@glw907/cairn-cms 0.18.0 → 0.24.0

package/dist/sveltekit/content-routes.js

@@ -2,14 +2,16 @@
 // A factory closes over the composed runtime and the GitHub token mint, so the read and
 // commit paths are unit-testable against a fetch double with an injected token, mirroring the
 // email `send` injection in auth-routes. A shim stays one line: `export const load = routes.editLoad`.
-import { redirect, error } from '@sveltejs/kit';
+import { redirect, error, fail } from '@sveltejs/kit';
 import { findConcept } from '../content/concepts.js';
+import { extractCairnLinks, formatCairnToken } from '../content/links.js';
 import { frontmatterFromForm, parseMarkdown, dateInputValue, serializeMarkdown } from '../content/frontmatter.js';
-import { isValidId, slugify, filenameFromId, composeDatedId } from '../content/ids.js';
+import { isValidId, slugify, filenameFromId, composeDatedId, slugFromId, renameId } from '../content/ids.js';
+import { rewriteCairnLink } from '../components/markdown-format.js';
 import { appCredentials } from '../github/credentials.js';
 import { listMarkdown, readRaw, commitFiles } from '../github/repo.js';
 import { cachedInstallationToken } from '../github/signing.js';
-import { emptyManifest, manifestEntryFromFile, parseManifest, serializeManifest, upsertEntry } from '../content/manifest.js';
+import { emptyManifest, manifestEntryFromFile, parseManifest, serializeManifest, upsertEntry, removeEntry, inboundLinks } from '../content/manifest.js';
 import { CommitConflictError } from '../github/types.js';
 /** The signed-in editor the guard resolved, or a login redirect. Kept local to decouple event shapes. */
 function sessionOf(event) {
@@ -135,15 +137,21 @@ export function createContentRoutes(runtime, deps = {}) {
             throw error(400, 'Invalid entry id');
         const isNew = event.url.searchParams.get('new') === '1';
         const token = await mintToken(event.platform?.env ?? {});
-        const raw = await readRaw(runtime.backend, `${concept.dir}/${filenameFromId(id)}`, token);
+        const datePrefix = concept.routing.dated ? concept.datePrefix : null;
+        // The entry file and the manifest are independent reads sharing the token; fetch them together.
+        const [raw, manifestRaw] = await Promise.all([
+            readRaw(runtime.backend, `${concept.dir}/${filenameFromId(id)}`, token),
+            readRaw(runtime.backend, runtime.manifestPath, token),
+        ]);
         if (raw === null && !isNew)
             throw error(404, 'Entry not found');
         const parsed = raw === null ? { frontmatter: {}, body: '' } : parseMarkdown(raw);
         const title = typeof parsed.frontmatter.title === 'string' && parsed.frontmatter.title.trim() ? parsed.frontmatter.title : id;
         let linkTargets = [];
-        const manifestRaw = await readRaw(runtime.backend, runtime.manifestPath, token);
+        let inbound = [];
         if (manifestRaw !== null) {
-            linkTargets = parseManifest(manifestRaw).entries.map((e) => ({
+            const manifest = parseManifest(manifestRaw);
+            linkTargets = manifest.entries.map((e) => ({
                 concept: e.concept,
                 id: e.id,
                 permalink: e.permalink,
@@ -151,6 +159,7 @@ export function createContentRoutes(runtime, deps = {}) {
                 date: e.date,
                 draft: e.draft,
             }));
+            inbound = inboundLinks(manifest, concept.id, id);
         }
         return {
             conceptId: concept.id,
@@ -162,8 +171,11 @@ export function createContentRoutes(runtime, deps = {}) {
             title,
             isNew,
             saved: event.url.searchParams.get('saved') === '1',
+            renamed: event.url.searchParams.get('renamed') === '1',
             error: event.url.searchParams.get('error'),
+            slug: slugFromId(id, datePrefix),
             linkTargets,
+            inboundLinks: inbound,
         };
     }
     /** Match a commit conflict by class and by name (bundling can alias the class identity). */
@@ -200,7 +212,29 @@ export function createContentRoutes(runtime, deps = {}) {
         const manifestRaw = await readRaw(runtime.backend, runtime.manifestPath, token);
         const manifest = manifestRaw === null ? emptyManifest() : parseManifest(manifestRaw);
         const row = manifestEntryFromFile(concept, { path, raw: markdown });
-        const nextManifest = serializeManifest(upsertEntry(manifest, row));
+        const upserted = upsertEntry(manifest, row);
+        const nextManifest = serializeManifest(upserted);
+        // Save guard: resolve the body's cairn links against the manifest with this entry upserted, so a
+        // self-link and a link to any existing target resolves. A link to an absent target hard-blocks
+        // the save (it would red the deploy build and the author would not see it); a link to a draft
+        // target commits with a warning, since it is valid and resolves once the target is published.
+        const byKey = new Map(upserted.entries.map((e) => [`${e.concept}/${e.id}`, e]));
+        const absent = [];
+        const draft = [];
+        for (const ref of extractCairnLinks(body)) {
+            // A self-link is valid by construction (the upserted manifest holds this very entry), so
+            // skip it before classifying. Mirrors inboundLinks's self-exclusion.
+            if (ref.concept === concept.id && ref.id === id)
+                continue;
+            const target = byKey.get(`${ref.concept}/${ref.id}`);
+            if (!target)
+                absent.push(formatCairnToken(ref));
+            else if (target.draft)
+                draft.push(formatCairnToken(ref));
+        }
+        if (absent.length) {
+            return fail(400, { brokenLinks: absent, body });
+        }
         try {
             await commitFiles(runtime.backend, [
                 { path, content: markdown },
@@ -214,7 +248,121 @@ export function createContentRoutes(runtime, deps = {}) {
             }
             throw err;
         }
-        throw redirect(303, `/admin/${concept.id}/${id}?saved=1`);
+        const savedQuery = draft.length ? `saved=1&drafts=${encodeURIComponent(draft.join(','))}` : 'saved=1';
+        throw redirect(303, `/admin/${concept.id}/${id}?${savedQuery}`);
+    }
+    /** Delete an entry. Block-until-clean: refuse while inbound links exist (naming them), else commit
+     *  the file removal and the manifest patch in one commit. The inbound recheck here is the
+     *  authoritative gate, closing the load-to-delete race. */
+    async function deleteAction(event) {
+        const editor = sessionOf(event);
+        const concept = conceptOf(runtime, event.params);
+        const id = event.params.id ?? '';
+        if (!isValidId(id))
+            throw error(400, 'Invalid entry id');
+        const path = `${concept.dir}/${filenameFromId(id)}`;
+        const token = await mintToken(event.platform?.env ?? {});
+        // An absent manifest degrades the inbound gate to "allow": with no manifest there is nothing to
+        // check, and the build's cairn: backstop still catches any dangling token, mirroring saveAction.
+        const manifestRaw = await readRaw(runtime.backend, runtime.manifestPath, token);
+        const manifest = manifestRaw === null ? emptyManifest() : parseManifest(manifestRaw);
+        const inbound = inboundLinks(manifest, concept.id, id);
+        if (inbound.length) {
+            return fail(409, { inboundLinks: inbound });
+        }
+        const nextManifest = serializeManifest(removeEntry(manifest, concept.id, id));
+        try {
+            await commitFiles(runtime.backend, [
+                { path, content: null },
+                { path: runtime.manifestPath, content: nextManifest },
+            ], { message: `Delete ${concept.label.toLowerCase()}: ${id}`, author: { name: editor.displayName, email: editor.email } }, token);
+        }
+        catch (err) {
+            if (isConflict(err)) {
+                const message = 'This file changed since you opened it. Reload and try again.';
+                throw redirect(303, `/admin/${concept.id}/${id}?error=${encodeURIComponent(message)}`);
+            }
+            throw err;
+        }
+        throw redirect(303, `/admin/${concept.id}`);
+    }
+    /** Rename an entry: change its slug, move the file, and rewrite every inbound cairn token in one
+     *  atomic commit, so no internal link breaks. The collision check and the inbound recompute here
+     *  are the authoritative gate. The same last-writer-wins manifest race as save and delete applies,
+     *  caught by the build's fail-closed backstop. */
+    async function renameAction(event) {
+        const editor = sessionOf(event);
+        const concept = conceptOf(runtime, event.params);
+        const id = event.params.id ?? '';
+        if (!isValidId(id))
+            throw error(400, 'Invalid entry id');
+        const form = await event.request.formData();
+        const newSlug = String(form.get('slug') ?? '').trim();
+        if (!isValidId(newSlug)) {
+            return fail(400, { renameError: 'Enter a valid slug: lowercase letters, numbers, and hyphens.' });
+        }
+        const datePrefix = concept.routing.dated ? concept.datePrefix : null;
+        if (concept.routing.dated && /^\d{4}-/.test(newSlug)) {
+            return fail(400, { renameError: 'Leave the date out of the slug.' });
+        }
+        if (newSlug === slugFromId(id, datePrefix)) {
+            return fail(400, { renameError: 'That is already the slug.' });
+        }
+        const newId = renameId(id, newSlug, datePrefix);
+        const oldPath = `${concept.dir}/${filenameFromId(id)}`;
+        const newPath = `${concept.dir}/${filenameFromId(newId)}`;
+        const token = await mintToken(event.platform?.env ?? {});
+        // Collision guard: refuse if a file already exists at the new path. This 409 covers two cases a
+        // single readRaw cannot tell apart: a static collision with an existing entry, and a
+        // concurrent-rename race where another editor renamed onto this path between load and submit.
+        const clobber = await readRaw(runtime.backend, newPath, token);
+        if (clobber !== null) {
+            return fail(409, { renameError: 'An entry with that slug already exists.' });
+        }
+        const [entryRaw, manifestRaw] = await Promise.all([
+            readRaw(runtime.backend, oldPath, token),
+            readRaw(runtime.backend, runtime.manifestPath, token),
+        ]);
+        if (entryRaw === null)
+            throw error(404, 'Entry not found');
+        const manifest = manifestRaw === null ? emptyManifest() : parseManifest(manifestRaw);
+        const oldHref = formatCairnToken({ concept: concept.id, id });
+        const newHref = formatCairnToken({ concept: concept.id, id: newId });
+        // The moved file keeps its content, except a self-token rewrite. Re-derive its manifest row from
+        // the new path so the row carries the new id and permalink by construction.
+        const movedRaw = rewriteCairnLink(entryRaw, oldHref, newHref);
+        const changes = [
+            { path: oldPath, content: null },
+            { path: newPath, content: movedRaw },
+        ];
+        let next = removeEntry(manifest, concept.id, id);
+        next = upsertEntry(next, manifestEntryFromFile(concept, { path: newPath, raw: movedRaw }));
+        // Rewrite every inbound linker's body and re-derive its row, so its outbound edge points at the
+        // new id. A linker missing from the repo is skipped; the build backstop catches any drift.
+        for (const linker of inboundLinks(manifest, concept.id, id)) {
+            const linkerConcept = findConcept(runtime.concepts, linker.concept);
+            if (!linkerConcept)
+                continue;
+            const linkerPath = `${linkerConcept.dir}/${filenameFromId(linker.id)}`;
+            const linkerRaw = await readRaw(runtime.backend, linkerPath, token);
+            if (linkerRaw === null)
+                continue;
+            const rewritten = rewriteCairnLink(linkerRaw, oldHref, newHref);
+            changes.push({ path: linkerPath, content: rewritten });
+            next = upsertEntry(next, manifestEntryFromFile(linkerConcept, { path: linkerPath, raw: rewritten }));
+        }
+        changes.push({ path: runtime.manifestPath, content: serializeManifest(next) });
+        try {
+            await commitFiles(runtime.backend, changes, { message: `Rename ${concept.label.toLowerCase()}: ${id} to ${newId}`, author: { name: editor.displayName, email: editor.email } }, token);
+        }
+        catch (err) {
+            if (isConflict(err)) {
+                const message = 'This file changed since you opened it. Reload and try again.';
+                throw redirect(303, `/admin/${concept.id}/${id}?error=${encodeURIComponent(message)}`);
+            }
+            throw err;
+        }
+        throw redirect(303, `/admin/${concept.id}/${newId}?renamed=1`);
     }
-    return { layoutLoad, indexRedirect, listLoad, createAction, editLoad, saveAction, mintToken };
+    return { layoutLoad, indexRedirect, listLoad, createAction, editLoad, saveAction, deleteAction, renameAction, mintToken };
 }

package/dist/sveltekit/public-routes.d.ts

@@ -40,6 +40,7 @@ export interface TagIndexData {
 }
 /** One entry's data: the detail entry, its rendered html, and its canonical URL. */
 export interface EntryData {
+    concept: string;
     entry: ContentEntry;
     html: string;
     canonicalUrl: string;

package/dist/sveltekit/public-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"public-routes.d.ts","sourceRoot":"","sources":["../../src/lib/sveltekit/public-routes.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAE3D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAGlD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,oDAAoD;AACpD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,WAAW,CAAA;KAAE,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACtG,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,KAAK,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC;6EACyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qEAAqE;AACrE,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAED,uDAAuD;AACvD,MAAM,WAAW,OAAQ,SAAQ,QAAQ;IACvC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACxC;AAED,oFAAoF;AACpF,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,YAAY,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,OAAO,CAAC;IACb,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED,2DAA2D;AAC3D,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB;uBAWvB;QAAE,GAAG,EAAE,GAAG,CAAA;KAAE,KAAG,OAAO,CAAC,SAAS,CAAC;6BA0BjC,MAAM,KAAG,QAAQ;8BAKhB,MAAM,KAAG,YAAY;yBAK1B,MAAM,SAAS;QAAE,MAAM,EAAE;YAAE,GAAG,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,KAAG,OAAO;mBAO5D;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE;EAKvC"}
+{"version":3,"file":"public-routes.d.ts","sourceRoot":"","sources":["../../src/lib/sveltekit/public-routes.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAE3D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAGlD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,oDAAoD;AACpD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,WAAW,CAAA;KAAE,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACtG,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,KAAK,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC;6EACyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qEAAqE;AACrE,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAED,uDAAuD;AACvD,MAAM,WAAW,OAAQ,SAAQ,QAAQ;IACvC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACxC;AAED,oFAAoF;AACpF,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,YAAY,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,OAAO,CAAC;IACb,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED,2DAA2D;AAC3D,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB;uBAWvB;QAAE,GAAG,EAAE,GAAG,CAAA;KAAE,KAAG,OAAO,CAAC,SAAS,CAAC;6BA0BjC,MAAM,KAAG,QAAQ;8BAKhB,MAAM,KAAG,YAAY;yBAK1B,MAAM,SAAS;QAAE,MAAM,EAAE;YAAE,GAAG,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,KAAG,OAAO;mBAO5D;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE;EAKvC"}

package/dist/sveltekit/public-routes.js

@@ -41,7 +41,7 @@ export function createPublicRoutes(deps) {
             ...(fields.author ? { author: fields.author } : {}),
             ...(entry.date ? { feeds } : {}),
         });
-        return { entry, html: await render(entry.body, { stagger: true, resolve: buildLinkResolver(site) }), canonicalUrl, seo, newer, older };
+        return { concept: entry.concept, entry, html: await render(entry.body, { stagger: true, resolve: buildLinkResolver(site) }), canonicalUrl, seo, newer, older };
     }
     /** The chronological archive for one concept: every non-draft summary, newest-first. */
     function archiveLoad(conceptId) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@glw907/cairn-cms",
-  "version": "0.18.0",
+  "version": "0.24.0",
   "description": "Embedded, magic-link, GitHub-committing CMS for SvelteKit/Cloudflare sites.",
   "type": "module",
   "sideEffects": [
@@ -53,6 +53,11 @@
       "svelte": "./dist/delivery/index.js",
       "default": "./dist/delivery/index.js"
     },
+    "./delivery/head": {
+      "types": "./dist/delivery/head.d.ts",
+      "svelte": "./dist/delivery/head.js",
+      "default": "./dist/delivery/head.js"
+    },
     "./package.json": "./package.json"
   },
   "files": [
@@ -64,6 +69,7 @@
     "svelte": "^5.0.0"
   },
   "dependencies": {
+    "@codemirror/autocomplete": "^6.20.2",
     "@codemirror/commands": "^6.10.3",
     "@codemirror/lang-markdown": "^6.5.0",
     "@codemirror/language": "^6.12.3",

package/src/lib/components/DeleteDialog.svelte

@@ -0,0 +1,81 @@
+<!--
+@component
+The Delete control and its modal. With no inbound links it is a plain confirm that posts to the
+?/delete action. With inbound links it blocks: it names how many entries link here and lists them,
+each linking to its edit page, so the author repoints or removes those links first. Built on a native
+<dialog>, following the LinkPicker a11y conventions.
+-->
+<script lang="ts">
+  import type { InboundLink } from '../content/manifest.js';
+
+  interface Props {
+    /** The concept this entry belongs to, e.g. "posts". Posted with the confirm. */
+    conceptId: string;
+    /** The entry id within its concept. Posted with the confirm. */
+    id: string;
+    /** A human label for the concept, e.g. "Post", used in the prompts. */
+    label: string;
+    /** The entries that link to this one; non-empty blocks the delete. */
+    inboundLinks: InboundLink[];
+  }
+
+  let { conceptId, id, label, inboundLinks }: Props = $props();
+
+  let dialog = $state<HTMLDialogElement | null>(null);
+  const blocked = $derived(inboundLinks.length > 0);
+  const noun = $derived(label.toLowerCase());
+  // One inbound link reads "1 post links here ... repoint it"; many reads "2 posts link here ...
+  // repoint them". The subject-verb agreement inverts the usual plural-s, so derive each form once.
+  const single = $derived(inboundLinks.length === 1);
+  const nouns = $derived(single ? noun : `${noun}s`);
+  const verb = $derived(single ? 'links' : 'link');
+  const pronoun = $derived(single ? 'it' : 'them');
+
+  function open() {
+    dialog?.showModal();
+  }
+  function close() {
+    dialog?.close();
+  }
+</script>
+
+<button type="button" class="btn btn-sm btn-ghost text-error" aria-haspopup="dialog" onclick={open}>
+  Delete
+</button>
+
+<dialog class="modal" aria-labelledby="cairn-delete-dialog-title" bind:this={dialog}>
+  <div class="modal-box">
+    <div class="mb-3 flex items-center justify-between">
+      <h2 id="cairn-delete-dialog-title" class="text-base font-semibold">Delete this {label.toLowerCase()}?</h2>
+      <button type="button" class="btn btn-ghost btn-sm" aria-label="Close" onclick={close}>✕</button>
+    </div>
+
+    {#if blocked}
+      <p class="mb-2 text-sm">
+        {inboundLinks.length} {nouns} {verb} here. Remove or repoint {pronoun} before deleting, so no link is left
+        broken.
+      </p>
+      <ul class="menu w-full">
+        {#each inboundLinks as link (link.concept + '/' + link.id)}
+          <li>
+            <a href={`/admin/${link.concept}/${link.id}`}>{link.title}</a>
+          </li>
+        {/each}
+      </ul>
+      <div class="mt-3 flex justify-end">
+        <button type="button" class="btn btn-sm" onclick={close}>Close</button>
+      </div>
+    {:else}
+      <p class="mb-3 text-sm">This cannot be undone.</p>
+      <form method="POST" action="?/delete" class="flex justify-end gap-2">
+        <input type="hidden" name="concept" value={conceptId} />
+        <input type="hidden" name="id" value={id} />
+        <button type="button" class="btn btn-sm" onclick={close}>Cancel</button>
+        <button type="submit" class="btn btn-sm btn-error">Delete this {label.toLowerCase()}</button>
+      </form>
+    {/if}
+  </div>
+  <form method="dialog" class="modal-backdrop">
+    <button tabindex="-1" aria-label="Close">close</button>
+  </form>
+</dialog>

package/src/lib/components/EditPage.svelte

@@ -8,6 +8,11 @@ markdown editor and a live, design-accurate preview. The whole surface is one fo
   import { untrack } from 'svelte';
   import MarkdownEditor from './MarkdownEditor.svelte';
   import ComponentInsertDialog from './ComponentInsertDialog.svelte';
+  import LinkPicker from './LinkPicker.svelte';
+  import DeleteDialog from './DeleteDialog.svelte';
+  import RenameDialog from './RenameDialog.svelte';
+  import { cairnLinkCompletionSource } from './link-completion.js';
+  import { unwrapCairnLink } from './markdown-format.js';
   import type { ComponentRegistry } from '../render/registry.js';
   import type { IconSet } from '../render/glyph.js';
   import type { EditData } from '../sveltekit/content-routes.js';
@@ -24,21 +29,86 @@ markdown editor and a live, design-accurate preview. The whole surface is one fo
     render?: (md: string, opts?: { stagger?: boolean; resolve?: LinkResolve }) => string | Promise<string>;
     /** The site's icon set, for the guided form's icon fields. */
     icons?: IconSet;
+    /** The `?/save` or `?/delete` action result. Carries the save guard's broken links when a save was
+     *  blocked, or the delete guard's inbound linkers when a delete was refused. */
+    form?: { brokenLinks?: string[]; body?: string; inboundLinks?: import('../content/manifest.js').InboundLink[]; renameError?: string } | null;
   }
 
-  let { data, registry, render, icons }: Props = $props();
+  let { data, registry, render, icons, form }: Props = $props();
 
-  // `body` is local editor state seeded once from the prop; it diverges as the user types.
-  // untrack() captures the initial value without subscribing to future prop changes.
-  let body = $state(untrack(() => data.body));
+  // `body` is local editor state seeded once; it diverges as the user types. A blocked save returns
+  // the author's edited markdown as form.body, so seed from that when present to keep the edits and
+  // the broken link they were told to fix. On the success and delete-refused paths form carries no
+  // body, so it falls back to the committed data.body. untrack() captures the initial value without
+  // subscribing to future prop changes.
+  let body = $state(untrack(() => form?.body ?? data.body));
   let showPreview = $state(false);
   let previewHtml = $state('');
   let insert = $state.raw<(text: string) => void>(() => {});
+  let insertLink = $state.raw<(href: string, title: string) => void>(() => {});
+
+  // The save guard's broken links, from the blocked action result. The fix unwraps a link in the
+  // local body, which the bound editor reconciles, so the author re-saves clean.
+  const brokenLinks = $derived(form?.brokenLinks ?? []);
+  // Track the hrefs the author has already fixed this session. The banner reads the immutable action
+  // result, so without this a fixed row would linger and "Remove link" would read as a no-op.
+  let removedLinks = $state<string[]>([]);
+  const visibleBrokenLinks = $derived(brokenLinks.filter((h) => !removedLinks.includes(h)));
+  function removeBrokenLink(href: string) {
+    // Hide the row only when the unwrap changed the body. A genuine no-op keeps the row honest.
+    const next = unwrapCairnLink(body, href);
+    if (next !== body) {
+      body = next;
+      removedLinks = [...removedLinks, href];
+    }
+  }
+
+  // The delete guard's inbound linkers, from a refused delete (fail 409). Empty when the delete was
+  // not refused. When set, a delete was blocked by a link that appeared since the page loaded.
+  const deleteRefusedLinks = $derived(form?.inboundLinks ?? []);
+
+  // A rename that hit a collision or an invalid slug returns form.renameError.
+  const renameError = $derived(form?.renameError ?? '');
+
+  // After a save that links to a draft target, the redirect carries ?drafts=<tokens>.
+  let draftWarning = $state('');
+  $effect(() => {
+    const search = typeof location === 'undefined' ? '' : location.search;
+    const drafts = new URLSearchParams(search).get('drafts');
+    draftWarning = drafts ? drafts.split(',').filter(Boolean).join(', ') : '';
+  });
+
+  // One persistent live region announces the current message, since a {#if}-gated role element
+  // inserted fresh is announced inconsistently. A polite region carries the success and draft
+  // notices; an assertive region carries the errors. The visible banners below keep their styling
+  // but drop their roles, so a message is announced once.
+  const politeMessage = $derived.by(() => {
+    if (draftWarning) return `Saved. This page links to unpublished pages: ${draftWarning}.`;
+    if (data.saved) return 'Saved.';
+    if (data.renamed) return `The URL is now ${data.slug}.`;
+    return '';
+  });
+  const assertiveMessage = $derived.by(() => {
+    if (data.error) return data.error;
+    if (renameError) return renameError;
+    if (deleteRefusedLinks.length) {
+      const count = deleteRefusedLinks.length;
+      return `This ${data.label.toLowerCase()} could not be deleted. ${count} ${count === 1 ? 'page links' : 'pages link'} to it.`;
+    }
+    if (visibleBrokenLinks.length) {
+      const count = visibleBrokenLinks.length;
+      return `This page links to ${count} missing ${count === 1 ? 'page' : 'pages'}.`;
+    }
+    return '';
+  });
 
   // The manifest-backed resolver turns a cairn: link into its live permalink in the preview, and
   // returns undefined for a missing target so the render step marks it cairn-broken-link.
   const resolveLink = $derived(manifestLinkResolver(data.linkTargets));
 
+  // The [[ autocomplete source over the same link targets, handed to the editor's generic seam.
+  const completionSources = $derived([cairnLinkCompletionSource(data.linkTargets)]);
+
   const PREVIEW_KEY = 'cairn-admin:preview';
 
   $effect(() => {
@@ -85,6 +155,9 @@ markdown editor and a live, design-accurate preview. The whole surface is one fo
   </div>
   <div class="flex items-center gap-2">
     <ComponentInsertDialog {registry} {insert} {icons} />
+    <LinkPicker linkTargets={data.linkTargets} insert={insertLink} />
+    <RenameDialog conceptId={data.conceptId} id={data.id} label={data.label} slug={data.slug} />
+    <DeleteDialog conceptId={data.conceptId} id={data.id} label={data.label} inboundLinks={data.inboundLinks} />
     <button
       type="button"
       class="btn btn-sm btn-ghost"
@@ -97,11 +170,51 @@ markdown editor and a live, design-accurate preview. The whole surface is one fo
   </div>
 </header>
 
-{#if data.saved}
-  <div role="status" class="alert alert-success mb-4 text-sm">Saved.</div>
+<div class="sr-only" aria-live="polite">{politeMessage}</div>
+<div class="sr-only" aria-live="assertive">{assertiveMessage}</div>
+
+{#if data.saved && !draftWarning}
+  <div class="alert alert-success mb-4 text-sm">Saved.</div>
+{/if}
+{#if data.renamed}
+  <div class="alert alert-success mb-4 text-sm">The URL is now {data.slug}.</div>
 {/if}
 {#if data.error}
-  <div role="alert" class="alert alert-error mb-4 text-sm">{data.error}</div>
+  <div class="alert alert-error mb-4 text-sm">{data.error}</div>
+{/if}
+{#if renameError}
+  <div class="alert alert-error mb-4 text-sm">{renameError}</div>
+{/if}
+{#if deleteRefusedLinks.length}
+  <div class="alert alert-error mb-4 flex-col items-start text-sm">
+    <p class="font-medium">This {data.label.toLowerCase()} could not be deleted.</p>
+    <p>{deleteRefusedLinks.length} {deleteRefusedLinks.length === 1 ? 'page' : 'pages'} now link to it. Remove or repoint the {deleteRefusedLinks.length === 1 ? 'link' : 'links'} listed below, then delete again.</p>
+    <ul class="mt-1 w-full">
+      {#each deleteRefusedLinks as link (link.concept + '/' + link.id)}
+        <li>
+          <a class="link" href={`/admin/${link.concept}/${link.id}`}>{link.title}</a>
+        </li>
+      {/each}
+    </ul>
+  </div>
+{/if}
+{#if visibleBrokenLinks.length}
+  <div class="alert alert-error mb-4 flex-col items-start text-sm">
+    <p>This page links to {visibleBrokenLinks.length === 1 ? 'a page' : 'pages'} that no longer {visibleBrokenLinks.length === 1 ? 'exists' : 'exist'}. Remove the broken {visibleBrokenLinks.length === 1 ? 'link' : 'links'} and save again.</p>
+    <ul class="mt-1 w-full">
+      {#each visibleBrokenLinks as href (href)}
+        <li class="flex items-center justify-between gap-2">
+          <code class="text-xs">{href}</code>
+          <button type="button" class="btn btn-xs" onclick={() => removeBrokenLink(href)}>Remove link</button>
+        </li>
+      {/each}
+    </ul>
+  </div>
+{/if}
+{#if draftWarning}
+  <div class="alert alert-warning mb-4 text-sm">
+    Saved. Note: this page links to unpublished {draftWarning.includes(',') ? 'pages' : 'a page'} ({draftWarning}), which will 404 until published.
+  </div>
 {/if}
 
 <form method="POST" action="?/save" class="lg:grid lg:grid-cols-[1fr_20rem] lg:gap-6">
@@ -109,7 +222,13 @@ markdown editor and a live, design-accurate preview. The whole surface is one fo
 
   <div class="lg:order-1">
     <div class="rounded-box border border-base-300 bg-base-100 overflow-hidden">
-      <MarkdownEditor bind:value={body} name="body" registerInsert={(fn) => (insert = fn)} />
+      <MarkdownEditor
+        bind:value={body}
+        name="body"
+        registerInsert={(fn) => (insert = fn)}
+        registerInsertLink={(fn) => (insertLink = fn)}
+        {completionSources}
+      />
     </div>
     {#if showPreview}
       <section

package/src/lib/components/LinkPicker.svelte

@@ -0,0 +1,109 @@
+<!--
+@component
+The "Link to page" control and its modal. It lists the site's posts and pages from the committed
+manifest (the linkTargets the editor receives), grouped by concept with Pages first, each post
+showing its date and each draft marked. Picking a target inserts a cairn: internal link through the
+editor's registerInsertLink seam. Built on a native <dialog>, following the component dialog's a11y
+conventions. The plain-URL link stays the toolbar's link button; this is for an internal target.
+-->
+<script lang="ts">
+  import type { LinkTarget } from '../content/manifest.js';
+  import { formatCairnToken } from '../content/links.js';
+
+  interface Props {
+    /** The site's link targets, from the committed manifest (editLoad ships them). */
+    linkTargets: LinkTarget[];
+    /** Insert an inline cairn link at the editor cursor. */
+    insert: (href: string, title: string) => void;
+  }
+
+  let { linkTargets, insert }: Props = $props();
+
+  let dialog = $state<HTMLDialogElement | null>(null);
+  let query = $state('');
+
+  // Group filtered targets by concept, Pages first then Posts then any other concept, so the list
+  // reads in a stable order. The filter is a case-insensitive title substring.
+  const ORDER: Record<string, number> = { pages: 0, posts: 1 };
+  function rank(concept: string): number {
+    return ORDER[concept] ?? 2;
+  }
+  function heading(concept: string): string {
+    if (concept === 'pages') return 'Pages';
+    if (concept === 'posts') return 'Posts';
+    return concept.charAt(0).toUpperCase() + concept.slice(1);
+  }
+
+  const groups = $derived.by(() => {
+    const q = query.trim().toLowerCase();
+    const matched = q ? linkTargets.filter((t) => t.title.toLowerCase().includes(q)) : linkTargets;
+    const byConcept = new Map<string, LinkTarget[]>();
+    for (const t of matched) {
+      const list = byConcept.get(t.concept) ?? [];
+      list.push(t);
+      byConcept.set(t.concept, list);
+    }
+    return [...byConcept.entries()]
+      .map(([concept, items]) => ({ concept, heading: heading(concept), items }))
+      .sort((a, b) => rank(a.concept) - rank(b.concept) || a.heading.localeCompare(b.heading));
+  });
+
+  function open() {
+    query = '';
+    dialog?.showModal();
+  }
+  function close() {
+    dialog?.close();
+  }
+  function choose(target: LinkTarget) {
+    insert(formatCairnToken(target), target.title);
+    close();
+  }
+</script>
+
+<button type="button" class="btn btn-sm btn-ghost" aria-haspopup="dialog" aria-label="Link to page" onclick={open}>
+  Link to page
+</button>
+
+<dialog class="modal" aria-labelledby="cairn-link-dialog-title" bind:this={dialog}>
+  <div class="modal-box">
+    <div class="mb-3 flex items-center justify-between">
+      <h2 id="cairn-link-dialog-title" class="text-base font-semibold">Link to a page</h2>
+      <button type="button" class="btn btn-ghost btn-sm" aria-label="Close" onclick={close}>✕</button>
+    </div>
+
+    <input
+      type="search"
+      class="input input-bordered mb-3 w-full"
+      placeholder="Search by title"
+      aria-label="Search pages and posts"
+      bind:value={query}
+    />
+
+    {#if groups.length === 0}
+      <p class="text-sm text-[var(--color-muted)]">No pages or posts to link to.</p>
+    {:else}
+      {#each groups as group (group.concept)}
+        <h3 class="mt-2 mb-1 text-xs font-semibold tracking-wide text-[var(--color-muted)] uppercase">{group.heading}</h3>
+        <ul class="menu w-full">
+          {#each group.items as target (`${target.concept}/${target.id}`)}
+            <li>
+              <button type="button" onclick={() => choose(target)}>
+                <span class="flex flex-col items-start">
+                  <span class="font-medium">{target.title}</span>
+                  <span class="text-xs text-[var(--color-muted)]">
+                    {#if target.draft}<span class="badge badge-ghost badge-sm mr-1">Draft</span>{/if}
+                    {#if target.date}{target.date}{/if}
+                  </span>
+                </span>
+              </button>
+            </li>
+          {/each}
+        </ul>
+      {/each}
+    {/if}
+  </div>
+  <form method="dialog" class="modal-backdrop">
+    <button tabindex="-1" aria-label="Close">close</button>
+  </form>
+</dialog>