved=1';
+        throw redirect(303, `/admin/${concept.id}/${id}?${savedQuery}`);
+    }
+    /** Delete an entry. Block-until-clean: refuse while inbound links exist (naming them), else commit
+     *  the file removal and the manifest patch in one commit. The inbound recheck here is the
+     *  authoritative gate, closing the load-to-delete race. */
+    async function deleteAction(event) {
+        const editor = sessionOf(event);
+        const concept = conceptOf(runtime, event.params);
+        const id = event.params.id ?? '';
+        if (!isValidId(id))
+            throw error(400, 'Invalid entry id');
+        const path = `${concept.dir}/${filenameFromId(id)}`;
+        const token = await mintToken(event.platform?.env ?? {});
+        // An absent manifest degrades the inbound gate to "allow": with no manifest there is nothing to
+        // check, and the build's cairn: backstop still catches any dangling token, mirroring saveAction.
+        const manifestRaw = await readRaw(runtime.backend, runtime.manifestPath, token);
+        const manifest = manifestRaw === null ? emptyManifest() : parseManifest(manifestRaw);
+        const inbound = inboundLinks(manifest, concept.id, id);
+        if (inbound.length) {
+            return fail(409, { inboundLinks: inbound });
+        }
+        const nextManifest = serializeManifest(removeEntry(manifest, concept.id, id));
+        try {
+            await commitFiles(runtime.backend, [
+                { path, content: null },
+                { path: runtime.manifestPath, content: nextManifest },
+            ], { message: `Delete ${concept.label.toLowerCase()}: ${id}`, author: { name: editor.displayName, email: editor.email } }, token);
+        }
+        catch (err) {
+            if (isConflict(err)) {
+                const message = 'This file changed since you opened it. Reload and try again.';
+                throw redirect(303, `/admin/${concept.id}/${id}?error=${encodeURIComponent(message)}`);
+            }
+            throw err;
+        }
+        throw redirect(303, `/admin/${concept.id}`);
+    }
+    /** Rename an entry: change its slug, move the file, and rewrite every inbound cairn token in one
+     *  atomic commit, so no internal link breaks. The collision check and the inbound recompute here
+     *  are the authoritative gate. The same last-writer-wins manifest race as save and delete applies,
+     *  caught by the build's fail-closed backstop. */
+    async function renameAction(event) {
+        const editor = sessionOf(event);
+        const concept = conceptOf(runtime, event.params);
+        const id = event.params.id ?? '';
+        if (!isValidId(id))
+            throw error(400, 'Invalid entry id');
+        const form = await event.request.formData();
+        const newSlug = String(form.get('slug') ?? '').trim();
+        if (!isValidId(newSlug)) {
+            return fail(400, { renameError: 'Enter a valid slug: lowercase letters, numbers, and hyphens.' });
+        }
+        const datePrefix = concept.routing.dated ? concept.datePrefix : null;
+        if (concept.routing.dated && /^\d{4}-/.test(newSlug)) {
+            return fail(400, { renameError: 'Leave the date out of the slug.' });
+        }
+        if (newSlug === slugFromId(id, datePrefix)) {
+            return fail(400, { renameError: 'That is already the slug.' });
+        }
+        const newId = renameId(id, newSlug, datePrefix);
+        const oldPath = `${concept.dir}/${filenameFromId(id)}`;
+        const newPath = `${concept.dir}/${filenameFromId(newId)}`;
+        const token = await mintToken(event.platform?.env ?? {});
+        // Collision guard: refuse if a file already exists at the new path. This 409 covers two cases a
+        // single readRaw cannot tell apart: a static collision with an existing entry, and a
+        // concurrent-rename race where another editor renamed onto this path between load and submit.
+        const clobber = await readRaw(runtime.backend, newPath, token);
+        if (clobber !== null) {
+            return fail(409, { renameError: 'An entry with that slug already exists.' });
+        }
+        const [entryRaw, manifestRaw] = await Promise.all([
+            readRaw(runtime.backend, oldPath, token),
+            readRaw(runtime.backend, runtime.manifestPath, token),
+        ]);
+        if (entryRaw === null)
+            throw error(404, 'Entry not found');
+        const manifest = manifestRaw === null ? emptyManifest() : parseManifest(manifestRaw);
+        const oldHref = formatCairnToken({ concept: concept.id, id });
+        const newHref = formatCairnToken({ concept: concept.id, id: newId });
+        // The moved file keeps its content, except a self-token rewrite. Re-derive its manifest row from
+        // the new path so the row carries the new id and permalink by construction.
+        const movedRaw = rewriteCairnLink(entryRaw, oldHref, newHref);
+        const changes = [
+            { path: oldPath, content: null },
+            { path: newPath, content: movedRaw },
+        ];
+        let next = removeEntry(manifest, concept.id, id);
+        next = upsertEntry(next, manifestEntryFromFile(concept, { path: newPath, raw: movedRaw }));
+        // Rewrite every inbound linker's body and re-derive its row, so its outbound edge points at the
+        // new id. A linker missing from the repo is skipped; the build backstop catches any drift.
+        for (const linker of inboundLinks(manifest, concept.id, id)) {
+            const linkerConcept = findConcept(runtime.concepts, linker.concept);
+            if (!linkerConcept)
+                continue;
+            const linkerPath = `${linkerConcept.dir}/${filenameFromId(linker.id)}`;
+            const linkerRaw = await readRaw(runtime.backend, linkerPath, token);
+            if (linkerRaw === null)
+                continue;
+            const rewritten = rewriteCairnLink(linkerRaw, oldHref, newHref);
+            changes.push({ path: linkerPath, content: rewritten });
+            next = upsertEntry(next, manifestEntryFromFile(linkerConcept, { path: linkerPath, raw: rewritten }));
+        }
+        changes.push({ path: runtime.manifestPath, content: serializeManifest(next) });
+        try {
+            await commitFiles(runtime.backend, changes, { message: `Rename ${concept.label.toLowerCase()}: ${id} to ${newId}`, author: { name: editor.displayName, email: editor.email } }, token);
+        }
+        catch (err) {
+            if (isConflict(err)) {
+                const message = 'This file changed since you opened it. Reload and try again.';
+                throw redirect(303, `/admin/${concept.id}/${id}?error=${encodeURIComponent(message)}`);
+            }
+            throw err;
+        }
+        throw redirect(303, `/admin/${concept.id}/${newId}?renamed=1`);
     }
-    return { layoutLoad, indexRedirect, listLoad, createAction, editLoad, saveAction, mintToken };
+    return { layoutLoad, indexRedirect, listLoad, createAction, editLoad, saveAction, deleteAction, renameAction, mintToken };
 }

package/dist/sveltekit/public-routes.d.ts

@@ -1,11 +1,13 @@
 import type { ContentSummary, ContentEntry } from '../delivery/content-index.js';
 import type { SiteIndex } from '../delivery/site-index.js';
 import type { SeoMeta } from '../delivery/seo.js';
+import type { LinkResolve } from '../content/links.js';
 /** Injected dependencies for the public loaders. */
 export interface PublicRoutesDeps {
     site: SiteIndex;
     render: (md: string, opts?: {
         stagger?: boolean;
+        resolve?: LinkResolve;
     }) => string | Promise<string>;
     origin: string;
     /** Site name for og:site_name and the SEO head. */

package/dist/sveltekit/public-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"public-routes.d.ts","sourceRoot":"","sources":["../../src/lib/sveltekit/public-routes.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAE3D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAGlD,oDAAoD;AACpD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/E,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,KAAK,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC;6EACyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qEAAqE;AACrE,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAED,uDAAuD;AACvD,MAAM,WAAW,OAAQ,SAAQ,QAAQ;IACvC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACxC;AAED,oFAAoF;AACpF,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,YAAY,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,OAAO,CAAC;IACb,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED,2DAA2D;AAC3D,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB;uBAWvB;QAAE,GAAG,EAAE,GAAG,CAAA;KAAE,KAAG,OAAO,CAAC,SAAS,CAAC;6BA0BjC,MAAM,KAAG,QAAQ;8BAKhB,MAAM,KAAG,YAAY;yBAK1B,MAAM,SAAS;QAAE,MAAM,EAAE;YAAE,GAAG,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,KAAG,OAAO;mBAO5D;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE;EAKvC"}
+{"version":3,"file":"public-routes.d.ts","sourceRoot":"","sources":["../../src/lib/sveltekit/public-routes.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAE3D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAGlD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,oDAAoD;AACpD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,WAAW,CAAA;KAAE,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACtG,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,KAAK,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC;6EACyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qEAAqE;AACrE,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAED,uDAAuD;AACvD,MAAM,WAAW,OAAQ,SAAQ,QAAQ;IACvC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACxC;AAED,oFAAoF;AACpF,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,YAAY,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,OAAO,CAAC;IACb,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED,2DAA2D;AAC3D,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB;uBAWvB;QAAE,GAAG,EAAE,GAAG,CAAA;KAAE,KAAG,OAAO,CAAC,SAAS,CAAC;6BA0BjC,MAAM,KAAG,QAAQ;8BAKhB,MAAM,KAAG,YAAY;yBAK1B,MAAM,SAAS;QAAE,MAAM,EAAE;YAAE,GAAG,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,KAAG,OAAO;mBAO5D;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE;EAKvC"}

package/dist/sveltekit/public-routes.js

@@ -6,6 +6,7 @@
 import { error } from '@sveltejs/kit';
 import { buildSeoMeta } from '../delivery/seo.js';
 import { readSeoFields, resolveImageUrl } from '../delivery/seo-fields.js';
+import { buildLinkResolver } from '../delivery/manifest.js';
 /** Build the public loaders for a site's unified index. */
 export function createPublicRoutes(deps) {
     const { site, render, origin, siteName, description, feeds, defaultImage } = deps;
@@ -40,7 +41,7 @@ export function createPublicRoutes(deps) {
             ...(fields.author ? { author: fields.author } : {}),
             ...(entry.date ? { feeds } : {}),
         });
-        return { entry, html: await render(entry.body, { stagger: true }), canonicalUrl, seo, newer, older };
+        return { entry, html: await render(entry.body, { stagger: true, resolve: buildLinkResolver(site) }), canonicalUrl, seo, newer, older };
     }
     /** The chronological archive for one concept: every non-draft summary, newest-first. */
     function archiveLoad(conceptId) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@glw907/cairn-cms",
-  "version": "0.17.0",
+  "version": "0.21.0",
   "description": "Embedded, magic-link, GitHub-committing CMS for SvelteKit/Cloudflare sites.",
   "type": "module",
   "sideEffects": [
@@ -64,6 +64,7 @@
     "svelte": "^5.0.0"
   },
   "dependencies": {
+    "@codemirror/autocomplete": "^6.20.2",
     "@codemirror/commands": "^6.10.3",
     "@codemirror/lang-markdown": "^6.5.0",
     "@codemirror/language": "^6.12.3",

package/src/lib/components/DeleteDialog.svelte

@@ -0,0 +1,81 @@
+<!--
+@component
+The Delete control and its modal. With no inbound links it is a plain confirm that posts to the
+?/delete action. With inbound links it blocks: it names how many entries link here and lists them,
+each linking to its edit page, so the author repoints or removes those links first. Built on a native
+<dialog>, following the LinkPicker a11y conventions.
+-->
+<script lang="ts">
+  import type { InboundLink } from '../content/manifest.js';
+
+  interface Props {
+    /** The concept this entry belongs to, e.g. "posts". Posted with the confirm. */
+    conceptId: string;
+    /** The entry id within its concept. Posted with the confirm. */
+    id: string;
+    /** A human label for the concept, e.g. "Post", used in the prompts. */
+    label: string;
+    /** The entries that link to this one; non-empty blocks the delete. */
+    inboundLinks: InboundLink[];
+  }
+
+  let { conceptId, id, label, inboundLinks }: Props = $props();
+
+  let dialog = $state<HTMLDialogElement | null>(null);
+  const blocked = $derived(inboundLinks.length > 0);
+  const noun = $derived(label.toLowerCase());
+  // One inbound link reads "1 post links here ... repoint it"; many reads "2 posts link here ...
+  // repoint them". The subject-verb agreement inverts the usual plural-s, so derive each form once.
+  const single = $derived(inboundLinks.length === 1);
+  const nouns = $derived(single ? noun : `${noun}s`);
+  const verb = $derived(single ? 'links' : 'link');
+  const pronoun = $derived(single ? 'it' : 'them');
+
+  function open() {
+    dialog?.showModal();
+  }
+  function close() {
+    dialog?.close();
+  }
+</script>
+
+<button type="button" class="btn btn-sm btn-ghost text-error" aria-haspopup="dialog" onclick={open}>
+  Delete
+</button>
+
+<dialog class="modal" aria-labelledby="cairn-delete-dialog-title" bind:this={dialog}>
+  <div class="modal-box">
+    <div class="mb-3 flex items-center justify-between">
+      <h2 id="cairn-delete-dialog-title" class="text-base font-semibold">Delete this {label.toLowerCase()}?</h2>
+      <button type="button" class="btn btn-ghost btn-sm" aria-label="Close" onclick={close}>✕</button>
+    </div>
+
+    {#if blocked}
+      <p class="mb-2 text-sm">
+        {inboundLinks.length} {nouns} {verb} here. Remove or repoint {pronoun} before deleting, so no link is left
+        broken.
+      </p>
+      <ul class="menu w-full">
+        {#each inboundLinks as link (link.concept + '/' + link.id)}
+          <li>
+            <a href={`/admin/${link.concept}/${link.id}`}>{link.title}</a>
+          </li>
+        {/each}
+      </ul>
+      <div class="mt-3 flex justify-end">
+        <button type="button" class="btn btn-sm" onclick={close}>Close</button>
+      </div>
+    {:else}
+      <p class="mb-3 text-sm">This cannot be undone.</p>
+      <form method="POST" action="?/delete" class="flex justify-end gap-2">
+        <input type="hidden" name="concept" value={conceptId} />
+        <input type="hidden" name="id" value={id} />
+        <button type="button" class="btn btn-sm" onclick={close}>Cancel</button>
+        <button type="submit" class="btn btn-sm btn-error">Delete this {label.toLowerCase()}</button>
+      </form>
+    {/if}
+  </div>
+  <form method="dialog" class="modal-backdrop">
+    <button tabindex="-1" aria-label="Close">close</button>
+  </form>
+</dialog>

package/src/lib/components/EditPage.svelte

@@ -8,10 +8,17 @@ markdown editor and a live, design-accurate preview. The whole surface is one fo
   import { untrack } from 'svelte';
   import MarkdownEditor from './MarkdownEditor.svelte';
   import ComponentInsertDialog from './ComponentInsertDialog.svelte';
+  import LinkPicker from './LinkPicker.svelte';
+  import DeleteDialog from './DeleteDialog.svelte';
+  import RenameDialog from './RenameDialog.svelte';
+  import { cairnLinkCompletionSource } from './link-completion.js';
+  import { unwrapCairnLink } from './markdown-format.js';
   import type { ComponentRegistry } from '../render/registry.js';
   import type { IconSet } from '../render/glyph.js';
   import type { EditData } from '../sveltekit/content-routes.js';
   import type { TextareaField, TagsField, FreeTagsField } from '../content/types.js';
+  import type { LinkResolve } from '../content/links.js';
+  import { manifestLinkResolver } from '../content/manifest.js';
 
   interface Props {
     /** The edit load's data, plus the site name for the heading. */
@@ -19,19 +26,88 @@ markdown editor and a live, design-accurate preview. The whole surface is one fo
     /** The site's component registry, for the insert palette. */
     registry?: ComponentRegistry;
     /** The site's design-accurate render pipeline; the preview pane renders its output, which the floored pipeline already sanitized. */
-    render?: (md: string, opts?: { stagger?: boolean }) => string | Promise<string>;
+    render?: (md: string, opts?: { stagger?: boolean; resolve?: LinkResolve }) => string | Promise<string>;
     /** The site's icon set, for the guided form's icon fields. */
     icons?: IconSet;
+    /** The `?/save` or `?/delete` action result. Carries the save guard's broken links when a save was
+     *  blocked, or the delete guard's inbound linkers when a delete was refused. */
+    form?: { brokenLinks?: string[]; body?: string; inboundLinks?: import('../content/manifest.js').InboundLink[]; renameError?: string } | null;
   }
 
-  let { data, registry, render, icons }: Props = $props();
+  let { data, registry, render, icons, form }: Props = $props();
 
-  // `body` is local editor state seeded once from the prop; it diverges as the user types.
-  // untrack() captures the initial value without subscribing to future prop changes.
-  let body = $state(untrack(() => data.body));
+  // `body` is local editor state seeded once; it diverges as the user types. A blocked save returns
+  // the author's edited markdown as form.body, so seed from that when present to keep the edits and
+  // the broken link they were told to fix. On the success and delete-refused paths form carries no
+  // body, so it falls back to the committed data.body. untrack() captures the initial value without
+  // subscribing to future prop changes.
+  let body = $state(untrack(() => form?.body ?? data.body));
   let showPreview = $state(false);
   let previewHtml = $state('');
   let insert = $state.raw<(text: string) => void>(() => {});
+  let insertLink = $state.raw<(href: string, title: string) => void>(() => {});
+
+  // The save guard's broken links, from the blocked action result. The fix unwraps a link in the
+  // local body, which the bound editor reconciles, so the author re-saves clean.
+  const brokenLinks = $derived(form?.brokenLinks ?? []);
+  // Track the hrefs the author has already fixed this session. The banner reads the immutable action
+  // result, so without this a fixed row would linger and "Remove link" would read as a no-op.
+  let removedLinks = $state<string[]>([]);
+  const visibleBrokenLinks = $derived(brokenLinks.filter((h) => !removedLinks.includes(h)));
+  function removeBrokenLink(href: string) {
+    // Hide the row only when the unwrap changed the body. A genuine no-op keeps the row honest.
+    const next = unwrapCairnLink(body, href);
+    if (next !== body) {
+      body = next;
+      removedLinks = [...removedLinks, href];
+    }
+  }
+
+  // The delete guard's inbound linkers, from a refused delete (fail 409). Empty when the delete was
+  // not refused. When set, a delete was blocked by a link that appeared since the page loaded.
+  const deleteRefusedLinks = $derived(form?.inboundLinks ?? []);
+
+  // A rename that hit a collision or an invalid slug returns form.renameError.
+  const renameError = $derived(form?.renameError ?? '');
+
+  // After a save that links to a draft target, the redirect carries ?drafts=<tokens>.
+  let draftWarning = $state('');
+  $effect(() => {
+    const search = typeof location === 'undefined' ? '' : location.search;
+    const drafts = new URLSearchParams(search).get('drafts');
+    draftWarning = drafts ? drafts.split(',').filter(Boolean).join(', ') : '';
+  });
+
+  // One persistent live region announces the current message, since a {#if}-gated role element
+  // inserted fresh is announced inconsistently. A polite region carries the success and draft
+  // notices; an assertive region carries the errors. The visible banners below keep their styling
+  // but drop their roles, so a message is announced once.
+  const politeMessage = $derived.by(() => {
+    if (draftWarning) return `Saved. This page links to unpublished pages: ${draftWarning}.`;
+    if (data.saved) return 'Saved.';
+    if (data.renamed) return `The URL is now ${data.slug}.`;
+    return '';
+  });
+  const assertiveMessage = $derived.by(() => {
+    if (data.error) return data.error;
+    if (renameError) return renameError;
+    if (deleteRefusedLinks.length) {
+      const count = deleteRefusedLinks.length;
+      return `This ${data.label.toLowerCase()} could not be deleted. ${count} ${count === 1 ? 'page links' : 'pages link'} to it.`;
+    }
+    if (visibleBrokenLinks.length) {
+      const count = visibleBrokenLinks.length;
+      return `This page links to ${count} missing ${count === 1 ? 'page' : 'pages'}.`;
+    }
+    return '';
+  });
+
+  // The manifest-backed resolver turns a cairn: link into its live permalink in the preview, and
+  // returns undefined for a missing target so the render step marks it cairn-broken-link.
+  const resolveLink = $derived(manifestLinkResolver(data.linkTargets));
+
+  // The [[ autocomplete source over the same link targets, handed to the editor's generic seam.
+  const completionSources = $derived([cairnLinkCompletionSource(data.linkTargets)]);
 
   const PREVIEW_KEY = 'cairn-admin:preview';
 
@@ -53,10 +129,11 @@ markdown editor and a live, design-accurate preview. The whole surface is one fo
   $effect(() => {
     if (!showPreview || !render) return;
     const md = body;
+    const resolve = resolveLink; // tracked read in the effect body
     const run = ++previewRun;
     const handle = setTimeout(async () => {
       try {
-        const html = await render(md);
+        const html = await render(md, { resolve });
         if (run === previewRun) previewHtml = html;
       } catch {
         if (run === previewRun) previewHtml = '';
@@ -78,6 +155,9 @@ markdown editor and a live, design-accurate preview. The whole surface is one fo
   </div>
   <div class="flex items-center gap-2">
     <ComponentInsertDialog {registry} {insert} {icons} />
+    <LinkPicker linkTargets={data.linkTargets} insert={insertLink} />
+    <RenameDialog conceptId={data.conceptId} id={data.id} label={data.label} slug={data.slug} />
+    <DeleteDialog conceptId={data.conceptId} id={data.id} label={data.label} inboundLinks={data.inboundLinks} />
     <button
       type="button"
       class="btn btn-sm btn-ghost"
@@ -90,11 +170,51 @@ markdown editor and a live, design-accurate preview. The whole surface is one fo
   </div>
 </header>
 
-{#if data.saved}
-  <div role="status" class="alert alert-success mb-4 text-sm">Saved.</div>
+<div class="sr-only" aria-live="polite">{politeMessage}</div>
+<div class="sr-only" aria-live="assertive">{assertiveMessage}</div>
+
+{#if data.saved && !draftWarning}
+  <div class="alert alert-success mb-4 text-sm">Saved.</div>
+{/if}
+{#if data.renamed}
+  <div class="alert alert-success mb-4 text-sm">The URL is now {data.slug}.</div>
 {/if}
 {#if data.error}
-  <div role="alert" class="alert alert-error mb-4 text-sm">{data.error}</div>
+  <div class="alert alert-error mb-4 text-sm">{data.error}</div>
+{/if}
+{#if renameError}
+  <div class="alert alert-error mb-4 text-sm">{renameError}</div>
+{/if}
+{#if deleteRefusedLinks.length}
+  <div class="alert alert-error mb-4 flex-col items-start text-sm">
+    <p class="font-medium">This {data.label.toLowerCase()} could not be deleted.</p>
+    <p>{deleteRefusedLinks.length} {deleteRefusedLinks.length === 1 ? 'page' : 'pages'} now link to it. Remove or repoint the {deleteRefusedLinks.length === 1 ? 'link' : 'links'} listed below, then delete again.</p>
+    <ul class="mt-1 w-full">
+      {#each deleteRefusedLinks as link (link.concept + '/' + link.id)}
+        <li>
+          <a class="link" href={`/admin/${link.concept}/${link.id}`}>{link.title}</a>
+        </li>
+      {/each}
+    </ul>
+  </div>
+{/if}
+{#if visibleBrokenLinks.length}
+  <div class="alert alert-error mb-4 flex-col items-start text-sm">
+    <p>This page links to {visibleBrokenLinks.length === 1 ? 'a page' : 'pages'} that no longer {visibleBrokenLinks.length === 1 ? 'exists' : 'exist'}. Remove the broken {visibleBrokenLinks.length === 1 ? 'link' : 'links'} and save again.</p>
+    <ul class="mt-1 w-full">
+      {#each visibleBrokenLinks as href (href)}
+        <li class="flex items-center justify-between gap-2">
+          <code class="text-xs">{href}</code>
+          <button type="button" class="btn btn-xs" onclick={() => removeBrokenLink(href)}>Remove link</button>
+        </li>
+      {/each}
+    </ul>
+  </div>
+{/if}
+{#if draftWarning}
+  <div class="alert alert-warning mb-4 text-sm">
+    Saved. Note: this page links to unpublished {draftWarning.includes(',') ? 'pages' : 'a page'} ({draftWarning}), which will 404 until published.
+  </div>
 {/if}
 
 <form method="POST" action="?/save" class="lg:grid lg:grid-cols-[1fr_20rem] lg:gap-6">
@@ -102,7 +222,13 @@ markdown editor and a live, design-accurate preview. The whole surface is one fo
 
   <div class="lg:order-1">
     <div class="rounded-box border border-base-300 bg-base-100 overflow-hidden">
-      <MarkdownEditor bind:value={body} name="body" registerInsert={(fn) => (insert = fn)} />
+      <MarkdownEditor
+        bind:value={body}
+        name="body"
+        registerInsert={(fn) => (insert = fn)}
+        registerInsertLink={(fn) => (insertLink = fn)}
+        {completionSources}
+      />
     </div>
     {#if showPreview}
       <section