@glw907/cairn-cms 0.26.0 → 0.33.0

package/src/lib/content/manifest.ts

@@ -3,9 +3,8 @@
 // code reads the content graph without an N+1 GitHub crawl. The build regenerates and verifies
 // it; the save path patches one entry and commits it with the content in one commit. Each entry
 // carries its identity and its outbound cairn: edges, so the manifest is the link graph.
-import { idFromFilename, slugFromId } from './ids.js';
 import { parseMarkdown } from './frontmatter.js';
-import { permalink } from './permalink.js';
+import { entryIdentity, asString } from './identity.js';
 import { extractCairnLinks, type CairnRef, type LinkResolve } from './links.js';
 import type { ConceptDescriptor } from './types.js';
 
@@ -36,38 +35,18 @@ export interface LinkTarget {
   draft: boolean;
 }
 
-function basename(path: string): string {
-  const slash = path.lastIndexOf('/');
-  return slash >= 0 ? path.slice(slash + 1) : path;
-}
-
-/** Mirror content-index's frontmatter coercion: a present non-empty string, else undefined. */
-function asString(value: unknown): string | undefined {
-  return typeof value === 'string' && value.trim() ? value : undefined;
-}
-
-/** Mirror content-index's date coercion: an unquoted YAML date is a JS Date, a string is sliced. */
-function asDate(value: unknown): string | undefined {
-  if (value instanceof Date) return Number.isNaN(value.getTime()) ? undefined : value.toISOString().slice(0, 10);
-  if (typeof value === 'string') return value.match(/^\d{4}-\d{2}-\d{2}/)?.[0];
-  return undefined;
-}
-
-/** Build one manifest entry from a content file. Drafts are included and flagged. */
+/** Build one manifest entry from a content file. Drafts are included and flagged. The id, date, and
+ *  permalink come from entryIdentity, the same source content-index uses, so a cairn: link resolves to
+ *  one URL whether the admin preview reads the manifest or the public build reads the content index. */
 export function manifestEntryFromFile(descriptor: ConceptDescriptor, file: { path: string; raw: string }): ManifestEntry {
-  const id = idFromFilename(basename(file.path));
-  // Use the same slug rule content-index uses, so the manifest's permalink for an entry always
-  // equals content-index's permalink for it. A cairn link must resolve to one URL whether the
-  // admin preview reads the manifest or the public build reads the content index.
-  const slug = slugFromId(id, descriptor.routing.dated ? descriptor.datePrefix : null);
   const { frontmatter, body } = parseMarkdown(file.raw);
-  const date = asDate(frontmatter.date);
+  const { id, date, permalink } = entryIdentity(descriptor, file.path, frontmatter);
   return {
     id,
     concept: descriptor.id,
     title: asString(frontmatter.title) ?? id,
     date,
-    permalink: permalink(descriptor, { id, slug, date }),
+    permalink,
     draft: frontmatter.draft === true,
     links: extractCairnLinks(body),
   };

package/src/lib/delivery/content-index.ts

@@ -3,8 +3,7 @@
 // returns cheap plain-data summaries plus an on-demand detail lookup. It is concept-generic:
 // every operation reads the descriptor and its routing rule, never a hardcoded concept id.
 import { parseMarkdown } from '../content/frontmatter.js';
-import { idFromFilename, slugFromId } from '../content/ids.js';
-import { permalink } from '../content/permalink.js';
+import { entryId, entryIdentity, asDate, asString, asTags } from '../content/identity.js';
 import { deriveExcerpt, wordCount } from './excerpt.js';
 import type { ConceptDescriptor } from '../content/types.js';
 
@@ -70,25 +69,6 @@ export function fromGlob(record: Record<string, string>): RawFile[] {
   return Object.entries(record).map(([path, raw]) => ({ path, raw }));
 }
 
-function basename(path: string): string {
-  const slash = path.lastIndexOf('/');
-  return slash >= 0 ? path.slice(slash + 1) : path;
-}
-
-function asString(value: unknown): string | undefined {
-  return typeof value === 'string' && value.trim() ? value : undefined;
-}
-
-function asDate(value: unknown): string | undefined {
-  if (value instanceof Date) return Number.isNaN(value.getTime()) ? undefined : value.toISOString().slice(0, 10);
-  if (typeof value === 'string') return value.match(/^\d{4}-\d{2}-\d{2}/)?.[0];
-  return undefined;
-}
-
-function asTags(value: unknown): string[] {
-  return Array.isArray(value) ? value.map(String) : [];
-}
-
 /** Build a concept's index from its raw files and normalized descriptor. */
 export function createContentIndex<F = Record<string, unknown>>(
   files: RawFile[],
@@ -97,18 +77,19 @@ export function createContentIndex<F = Record<string, unknown>>(
   const problems: ContentProblem[] = [];
   const entries: ContentEntry<F>[] = [];
   for (const file of files) {
-    const id = idFromFilename(basename(file.path));
-    const slug = slugFromId(id, descriptor.routing.dated ? descriptor.datePrefix : null);
     const { frontmatter: raw, body } = parseMarkdown(file.raw);
-    const date = asDate(raw.date);
+    const id = entryId(file.path);
     const draft = raw.draft === true;
-    // Validate once at build. A failure is recorded for the site gate and excluded from the typed
-    // read, so every readable entry's frontmatter is the validator's normalized output, never raw.
+    // Validate before resolving the permalink. A date-token permalink throws on an entry with no
+    // valid date; the validate gate records that as a content problem rather than aborting the whole
+    // index build, so one bad entry degrades to a skip, not a crash. A failure is also excluded from
+    // the typed read, so every readable entry's frontmatter is the validator's normalized output.
     const result = descriptor.validate(raw, body);
     if (!result.ok) {
       problems.push({ id, draft, errors: result.errors });
       continue;
     }
+    const { slug, date, permalink } = entryIdentity(descriptor, file.path, raw);
     const summaryFieldValues: Record<string, unknown> = {};
     for (const key of descriptor.summaryFields) {
       if (key in result.data) summaryFieldValues[key] = result.data[key];
@@ -117,7 +98,7 @@ export function createContentIndex<F = Record<string, unknown>>(
       concept: descriptor.id,
       id,
       slug,
-      permalink: permalink(descriptor, { id, slug, date }),
+      permalink,
       title: asString(raw.title) ?? id,
       date,
       updated: asDate(raw.updated),

package/src/lib/delivery/site-descriptors.ts

@@ -1,12 +1,11 @@
-// cairn-cms: the one-call descriptor helper. A delivery site needs the same per-concept
-// descriptors the admin runtime uses; this wraps the two calls that derive them so the
-// pairing is not tribal knowledge. The YAML URL policy stays the single source of truth.
-import { normalizeConcepts } from '../content/concepts.js';
-import { urlPolicyFrom } from '../nav/site-config.js';
+// cairn-cms: the one-call descriptor helper. A delivery site needs the same per-concept descriptors
+// the admin runtime uses; this delegates to the shared resolveConcepts so the pairing is one path, not
+// tribal knowledge. The YAML URL policy stays the single source of truth.
+import { resolveConcepts } from '../content/concepts.js';
 import type { CairnAdapter, ConceptDescriptor } from '../content/types.js';
 import type { SiteConfig } from '../nav/site-config.js';
 
 /** Per-concept descriptors for a site, from its adapter content and its parsed site config. */
 export function siteDescriptors(adapter: CairnAdapter, siteConfig: SiteConfig): ConceptDescriptor[] {
-  return normalizeConcepts(adapter.content, urlPolicyFrom(siteConfig));
+  return resolveConcepts(adapter.content, siteConfig);
 }

package/src/lib/index.ts

@@ -88,34 +88,16 @@ export type { ReferenceOptions } from './render/component-reference.js';
 export { glyph } from './render/glyph.js';
 export type { IconSet } from './render/glyph.js';
 export { remarkDirectiveStamp } from './render/remark-directives.js';
-export {
-  rehypeDispatch,
-  isElement,
-  strProp,
-  iconSpan,
-  cardShell,
-  headRow,
-  markFirstList,
-} from './render/rehype-dispatch.js';
-export type { MakeIcon } from './render/rehype-dispatch.js';
+// The component-authoring helpers (iconSpan, cardShell, headRow, isElement, strAttr) live on the
+// @glw907/cairn-cms/render subpath, not the root barrel. rehypeDispatch is deliberately not public:
+// createRenderer is the one public render pipeline, so the safe plugin ordering is the only public
+// path. See docs/superpowers/specs/2026-06-05-cairn-render-authoring-surface-design.md.
 export { createRenderer } from './render/pipeline.js';
 export type { RendererOptions } from './render/pipeline.js';
 
 // GitHub read-and-commit backend (Plan 03).
 export type { RepoRef, RepoFile, CommitAuthor, AppCredentials } from './github/types.js';
 export { CommitConflictError } from './github/types.js';
-export { appJwt, installationToken, signingSelfTest } from './github/signing.js';
-export {
-  treeUrl,
-  markdownFilesIn,
-  listMarkdown,
-  contentsUrl,
-  readRaw,
-  fileSha,
-  commitFile,
-} from './github/repo.js';
-export { appCredentials } from './github/credentials.js';
-export type { GithubKeyEnv } from './github/credentials.js';
 
 // Nav tree and site-config helpers (Plan 06).
 export {
@@ -129,38 +111,3 @@ export {
   SiteConfigError,
 } from './nav/site-config.js';
 export type { NavNode, SiteConfig } from './nav/site-config.js';
-
-// Public content delivery (public-delivery design): the query index, syndication, and
-// discovery surface that sites read. Pure builders plus the one permalink resolver; the
-// SvelteKit loaders live under the /sveltekit subpath.
-export { permalink } from './content/permalink.js';
-export { createContentIndex, fromGlob } from './delivery/content-index.js';
-export type {
-  RawFile,
-  ContentSummary,
-  ContentEntry,
-  ContentIndex,
-  ContentProblem,
-} from './delivery/content-index.js';
-export { createSiteIndex } from './delivery/site-index.js';
-export type { SiteIndex, ConceptIndex } from './delivery/site-index.js';
-export { createSiteIndexes } from './delivery/site-indexes.js';
-export type { SiteIndexes, SiteGlobs } from './delivery/site-indexes.js';
-export { deriveExcerpt, wordCount } from './delivery/excerpt.js';
-export { buildRssFeed, buildJsonFeed } from './delivery/feeds.js';
-export type { FeedChannel, FeedItem } from './delivery/feeds.js';
-export { buildSitemap } from './delivery/sitemap.js';
-export type { SitemapUrl } from './delivery/sitemap.js';
-export { buildRobots } from './delivery/robots.js';
-export { buildSeoMeta } from './delivery/seo.js';
-export type { SeoInput, SeoMeta } from './delivery/seo.js';
-export { readSeoFields, resolveImageUrl } from './delivery/seo-fields.js';
-export type { SeoFields } from './delivery/seo-fields.js';
-export { paginate } from './delivery/paginate.js';
-export type { Page } from './delivery/paginate.js';
-// Root superset of the delivery route surface: a wrong guess from root for a route loader or a
-// response helper now resolves. The CairnHead component stays out of root so the root barrel stays
-// node-importable for the unit suite; it resolves from @glw907/cairn-cms/delivery/head.
-export { rssResponse, jsonFeedResponse, sitemapResponse, robotsResponse } from './delivery/responses.js';
-export { createPublicRoutes } from './sveltekit/public-routes.js';
-export type { PublicRoutesDeps, ListData, TagData, TagIndexData, EntryData } from './sveltekit/public-routes.js';

package/src/lib/render/authoring.ts

@@ -0,0 +1,7 @@
+// cairn-cms: the component-authoring toolkit (@glw907/cairn-cms/render). A site authoring components
+// through build(ctx) reaches for these hast builders and the string-attribute reader. Curated on
+// purpose: the internal hast helpers (strProp, markFirstList, dataAttrProp) stay internal, and
+// rehypeDispatch is deliberately omitted (createRenderer is the one public render pipeline).
+export { iconSpan, cardShell, headRow, isElement, strAttr } from './rehype-dispatch.js';
+export type { MakeIcon } from './rehype-dispatch.js';
+export type { ComponentContext } from './registry.js';

package/src/lib/render/pipeline.ts

@@ -9,7 +9,7 @@ import rehypeStringify from 'rehype-stringify';
 import rehypeSanitize from 'rehype-sanitize';
 import type { Schema } from 'hast-util-sanitize';
 import { VFile } from 'vfile';
-import { buildSanitizeSchema, rehypeAnchorRel } from './sanitize-schema.js';
+import { buildSanitizeSchema, rehypeAnchorRel, rehypeSinkGuard } from './sanitize-schema.js';
 import { remarkDirectiveStamp } from './remark-directives.js';
 import { remarkResolveCairnLinks, CAIRN_RESOLVE } from './resolve-links.js';
 import { rehypeDispatch } from './rehype-dispatch.js';
@@ -58,6 +58,9 @@ export function createRenderer(
     rehypeSlug,
   ];
   if (rel !== false) rehypePlugins.push([rehypeAnchorRel, rel]);
+  // The sink guard runs last, over the fully-built tree, so it neutralizes a sink a component
+  // build() emitted after the floor. Gated by the same switch as the floor.
+  if (!options.unsafeDisableSanitize) rehypePlugins.push(rehypeSinkGuard);
   const processor = unified()
     .use(remarkParse)
     .use(remarkGfm)

package/src/lib/render/registry.ts

@@ -82,6 +82,8 @@ export interface ComponentRegistry {
   names: string[];
   get(name: string): ComponentDef | undefined;
   defaultIcon(name: string, role?: string): string | undefined;
+  /** The component's first `type:'icon'` attribute, or undefined when it declares none. */
+  iconField(name: string): AttributeField | undefined;
 }
 
 /** The hast property name carrying one declared attribute from stamp to dispatch, e.g. `tone`
@@ -91,17 +93,35 @@ export function dataAttrProp(key: string): string {
   return `dataAttr${key.charAt(0).toUpperCase()}${key.slice(1)}`;
 }
 
+/** A component's first `type:'icon'` attribute, or undefined when it declares none. Both the
+ *  construction-time guard and the registry's `iconField` derive the icon field from this one
+ *  predicate rather than spelling the `type === 'icon'` find twice. */
+function findIconField(def: ComponentDef): AttributeField | undefined {
+  return def.attributes?.find((field) => field.type === 'icon');
+}
+
 /**
  * Build a registry from a site's component definitions. The single source the render
  * pipeline (directive stamp plus rehype dispatch) and the editor palette both read.
  */
 export function defineRegistry({ components }: { components: ComponentDef[] }): ComponentRegistry {
+  for (const c of components) {
+    if (c.defaultIconByRole && Object.keys(c.defaultIconByRole).length > 0 && !findIconField(c)) {
+      throw new Error(
+        `cairn: component "${c.name}" sets defaultIconByRole but declares no type:'icon' attribute, so the default icon can never render`,
+      );
+    }
+  }
   const byName = new Map(components.map((c) => [c.name, c]));
   return {
     defs: components,
     names: components.map((c) => c.name),
     get: (name) => byName.get(name),
     defaultIcon: (name, role) => (role ? byName.get(name)?.defaultIconByRole?.[role] : undefined),
+    iconField: (name) => {
+      const def = byName.get(name);
+      return def ? findIconField(def) : undefined;
+    },
   };
 }
 

package/src/lib/render/rehype-dispatch.ts

@@ -6,6 +6,13 @@ export function isElement(node: ElementContent | undefined): node is Element {
   return !!node && node.type === 'element';
 }
 
+/** Read a declared string attribute off the component context, returning undefined for a boolean or
+ *  absent value. Replaces the `typeof ctx.attributes[key] === 'string'` narrowing a build repeats. */
+export function strAttr(ctx: ComponentContext, key: string): string | undefined {
+  const value = ctx.attributes[key];
+  return typeof value === 'string' ? value : undefined;
+}
+
 // hast Properties values are PropertyValue (string | number | boolean | array | null).
 // Directive markers (dataPrimitive/dataRole/dataAttr<Key>) are always stamped as strings;
 // this reads them back with that guarantee instead of casting at each call site.
@@ -28,14 +35,14 @@ export function cardShell(classes: string[], body: ElementContent[]): Element {
   return h('section', { className: classes }, [h('div', { className: ['card-body'] }, body)]);
 }
 
-/** Card head row: `<div class="ec-head">[icon]<h2 class="card-title">{title}</h2></div>`.
- *  Pass the title's inline children and an optional pre-built icon element, the way `cardShell`
- *  takes already-built body content. This factors the icon-plus-heading head that a titled
- *  component build would otherwise rebuild by hand (the shape the removed `splitHead` produced). */
-export function headRow(title: ElementContent[], icon?: Element): Element {
+/** Card head row: `<div class="ec-head">[icon]<hN class="card-title">{title}</hN></div>`.
+ *  Pass the title's inline children, an optional pre-built icon element, and an optional heading
+ *  level (default 2). This factors the icon-plus-heading head that a titled component build would
+ *  otherwise rebuild by hand (the shape the removed `splitHead` produced). */
+export function headRow(title: ElementContent[], icon?: Element, level: number = 2): Element {
   const children: ElementContent[] = [];
   if (icon) children.push(icon);
-  children.push(h('h2', { className: ['card-title'] }, title));
+  children.push(h(`h${level}`, { className: ['card-title'] }, title));
   return h('div', { className: ['ec-head'] }, children);
 }
 

package/src/lib/render/remark-directives.ts

@@ -59,7 +59,7 @@ export function remarkDirectiveStamp(registry: ComponentRegistry) {
       const def = registry.get(node.name);
       const attrs = node.attributes ?? {};
       const role = attrs.role || undefined;
-      const iconField = def?.attributes?.find((field) => field.type === 'icon');
+      const iconField = registry.iconField(node.name);
       const iconKey = iconField?.key ?? 'icon';
       let icon = attrs[iconKey] || undefined;
       if (!icon && role) icon = registry.defaultIcon(node.name, role);

package/src/lib/render/sanitize-schema.ts

@@ -65,3 +65,100 @@ export function rehypeAnchorRel(rel: string) {
     });
   };
 }
+
+// URL-bearing hast properties the post-dispatch guard scheme-checks. hast camelCases attribute
+// names through property-information (srcset -> srcSet, xlink:href -> xLinkHref with a capital L,
+// formaction -> formAction). data is the <object data> URL attribute; data-* attributes camelCase
+// to dataFoo and are not matched here.
+const URL_PROPS = new Set([
+  'href',
+  'src',
+  'srcSet',
+  'xLinkHref',
+  'poster',
+  'formAction',
+  'action',
+  'data',
+  'background',
+]);
+
+// The safe URL schemes: the union of every protocol list in defaultSchema, plus cairn. The
+// floor admits these and strips the rest, so deriving from the same source keeps the floor and
+// this guard from drifting on what a safe scheme is. javascript:/data:/vbscript: are never in
+// defaultSchema, so they are never safe.
+const SAFE_SCHEMES: Set<string> = (() => {
+  const protocols = defaultSchema.protocols ?? {};
+  const schemes = new Set<string>(['cairn']);
+  for (const list of Object.values(protocols)) {
+    for (const scheme of list ?? []) schemes.add(String(scheme).toLowerCase());
+  }
+  return schemes;
+})();
+
+// Read a URL value's scheme for the safety check, defeating the whitespace and control-character
+// tricks a browser ignores inside a scheme (java\tscript:, a leading space). A value with no
+// scheme (relative, anchor, query) returns undefined and is always safe.
+function urlScheme(value: string): string | undefined {
+  const cleaned = value.replace(/[\x00-\x20]+/g, '');
+  const match = /^([a-z][a-z0-9+.-]*):/i.exec(cleaned);
+  return match ? match[1].toLowerCase() : undefined;
+}
+
+function isSafeUrl(value: string): boolean {
+  const scheme = urlScheme(value);
+  return scheme === undefined || SAFE_SCHEMES.has(scheme);
+}
+
+// srcset is "url descriptor, url descriptor, …". hast may store it as a string or, because
+// property-information marks it comma-separated, as a string array. One unsafe candidate makes
+// the whole attribute unsafe.
+function isSafeSrcset(value: unknown): boolean {
+  const candidates = Array.isArray(value)
+    ? value.map(String)
+    : typeof value === 'string'
+      ? value.split(',')
+      : [];
+  return candidates.every((candidate) => {
+    const url = candidate.trim().split(/\s+/)[0];
+    return url === '' || isSafeUrl(url);
+  });
+}
+
+// Decide whether one URL-bearing property value is safe to keep. srcset has its own
+// multi-candidate grammar. A non-string value carries no scheme to abuse, so the floor's own
+// handling stands and the guard leaves it alone.
+function isSafeUrlProp(key: string, value: unknown): boolean {
+  if (key === 'srcSet') return isSafeSrcset(value);
+  if (typeof value !== 'string') return true;
+  return isSafeUrl(value);
+}
+
+/**
+ * Post-dispatch safety floor over the fully-built tree. The pre-dispatch rehype-sanitize floor
+ * cleans author content, but a component build() runs after it and can route a raw author
+ * attribute value into a sink. This guard runs last and neutralizes those sinks on every element
+ * no matter which plugin or which build() produced it: an unsafe URL scheme in a URL-bearing
+ * attribute, an inline on* event handler, or an inline style (stripped wholesale, matching the
+ * floor and cairn's class-driven styling). It is gated by the same unsafeDisableSanitize switch as
+ * the floor.
+ *
+ * The guard's boundary is the URL scheme check plus the on* and style strip. It does not remove a
+ * build()-emitted raw script, style, or iframe srcdoc element node. A build() that emits those is
+ * running site-developer code, and author markdown is cleaned by the pre-dispatch floor.
+ */
+export function rehypeSinkGuard() {
+  return (tree: Root) => {
+    visit(tree, 'element', (node: Element) => {
+      const props = node.properties;
+      if (!props) return;
+      for (const key of Object.keys(props)) {
+        if (/^on/i.test(key) || key === 'style') {
+          delete props[key];
+          continue;
+        }
+        if (!URL_PROPS.has(key)) continue;
+        if (!isSafeUrlProp(key, props[key])) delete props[key];
+      }
+    });
+  };
+}

package/src/lib/sveltekit/content-routes.ts

@@ -22,15 +22,20 @@ export interface NavConcept {
   label: string;
 }
 
-/** The admin layout's data: site identity, the signed-in user, the nav, and the active path. */
+/** The admin layout's data: site identity, the signed-in user, the nav, the active path, and theme. */
 export interface LayoutData {
   siteName: string;
-  user: { displayName: string; role: Role };
+  user: { displayName: string; email: string; role: Role };
   concepts: NavConcept[];
   pathname: string;
   canManageEditors: boolean;
   /** The nav menu's label when the site configures one; gates the Navigation nav entry. Null otherwise. */
   navLabel: string | null;
+  /** The admin theme resolved for SSR: the persisted cookie choice, or the light default. */
+  theme: 'cairn-admin' | 'cairn-admin-dark';
+  /** The nav group labels the user has collapsed, from the persisted cookie. Read at SSR so a
+   *  collapsed group renders collapsed with no flash. Empty when none are collapsed. */
+  collapsedNav: string[];
 }
 
 /** One row in a concept's list view. */
@@ -83,6 +88,8 @@ export interface ContentEvent {
   request: Request;
   locals: { editor?: Editor | null };
   platform?: { env?: GithubKeyEnv };
+  /** SvelteKit's cookie jar; the layout load reads the persisted admin theme. Optional for non-route callers. */
+  cookies?: { get(name: string): string | undefined };
 }
 
 /** Injectable dependencies; tests stub the token mint to avoid signing a real key. */
@@ -109,16 +116,24 @@ export function createContentRoutes(runtime: CairnRuntime, deps: ContentRoutesDe
   const mintToken =
     deps.mintToken ?? ((env: GithubKeyEnv) => cachedInstallationToken(appCredentials(runtime.backend, env)));
 
-  /** Layout load for every admin page: the nav, the user, and the active path. */
+  /** Layout load for every admin page: the nav, the user, the active path, and the resolved theme. */
   function layoutLoad(event: ContentEvent): LayoutData {
     const editor = sessionOf(event);
+    const cookieTheme = event.cookies?.get('cairn-admin-theme');
+    const theme = cookieTheme === 'cairn-admin-dark' ? 'cairn-admin-dark' : 'cairn-admin';
+    const cookieCollapsed = event.cookies?.get('cairn-admin-nav-collapsed');
+    const collapsedNav = cookieCollapsed
+      ? cookieCollapsed.split(',').map((part) => decodeURIComponent(part)).filter(Boolean)
+      : [];
     return {
       siteName: runtime.siteName,
-      user: { displayName: editor.displayName, role: editor.role },
+      user: { displayName: editor.displayName, email: editor.email, role: editor.role },
       concepts: runtime.concepts.map((c) => ({ id: c.id, label: c.label })),
       pathname: event.url.pathname,
       canManageEditors: editor.role === 'owner',
       navLabel: runtime.navMenu?.label ?? null,
+      theme,
+      collapsedNav,
     };
   }
 
@@ -338,14 +353,17 @@ export function createContentRoutes(runtime: CairnRuntime, deps: ContentRoutesDe
     throw redirect(303, `/admin/${concept.id}/${id}?${savedQuery}`);
   }
 
-  /** Delete an entry. Block-until-clean: refuse while inbound links exist (naming them), else commit
-   *  the file removal and the manifest patch in one commit. The inbound recheck here is the
-   *  authoritative gate, closing the load-to-delete race. */
-  async function deleteAction(event: ContentEvent): Promise<ReturnType<typeof fail> | never> {
-    const editor = sessionOf(event);
-    const concept = conceptOf(runtime, event.params);
-    const id = event.params.id ?? '';
-    if (!isValidId(id)) throw error(400, 'Invalid entry id');
+  /** The shared delete core. Block-until-clean: refuse while inbound links exist (naming them), else
+   *  commit the file removal and the manifest patch in one commit. The inbound recheck here is the
+   *  authoritative gate, closing the load-to-delete race. Both the editor delete (id from params) and
+   *  the list delete (id from the form body) call this with an already-validated id, so the guard is
+   *  enforced once. */
+  async function deleteEntry(
+    event: ContentEvent,
+    concept: ConceptDescriptor,
+    id: string,
+    editor: Editor,
+  ): Promise<ReturnType<typeof fail> | never> {
     const path = `${concept.dir}/${filenameFromId(id)}`;
     const token = await mintToken(event.platform?.env ?? {});
 
@@ -355,7 +373,7 @@ export function createContentRoutes(runtime: CairnRuntime, deps: ContentRoutesDe
     const manifest = manifestRaw === null ? emptyManifest() : parseManifest(manifestRaw);
     const inbound = inboundLinks(manifest, concept.id, id);
     if (inbound.length) {
-      return fail(409, { inboundLinks: inbound });
+      return fail(409, { inboundLinks: inbound, id });
     }
 
     const nextManifest = serializeManifest(removeEntry(manifest, concept.id, id));
@@ -379,6 +397,25 @@ export function createContentRoutes(runtime: CairnRuntime, deps: ContentRoutesDe
     throw redirect(303, `/admin/${concept.id}`);
   }
 
+  /** Delete an entry from its editor. The id comes from the route param. */
+  async function deleteAction(event: ContentEvent): Promise<ReturnType<typeof fail> | never> {
+    const editor = sessionOf(event);
+    const concept = conceptOf(runtime, event.params);
+    const id = event.params.id ?? '';
+    if (!isValidId(id)) throw error(400, 'Invalid entry id');
+    return deleteEntry(event, concept, id, editor);
+  }
+
+  /** Delete an entry from the concept list. The id comes from the form body. */
+  async function listDeleteAction(event: ContentEvent): Promise<ReturnType<typeof fail> | never> {
+    const editor = sessionOf(event);
+    const concept = conceptOf(runtime, event.params);
+    const form = await event.request.formData();
+    const id = String(form.get('id') ?? '');
+    if (!isValidId(id)) throw error(400, 'Invalid entry id');
+    return deleteEntry(event, concept, id, editor);
+  }
+
   /** Rename an entry: change its slug, move the file, and rewrite every inbound cairn token in one
    *  atomic commit, so no internal link breaks. The collision check and the inbound recompute here
    *  are the authoritative gate. The same last-writer-wins manifest race as save and delete applies,
@@ -466,5 +503,5 @@ export function createContentRoutes(runtime: CairnRuntime, deps: ContentRoutesDe
     throw redirect(303, `/admin/${concept.id}/${newId}?renamed=1`);
   }
 
-  return { layoutLoad, indexRedirect, listLoad, createAction, editLoad, saveAction, deleteAction, renameAction, mintToken };
+  return { layoutLoad, indexRedirect, listLoad, createAction, editLoad, saveAction, deleteAction, listDeleteAction, renameAction, mintToken };
 }

package/src/lib/sveltekit/index.ts

@@ -17,11 +17,5 @@ export { createNavRoutes } from './nav-routes.js';
 export type { NavLoadData, NavPageOption, NavRoutesDeps } from './nav-routes.js';
 export { healthLoad, type HealthData } from './health.js';
 export type { RequestContext, CookieJar, HandleInput } from './types.js';
-export { createPublicRoutes } from './public-routes.js';
-export type {
-  PublicRoutesDeps,
-  ListData as PublicListData,
-  TagData,
-  TagIndexData,
-  EntryData,
-} from './public-routes.js';
+// Re-exported here, not from root, so the public ContentRoutesDeps consumer can name it.
+export type { GithubKeyEnv } from '../github/credentials.js';

package/dist/auth/crypto.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/lib/auth/crypto.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAEzD;AAED,yCAAyC;AACzC,eAAO,MAAM,YAAY,QAAiB,CAAC;AAE3C,6BAA6B;AAC7B,eAAO,MAAM,cAAc,QAA2B,CAAC;AAEvD,0FAA0F;AAC1F,eAAO,MAAM,gBAAgB,QAAY,CAAC;AAU1C,kDAAkD;AAClD,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,4CAA4C;AAC5C,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,oEAAoE;AACpE,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAI9D"}

package/dist/auth/store.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/lib/auth/store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAQ/C,yCAAyC;AACzC,wBAAsB,UAAU,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMtF;AAED,2EAA2E;AAC3E,wBAAsB,UAAU,CAC9B,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,yGAAyG;AACzG,wBAAsB,cAAc,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMnG;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMzG;AAED,4BAA4B;AAC5B,wBAAsB,aAAa,CACjC,EAAE,EAAE,UAAU,EACd,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAUpG;AAED,iCAAiC;AACjC,wBAAsB,aAAa,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7E;AAED,2CAA2C;AAC3C,wBAAsB,WAAW,CAAC,EAAE,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAKnE;AAED,sCAAsC;AACtC,wBAAsB,YAAY,CAChC,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,IAAI,EACV,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,0FAA0F;AAC1F,wBAAsB,YAAY,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAM/E;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAe1F;AAED,iFAAiF;AACjF,wBAAsB,aAAa,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5F;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAU1F"}

package/dist/auth/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/lib/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAE5D,MAAM,MAAM,IAAI,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEtC,0FAA0F;AAC1F,MAAM,WAAW,MAAM;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,4FAA4F;AAC5F,MAAM,WAAW,OAAO;IACtB,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB,qGAAqG;IACrG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wCAAwC;IACxC,KAAK,CAAC,EAAE;QACN,IAAI,CAAC,OAAO,EAAE;YACZ,EAAE,EAAE,MAAM,CAAC;YACX,IAAI,EAAE,MAAM,CAAC;YACb,OAAO,EAAE,MAAM,CAAC;YAChB,IAAI,EAAE,MAAM,CAAC;YACb,IAAI,EAAE,MAAM,CAAC;SACd,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACnB,CAAC;CACH"}

package/dist/components/AdminLayout.svelte.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"AdminLayout.svelte.d.ts","sourceRoot":"","sources":["../../src/lib/components/AdminLayout.svelte.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,mBAAmB,CAAC;AAGzB,UAAU,KAAK;IACb,4FAA4F;IAC5F,IAAI,EAAE,UAAU,CAAC;IACjB,qBAAqB;IACrB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAyEH;;;;;GAKG;AACH,QAAA,MAAM,WAAW,2CAAwC,CAAC;AAC1D,KAAK,WAAW,GAAG,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC;AAClD,eAAe,WAAW,CAAC"}

package/dist/components/ComponentForm.svelte.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ComponentForm.svelte.d.ts","sourceRoot":"","sources":["../../src/lib/components/ComponentForm.svelte.ts"],"names":[],"mappings":"AAIA,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAEvE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAIhD,UAAU,KAAK;IACb,GAAG,EAAE,YAAY,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,mEAAmE;IACnE,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,4BAA4B;IAC5B,MAAM,EAAE,MAAM,IAAI,CAAC;CACpB;AAyJH;;;;;GAKG;AACH,QAAA,MAAM,aAAa,2CAAwC,CAAC;AAC5D,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,eAAe,aAAa,CAAC"}

package/dist/components/ComponentInsertDialog.svelte.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ComponentInsertDialog.svelte.d.ts","sourceRoot":"","sources":["../../src/lib/components/ComponentInsertDialog.svelte.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAgB,MAAM,uBAAuB,CAAC;AAC7E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAIhD,UAAU,KAAK;IACb,qCAAqC;IACrC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,4CAA4C;IAC5C,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,4CAA4C;IAC5C,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAkFH;;;;;GAKG;AACH,QAAA,MAAM,qBAAqB,2CAAwC,CAAC;AACpE,KAAK,qBAAqB,GAAG,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACtE,eAAe,qBAAqB,CAAC"}

package/dist/components/ConceptList.svelte.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ConceptList.svelte.d.ts","sourceRoot":"","sources":["../../src/lib/components/ConceptList.svelte.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAG7D,UAAU,KAAK;IACb,qFAAqF;IACrF,IAAI,EAAE,QAAQ,CAAC;CAChB;AA2EH;;;GAGG;AACH,QAAA,MAAM,WAAW,2CAAwC,CAAC;AAC1D,KAAK,WAAW,GAAG,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC;AAClD,eAAe,WAAW,CAAC"}

package/dist/components/ConfirmPage.svelte.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ConfirmPage.svelte.d.ts","sourceRoot":"","sources":["../../src/lib/components/ConfirmPage.svelte.ts"],"names":[],"mappings":"AAGA,OAAO,mBAAmB,CAAC;AAGzB,UAAU,KAAK;IACb,0FAA0F;IAC1F,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CACjE;AA8BH;;;GAGG;AACH,QAAA,MAAM,WAAW,2CAAwC,CAAC;AAC1D,KAAK,WAAW,GAAG,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC;AAClD,eAAe,WAAW,CAAC"}

package/dist/components/DeleteDialog.svelte.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"DeleteDialog.svelte.d.ts","sourceRoot":"","sources":["../../src/lib/components/DeleteDialog.svelte.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAGxD,UAAU,KAAK;IACb,gFAAgF;IAChF,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,EAAE,EAAE,MAAM,CAAC;IACX,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,YAAY,EAAE,WAAW,EAAE,CAAC;CAC7B;AAqEH;;;;;GAKG;AACH,QAAA,MAAM,YAAY,2CAAwC,CAAC;AAC3D,KAAK,YAAY,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;AACpD,eAAe,YAAY,CAAC"}

package/dist/components/EditPage.svelte.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"EditPage.svelte.d.ts","sourceRoot":"","sources":["../../src/lib/components/EditPage.svelte.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAE/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAIrD,UAAU,KAAK;IACb,gEAAgE;IAChE,IAAI,EAAE,QAAQ,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,qIAAqI;IACrI,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,WAAW,CAAA;KAAE,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvG,8DAA8D;IAC9D,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;oFACgF;IAChF,IAAI,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,wBAAwB,EAAE,WAAW,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC9I;AAyQH;;;;GAIG;AACH,QAAA,MAAM,QAAQ,2CAAwC,CAAC;AACvD,KAAK,QAAQ,GAAG,UAAU,CAAC,OAAO,QAAQ,CAAC,CAAC;AAC5C,eAAe,QAAQ,CAAC"}

package/dist/components/EditorToolbar.svelte.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"EditorToolbar.svelte.d.ts","sourceRoot":"","sources":["../../src/lib/components/EditorToolbar.svelte.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGrD,UAAU,KAAK;IACb,oEAAoE;IACpE,MAAM,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,CAAC;CACpC;AAiDH;;;;;GAKG;AACH,QAAA,MAAM,aAAa,2CAAwC,CAAC;AAC5D,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,eAAe,aAAa,CAAC"}