@glw907/cairn-cms 0.26.0 → 0.33.0

package/dist/render/sanitize-schema.js

@@ -56,3 +56,99 @@ export function rehypeAnchorRel(rel) {
         });
     };
 }
+// URL-bearing hast properties the post-dispatch guard scheme-checks. hast camelCases attribute
+// names through property-information (srcset -> srcSet, xlink:href -> xLinkHref with a capital L,
+// formaction -> formAction). data is the <object data> URL attribute; data-* attributes camelCase
+// to dataFoo and are not matched here.
+const URL_PROPS = new Set([
+    'href',
+    'src',
+    'srcSet',
+    'xLinkHref',
+    'poster',
+    'formAction',
+    'action',
+    'data',
+    'background',
+]);
+// The safe URL schemes: the union of every protocol list in defaultSchema, plus cairn. The
+// floor admits these and strips the rest, so deriving from the same source keeps the floor and
+// this guard from drifting on what a safe scheme is. javascript:/data:/vbscript: are never in
+// defaultSchema, so they are never safe.
+const SAFE_SCHEMES = (() => {
+    const protocols = defaultSchema.protocols ?? {};
+    const schemes = new Set(['cairn']);
+    for (const list of Object.values(protocols)) {
+        for (const scheme of list ?? [])
+            schemes.add(String(scheme).toLowerCase());
+    }
+    return schemes;
+})();
+// Read a URL value's scheme for the safety check, defeating the whitespace and control-character
+// tricks a browser ignores inside a scheme (java\tscript:, a leading space). A value with no
+// scheme (relative, anchor, query) returns undefined and is always safe.
+function urlScheme(value) {
+    const cleaned = value.replace(/[\x00-\x20]+/g, '');
+    const match = /^([a-z][a-z0-9+.-]*):/i.exec(cleaned);
+    return match ? match[1].toLowerCase() : undefined;
+}
+function isSafeUrl(value) {
+    const scheme = urlScheme(value);
+    return scheme === undefined || SAFE_SCHEMES.has(scheme);
+}
+// srcset is "url descriptor, url descriptor, …". hast may store it as a string or, because
+// property-information marks it comma-separated, as a string array. One unsafe candidate makes
+// the whole attribute unsafe.
+function isSafeSrcset(value) {
+    const candidates = Array.isArray(value)
+        ? value.map(String)
+        : typeof value === 'string'
+            ? value.split(',')
+            : [];
+    return candidates.every((candidate) => {
+        const url = candidate.trim().split(/\s+/)[0];
+        return url === '' || isSafeUrl(url);
+    });
+}
+// Decide whether one URL-bearing property value is safe to keep. srcset has its own
+// multi-candidate grammar. A non-string value carries no scheme to abuse, so the floor's own
+// handling stands and the guard leaves it alone.
+function isSafeUrlProp(key, value) {
+    if (key === 'srcSet')
+        return isSafeSrcset(value);
+    if (typeof value !== 'string')
+        return true;
+    return isSafeUrl(value);
+}
+/**
+ * Post-dispatch safety floor over the fully-built tree. The pre-dispatch rehype-sanitize floor
+ * cleans author content, but a component build() runs after it and can route a raw author
+ * attribute value into a sink. This guard runs last and neutralizes those sinks on every element
+ * no matter which plugin or which build() produced it: an unsafe URL scheme in a URL-bearing
+ * attribute, an inline on* event handler, or an inline style (stripped wholesale, matching the
+ * floor and cairn's class-driven styling). It is gated by the same unsafeDisableSanitize switch as
+ * the floor.
+ *
+ * The guard's boundary is the URL scheme check plus the on* and style strip. It does not remove a
+ * build()-emitted raw script, style, or iframe srcdoc element node. A build() that emits those is
+ * running site-developer code, and author markdown is cleaned by the pre-dispatch floor.
+ */
+export function rehypeSinkGuard() {
+    return (tree) => {
+        visit(tree, 'element', (node) => {
+            const props = node.properties;
+            if (!props)
+                return;
+            for (const key of Object.keys(props)) {
+                if (/^on/i.test(key) || key === 'style') {
+                    delete props[key];
+                    continue;
+                }
+                if (!URL_PROPS.has(key))
+                    continue;
+                if (!isSafeUrlProp(key, props[key]))
+                    delete props[key];
+            }
+        });
+    };
+}

package/dist/sveltekit/auth-routes.d.ts

@@ -20,4 +20,3 @@ export declare function createAuthRoutes(config: AuthRoutesConfig): {
     confirmAction: (event: RequestContext) => Promise<never>;
     logoutAction: (event: RequestContext) => Promise<never>;
 };
-//# sourceMappingURL=auth-routes.d.ts.map

package/dist/sveltekit/content-routes.d.ts

@@ -8,11 +8,12 @@ export interface NavConcept {
     id: string;
     label: string;
 }
-/** The admin layout's data: site identity, the signed-in user, the nav, and the active path. */
+/** The admin layout's data: site identity, the signed-in user, the nav, the active path, and theme. */
 export interface LayoutData {
     siteName: string;
     user: {
         displayName: string;
+        email: string;
         role: Role;
     };
     concepts: NavConcept[];
@@ -20,6 +21,11 @@ export interface LayoutData {
     canManageEditors: boolean;
     /** The nav menu's label when the site configures one; gates the Navigation nav entry. Null otherwise. */
     navLabel: string | null;
+    /** The admin theme resolved for SSR: the persisted cookie choice, or the light default. */
+    theme: 'cairn-admin' | 'cairn-admin-dark';
+    /** The nav group labels the user has collapsed, from the persisted cookie. Read at SSR so a
+     *  collapsed group renders collapsed with no flash. Empty when none are collapsed. */
+    collapsedNav: string[];
 }
 /** One row in a concept's list view. */
 export interface EntrySummary {
@@ -72,6 +78,10 @@ export interface ContentEvent {
     platform?: {
         env?: GithubKeyEnv;
     };
+    /** SvelteKit's cookie jar; the layout load reads the persisted admin theme. Optional for non-route callers. */
+    cookies?: {
+        get(name: string): string | undefined;
+    };
 }
 /** Injectable dependencies; tests stub the token mint to avoid signing a real key. */
 export interface ContentRoutesDeps {
@@ -86,7 +96,7 @@ export declare function createContentRoutes(runtime: CairnRuntime, deps?: Conten
     editLoad: (event: ContentEvent) => Promise<EditData>;
     saveAction: (event: ContentEvent) => Promise<ReturnType<typeof fail> | never>;
     deleteAction: (event: ContentEvent) => Promise<ReturnType<typeof fail> | never>;
+    listDeleteAction: (event: ContentEvent) => Promise<ReturnType<typeof fail> | never>;
     renameAction: (event: ContentEvent) => Promise<ReturnType<typeof fail> | never>;
     mintToken: (env: GithubKeyEnv) => Promise<string>;
 };
-//# sourceMappingURL=content-routes.d.ts.map

package/dist/sveltekit/content-routes.js

@@ -29,16 +29,24 @@ function conceptOf(runtime, params) {
 }
 export function createContentRoutes(runtime, deps = {}) {
     const mintToken = deps.mintToken ?? ((env) => cachedInstallationToken(appCredentials(runtime.backend, env)));
-    /** Layout load for every admin page: the nav, the user, and the active path. */
+    /** Layout load for every admin page: the nav, the user, the active path, and the resolved theme. */
     function layoutLoad(event) {
         const editor = sessionOf(event);
+        const cookieTheme = event.cookies?.get('cairn-admin-theme');
+        const theme = cookieTheme === 'cairn-admin-dark' ? 'cairn-admin-dark' : 'cairn-admin';
+        const cookieCollapsed = event.cookies?.get('cairn-admin-nav-collapsed');
+        const collapsedNav = cookieCollapsed
+            ? cookieCollapsed.split(',').map((part) => decodeURIComponent(part)).filter(Boolean)
+            : [];
         return {
             siteName: runtime.siteName,
-            user: { displayName: editor.displayName, role: editor.role },
+            user: { displayName: editor.displayName, email: editor.email, role: editor.role },
             concepts: runtime.concepts.map((c) => ({ id: c.id, label: c.label })),
             pathname: event.url.pathname,
             canManageEditors: editor.role === 'owner',
             navLabel: runtime.navMenu?.label ?? null,
+            theme,
+            collapsedNav,
         };
     }
     /** Redirect /admin to the first concept's list (spec §7.6: land on the first concept). */
@@ -251,15 +259,12 @@ export function createContentRoutes(runtime, deps = {}) {
         const savedQuery = draft.length ? `saved=1&drafts=${encodeURIComponent(draft.join(','))}` : 'saved=1';
         throw redirect(303, `/admin/${concept.id}/${id}?${savedQuery}`);
     }
-    /** Delete an entry. Block-until-clean: refuse while inbound links exist (naming them), else commit
-     *  the file removal and the manifest patch in one commit. The inbound recheck here is the
-     *  authoritative gate, closing the load-to-delete race. */
-    async function deleteAction(event) {
-        const editor = sessionOf(event);
-        const concept = conceptOf(runtime, event.params);
-        const id = event.params.id ?? '';
-        if (!isValidId(id))
-            throw error(400, 'Invalid entry id');
+    /** The shared delete core. Block-until-clean: refuse while inbound links exist (naming them), else
+     *  commit the file removal and the manifest patch in one commit. The inbound recheck here is the
+     *  authoritative gate, closing the load-to-delete race. Both the editor delete (id from params) and
+     *  the list delete (id from the form body) call this with an already-validated id, so the guard is
+     *  enforced once. */
+    async function deleteEntry(event, concept, id, editor) {
         const path = `${concept.dir}/${filenameFromId(id)}`;
         const token = await mintToken(event.platform?.env ?? {});
         // An absent manifest degrades the inbound gate to "allow": with no manifest there is nothing to
@@ -268,7 +273,7 @@ export function createContentRoutes(runtime, deps = {}) {
         const manifest = manifestRaw === null ? emptyManifest() : parseManifest(manifestRaw);
         const inbound = inboundLinks(manifest, concept.id, id);
         if (inbound.length) {
-            return fail(409, { inboundLinks: inbound });
+            return fail(409, { inboundLinks: inbound, id });
         }
         const nextManifest = serializeManifest(removeEntry(manifest, concept.id, id));
         try {
@@ -286,6 +291,25 @@ export function createContentRoutes(runtime, deps = {}) {
         }
         throw redirect(303, `/admin/${concept.id}`);
     }
+    /** Delete an entry from its editor. The id comes from the route param. */
+    async function deleteAction(event) {
+        const editor = sessionOf(event);
+        const concept = conceptOf(runtime, event.params);
+        const id = event.params.id ?? '';
+        if (!isValidId(id))
+            throw error(400, 'Invalid entry id');
+        return deleteEntry(event, concept, id, editor);
+    }
+    /** Delete an entry from the concept list. The id comes from the form body. */
+    async function listDeleteAction(event) {
+        const editor = sessionOf(event);
+        const concept = conceptOf(runtime, event.params);
+        const form = await event.request.formData();
+        const id = String(form.get('id') ?? '');
+        if (!isValidId(id))
+            throw error(400, 'Invalid entry id');
+        return deleteEntry(event, concept, id, editor);
+    }
     /** Rename an entry: change its slug, move the file, and rewrite every inbound cairn token in one
      *  atomic commit, so no internal link breaks. The collision check and the inbound recompute here
      *  are the authoritative gate. The same last-writer-wins manifest race as save and delete applies,
@@ -364,5 +388,5 @@ export function createContentRoutes(runtime, deps = {}) {
         }
         throw redirect(303, `/admin/${concept.id}/${newId}?renamed=1`);
     }
-    return { layoutLoad, indexRedirect, listLoad, createAction, editLoad, saveAction, deleteAction, renameAction, mintToken };
+    return { layoutLoad, indexRedirect, listLoad, createAction, editLoad, saveAction, deleteAction, listDeleteAction, renameAction, mintToken };
 }

package/dist/sveltekit/editors-routes.d.ts

@@ -21,4 +21,3 @@ export declare function createEditorRoutes(): {
         ok: true;
     }>;
 };
-//# sourceMappingURL=editors-routes.d.ts.map

package/dist/sveltekit/guard.d.ts

@@ -6,4 +6,3 @@ export declare function createAuthGuard(): ({ event, resolve }: HandleInput) =>
 export declare function requireSession(event: RequestContext): Editor;
 /** For the management surface: a signed-in owner, or 403 for an editor. */
 export declare function requireOwner(event: RequestContext): Editor;
-//# sourceMappingURL=guard.d.ts.map

package/dist/sveltekit/health.d.ts

@@ -16,4 +16,3 @@ export declare function healthLoad(event: {
         env?: GithubKeyEnv;
     };
 }, runtime: CairnRuntime): Promise<HealthData>;
-//# sourceMappingURL=health.d.ts.map

package/dist/sveltekit/index.d.ts

@@ -7,6 +7,4 @@ export { createNavRoutes } from './nav-routes.js';
 export type { NavLoadData, NavPageOption, NavRoutesDeps } from './nav-routes.js';
 export { healthLoad, type HealthData } from './health.js';
 export type { RequestContext, CookieJar, HandleInput } from './types.js';
-export { createPublicRoutes } from './public-routes.js';
-export type { PublicRoutesDeps, ListData as PublicListData, TagData, TagIndexData, EntryData, } from './public-routes.js';
-//# sourceMappingURL=index.d.ts.map
+export type { GithubKeyEnv } from '../github/credentials.js';

package/dist/sveltekit/index.js

@@ -6,4 +6,3 @@ export { createEditorRoutes } from './editors-routes.js';
 export { createContentRoutes } from './content-routes.js';
 export { createNavRoutes } from './nav-routes.js';
 export { healthLoad } from './health.js';
-export { createPublicRoutes } from './public-routes.js';

package/dist/sveltekit/nav-routes.d.ts

@@ -27,4 +27,3 @@ export declare function createNavRoutes(runtime: CairnRuntime, deps?: NavRoutesD
     navLoad: (event: ContentEvent) => Promise<NavLoadData>;
     navSave: (event: ContentEvent) => Promise<never>;
 };
-//# sourceMappingURL=nav-routes.d.ts.map

package/dist/sveltekit/public-routes.d.ts

@@ -64,4 +64,3 @@ export declare function createPublicRoutes(deps: PublicRoutesDeps): {
         path: string;
     }[];
 };
-//# sourceMappingURL=public-routes.d.ts.map

package/dist/sveltekit/types.d.ts

@@ -35,4 +35,3 @@ export interface HandleInput {
     event: RequestContext;
     resolve(event: RequestContext): Promise<Response> | Response;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/vite/bin.d.ts

@@ -1,3 +1,2 @@
 #!/usr/bin/env node
 export {};
-//# sourceMappingURL=bin.d.ts.map

package/dist/vite/index.d.ts

@@ -30,4 +30,3 @@ export declare function cairnManifest(opts: CairnManifestOptions): Plugin;
  *  resolution, and writes the serialized manifest. The cairn-manifest bin calls this; it is exported
  *  so the write logic is testable apart from the CLI shell. */
 export declare function writeManifest(cwd?: string): Promise<void>;
-//# sourceMappingURL=index.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@glw907/cairn-cms",
-  "version": "0.26.0",
+  "version": "0.33.0",
   "description": "Embedded, magic-link, GitHub-committing CMS for SvelteKit/Cloudflare sites.",
   "type": "module",
   "sideEffects": [
@@ -26,8 +26,10 @@
     "markdown"
   ],
   "scripts": {
-    "package": "svelte-package && chmod +x dist/vite/bin.js",
+    "package": "svelte-package && node scripts/build-admin-css.mjs && chmod +x dist/vite/bin.js",
     "check:package": "npm run package && publint --strict && attw --pack . --ignore-rules no-resolution cjs-resolves-to-esm internal-resolution-error",
+    "check:reference": "npm run package && node scripts/reference-coverage.mjs",
+    "check:docs": "node scripts/docs-links.mjs",
     "prepare": "npm run package",
     "check": "svelte-check --tsconfig ./tsconfig.json",
     "test": "vitest run",
@@ -52,6 +54,11 @@
       "svelte": "./dist/components/index.js",
       "default": "./dist/components/index.js"
     },
+    "./render": {
+      "types": "./dist/render/authoring.d.ts",
+      "svelte": "./dist/render/authoring.js",
+      "default": "./dist/render/authoring.js"
+    },
     "./delivery": {
       "types": "./dist/delivery/index.d.ts",
       "svelte": "./dist/delivery/index.js",
@@ -92,6 +99,7 @@
     "@codemirror/language": "^6.12.3",
     "@codemirror/state": "^6.6.0",
     "@codemirror/view": "^6.43.0",
+    "@lucide/svelte": "^1.17.0",
     "@rodrigodagostino/svelte-sortable-list": "^2.1.17",
     "@types/hast": "^3.0.4",
     "@types/mdast": "^4.0.4",
@@ -120,13 +128,19 @@
     "@sveltejs/kit": "^2.61",
     "@sveltejs/package": "^2",
     "@sveltejs/vite-plugin-svelte": "^7.1",
+    "@tailwindcss/postcss": "^4.3.0",
     "@types/node": "^22.19.19",
     "@vitest/browser": "^4.1.7",
     "@vitest/browser-playwright": "^4.1.7",
+    "daisyui": "^5.5.23",
+    "lightningcss": "^1.32.0",
     "playwright": "^1.60.0",
+    "postcss": "^8.5.15",
+    "postcss-prefix-selector": "^2.1.1",
     "publint": "^0.3.21",
     "svelte": "^5.55",
     "svelte-check": "^4",
+    "tailwindcss": "^4.3.0",
     "typescript": "^6.0.3",
     "vite": "^8.0",
     "vitest": "^4.1",