@glw907/cairn-cms 0.26.0 → 0.33.0

package/dist/delivery/content-index.js

@@ -3,47 +3,30 @@
 // returns cheap plain-data summaries plus an on-demand detail lookup. It is concept-generic:
 // every operation reads the descriptor and its routing rule, never a hardcoded concept id.
 import { parseMarkdown } from '../content/frontmatter.js';
-import { idFromFilename, slugFromId } from '../content/ids.js';
-import { permalink } from '../content/permalink.js';
+import { entryId, entryIdentity, asDate, asString, asTags } from '../content/identity.js';
 import { deriveExcerpt, wordCount } from './excerpt.js';
 /** Map a Vite eager `?raw` glob record (`{ path: raw }`) to `RawFile[]`. */
 export function fromGlob(record) {
     return Object.entries(record).map(([path, raw]) => ({ path, raw }));
 }
-function basename(path) {
-    const slash = path.lastIndexOf('/');
-    return slash >= 0 ? path.slice(slash + 1) : path;
-}
-function asString(value) {
-    return typeof value === 'string' && value.trim() ? value : undefined;
-}
-function asDate(value) {
-    if (value instanceof Date)
-        return Number.isNaN(value.getTime()) ? undefined : value.toISOString().slice(0, 10);
-    if (typeof value === 'string')
-        return value.match(/^\d{4}-\d{2}-\d{2}/)?.[0];
-    return undefined;
-}
-function asTags(value) {
-    return Array.isArray(value) ? value.map(String) : [];
-}
 /** Build a concept's index from its raw files and normalized descriptor. */
 export function createContentIndex(files, descriptor) {
     const problems = [];
     const entries = [];
     for (const file of files) {
-        const id = idFromFilename(basename(file.path));
-        const slug = slugFromId(id, descriptor.routing.dated ? descriptor.datePrefix : null);
         const { frontmatter: raw, body } = parseMarkdown(file.raw);
-        const date = asDate(raw.date);
+        const id = entryId(file.path);
         const draft = raw.draft === true;
-        // Validate once at build. A failure is recorded for the site gate and excluded from the typed
-        // read, so every readable entry's frontmatter is the validator's normalized output, never raw.
+        // Validate before resolving the permalink. A date-token permalink throws on an entry with no
+        // valid date; the validate gate records that as a content problem rather than aborting the whole
+        // index build, so one bad entry degrades to a skip, not a crash. A failure is also excluded from
+        // the typed read, so every readable entry's frontmatter is the validator's normalized output.
         const result = descriptor.validate(raw, body);
         if (!result.ok) {
             problems.push({ id, draft, errors: result.errors });
             continue;
         }
+        const { slug, date, permalink } = entryIdentity(descriptor, file.path, raw);
         const summaryFieldValues = {};
         for (const key of descriptor.summaryFields) {
             if (key in result.data)
@@ -53,7 +36,7 @@ export function createContentIndex(files, descriptor) {
             concept: descriptor.id,
             id,
             slug,
-            permalink: permalink(descriptor, { id, slug, date }),
+            permalink,
             title: asString(raw.title) ?? id,
             date,
             updated: asDate(raw.updated),

package/dist/delivery/data.d.ts

@@ -21,4 +21,3 @@ export { rssResponse, jsonFeedResponse, sitemapResponse, robotsResponse } from '
 export { jsonLdScript } from './json-ld.js';
 export { permalink } from '../content/permalink.js';
 export { buildSiteManifest, buildLinkResolver } from './manifest.js';
-//# sourceMappingURL=data.d.ts.map

package/dist/delivery/excerpt.d.ts

@@ -8,4 +8,3 @@ export declare function deriveExcerpt(body: string, opts?: {
 }): string;
 /** Count words in the stripped body. */
 export declare function wordCount(body: string): number;
-//# sourceMappingURL=excerpt.d.ts.map

package/dist/delivery/feeds.d.ts

@@ -24,4 +24,3 @@ export interface FeedItem {
 export declare function buildRssFeed(channel: FeedChannel, items: FeedItem[]): string;
 /** Build a JSON Feed 1.1 document. */
 export declare function buildJsonFeed(channel: FeedChannel, items: FeedItem[]): string;
-//# sourceMappingURL=feeds.d.ts.map

package/dist/delivery/head.d.ts

@@ -1,2 +1 @@
 export { default as CairnHead } from './CairnHead.svelte';
-//# sourceMappingURL=head.d.ts.map

package/dist/delivery/index.d.ts

@@ -1,4 +1,3 @@
 export * from './data.js';
 export { createPublicRoutes } from '../sveltekit/public-routes.js';
 export type { PublicRoutesDeps, ListData, TagData, TagIndexData, EntryData, } from '../sveltekit/public-routes.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/delivery/json-ld.d.ts

@@ -1,2 +1 @@
 export declare function jsonLdScript(data: Record<string, unknown>): string;
-//# sourceMappingURL=json-ld.d.ts.map

package/dist/delivery/manifest.d.ts

@@ -10,4 +10,3 @@ export declare function buildSiteManifest<A extends CairnAdapter>(adapter: A, co
 /** A resolver backed by the site index, for the build. A miss throws, so a dangling cairn: token
  *  fails the prerender (the build backstop). The preview uses manifestLinkResolver, which marks. */
 export declare function buildLinkResolver(site: SiteIndex): LinkResolve;
-//# sourceMappingURL=manifest.d.ts.map

package/dist/delivery/paginate.d.ts

@@ -10,4 +10,3 @@ export interface Page<T> {
 }
 /** Slice `items` into the 1-based `page` of size `perPage`, clamping the page into bounds. */
 export declare function paginate<T>(items: T[], page: number, perPage: number): Page<T>;
-//# sourceMappingURL=paginate.d.ts.map

package/dist/delivery/responses.d.ts

@@ -11,4 +11,3 @@ export declare function robotsResponse(opts: {
     sitemapUrl: string;
     disallow?: string[];
 }): Response;
-//# sourceMappingURL=responses.d.ts.map

package/dist/delivery/robots.d.ts

@@ -3,4 +3,3 @@ export declare function buildRobots(opts: {
     sitemapUrl: string;
     disallow?: string[];
 }): string;
-//# sourceMappingURL=robots.d.ts.map

package/dist/delivery/seo-fields.d.ts

@@ -19,4 +19,3 @@ export declare function readSeoFields(frontmatter: Record<string, unknown>): Seo
  *  bare path also anchors to the origin root; against a sub-path origin it would resolve relative to
  *  that path, per the WHATWG URL rules. */
 export declare function resolveImageUrl(image: string, origin: string): string | undefined;
-//# sourceMappingURL=seo-fields.d.ts.map

package/dist/delivery/seo.d.ts

@@ -35,4 +35,3 @@ export interface SeoMeta {
 }
 /** Build the head data for a page. */
 export declare function buildSeoMeta(input: SeoInput): SeoMeta;
-//# sourceMappingURL=seo.d.ts.map

package/dist/delivery/site-descriptors.d.ts

@@ -2,4 +2,3 @@ import type { CairnAdapter, ConceptDescriptor } from '../content/types.js';
 import type { SiteConfig } from '../nav/site-config.js';
 /** Per-concept descriptors for a site, from its adapter content and its parsed site config. */
 export declare function siteDescriptors(adapter: CairnAdapter, siteConfig: SiteConfig): ConceptDescriptor[];
-//# sourceMappingURL=site-descriptors.d.ts.map

package/dist/delivery/site-descriptors.js

@@ -1,9 +1,8 @@
-// cairn-cms: the one-call descriptor helper. A delivery site needs the same per-concept
-// descriptors the admin runtime uses; this wraps the two calls that derive them so the
-// pairing is not tribal knowledge. The YAML URL policy stays the single source of truth.
-import { normalizeConcepts } from '../content/concepts.js';
-import { urlPolicyFrom } from '../nav/site-config.js';
+// cairn-cms: the one-call descriptor helper. A delivery site needs the same per-concept descriptors
+// the admin runtime uses; this delegates to the shared resolveConcepts so the pairing is one path, not
+// tribal knowledge. The YAML URL policy stays the single source of truth.
+import { resolveConcepts } from '../content/concepts.js';
 /** Per-concept descriptors for a site, from its adapter content and its parsed site config. */
 export function siteDescriptors(adapter, siteConfig) {
-    return normalizeConcepts(adapter.content, urlPolicyFrom(siteConfig));
+    return resolveConcepts(adapter.content, siteConfig);
 }

package/dist/delivery/site-index.d.ts

@@ -31,4 +31,3 @@ export interface SiteIndex {
 export declare function createSiteIndex(concepts: ConceptIndex[], opts?: {
     validate?: boolean;
 }): SiteIndex;
-//# sourceMappingURL=site-index.d.ts.map

package/dist/delivery/site-indexes.d.ts

@@ -23,4 +23,3 @@ export type SiteIndexes<A extends CairnAdapter> = {
 export declare function createSiteIndexes<const A extends CairnAdapter>(adapter: A, config: SiteConfig, globs: SiteGlobs<A>, opts?: {
     validate?: boolean;
 }): SiteIndexes<A>;
-//# sourceMappingURL=site-indexes.d.ts.map

package/dist/delivery/sitemap.d.ts

@@ -5,4 +5,3 @@ export interface SitemapUrl {
 }
 /** Build a sitemap XML document from a list of URLs. */
 export declare function buildSitemap(urls: SitemapUrl[]): string;
-//# sourceMappingURL=sitemap.d.ts.map

package/dist/email.d.ts

@@ -24,4 +24,3 @@ export declare function buildMagicLinkMessage(input: {
 }): MagicLinkMessage;
 /** The production send: Cloudflare Email Sending through the EMAIL binding. */
 export declare const cloudflareSend: SendMagicLink;
-//# sourceMappingURL=email.d.ts.map

package/dist/env.d.ts

@@ -21,4 +21,3 @@ export declare function requireOrigin(env: {
 export declare function requireDb(env: {
     AUTH_DB?: D1Database;
 }): D1Database;
-//# sourceMappingURL=env.d.ts.map

package/dist/github/credentials.d.ts

@@ -9,4 +9,3 @@ export interface GithubKeyEnv {
  * installation) and the Worker's private-key secret. Throws when the secret is unset.
  */
 export declare function appCredentials(backend: Pick<BackendConfig, 'appId' | 'installationId'>, env: GithubKeyEnv): AppCredentials;
-//# sourceMappingURL=credentials.d.ts.map

package/dist/github/repo.d.ts

@@ -67,4 +67,3 @@ export declare function commitFiles(repo: RepoRef, changes: FileChange[], opts:
     author: CommitAuthor;
 }, token: string): Promise<string>;
 export {};
-//# sourceMappingURL=repo.d.ts.map

package/dist/github/signing.d.ts

@@ -26,4 +26,3 @@ export declare function signingSelfTest(appId: string, privateKeyB64: string): P
     ok: boolean;
     detail?: string;
 }>;
-//# sourceMappingURL=signing.d.ts.map

package/dist/github/types.d.ts

@@ -32,4 +32,3 @@ export declare class CommitConflictError extends Error {
     readonly path: string;
     constructor(path: string);
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/index.d.ts

@@ -27,38 +27,9 @@ export type { ReferenceOptions } from './render/component-reference.js';
 export { glyph } from './render/glyph.js';
 export type { IconSet } from './render/glyph.js';
 export { remarkDirectiveStamp } from './render/remark-directives.js';
-export { rehypeDispatch, isElement, strProp, iconSpan, cardShell, headRow, markFirstList, } from './render/rehype-dispatch.js';
-export type { MakeIcon } from './render/rehype-dispatch.js';
 export { createRenderer } from './render/pipeline.js';
 export type { RendererOptions } from './render/pipeline.js';
 export type { RepoRef, RepoFile, CommitAuthor, AppCredentials } from './github/types.js';
 export { CommitConflictError } from './github/types.js';
-export { appJwt, installationToken, signingSelfTest } from './github/signing.js';
-export { treeUrl, markdownFilesIn, listMarkdown, contentsUrl, readRaw, fileSha, commitFile, } from './github/repo.js';
-export { appCredentials } from './github/credentials.js';
-export type { GithubKeyEnv } from './github/credentials.js';
 export { parseSiteConfig, urlPolicyFrom, extractMenu, setMenu, validateNavTree, MAX_NAV_NODES, NavValidationError, SiteConfigError, } from './nav/site-config.js';
 export type { NavNode, SiteConfig } from './nav/site-config.js';
-export { permalink } from './content/permalink.js';
-export { createContentIndex, fromGlob } from './delivery/content-index.js';
-export type { RawFile, ContentSummary, ContentEntry, ContentIndex, ContentProblem, } from './delivery/content-index.js';
-export { createSiteIndex } from './delivery/site-index.js';
-export type { SiteIndex, ConceptIndex } from './delivery/site-index.js';
-export { createSiteIndexes } from './delivery/site-indexes.js';
-export type { SiteIndexes, SiteGlobs } from './delivery/site-indexes.js';
-export { deriveExcerpt, wordCount } from './delivery/excerpt.js';
-export { buildRssFeed, buildJsonFeed } from './delivery/feeds.js';
-export type { FeedChannel, FeedItem } from './delivery/feeds.js';
-export { buildSitemap } from './delivery/sitemap.js';
-export type { SitemapUrl } from './delivery/sitemap.js';
-export { buildRobots } from './delivery/robots.js';
-export { buildSeoMeta } from './delivery/seo.js';
-export type { SeoInput, SeoMeta } from './delivery/seo.js';
-export { readSeoFields, resolveImageUrl } from './delivery/seo-fields.js';
-export type { SeoFields } from './delivery/seo-fields.js';
-export { paginate } from './delivery/paginate.js';
-export type { Page } from './delivery/paginate.js';
-export { rssResponse, jsonFeedResponse, sitemapResponse, robotsResponse } from './delivery/responses.js';
-export { createPublicRoutes } from './sveltekit/public-routes.js';
-export type { PublicRoutesDeps, ListData, TagData, TagIndexData, EntryData } from './sveltekit/public-routes.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -21,30 +21,11 @@ export { buildComponentInsert } from './render/component-insert.js';
 export { generateComponentReference } from './render/component-reference.js';
 export { glyph } from './render/glyph.js';
 export { remarkDirectiveStamp } from './render/remark-directives.js';
-export { rehypeDispatch, isElement, strProp, iconSpan, cardShell, headRow, markFirstList, } from './render/rehype-dispatch.js';
+// The component-authoring helpers (iconSpan, cardShell, headRow, isElement, strAttr) live on the
+// @glw907/cairn-cms/render subpath, not the root barrel. rehypeDispatch is deliberately not public:
+// createRenderer is the one public render pipeline, so the safe plugin ordering is the only public
+// path. See docs/superpowers/specs/2026-06-05-cairn-render-authoring-surface-design.md.
 export { createRenderer } from './render/pipeline.js';
 export { CommitConflictError } from './github/types.js';
-export { appJwt, installationToken, signingSelfTest } from './github/signing.js';
-export { treeUrl, markdownFilesIn, listMarkdown, contentsUrl, readRaw, fileSha, commitFile, } from './github/repo.js';
-export { appCredentials } from './github/credentials.js';
 // Nav tree and site-config helpers (Plan 06).
 export { parseSiteConfig, urlPolicyFrom, extractMenu, setMenu, validateNavTree, MAX_NAV_NODES, NavValidationError, SiteConfigError, } from './nav/site-config.js';
-// Public content delivery (public-delivery design): the query index, syndication, and
-// discovery surface that sites read. Pure builders plus the one permalink resolver; the
-// SvelteKit loaders live under the /sveltekit subpath.
-export { permalink } from './content/permalink.js';
-export { createContentIndex, fromGlob } from './delivery/content-index.js';
-export { createSiteIndex } from './delivery/site-index.js';
-export { createSiteIndexes } from './delivery/site-indexes.js';
-export { deriveExcerpt, wordCount } from './delivery/excerpt.js';
-export { buildRssFeed, buildJsonFeed } from './delivery/feeds.js';
-export { buildSitemap } from './delivery/sitemap.js';
-export { buildRobots } from './delivery/robots.js';
-export { buildSeoMeta } from './delivery/seo.js';
-export { readSeoFields, resolveImageUrl } from './delivery/seo-fields.js';
-export { paginate } from './delivery/paginate.js';
-// Root superset of the delivery route surface: a wrong guess from root for a route loader or a
-// response helper now resolves. The CairnHead component stays out of root so the root barrel stays
-// node-importable for the unit suite; it resolves from @glw907/cairn-cms/delivery/head.
-export { rssResponse, jsonFeedResponse, sitemapResponse, robotsResponse } from './delivery/responses.js';
-export { createPublicRoutes } from './sveltekit/public-routes.js';

package/dist/nav/site-config.d.ts

@@ -52,4 +52,3 @@ export declare function urlPolicyFrom(config: SiteConfig): Record<string, Concep
  * serializes without `url`/`children` keys.
  */
 export declare function setMenu(raw: string, name: string, tree: NavNode[]): string;
-//# sourceMappingURL=site-config.d.ts.map

package/dist/render/authoring.d.ts

@@ -0,0 +1,3 @@
+export { iconSpan, cardShell, headRow, isElement, strAttr } from './rehype-dispatch.js';
+export type { MakeIcon } from './rehype-dispatch.js';
+export type { ComponentContext } from './registry.js';

package/dist/render/authoring.js

@@ -0,0 +1,5 @@
+// cairn-cms: the component-authoring toolkit (@glw907/cairn-cms/render). A site authoring components
+// through build(ctx) reaches for these hast builders and the string-attribute reader. Curated on
+// purpose: the internal hast helpers (strProp, markFirstList, dataAttrProp) stay internal, and
+// rehypeDispatch is deliberately omitted (createRenderer is the one public render pipeline).
+export { iconSpan, cardShell, headRow, isElement, strAttr } from './rehype-dispatch.js';

package/dist/render/component-grammar.d.ts

@@ -14,4 +14,3 @@ export declare function parseComponentWithRawKeys(markdown: string, def: Compone
     values: ComponentValues;
     rawKeys: string[];
 }>;
-//# sourceMappingURL=component-grammar.d.ts.map

package/dist/render/component-insert.d.ts

@@ -11,4 +11,3 @@ export type ComponentInsert = {
 /** Serialize a component's form values, then validate the result against its schema. Returns the
  *  markdown to insert at the cursor, or the field errors keyed by attribute key or slot name. */
 export declare function buildComponentInsert(def: ComponentDef, values: ComponentValues): Promise<ComponentInsert>;
-//# sourceMappingURL=component-insert.d.ts.map

package/dist/render/component-reference.d.ts

@@ -8,4 +8,3 @@ export interface ReferenceOptions {
 /** Build a self-contained markdown reference (the llms-full.txt shape) for a component registry, for
  *  authors and for pointing an LLM at one curated file. */
 export declare function generateComponentReference(registry: ComponentRegistry, opts: ReferenceOptions): string;
-//# sourceMappingURL=component-reference.d.ts.map

package/dist/render/component-validate.d.ts

@@ -7,4 +7,3 @@ export type ComponentValidation = {
     errors: Record<string, string>;
 };
 export declare function validateComponent(markdown: string, def: ComponentDef): Promise<ComponentValidation>;
-//# sourceMappingURL=component-validate.d.ts.map

package/dist/render/glyph.d.ts

@@ -6,4 +6,3 @@ export type IconSet = Record<string, string>;
  *  a stray empty (or undefined) path. Callers always wrap the returned element, so the shell
  *  keeps them safe. */
 export declare function glyph(name: string, icons: IconSet): Element;
-//# sourceMappingURL=glyph.d.ts.map

package/dist/render/index.d.ts

@@ -3,4 +3,3 @@ export * from './glyph.js';
 export * from './remark-directives.js';
 export * from './rehype-dispatch.js';
 export * from './pipeline.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/render/pipeline.d.ts

@@ -31,4 +31,3 @@ export declare function createRenderer(registry?: ComponentRegistry, options?: R
         resolve?: LinkResolve;
     }) => Promise<string>;
 };
-//# sourceMappingURL=pipeline.d.ts.map

package/dist/render/pipeline.js

@@ -8,7 +8,7 @@ import rehypeSlug from 'rehype-slug';
 import rehypeStringify from 'rehype-stringify';
 import rehypeSanitize from 'rehype-sanitize';
 import { VFile } from 'vfile';
-import { buildSanitizeSchema, rehypeAnchorRel } from './sanitize-schema.js';
+import { buildSanitizeSchema, rehypeAnchorRel, rehypeSinkGuard } from './sanitize-schema.js';
 import { remarkDirectiveStamp } from './remark-directives.js';
 import { remarkResolveCairnLinks, CAIRN_RESOLVE } from './resolve-links.js';
 import { rehypeDispatch } from './rehype-dispatch.js';
@@ -33,6 +33,10 @@ export function createRenderer(registry = defineRegistry({ components: [] }), op
     ];
     if (rel !== false)
         rehypePlugins.push([rehypeAnchorRel, rel]);
+    // The sink guard runs last, over the fully-built tree, so it neutralizes a sink a component
+    // build() emitted after the floor. Gated by the same switch as the floor.
+    if (!options.unsafeDisableSanitize)
+        rehypePlugins.push(rehypeSinkGuard);
     const processor = unified()
         .use(remarkParse)
         .use(remarkGfm)

package/dist/render/registry.d.ts

@@ -70,6 +70,8 @@ export interface ComponentRegistry {
     names: string[];
     get(name: string): ComponentDef | undefined;
     defaultIcon(name: string, role?: string): string | undefined;
+    /** The component's first `type:'icon'` attribute, or undefined when it declares none. */
+    iconField(name: string): AttributeField | undefined;
 }
 /** The hast property name carrying one declared attribute from stamp to dispatch, e.g. `tone`
  *  becomes `dataAttrTone`. The directive stamp writes it and the rehype dispatch reads it, so both
@@ -91,4 +93,3 @@ export interface ComponentValues {
 /** Seed an empty {@link ComponentValues} from a component's schema: attribute defaults (or '' / false)
  *  and empty slot values ([] for repeatable, '' otherwise). */
 export declare function emptyValues(def: ComponentDef): ComponentValues;
-//# sourceMappingURL=registry.d.ts.map

package/dist/render/registry.js

@@ -4,17 +4,32 @@
 export function dataAttrProp(key) {
     return `dataAttr${key.charAt(0).toUpperCase()}${key.slice(1)}`;
 }
+/** A component's first `type:'icon'` attribute, or undefined when it declares none. Both the
+ *  construction-time guard and the registry's `iconField` derive the icon field from this one
+ *  predicate rather than spelling the `type === 'icon'` find twice. */
+function findIconField(def) {
+    return def.attributes?.find((field) => field.type === 'icon');
+}
 /**
  * Build a registry from a site's component definitions. The single source the render
  * pipeline (directive stamp plus rehype dispatch) and the editor palette both read.
  */
 export function defineRegistry({ components }) {
+    for (const c of components) {
+        if (c.defaultIconByRole && Object.keys(c.defaultIconByRole).length > 0 && !findIconField(c)) {
+            throw new Error(`cairn: component "${c.name}" sets defaultIconByRole but declares no type:'icon' attribute, so the default icon can never render`);
+        }
+    }
     const byName = new Map(components.map((c) => [c.name, c]));
     return {
         defs: components,
         names: components.map((c) => c.name),
         get: (name) => byName.get(name),
         defaultIcon: (name, role) => (role ? byName.get(name)?.defaultIconByRole?.[role] : undefined),
+        iconField: (name) => {
+            const def = byName.get(name);
+            return def ? findIconField(def) : undefined;
+        },
     };
 }
 /** Seed an empty {@link ComponentValues} from a component's schema: attribute defaults (or '' / false)

package/dist/render/rehype-dispatch.d.ts

@@ -1,6 +1,9 @@
 import type { Root, Element, ElementContent } from 'hast';
-import { type ComponentRegistry } from './registry.js';
+import { type ComponentContext, type ComponentRegistry } from './registry.js';
 export declare function isElement(node: ElementContent | undefined): node is Element;
+/** Read a declared string attribute off the component context, returning undefined for a boolean or
+ *  absent value. Replaces the `typeof ctx.attributes[key] === 'string'` narrowing a build repeats. */
+export declare function strAttr(ctx: ComponentContext, key: string): string | undefined;
 export declare function strProp(node: Element, name: string): string | undefined;
 /** Wrap a pre-built glyph in an ec-icon span; secondary role adds the modifier. */
 export declare function iconSpan(glyphEl: Element, role?: string): Element;
@@ -8,11 +11,11 @@ export declare function iconSpan(glyphEl: Element, role?: string): Element;
 export type MakeIcon = (name: string, role?: string) => Element;
 /** Section wrapper: `<section class=…><div class="card-body">…</div></section>`. */
 export declare function cardShell(classes: string[], body: ElementContent[]): Element;
-/** Card head row: `<div class="ec-head">[icon]<h2 class="card-title">{title}</h2></div>`.
- *  Pass the title's inline children and an optional pre-built icon element, the way `cardShell`
- *  takes already-built body content. This factors the icon-plus-heading head that a titled
- *  component build would otherwise rebuild by hand (the shape the removed `splitHead` produced). */
-export declare function headRow(title: ElementContent[], icon?: Element): Element;
+/** Card head row: `<div class="ec-head">[icon]<hN class="card-title">{title}</hN></div>`.
+ *  Pass the title's inline children, an optional pre-built icon element, and an optional heading
+ *  level (default 2). This factors the icon-plus-heading head that a titled component build would
+ *  otherwise rebuild by hand (the shape the removed `splitHead` produced). */
+export declare function headRow(title: ElementContent[], icon?: Element, level?: number): Element;
 /** Tag the first <ul> among children with `ec-grid` and strip its whitespace-only
  *  text nodes so the bare list serializes without newlines. Returns that <ul>. */
 export declare function markFirstList(children: ElementContent[]): Element | undefined;
@@ -23,4 +26,3 @@ export declare function markFirstList(children: ElementContent[]): Element | und
  *  `data-rise` while dropping `style`. Nested primitives never get it. Non-primitive
  *  content (lede, intro paragraphs, the page-toc nav) passes through untouched. */
 export declare function rehypeDispatch(registry: ComponentRegistry, stagger?: boolean): (tree: Root) => void;
-//# sourceMappingURL=rehype-dispatch.d.ts.map

package/dist/render/rehype-dispatch.js

@@ -3,6 +3,12 @@ import { dataAttrProp } from './registry.js';
 export function isElement(node) {
     return !!node && node.type === 'element';
 }
+/** Read a declared string attribute off the component context, returning undefined for a boolean or
+ *  absent value. Replaces the `typeof ctx.attributes[key] === 'string'` narrowing a build repeats. */
+export function strAttr(ctx, key) {
+    const value = ctx.attributes[key];
+    return typeof value === 'string' ? value : undefined;
+}
 // hast Properties values are PropertyValue (string | number | boolean | array | null).
 // Directive markers (dataPrimitive/dataRole/dataAttr<Key>) are always stamped as strings;
 // this reads them back with that guarantee instead of casting at each call site.
@@ -19,15 +25,15 @@ export function iconSpan(glyphEl, role) {
 export function cardShell(classes, body) {
     return h('section', { className: classes }, [h('div', { className: ['card-body'] }, body)]);
 }
-/** Card head row: `<div class="ec-head">[icon]<h2 class="card-title">{title}</h2></div>`.
- *  Pass the title's inline children and an optional pre-built icon element, the way `cardShell`
- *  takes already-built body content. This factors the icon-plus-heading head that a titled
- *  component build would otherwise rebuild by hand (the shape the removed `splitHead` produced). */
-export function headRow(title, icon) {
+/** Card head row: `<div class="ec-head">[icon]<hN class="card-title">{title}</hN></div>`.
+ *  Pass the title's inline children, an optional pre-built icon element, and an optional heading
+ *  level (default 2). This factors the icon-plus-heading head that a titled component build would
+ *  otherwise rebuild by hand (the shape the removed `splitHead` produced). */
+export function headRow(title, icon, level = 2) {
     const children = [];
     if (icon)
         children.push(icon);
-    children.push(h('h2', { className: ['card-title'] }, title));
+    children.push(h(`h${level}`, { className: ['card-title'] }, title));
     return h('div', { className: ['ec-head'] }, children);
 }
 /** Tag the first <ul> among children with `ec-grid` and strip its whitespace-only

package/dist/render/remark-directives.d.ts

@@ -1,4 +1,3 @@
 import type { Root } from 'mdast';
 import { type ComponentRegistry } from './registry.js';
 export declare function remarkDirectiveStamp(registry: ComponentRegistry): (tree: Root) => void;
-//# sourceMappingURL=remark-directives.d.ts.map

package/dist/render/remark-directives.js

@@ -60,7 +60,7 @@ export function remarkDirectiveStamp(registry) {
             const def = registry.get(node.name);
             const attrs = node.attributes ?? {};
             const role = attrs.role || undefined;
-            const iconField = def?.attributes?.find((field) => field.type === 'icon');
+            const iconField = registry.iconField(node.name);
             const iconKey = iconField?.key ?? 'icon';
             let icon = attrs[iconKey] || undefined;
             if (!icon && role)

package/dist/render/resolve-links.d.ts

@@ -5,4 +5,3 @@ export declare const CAIRN_RESOLVE = "cairnResolve";
  *  pass through. A missing target is marked with the cairn-broken-link class (the resolver returns
  *  undefined) or, when the resolver throws, the error propagates and fails the build. */
 export declare function remarkResolveCairnLinks(): (tree: unknown, file: VFile) => void;
-//# sourceMappingURL=resolve-links.d.ts.map

package/dist/render/sanitize-schema.d.ts

@@ -18,4 +18,17 @@ export declare function buildSanitizeSchema(registry: ComponentRegistry, extend?
  * `anchorRel` option (default `noopener noreferrer`); a site can override it or disable it entirely.
  */
 export declare function rehypeAnchorRel(rel: string): (tree: Root) => void;
-//# sourceMappingURL=sanitize-schema.d.ts.map
+/**
+ * Post-dispatch safety floor over the fully-built tree. The pre-dispatch rehype-sanitize floor
+ * cleans author content, but a component build() runs after it and can route a raw author
+ * attribute value into a sink. This guard runs last and neutralizes those sinks on every element
+ * no matter which plugin or which build() produced it: an unsafe URL scheme in a URL-bearing
+ * attribute, an inline on* event handler, or an inline style (stripped wholesale, matching the
+ * floor and cairn's class-driven styling). It is gated by the same unsafeDisableSanitize switch as
+ * the floor.
+ *
+ * The guard's boundary is the URL scheme check plus the on* and style strip. It does not remove a
+ * build()-emitted raw script, style, or iframe srcdoc element node. A build() that emits those is
+ * running site-developer code, and author markdown is cleaned by the pre-dispatch floor.
+ */
+export declare function rehypeSinkGuard(): (tree: Root) => void;