@glw907/cairn-cms 0.17.0 → 0.21.0

package/src/lib/sveltekit/content-routes.ts

@@ -2,13 +2,16 @@
 // A factory closes over the composed runtime and the GitHub token mint, so the read and
 // commit paths are unit-testable against a fetch double with an injected token, mirroring the
 // email `send` injection in auth-routes. A shim stays one line: `export const load = routes.editLoad`.
-import { redirect, error } from '@sveltejs/kit';
+import { redirect, error, fail } from '@sveltejs/kit';
 import { findConcept } from '../content/concepts.js';
+import { extractCairnLinks, formatCairnToken } from '../content/links.js';
 import { frontmatterFromForm, parseMarkdown, dateInputValue, serializeMarkdown } from '../content/frontmatter.js';
-import { isValidId, slugify, filenameFromId, composeDatedId } from '../content/ids.js';
+import { isValidId, slugify, filenameFromId, composeDatedId, slugFromId, renameId } from '../content/ids.js';
+import { rewriteCairnLink } from '../components/markdown-format.js';
 import { appCredentials, type GithubKeyEnv } from '../github/credentials.js';
-import { listMarkdown, readRaw, commitFile } from '../github/repo.js';
+import { listMarkdown, readRaw, commitFiles, type FileChange } from '../github/repo.js';
 import { cachedInstallationToken } from '../github/signing.js';
+import { emptyManifest, manifestEntryFromFile, parseManifest, serializeManifest, upsertEntry, removeEntry, inboundLinks, type LinkTarget, type InboundLink } from '../content/manifest.js';
 import { CommitConflictError } from '../github/types.js';
 import type { CairnRuntime, ConceptDescriptor, FrontmatterField } from '../content/types.js';
 import type { Editor, Role } from '../auth/types.js';
@@ -62,7 +65,15 @@ export interface EditData {
   title: string;
   isNew: boolean;
   saved: boolean;
+  /** True after a successful rename redirect (`?renamed=1`), to confirm the new URL to the author. */
+  renamed: boolean;
   error: string | null;
+  /** The current URL slug (the date-stripped id for a dated concept), for the rename dialog prefill. */
+  slug: string;
+  /** The site's link targets, for the preview resolver and the link picker; from the committed manifest. */
+  linkTargets: LinkTarget[];
+  /** The entries that link to this one, for the delete guard. Empty when nothing links here. */
+  inboundLinks: InboundLink[];
 }
 
 /** The structural event the content routes read; a real SvelteKit RequestEvent satisfies it. */
@@ -202,11 +213,32 @@ export function createContentRoutes(runtime: CairnRuntime, deps: ContentRoutesDe
     if (!isValidId(id)) throw error(400, 'Invalid entry id');
     const isNew = event.url.searchParams.get('new') === '1';
     const token = await mintToken(event.platform?.env ?? {});
-    const raw = await readRaw(runtime.backend, `${concept.dir}/${filenameFromId(id)}`, token);
+    const datePrefix = concept.routing.dated ? concept.datePrefix : null;
+    // The entry file and the manifest are independent reads sharing the token; fetch them together.
+    const [raw, manifestRaw] = await Promise.all([
+      readRaw(runtime.backend, `${concept.dir}/${filenameFromId(id)}`, token),
+      readRaw(runtime.backend, runtime.manifestPath, token),
+    ]);
     if (raw === null && !isNew) throw error(404, 'Entry not found');
 
     const parsed = raw === null ? { frontmatter: {}, body: '' } : parseMarkdown(raw);
     const title = typeof parsed.frontmatter.title === 'string' && parsed.frontmatter.title.trim() ? parsed.frontmatter.title : id;
+
+    let linkTargets: LinkTarget[] = [];
+    let inbound: InboundLink[] = [];
+    if (manifestRaw !== null) {
+      const manifest = parseManifest(manifestRaw);
+      linkTargets = manifest.entries.map((e) => ({
+        concept: e.concept,
+        id: e.id,
+        permalink: e.permalink,
+        title: e.title,
+        date: e.date,
+        draft: e.draft,
+      }));
+      inbound = inboundLinks(manifest, concept.id, id);
+    }
+
     return {
       conceptId: concept.id,
       id,
@@ -217,7 +249,11 @@ export function createContentRoutes(runtime: CairnRuntime, deps: ContentRoutesDe
       title,
       isNew,
       saved: event.url.searchParams.get('saved') === '1',
+      renamed: event.url.searchParams.get('renamed') === '1',
       error: event.url.searchParams.get('error'),
+      slug: slugFromId(id, datePrefix),
+      linkTargets,
+      inboundLinks: inbound,
     };
   }
 
@@ -227,7 +263,7 @@ export function createContentRoutes(runtime: CairnRuntime, deps: ContentRoutesDe
   }
 
   /** Save an edit: validate, then commit with the session editor as author. Fails safe on 409. */
-  async function saveAction(event: ContentEvent): Promise<never> {
+  async function saveAction(event: ContentEvent): Promise<ReturnType<typeof fail> | never> {
     const editor = sessionOf(event);
     const concept = conceptOf(runtime, event.params);
     const id = event.params.id ?? '';
@@ -249,11 +285,45 @@ export function createContentRoutes(runtime: CairnRuntime, deps: ContentRoutesDe
 
     const markdown = serializeMarkdown(result.data, body);
     const token = await mintToken(event.platform?.env ?? {});
+
+    // Read the committed manifest, upsert this entry's row, and commit content and manifest in one
+    // commit. A missing manifest starts empty (first save on a fresh repo). The build regenerates
+    // and verifies the manifest, so this incremental patch is the cheap request-time path. On a
+    // 422 retry commitFiles re-sends this manifest blob last-writer-wins. A concurrent save can then
+    // leave the committed manifest stale, which the next build rejects via verifyManifest; regenerate
+    // it with npm run cairn:manifest to recover.
+    const manifestRaw = await readRaw(runtime.backend, runtime.manifestPath, token);
+    const manifest = manifestRaw === null ? emptyManifest() : parseManifest(manifestRaw);
+    const row = manifestEntryFromFile(concept, { path, raw: markdown });
+    const upserted = upsertEntry(manifest, row);
+    const nextManifest = serializeManifest(upserted);
+
+    // Save guard: resolve the body's cairn links against the manifest with this entry upserted, so a
+    // self-link and a link to any existing target resolves. A link to an absent target hard-blocks
+    // the save (it would red the deploy build and the author would not see it); a link to a draft
+    // target commits with a warning, since it is valid and resolves once the target is published.
+    const byKey = new Map(upserted.entries.map((e) => [`${e.concept}/${e.id}`, e]));
+    const absent: string[] = [];
+    const draft: string[] = [];
+    for (const ref of extractCairnLinks(body)) {
+      // A self-link is valid by construction (the upserted manifest holds this very entry), so
+      // skip it before classifying. Mirrors inboundLinks's self-exclusion.
+      if (ref.concept === concept.id && ref.id === id) continue;
+      const target = byKey.get(`${ref.concept}/${ref.id}`);
+      if (!target) absent.push(formatCairnToken(ref));
+      else if (target.draft) draft.push(formatCairnToken(ref));
+    }
+    if (absent.length) {
+      return fail(400, { brokenLinks: absent, body });
+    }
+
     try {
-      await commitFile(
+      await commitFiles(
         runtime.backend,
-        path,
-        markdown,
+        [
+          { path, content: markdown },
+          { path: runtime.manifestPath, content: nextManifest },
+        ],
         { message: `Update ${concept.label.toLowerCase()}: ${id}`, author: { name: editor.displayName, email: editor.email } },
         token,
       );
@@ -264,8 +334,137 @@ export function createContentRoutes(runtime: CairnRuntime, deps: ContentRoutesDe
       }
       throw err;
     }
-    throw redirect(303, `/admin/${concept.id}/${id}?saved=1`);
+    const savedQuery = draft.length ? `saved=1&drafts=${encodeURIComponent(draft.join(','))}` : 'saved=1';
+    throw redirect(303, `/admin/${concept.id}/${id}?${savedQuery}`);
+  }
+
+  /** Delete an entry. Block-until-clean: refuse while inbound links exist (naming them), else commit
+   *  the file removal and the manifest patch in one commit. The inbound recheck here is the
+   *  authoritative gate, closing the load-to-delete race. */
+  async function deleteAction(event: ContentEvent): Promise<ReturnType<typeof fail> | never> {
+    const editor = sessionOf(event);
+    const concept = conceptOf(runtime, event.params);
+    const id = event.params.id ?? '';
+    if (!isValidId(id)) throw error(400, 'Invalid entry id');
+    const path = `${concept.dir}/${filenameFromId(id)}`;
+    const token = await mintToken(event.platform?.env ?? {});
+
+    // An absent manifest degrades the inbound gate to "allow": with no manifest there is nothing to
+    // check, and the build's cairn: backstop still catches any dangling token, mirroring saveAction.
+    const manifestRaw = await readRaw(runtime.backend, runtime.manifestPath, token);
+    const manifest = manifestRaw === null ? emptyManifest() : parseManifest(manifestRaw);
+    const inbound = inboundLinks(manifest, concept.id, id);
+    if (inbound.length) {
+      return fail(409, { inboundLinks: inbound });
+    }
+
+    const nextManifest = serializeManifest(removeEntry(manifest, concept.id, id));
+    try {
+      await commitFiles(
+        runtime.backend,
+        [
+          { path, content: null },
+          { path: runtime.manifestPath, content: nextManifest },
+        ],
+        { message: `Delete ${concept.label.toLowerCase()}: ${id}`, author: { name: editor.displayName, email: editor.email } },
+        token,
+      );
+    } catch (err) {
+      if (isConflict(err)) {
+        const message = 'This file changed since you opened it. Reload and try again.';
+        throw redirect(303, `/admin/${concept.id}/${id}?error=${encodeURIComponent(message)}`);
+      }
+      throw err;
+    }
+    throw redirect(303, `/admin/${concept.id}`);
+  }
+
+  /** Rename an entry: change its slug, move the file, and rewrite every inbound cairn token in one
+   *  atomic commit, so no internal link breaks. The collision check and the inbound recompute here
+   *  are the authoritative gate. The same last-writer-wins manifest race as save and delete applies,
+   *  caught by the build's fail-closed backstop. */
+  async function renameAction(event: ContentEvent): Promise<ReturnType<typeof fail> | never> {
+    const editor = sessionOf(event);
+    const concept = conceptOf(runtime, event.params);
+    const id = event.params.id ?? '';
+    if (!isValidId(id)) throw error(400, 'Invalid entry id');
+
+    const form = await event.request.formData();
+    const newSlug = String(form.get('slug') ?? '').trim();
+    if (!isValidId(newSlug)) {
+      return fail(400, { renameError: 'Enter a valid slug: lowercase letters, numbers, and hyphens.' });
+    }
+    const datePrefix = concept.routing.dated ? concept.datePrefix : null;
+    if (concept.routing.dated && /^\d{4}-/.test(newSlug)) {
+      return fail(400, { renameError: 'Leave the date out of the slug.' });
+    }
+    if (newSlug === slugFromId(id, datePrefix)) {
+      return fail(400, { renameError: 'That is already the slug.' });
+    }
+    const newId = renameId(id, newSlug, datePrefix);
+    const oldPath = `${concept.dir}/${filenameFromId(id)}`;
+    const newPath = `${concept.dir}/${filenameFromId(newId)}`;
+    const token = await mintToken(event.platform?.env ?? {});
+
+    // Collision guard: refuse if a file already exists at the new path. This 409 covers two cases a
+    // single readRaw cannot tell apart: a static collision with an existing entry, and a
+    // concurrent-rename race where another editor renamed onto this path between load and submit.
+    const clobber = await readRaw(runtime.backend, newPath, token);
+    if (clobber !== null) {
+      return fail(409, { renameError: 'An entry with that slug already exists.' });
+    }
+
+    const [entryRaw, manifestRaw] = await Promise.all([
+      readRaw(runtime.backend, oldPath, token),
+      readRaw(runtime.backend, runtime.manifestPath, token),
+    ]);
+    if (entryRaw === null) throw error(404, 'Entry not found');
+    const manifest = manifestRaw === null ? emptyManifest() : parseManifest(manifestRaw);
+
+    const oldHref = formatCairnToken({ concept: concept.id, id });
+    const newHref = formatCairnToken({ concept: concept.id, id: newId });
+
+    // The moved file keeps its content, except a self-token rewrite. Re-derive its manifest row from
+    // the new path so the row carries the new id and permalink by construction.
+    const movedRaw = rewriteCairnLink(entryRaw, oldHref, newHref);
+    const changes: FileChange[] = [
+      { path: oldPath, content: null },
+      { path: newPath, content: movedRaw },
+    ];
+    let next = removeEntry(manifest, concept.id, id);
+    next = upsertEntry(next, manifestEntryFromFile(concept, { path: newPath, raw: movedRaw }));
+
+    // Rewrite every inbound linker's body and re-derive its row, so its outbound edge points at the
+    // new id. A linker missing from the repo is skipped; the build backstop catches any drift.
+    for (const linker of inboundLinks(manifest, concept.id, id)) {
+      const linkerConcept = findConcept(runtime.concepts, linker.concept);
+      if (!linkerConcept) continue;
+      const linkerPath = `${linkerConcept.dir}/${filenameFromId(linker.id)}`;
+      const linkerRaw = await readRaw(runtime.backend, linkerPath, token);
+      if (linkerRaw === null) continue;
+      const rewritten = rewriteCairnLink(linkerRaw, oldHref, newHref);
+      changes.push({ path: linkerPath, content: rewritten });
+      next = upsertEntry(next, manifestEntryFromFile(linkerConcept, { path: linkerPath, raw: rewritten }));
+    }
+
+    changes.push({ path: runtime.manifestPath, content: serializeManifest(next) });
+
+    try {
+      await commitFiles(
+        runtime.backend,
+        changes,
+        { message: `Rename ${concept.label.toLowerCase()}: ${id} to ${newId}`, author: { name: editor.displayName, email: editor.email } },
+        token,
+      );
+    } catch (err) {
+      if (isConflict(err)) {
+        const message = 'This file changed since you opened it. Reload and try again.';
+        throw redirect(303, `/admin/${concept.id}/${id}?error=${encodeURIComponent(message)}`);
+      }
+      throw err;
+    }
+    throw redirect(303, `/admin/${concept.id}/${newId}?renamed=1`);
   }
 
-  return { layoutLoad, indexRedirect, listLoad, createAction, editLoad, saveAction, mintToken };
+  return { layoutLoad, indexRedirect, listLoad, createAction, editLoad, saveAction, deleteAction, renameAction, mintToken };
 }

package/src/lib/sveltekit/public-routes.ts

@@ -9,11 +9,13 @@ import type { SiteIndex } from '../delivery/site-index.js';
 import { buildSeoMeta } from '../delivery/seo.js';
 import type { SeoMeta } from '../delivery/seo.js';
 import { readSeoFields, resolveImageUrl } from '../delivery/seo-fields.js';
+import { buildLinkResolver } from '../delivery/manifest.js';
+import type { LinkResolve } from '../content/links.js';
 
 /** Injected dependencies for the public loaders. */
 export interface PublicRoutesDeps {
   site: SiteIndex;
-  render: (md: string, opts?: { stagger?: boolean }) => string | Promise<string>;
+  render: (md: string, opts?: { stagger?: boolean; resolve?: LinkResolve }) => string | Promise<string>;
   origin: string;
   /** Site name for og:site_name and the SEO head. */
   siteName: string;
@@ -85,7 +87,7 @@ export function createPublicRoutes(deps: PublicRoutesDeps) {
       ...(fields.author ? { author: fields.author } : {}),
       ...(entry.date ? { feeds } : {}),
     });
-    return { entry, html: await render(entry.body, { stagger: true }), canonicalUrl, seo, newer, older };
+    return { entry, html: await render(entry.body, { stagger: true, resolve: buildLinkResolver(site) }), canonicalUrl, seo, newer, older };
   }
 
   /** The chronological archive for one concept: every non-draft summary, newest-first. */