@glw907/cairn-cms 0.18.0 → 0.24.0

package/src/lib/components/MarkdownEditor.svelte

@@ -9,7 +9,7 @@ preview lives in EditPage through the adapter's render. Swapping the editor stay
 <script lang="ts">
   import { onMount, onDestroy } from 'svelte';
   import EditorToolbar from './EditorToolbar.svelte';
-  import { applyMarkdownFormat, type FormatKind } from './markdown-format.js';
+  import { applyMarkdownFormat, insertInlineLink, type FormatKind } from './markdown-format.js';
 
   interface Props {
     /** The markdown source; bindable so the parent reads edits back. */
@@ -18,9 +18,14 @@ preview lives in EditPage through the adapter's render. Swapping the editor stay
     name: string;
     /** Receives a `(text) => void` that inserts at the cursor; the palette calls it. */
     registerInsert?: (insert: (text: string) => void) => void;
+    /** Receives a `(href, title) => void` that inserts an inline link; the link picker calls it. */
+    registerInsertLink?: (insert: (href: string, title: string) => void) => void;
+    /** Generic CodeMirror completion sources wired into the editor; the link autocomplete is one. The
+     *  type is referenced inline so no static `@codemirror/*` import sits in this client-only file. */
+    completionSources?: import('@codemirror/autocomplete').CompletionSource[];
   }
 
-  let { value = $bindable(), name, registerInsert }: Props = $props();
+  let { value = $bindable(), name, registerInsert, registerInsertLink, completionSources = [] }: Props = $props();
 
   let host = $state<HTMLDivElement | null>(null);
   let mounted = $state(false);
@@ -35,6 +40,7 @@ preview lives in EditPage through the adapter's render. Swapping the editor stay
     const markdownMod = await import('@codemirror/lang-markdown');
     const commandsMod = await import('@codemirror/commands');
     const languageMod = await import('@codemirror/language');
+    const autocompleteMod = await import('@codemirror/autocomplete');
 
     if (!host) return;
 
@@ -56,8 +62,13 @@ preview lives in EditPage through the adapter's render. Swapping the editor stay
         doc: value,
         extensions: [
           commandsMod.history(),
-          keymap.of([...commandsMod.defaultKeymap, ...commandsMod.historyKeymap]),
+          keymap.of([...autocompleteMod.completionKeymap, ...commandsMod.defaultKeymap, ...commandsMod.historyKeymap]),
           markdownMod.markdown(),
+          ...(completionSources.length
+            ? // interactionDelay 0: the popup opens only on an explicit `[[` trigger, so the default
+              // accidental-accept guard adds no value and would swallow an immediate Enter into a newline.
+              [autocompleteMod.autocompletion({ override: completionSources, interactionDelay: 0 })]
+            : []),
           EditorView.lineWrapping,
           languageMod.syntaxHighlighting(languageMod.defaultHighlightStyle, { fallback: true }),
           theme,
@@ -69,6 +80,7 @@ preview lives in EditPage through the adapter's render. Swapping the editor stay
     });
 
     registerInsert?.(insertAtCursor);
+    registerInsertLink?.(insertLink);
     mounted = true;
   });
 
@@ -96,6 +108,24 @@ preview lives in EditPage through the adapter's render. Swapping the editor stay
     view.focus();
   }
 
+  function insertLink(href: string, title: string) {
+    if (!view) {
+      // The editor has not mounted yet; append the link to the raw value so a pick is never lost,
+      // mirroring insertAtCursor's pre-mount fallback.
+      const link = insertInlineLink('', 0, 0, href, title).doc;
+      value = value ? `${value} ${link}` : link;
+      return;
+    }
+    const { from, to } = view.state.selection.main;
+    const doc = view.state.doc.toString();
+    const next = insertInlineLink(doc, from, to, href, title);
+    view.dispatch({
+      changes: { from: 0, to: doc.length, insert: next.doc },
+      selection: { anchor: next.from, head: next.to },
+    });
+    view.focus();
+  }
+
   function applyFormat(kind: FormatKind) {
     if (!view) return;
     const { from, to } = view.state.selection.main;

package/src/lib/components/RenameDialog.svelte

@@ -0,0 +1,72 @@
+<!--
+@component
+The Change URL control and its modal. The author edits the URL slug; on submit the ?/rename action
+moves the entry and rewrites every inbound cairn link in one commit, so no internal link breaks. A
+dated post keeps its date; only the slug changes. Built on a native <dialog>, following the
+DeleteDialog a11y conventions.
+-->
+<script lang="ts">
+  interface Props {
+    /** The concept this entry belongs to, e.g. "posts". Posted with the confirm. */
+    conceptId: string;
+    /** The entry id within its concept. Posted with the confirm. */
+    id: string;
+    /** A human label for the concept, e.g. "Post", used in the prompts. */
+    label: string;
+    /** The current slug, prefilled into the input. */
+    slug: string;
+  }
+
+  let { conceptId, id, label, slug }: Props = $props();
+
+  let dialog = $state<HTMLDialogElement | null>(null);
+  let slugInput = $state<HTMLInputElement | null>(null);
+  // Seeded on open() rather than from the prop at declaration, so the input prefills with the
+  // current slug each time the dialog opens without capturing only the initial prop value.
+  let nextSlug = $state('');
+
+  function open() {
+    nextSlug = slug;
+    dialog?.showModal();
+    // showModal() lands focus on the first focusable element (the header Close button), so move
+    // it to the slug input the dialog exists for, and select the prefill so the author can replace
+    // it in one keystroke (WCAG 2.4.3). A microtask defers past the dialog's own focus handling.
+    queueMicrotask(() => {
+      slugInput?.focus();
+      slugInput?.select();
+    });
+  }
+  function close() {
+    dialog?.close();
+  }
+</script>
+
+<button type="button" class="btn btn-sm btn-ghost" aria-haspopup="dialog" onclick={open}>Change URL</button>
+
+<dialog class="modal" aria-labelledby="cairn-rename-dialog-title" bind:this={dialog}>
+  <div class="modal-box">
+    <div class="mb-3 flex items-center justify-between">
+      <h2 id="cairn-rename-dialog-title" class="text-base font-semibold">Change this {label.toLowerCase()} URL</h2>
+      <button type="button" class="btn btn-ghost btn-sm" aria-label="Close" onclick={close}>✕</button>
+    </div>
+    <form method="POST" action="?/rename" class="flex flex-col gap-3">
+      <input type="hidden" name="concept" value={conceptId} />
+      <input type="hidden" name="id" value={id} />
+      <label class="flex flex-col gap-1">
+        <span class="text-sm font-medium">URL slug</span>
+        <input class="input" name="slug" bind:value={nextSlug} bind:this={slugInput} autocomplete="off" />
+      </label>
+      <p class="text-xs text-[var(--color-muted)]">
+        Links from other pages update automatically, so nothing breaks. The new URL slug will be
+        <code class="text-xs">{nextSlug}</code>.
+      </p>
+      <div class="flex justify-end gap-2">
+        <button type="button" class="btn btn-sm" onclick={close}>Cancel</button>
+        <button type="submit" class="btn btn-sm btn-primary">Change URL</button>
+      </div>
+    </form>
+  </div>
+  <form method="dialog" class="modal-backdrop">
+    <button tabindex="-1" aria-label="Close">close</button>
+  </form>
+</dialog>

package/src/lib/components/index.ts

@@ -11,3 +11,6 @@ export { default as ComponentInsertDialog } from './ComponentInsertDialog.svelte
 export { default as ComponentForm } from './ComponentForm.svelte';
 export { default as IconPicker } from './IconPicker.svelte';
 export { default as NavTree } from './NavTree.svelte';
+export { default as LinkPicker } from './LinkPicker.svelte';
+export { default as DeleteDialog } from './DeleteDialog.svelte';
+export { default as RenameDialog } from './RenameDialog.svelte';

package/src/lib/components/link-completion.ts

@@ -0,0 +1,57 @@
+// cairn-cms: the [[ link autocomplete (content-graph design). The matcher and the completion
+// builder are pure so they unit-test without a DOM; cairnLinkCompletionSource is a thin adapter
+// to CodeMirror's CompletionSource. The editor wires the source through a generic completionSources
+// prop, so this stays the only link-aware piece and the seam itself knows nothing about links.
+import type { Completion, CompletionContext, CompletionResult, CompletionSource } from '@codemirror/autocomplete';
+import { syntaxTree } from '@codemirror/language';
+import type { LinkTarget } from '../content/manifest.js';
+import { formatCairnToken, escapeLinkText } from '../content/links.js';
+
+/** The known concepts in display order; an unlisted concept sorts after these under its own name. */
+const CONCEPT_SECTIONS: Record<string, { name: string; rank: number }> = {
+  pages: { name: 'Pages', rank: 0 },
+  posts: { name: 'Posts', rank: 1 },
+};
+
+function sectionFor(concept: string): { name: string; rank: number } {
+  return CONCEPT_SECTIONS[concept] ?? { name: concept.charAt(0).toUpperCase() + concept.slice(1), rank: 2 };
+}
+
+/** The open `[[query` before the cursor, or null. The query stops at a closing bracket or a newline,
+ *  so a finished `[[x]]` link and ordinary prose never trigger. `from` is the index of the `[[`. */
+export function matchCairnTrigger(before: string): { query: string; from: number } | null {
+  const match = /\[\[([^[\]\n]*)$/.exec(before);
+  return match ? { query: match[1], from: match.index } : null;
+}
+
+/** The completion options for a query: a case-insensitive title substring match, each option grouped
+ *  by concept, a draft marked and a post date shown in the detail, and the apply text the full link. */
+export function linkCompletions(targets: LinkTarget[], query: string): Completion[] {
+  const q = query.trim().toLowerCase();
+  const matched = q ? targets.filter((t) => t.title.toLowerCase().includes(q)) : targets;
+  return matched.map((t) => ({
+    label: t.title,
+    section: sectionFor(t.concept),
+    detail: t.draft ? 'Draft' : t.date,
+    apply: `[${escapeLinkText(t.title)}](${formatCairnToken(t)})`,
+  }));
+}
+
+/** A CodeMirror CompletionSource over the site's link targets, triggered by `[[`. It replaces the
+ *  whole `[[query` with the chosen link, and sets filter:false because linkCompletions already
+ *  filtered by the query (CodeMirror would otherwise re-filter against the literal `[[query`). */
+export function cairnLinkCompletionSource(targets: LinkTarget[]): CompletionSource {
+  return (context: CompletionContext): CompletionResult | null => {
+    const line = context.state.doc.lineAt(context.pos);
+    const before = context.state.sliceDoc(line.from, context.pos);
+    const trigger = matchCairnTrigger(before);
+    if (!trigger) return null;
+    // Skip a [[ inside a fenced or inline code node: a cairn link there would be literal text, and
+    // the build resolver does not look inside code. The node name carries "Code" for both forms.
+    const node = syntaxTree(context.state).resolveInner(context.pos, -1);
+    for (let n: typeof node | null = node; n; n = n.parent) {
+      if (/Code/.test(n.name)) return null;
+    }
+    return { from: line.from + trigger.from, options: linkCompletions(targets, trigger.query), filter: false };
+  };
+}

package/src/lib/components/markdown-format.ts

@@ -3,6 +3,13 @@
  * selection range to a new document and a new selection, with no DOM. The MarkdownEditor view
  * dispatches the result; keeping the logic here lets it unit-test without a browser.
  */
+import { unified } from 'unified';
+import remarkParse from 'remark-parse';
+import remarkGfm from 'remark-gfm';
+import { visit } from 'unist-util-visit';
+import type { Link } from 'mdast';
+import { escapeLinkText } from '../content/links.js';
+
 export type FormatKind = 'bold' | 'italic' | 'code' | 'heading' | 'quote' | 'ul' | 'link';
 
 export interface FormatResult {
@@ -37,3 +44,78 @@ export function applyMarkdownFormat(doc: string, from: number, to: number, kind:
   const added = prefixed.length - region.length;
   return { doc: doc.slice(0, lineStart) + prefixed + doc.slice(to), from: from + prefix.length, to: to + added };
 }
+
+/**
+ * Insert an inline markdown link at the selection. With a non-empty selection the selected text
+ * becomes the display text; with an empty selection the title is the display text. The cursor
+ * collapses just after the inserted link. Unlike the block insert, this adds no surrounding
+ * blank lines, since a link is inline. Pure, so the editor dispatches the result.
+ */
+export function insertInlineLink(doc: string, from: number, to: number, href: string, title: string): FormatResult {
+  const text = from < to ? doc.slice(from, to) : escapeLinkText(title);
+  const inserted = `[${text}](${href})`;
+  const end = from + inserted.length;
+  return { doc: doc.slice(0, from) + inserted + doc.slice(to), from: end, to: end };
+}
+
+/** Concatenate a link node's text-child values. The parser has already unescaped them, so a source
+ *  `Notes \[draft\]` yields `Notes [draft]`. Used instead of mdast-util-to-string, which is not a
+ *  direct dependency. Non-text children (a nested emphasis, say) contribute no value, which is fine
+ *  for the picker-produced links this fix targets. */
+function linkText(node: Link): string {
+  return node.children.map((c) => ('value' in c ? c.value : '')).join('');
+}
+
+/**
+ * Unwrap every cairn: link whose href is exactly `href`, replacing it with its plain display text.
+ * The save guard's one-click fix calls this to drop a broken link while keeping the words. The
+ * document is parsed with the same remark pipeline extractCairnLinks uses, so the two agree on what
+ * a link is. Each matching link node is located by its source offsets and spliced out from last to
+ * first, which leaves the rest of the document exact and unescapes the display text. A token inside
+ * a code span or fence is not a link node, so it is never touched, and a link with a different url
+ * is left in place.
+ */
+export function unwrapCairnLink(doc: string, href: string): string {
+  const tree = unified().use(remarkParse).use(remarkGfm).parse(doc);
+  const spans: { start: number; end: number; text: string }[] = [];
+  visit(tree, 'link', (node: Link) => {
+    if (node.url !== href) return;
+    const start = node.position?.start?.offset;
+    const end = node.position?.end?.offset;
+    if (start == null || end == null) return;
+    spans.push({ start, end, text: linkText(node) });
+  });
+  spans.sort((a, b) => b.start - a.start);
+  let out = doc;
+  for (const span of spans) {
+    out = out.slice(0, span.start) + span.text + out.slice(span.end);
+  }
+  return out;
+}
+
+/**
+ * Rewrite every cairn: link whose href is exactly `oldHref` so its href becomes `newHref`, keeping
+ * the display text and any link title byte-for-byte. Rename calls this to repoint a renamed entry's
+ * inbound tokens. Parsed with the same remark pipeline as extractCairnLinks, so a token inside a code
+ * span is not a link node and is never touched. Each matching node's source span is rewritten from
+ * last to first, replacing only the `](oldHref` run so the label and title stay exact.
+ */
+export function rewriteCairnLink(doc: string, oldHref: string, newHref: string): string {
+  const tree = unified().use(remarkParse).use(remarkGfm).parse(doc);
+  const spans: { start: number; end: number }[] = [];
+  visit(tree, 'link', (node: Link) => {
+    if (node.url !== oldHref) return;
+    const start = node.position?.start?.offset;
+    const end = node.position?.end?.offset;
+    if (start == null || end == null) return;
+    spans.push({ start, end });
+  });
+  spans.sort((a, b) => b.start - a.start);
+  let out = doc;
+  for (const span of spans) {
+    const src = out.slice(span.start, span.end);
+    const rewritten = src.replace(`](${oldHref}`, `](${newHref}`);
+    out = out.slice(0, span.start) + rewritten + out.slice(span.end);
+  }
+  return out;
+}

package/src/lib/content/concepts.ts

@@ -43,6 +43,14 @@ export function normalizeConcepts(
   const descriptors: ConceptDescriptor[] = [];
   for (const [id, config] of Object.entries(content)) {
     if (!config) continue;
+    const summaryFields = config.summaryFields ?? [];
+    const declared = new Set(config.schema.fields.map((field) => field.name));
+    const undeclared = summaryFields.find((key) => !declared.has(key));
+    if (undeclared !== undefined) {
+      throw new Error(
+        `cairn: concept "${id}" summaryFields key "${undeclared}" is not a declared field`,
+      );
+    }
     const policy = urlPolicy[id] ?? {};
     descriptors.push({
       id,
@@ -52,6 +60,7 @@ export function normalizeConcepts(
       permalink: policy.permalink ?? defaultPermalink(id),
       datePrefix: policy.datePrefix ?? 'day',
       fields: config.schema.fields,
+      summaryFields,
       validate: config.schema.validate,
     });
   }

package/src/lib/content/frontmatter.ts

@@ -56,6 +56,27 @@ export function dateInputValue(value: unknown): string {
   return '';
 }
 
+/**
+ * True when `s` is a canonical zero-padded `YYYY-MM-DD` string naming a real calendar date.
+ * Rejects a wrong format, an impossible month or day, and a JS date-rollover such as
+ * `2026-02-30` (which `Date` would silently roll forward to March 2). The committed form a
+ * date field carries is exactly this canonical shape, which is what the form and
+ * `dateInputValue` emit, so a value outside it is a hand-edit or odd-YAML error.
+ */
+export function isCalendarDate(s: string): boolean {
+  const match = /^(\d{4})-(\d{2})-(\d{2})$/.exec(s);
+  if (!match) return false;
+  const year = Number(match[1]);
+  const month = Number(match[2]);
+  const day = Number(match[3]);
+  const date = new Date(Date.UTC(year, month - 1, day));
+  return (
+    date.getUTCFullYear() === year &&
+    date.getUTCMonth() === month - 1 &&
+    date.getUTCDate() === day
+  );
+}
+
 /** Reassemble a markdown file from frontmatter and body for committing. */
 export function serializeMarkdown(frontmatter: object, body: string): string {
   return matter.stringify(body, frontmatter);

package/src/lib/content/ids.ts

@@ -80,3 +80,15 @@ export function composeDatedId(date: string, slug: string, datePrefix: DatePrefi
   }
   return `${prefix}-${slug}`;
 }
+
+/**
+ * Rename an id by swapping its slug, keeping any date prefix. slugFromId strips only the leading
+ * date prefix, so the id is exactly its prefix followed by its slug; this replaces the slug suffix
+ * with newSlug. A non-dated concept passes null, so the whole id is the slug and the id becomes
+ * newSlug. The caller validates newSlug with isValidId first.
+ */
+export function renameId(oldId: string, newSlug: string, datePrefix: DatePrefix | null): string {
+  const oldSlug = slugFromId(oldId, datePrefix);
+  const prefix = oldId.slice(0, oldId.length - oldSlug.length);
+  return prefix + newSlug;
+}

package/src/lib/content/links.ts

@@ -30,6 +30,19 @@ export function parseCairnToken(href: string): CairnRef | null {
   return { concept, id };
 }
 
+/** Write the `cairn:<concept>/<id>` token for a ref. The inverse of parseCairnToken, so the editor
+ *  link picker and the autocomplete write exactly the form the resolver reads back. */
+export function formatCairnToken(ref: CairnRef): string {
+  return `cairn:${ref.concept}/${ref.id}`;
+}
+
+/** Escape the characters that would break a markdown link's display text: a backslash and the
+ *  square brackets that delimit the text. Used where a content title becomes link display text,
+ *  so an unbalanced bracket in a title cannot truncate the generated link. */
+export function escapeLinkText(text: string): string {
+  return text.replace(/[\\[\]]/g, (ch) => `\\${ch}`);
+}
+
 /** The cairn links a markdown body points at, in first-occurrence order, deduped by concept/id.
  *  Parses the body as mdast, so a token inside a code span or fence is never matched. */
 export function extractCairnLinks(body: string): CairnRef[] {

package/src/lib/content/manifest.ts

@@ -97,13 +97,47 @@ export function serializeManifest(manifest: Manifest): string {
   return `${JSON.stringify({ version: 1, entries }, null, 2)}\n`;
 }
 
-/** Parse a committed manifest. Throws on malformed JSON or the wrong shape. */
+/** Parse a committed manifest. Throws on malformed JSON, a wrong version, or a malformed entry, so
+ *  every reader (the save guard, the delete path, the preview) sees a well-formed graph or a clear
+ *  error. The build regenerates the manifest, so a real file is always canonical; this guards a
+ *  hand-edited or truncated one. */
 export function parseManifest(raw: string): Manifest {
   const data = JSON.parse(raw) as unknown;
-  if (!data || typeof data !== 'object' || !Array.isArray((data as { entries?: unknown }).entries)) {
+  if (!data || typeof data !== 'object') {
     throw new Error('content manifest: malformed file, expected { version, entries: [] }');
   }
-  return { version: 1, entries: (data as Manifest).entries };
+  const obj = data as { version?: unknown; entries?: unknown };
+  if (obj.version !== 1) {
+    throw new Error(`content manifest: unsupported version ${String(obj.version)}, expected 1`);
+  }
+  if (!Array.isArray(obj.entries)) {
+    throw new Error('content manifest: malformed file, expected { version, entries: [] }');
+  }
+  for (const entry of obj.entries) {
+    const e = entry as Record<string, unknown>;
+    const ok =
+      e &&
+      typeof e.id === 'string' &&
+      typeof e.concept === 'string' &&
+      typeof e.title === 'string' &&
+      typeof e.permalink === 'string' &&
+      typeof e.draft === 'boolean' &&
+      (e.date === undefined || typeof e.date === 'string') &&
+      Array.isArray(e.links);
+    if (!ok) {
+      throw new Error(`content manifest: malformed entry ${JSON.stringify(e)}`);
+    }
+    // Validate each link element's shape, not just that links is an array. inboundLinks and the
+    // delete guard read l.concept and l.id, so a string, null, or id-less element would read as
+    // undefined and silently drop a real inbound linker. Reject it here instead.
+    for (const link of e.links as unknown[]) {
+      const l = link as Record<string, unknown> | null;
+      if (!l || typeof l !== 'object' || typeof l.concept !== 'string' || typeof l.id !== 'string') {
+        throw new Error(`content manifest: malformed link ${JSON.stringify(link)} in entry ${JSON.stringify(e)}`);
+      }
+    }
+  }
+  return { version: 1, entries: obj.entries as ManifestEntry[] };
 }
 
 /** Throw if the committed manifest drifts from what the corpus says. Both sides are compared in the
@@ -130,6 +164,24 @@ export function removeEntry(manifest: Manifest, concept: string, id: string): Ma
   return { version: 1, entries: manifest.entries.filter((e) => !(e.concept === concept && e.id === id)) };
 }
 
+/** One inbound linker: enough to name it and link to its edit page in the delete guard. */
+export interface InboundLink {
+  concept: string;
+  id: string;
+  title: string;
+  permalink: string;
+}
+
+/** Every entry whose outbound edges point at the target, excluding the target itself. The delete
+ *  guard reads this to name "what links here"; the backlinks panel will reuse it. Pure over the
+ *  manifest, so the request-time delete path and a unit test call it the same way. */
+export function inboundLinks(manifest: Manifest, concept: string, id: string): InboundLink[] {
+  return manifest.entries
+    .filter((e) => !(e.concept === concept && e.id === id))
+    .filter((e) => e.links.some((l) => l.concept === concept && l.id === id))
+    .map((e) => ({ concept: e.concept, id: e.id, title: e.title, permalink: e.permalink }));
+}
+
 /** A resolver backed by manifest targets, for the admin preview. A miss returns undefined, so the
  *  render step marks the link broken rather than throwing. The build resolver throws instead. */
 export function manifestLinkResolver(targets: { concept: string; id: string; permalink: string }[]): LinkResolve {

package/src/lib/content/types.ts

@@ -110,6 +110,9 @@ export interface ConceptConfig<S extends ConceptSchema = ConceptSchema> {
   label?: string;
   /** The concept's schema: the form projection, the generated validator, and the inferred type. */
   schema: S;
+  /** Frontmatter keys to surface on each `ContentSummary.fields`, so a list card reads an authored
+   *  field without a per-entry detail read. Each key should also be declared in `schema`. */
+  summaryFields?: string[];
 }
 
 /**
@@ -215,6 +218,9 @@ export interface ConceptDescriptor {
   /** Filename date-prefix granularity for a dated concept; resolved by `normalizeConcepts`. */
   datePrefix: DatePrefix;
   fields: FrontmatterField[];
+  /** Frontmatter keys the index copies onto each summary's `fields` record. `normalizeConcepts`
+   *  resolves it to `[]` when a concept omits `summaryFields`. */
+  summaryFields: string[];
   validate(frontmatter: Record<string, unknown>, body: string): ValidationResult;
 }
 

package/src/lib/content/validate.ts

@@ -3,7 +3,7 @@
 // validator stays thin (engine-fat rule). Saving runs the concept's validator on the
 // server before any commit; invalid input bounces to the form (spec §7.4).
 import type { FrontmatterField, ValidationResult } from './types.js';
-import { dateInputValue } from './frontmatter.js';
+import { dateInputValue, isCalendarDate } from './frontmatter.js';
 
 /**
  * Validate raw frontmatter against a field list. Required text and date fields must be
@@ -34,12 +34,17 @@ export function validateFields(
       case 'freetags': {
         const list = Array.isArray(value) ? value.map(String) : [];
         if (field.required && list.length === 0) errors[field.name] = `${field.label} is required`;
+        else if (field.type === 'tags') {
+          const unknown = list.find((tag) => !field.options.includes(tag));
+          if (unknown !== undefined) errors[field.name] = `${field.label} contains an unknown value: ${unknown}`;
+        }
         if (list.length > 0) data[field.name] = list;
         break;
       }
       case 'date': {
         const text = value instanceof Date ? dateInputValue(value) : typeof value === 'string' ? value.trim() : '';
         if (field.required && text === '') errors[field.name] = `${field.label} is required`;
+        else if (text !== '' && !isCalendarDate(text)) errors[field.name] = `${field.label} must be a valid date (YYYY-MM-DD)`;
         if (text !== '') data[field.name] = text;
         break;
       }

package/src/lib/delivery/content-index.ts

@@ -16,6 +16,9 @@ export interface RawFile {
 
 /** The cheap, plain-data view of one entry, for lists, feeds, and the sitemap. */
 export interface ContentSummary {
+  /** The descriptor id this entry belongs to, e.g. "posts". Lets a list or page branch per
+   *  concept without re-deriving it from a proxy like `entry.date`. */
+  concept: string;
   id: string;
   slug: string;
   permalink: string;
@@ -26,6 +29,10 @@ export interface ContentSummary {
   excerpt: string;
   wordCount: number;
   draft: boolean;
+  /** The frontmatter keys the descriptor nominated via `summaryFields`, read off the validated,
+   *  normalized frontmatter. Held in a separate record so a nominated key cannot collide with a
+   *  typed summary field. Empty when the concept declares no `summaryFields`. */
+  fields: Record<string, unknown>;
 }
 
 /** The detail view: a summary plus the frontmatter and the body to render. The frontmatter
@@ -98,7 +105,12 @@ export function createContentIndex<F = Record<string, unknown>>(
       problems.push({ id, draft, errors: result.errors });
       continue;
     }
+    const summaryFieldValues: Record<string, unknown> = {};
+    for (const key of descriptor.summaryFields) {
+      if (key in result.data) summaryFieldValues[key] = result.data[key];
+    }
     entries.push({
+      concept: descriptor.id,
       id,
       slug,
       permalink: permalink(descriptor, { id, slug, date }),
@@ -109,6 +121,7 @@ export function createContentIndex<F = Record<string, unknown>>(
       excerpt: deriveExcerpt(body, { description: asString(raw.description) }),
       wordCount: wordCount(body),
       draft,
+      fields: summaryFieldValues,
       frontmatter: result.data as F,
       body,
     });

package/src/lib/delivery/head.ts

@@ -0,0 +1,4 @@
+// cairn-cms: the delivery head component entry (@glw907/cairn-cms/delivery/head). CairnHead lives
+// behind its own export so importing a delivery data helper from /delivery never pulls a .svelte
+// module into the graph. A node-environment data import then needs no Svelte plugin.
+export { default as CairnHead } from './CairnHead.svelte';

package/src/lib/delivery/index.ts

@@ -34,4 +34,3 @@ export type {
   TagIndexData,
   EntryData,
 } from '../sveltekit/public-routes.js';
-export { default as CairnHead } from './CairnHead.svelte';

package/src/lib/delivery/manifest.ts

@@ -5,6 +5,7 @@
 // the build (the backstop). The admin preview uses manifestLinkResolver instead.
 import { siteDescriptors } from './site-descriptors.js';
 import { fromGlob } from './content-index.js';
+import { parseMarkdown } from '../content/frontmatter.js';
 import { emptyManifest, manifestEntryFromFile } from '../content/manifest.js';
 import type { Manifest } from '../content/manifest.js';
 import type { LinkResolve } from '../content/links.js';
@@ -21,6 +22,11 @@ export function buildSiteManifest<A extends CairnAdapter>(adapter: A, config: Si
   for (const descriptor of siteDescriptors(adapter, config)) {
     const record = globRecord[descriptor.id] ?? {};
     for (const file of fromGlob(record)) {
+      // Validate the same way createContentIndex does, so the manifest and the site index agree on
+      // which entries exist. A validation failure is excluded from both; otherwise the preview would
+      // resolve a link the build then rejects as a missing target.
+      const { frontmatter, body } = parseMarkdown(file.raw);
+      if (!descriptor.validate(frontmatter, body).ok) continue;
       manifest.entries.push(manifestEntryFromFile(descriptor, file));
     }
   }

package/src/lib/github/repo.ts

@@ -216,7 +216,14 @@ export async function commitFiles(
       headers: { ...ghHeaders('application/vnd.github+json', token), 'Content-Type': 'application/json' },
       body: JSON.stringify({ base_tree: baseTree, tree }),
     });
-    if (!treeRes.ok) throw new Error(`GitHub tree create failed: ${treeRes.status} ${await treeRes.text()}`);
+    if (!treeRes.ok) {
+      // A 422 means an entry is unprocessable against the base tree, which a delete of an
+      // already-removed path produces (a concurrent delete or rename got there first). Treat it as
+      // the same non-fast-forward conflict the ref PATCH surfaces, so the caller fails safe with the
+      // reload-and-retry path instead of a raw 500.
+      if (treeRes.status === 422) throw new CommitConflictError(`${repo.branch} (tree create)`);
+      throw new Error(`GitHub tree create failed: ${treeRes.status} ${await treeRes.text()}`);
+    }
     const newTree = ((await treeRes.json()) as { sha: string }).sha;
 
     const commitRes = await fetch(gitUrl(repo, 'commits'), {

package/src/lib/index.ts

@@ -52,7 +52,7 @@ export type { DatePrefix } from './content/ids.js';
 // Internal-link token and the committed content manifest (content-graph design). The corpus
 // builder and the request-time resolver ship from the delivery entry; this surface is the
 // grammar, the manifest operations, and their types a migrating site adopts.
-export { parseCairnToken, extractCairnLinks } from './content/links.js';
+export { parseCairnToken, extractCairnLinks, formatCairnToken, escapeLinkText } from './content/links.js';
 export type { CairnRef, LinkResolve } from './content/links.js';
 export {
   serializeManifest,
@@ -63,8 +63,9 @@ export {
   removeEntry,
   manifestEntryFromFile,
   manifestLinkResolver,
+  inboundLinks,
 } from './content/manifest.js';
-export type { Manifest, ManifestEntry, LinkTarget } from './content/manifest.js';
+export type { Manifest, ManifestEntry, LinkTarget, InboundLink } from './content/manifest.js';
 // Render engine (Plan 04): generic directive pipeline; sites own the component registry.
 export { defineRegistry, emptyValues } from './render/registry.js';
 export type {
@@ -91,6 +92,7 @@ export {
   strProp,
   iconSpan,
   cardShell,
+  headRow,
   markFirstList,
 } from './render/rehype-dispatch.js';
 export type { MakeIcon } from './render/rehype-dispatch.js';
@@ -154,3 +156,9 @@ export { readSeoFields, resolveImageUrl } from './delivery/seo-fields.js';
 export type { SeoFields } from './delivery/seo-fields.js';
 export { paginate } from './delivery/paginate.js';
 export type { Page } from './delivery/paginate.js';
+// Root superset of the delivery route surface: a wrong guess from root for a route loader or a
+// response helper now resolves. The CairnHead component stays out of root so the root barrel stays
+// node-importable for the unit suite; it resolves from @glw907/cairn-cms/delivery/head.
+export { rssResponse, jsonFeedResponse, sitemapResponse, robotsResponse } from './delivery/responses.js';
+export { createPublicRoutes } from './sveltekit/public-routes.js';
+export type { PublicRoutesDeps, ListData, TagData, TagIndexData, EntryData } from './sveltekit/public-routes.js';