@glw907/cairn-cms 0.4.0 → 0.5.1

package/dist/sveltekit/index.d.ts

@@ -1,7 +1,7 @@
 import type { CairnUser } from '../auth/guard';
-import { type RepoFile } from '../github';
 import { type CairnAdapter, type CairnField } from '../adapter';
-/** The `platform.env` bindings the content routes read. All optional — the handlers guard. */
+import { type NavNode } from '../nav';
+/** The `platform.env` bindings the content routes read. All optional; the handlers guard. */
 export interface AdminEnv {
     GITHUB_APP_ID?: string;
     GITHUB_APP_INSTALLATION_ID?: string;
@@ -12,17 +12,31 @@ interface PlatformEvent {
         env?: AdminEnv;
     };
 }
+/** A collection reduced to what the sidebar nav needs (no plugin graph crosses to the client). */
+export interface NavCollection {
+    type: string;
+    label: string;
+}
 export interface AdminLayoutData {
     user: CairnUser | null;
     siteName: string;
     pathname: string;
+    collections: NavCollection[];
+    /** Managed menus (name+label only) so the shell can show a Navigation entry. */
+    navMenus: {
+        name: string;
+        label: string;
+    }[];
+    /** Whether the viewer may manage navigation (gates the Navigation nav entry). */
+    canManageNav: boolean;
 }
 /**
- * Branding + session for every admin page. `siteName` flows from the adapter without pulling
- * its plugin graph into client bundles — the import stays server-side in the layout load.
- * `pathname` lets the shared shell highlight the active nav item without a `$app/*` import
- * (those kit virtual modules have no types outside a kit app, so they can't live in the
- * package); reading `event.url` here also opts the layout load into rerunning on navigation.
+ * Branding, session, and collection nav for every admin page. `siteName` and the collection
+ * list flow from the adapter without pulling its plugin graph into client bundles (the import
+ * stays server-side in the layout load; only `{type,label}` crosses). `pathname` lets the
+ * shared shell highlight the active nav item without a `$app/*` import (those kit virtual
+ * modules have no types outside a kit app); reading `event.url` also opts the layout load into
+ * rerunning on navigation, keeping the active class correct.
  */
 export declare function adminLayoutLoad(event: {
     locals: {
@@ -30,20 +44,66 @@ export declare function adminLayoutLoad(event: {
     };
     url: URL;
 }, adapter: CairnAdapter): AdminLayoutData;
-export interface AdminCollectionList {
+/**
+ * The `/admin` index has no content of its own now that each collection is its own page; send
+ * the editor straight to the first collection's entries list (a Sveltia-style landing).
+ */
+export declare function adminIndexRedirect(adapter: CairnAdapter): never;
+/** One entry row: id (filename stem), display title, optional date, draft flag. */
+export interface CollectionEntry {
+    id: string;
+    path: string;
+    title: string;
+    date: string | null;
+    draft: boolean;
+}
+export interface CollectionListData {
     type: string;
     label: string;
-    files: RepoFile[];
+    kind: 'page' | 'story';
+    entries: CollectionEntry[];
+    /** Set when the directory listing itself failed (rate limit, network). */
     error?: string;
+    /** A create-flow error bounced back via `?error=` (an invalid or taken slug). */
+    formError: string | null;
+    /** Whether the viewer may create an entry in this collection (page-create is owner-only). */
+    canCreate: boolean;
 }
-/** List every collection's markdown files. A failed listing degrades to an inline error. */
-export declare function adminListLoad(event: PlatformEvent, adapter: CairnAdapter): Promise<{
-    collections: AdminCollectionList[];
-}>;
+/**
+ * List one collection's entries, reading each file's frontmatter for the display title, date,
+ * and draft badge. Reads run in parallel; a single failed read degrades that row to the slug
+ * (rather than failing the page), and a failed directory listing returns an inline `error`.
+ * Collections are small here; the 1,000-entry / Git-Trees sharding concern is risk #11, deferred.
+ */
+export declare function collectionListLoad(event: PlatformEvent & {
+    params: {
+        collection: string;
+    };
+    url: URL;
+    locals: {
+        user: CairnUser | null;
+    };
+}, adapter: CairnAdapter): Promise<CollectionListData>;
+/**
+ * The "New entry" form action. Validates the requested slug, rejects one that already exists,
+ * then redirects into the editor in create mode (`?new=1`, where `editLoad` serves a blank
+ * document and `saveCommit`'s create path commits a new file). cairn is filename-based, so the
+ * slug is the filename stem the author types; a title-driven auto-slug is a later (Pass K) concern.
+ */
+export declare function createEntry(event: PlatformEvent & {
+    params: {
+        collection: string;
+    };
+    locals: {
+        user: CairnUser | null;
+    };
+    request: Request;
+}, adapter: CairnAdapter): Promise<never>;
 export interface EditData {
     type: string;
     id: string;
     label: string;
+    kind: 'page' | 'story';
     fields: CairnField[];
     path: string;
     body: string;
@@ -51,6 +111,8 @@ export interface EditData {
     title: string;
     saved: boolean;
     error: string | null;
+    /** True when editing a not-yet-committed new entry (reached via `?new=1`). */
+    isNew: boolean;
 }
 export declare function editLoad(event: PlatformEvent & {
     params: {
@@ -65,5 +127,48 @@ export declare function saveCommit(event: PlatformEvent & {
         user: CairnUser | null;
     };
 }, adapter: CairnAdapter): Promise<never>;
+/** A page the picker can insert: its display label and the URL the nav item points at. */
+export interface NavPageOption {
+    label: string;
+    url: string;
+}
+export interface NavLoadData {
+    menu: {
+        name: string;
+        label: string;
+        maxDepth: number;
+    };
+    tree: NavNode[];
+    pages: NavPageOption[];
+    saved: boolean;
+    error: string | null;
+}
+export declare function navLoad(event: PlatformEvent & {
+    locals: {
+        user: CairnUser | null;
+    };
+    url: URL;
+}, adapter: CairnAdapter): Promise<NavLoadData>;
+export declare function navSave(event: PlatformEvent & {
+    locals: {
+        user: CairnUser | null;
+    };
+    request: Request;
+}, adapter: CairnAdapter): Promise<never>;
+export interface HealthData {
+    ok: boolean;
+    checks: {
+        githubAppSigning: {
+            ok: boolean;
+            detail?: string;
+        };
+    };
+}
+/**
+ * Deploy-time health check (M2): signs a dummy App JWT to prove the GitHub App key loads and
+ * the PKCS#1→PKCS#8 conversion still works, before an editor hits it on save. Behind the
+ * `/admin` guard (signed-in editors only); returns ok/fail with no secret in the body.
+ */
+export declare function healthLoad(event: PlatformEvent): Promise<HealthData>;
 export {};
 //# sourceMappingURL=index.d.ts.map

package/dist/sveltekit/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/sveltekit/index.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAwD,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEhG,OAAO,EAAuC,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAErG,8FAA8F;AAC9F,MAAM,WAAW,QAAQ;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACrC;AAED,UAAU,aAAa;IACrB,QAAQ,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,QAAQ,CAAA;KAAE,CAAC;CAC/B;AA2BD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE;IAAE,MAAM,EAAE;QAAE,IAAI,EAAE,SAAS,GAAG,IAAI,CAAA;KAAE,CAAC;IAAC,GAAG,EAAE,GAAG,CAAA;CAAE,EACvD,OAAO,EAAE,YAAY,GACpB,eAAe,CAEjB;AAID,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,4FAA4F;AAC5F,wBAAsB,aAAa,CACjC,KAAK,EAAE,aAAa,EACpB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC;IAAE,WAAW,EAAE,mBAAmB,EAAE,CAAA;CAAE,CAAC,CAajD;AAID,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,wBAAsB,QAAQ,CAC5B,KAAK,EAAE,aAAa,GAAG;IAAE,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,GAAG,EAAE,GAAG,CAAA;CAAE,EACzE,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC,CAyBnB;AAID,wBAAsB,UAAU,CAC9B,KAAK,EAAE,aAAa,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE;QAAE,IAAI,EAAE,SAAS,GAAG,IAAI,CAAA;KAAE,CAAA;CAAE,EAC/E,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC,CA0ChB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/sveltekit/index.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAY/C,OAAO,EAAuC,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AACrG,OAAO,EAA0D,KAAK,OAAO,EAAE,MAAM,QAAQ,CAAC;AAE9F,6FAA6F;AAC7F,MAAM,WAAW,QAAQ;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACrC;AAED,UAAU,aAAa;IACrB,QAAQ,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,QAAQ,CAAA;KAAE,CAAC;CAC/B;AA2BD,kGAAkG;AAClG,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,gFAAgF;IAChF,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC5C,iFAAiF;IACjF,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE;IAAE,MAAM,EAAE;QAAE,IAAI,EAAE,SAAS,GAAG,IAAI,CAAA;KAAE,CAAC;IAAC,GAAG,EAAE,GAAG,CAAA;CAAE,EACvD,OAAO,EAAE,YAAY,GACpB,eAAe,CASjB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,GAAG,KAAK,CAI/D;AAID,mFAAmF;AACnF,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,6FAA6F;IAC7F,SAAS,EAAE,OAAO,CAAC;CACpB;AASD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,aAAa,GAAG;IAAE,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,GAAG,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE;QAAE,IAAI,EAAE,SAAS,GAAG,IAAI,CAAA;KAAE,CAAA;CAAE,EACvG,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,kBAAkB,CAAC,CA0D7B;AAOD;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE,aAAa,GAAG;IACrB,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/B,MAAM,EAAE;QAAE,IAAI,EAAE,SAAS,GAAG,IAAI,CAAA;KAAE,CAAC;IACnC,OAAO,EAAE,OAAO,CAAC;CAClB,EACD,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC,CAsBhB;AAID,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,8EAA8E;IAC9E,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,wBAAsB,QAAQ,CAC5B,KAAK,EAAE,aAAa,GAAG;IAAE,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,GAAG,EAAE,GAAG,CAAA;CAAE,EACzE,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC,CAqCnB;AAID,wBAAsB,UAAU,CAC9B,KAAK,EAAE,aAAa,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE;QAAE,IAAI,EAAE,SAAS,GAAG,IAAI,CAAA;KAAE,CAAA;CAAE,EAC/E,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC,CAqDhB;AAID,0FAA0F;AAC1F,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAmBD,wBAAsB,OAAO,CAC3B,KAAK,EAAE,aAAa,GAAG;IAAE,MAAM,EAAE;QAAE,IAAI,EAAE,SAAS,GAAG,IAAI,CAAA;KAAE,CAAC;IAAC,GAAG,EAAE,GAAG,CAAA;CAAE,EACvE,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC,CAyBtB;AAED,wBAAsB,OAAO,CAC3B,KAAK,EAAE,aAAa,GAAG;IAAE,MAAM,EAAE;QAAE,IAAI,EAAE,SAAS,GAAG,IAAI,CAAA;KAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,EAC/E,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC,CAgDhB;AAID,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE;QAAE,gBAAgB,EAAE;YAAE,EAAE,EAAE,OAAO,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;CAChE;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAS1E"}

package/dist/sveltekit/index.js

@@ -2,22 +2,24 @@
 // route files are thin shims (`export const load = (event) => editLoad(event, cairn)`).
 //
 // SvelteKit's filesystem routing requires the route *files* to live in each site's
-// `src/routes/`, but their bodies are identical across sites — only the adapter differs.
+// `src/routes/`, but their bodies are identical across sites. Only the adapter differs.
 // These functions take the SvelteKit event (typed structurally, to avoid depending on the
 // site-generated `App.*` ambient types) plus the site `CairnAdapter`, and throw
 // `redirect`/`error` from `@sveltejs/kit` (a peer dependency, so the thrown objects share
-// class identity with the host's runtime — else the redirect 500s). Auth/session/manage-editors
+// class identity with the host's runtime; otherwise the redirect 500s). Auth/session/manage-editors
 // logic lives under `@glw907/cairn-cms/auth`; this module is content-only (list/edit/save).
 import { redirect, error } from '@sveltejs/kit';
 import matter from 'gray-matter';
-import { listMarkdown, readRaw, commitFile, installationToken } from '../github';
+import { can, requireCapability } from '../auth/capabilities';
+import { listMarkdown, readRaw, commitFile, installationToken, signingSelfTest, CommitConflictError, } from '../github';
 import { serializeMarkdown } from '../content';
 import { findCollection, frontmatterFromForm } from '../adapter';
+import { validateNavTree, extractMenu, parseSiteConfig, setMenu } from '../nav';
 /**
  * Mint a GitHub App installation token for *reads* when the App is configured, else undefined
  * (reads then fall back to anonymous). Authenticated reads get the 5000/hr limit; anonymous
  * reads share GitHub's 60/hr-per-IP budget across Cloudflare's egress IPs, so they 403 in prod.
- * A mint failure degrades gracefully to anonymous rather than 500ing — unlike the commit path,
+ * A mint failure degrades gracefully to anonymous rather than 500ing. Unlike the commit path,
  * where a missing App is fatal, a read can still succeed unauthenticated.
  */
 async function readToken(env) {
@@ -37,28 +39,132 @@ async function readToken(env) {
     }
 }
 /**
- * Branding + session for every admin page. `siteName` flows from the adapter without pulling
- * its plugin graph into client bundles — the import stays server-side in the layout load.
- * `pathname` lets the shared shell highlight the active nav item without a `$app/*` import
- * (those kit virtual modules have no types outside a kit app, so they can't live in the
- * package); reading `event.url` here also opts the layout load into rerunning on navigation.
+ * Branding, session, and collection nav for every admin page. `siteName` and the collection
+ * list flow from the adapter without pulling its plugin graph into client bundles (the import
+ * stays server-side in the layout load; only `{type,label}` crosses). `pathname` lets the
+ * shared shell highlight the active nav item without a `$app/*` import (those kit virtual
+ * modules have no types outside a kit app); reading `event.url` also opts the layout load into
+ * rerunning on navigation, keeping the active class correct.
  */
 export function adminLayoutLoad(event, adapter) {
-    return { user: event.locals.user, siteName: adapter.siteName, pathname: event.url.pathname };
+    return {
+        user: event.locals.user,
+        siteName: adapter.siteName,
+        pathname: event.url.pathname,
+        collections: adapter.collections.map(({ type, label }) => ({ type, label })),
+        navMenus: adapter.navMenu ? [{ name: adapter.navMenu.menuName, label: adapter.navMenu.label }] : [],
+        canManageNav: can(event.locals.user, 'nav:manage'),
+    };
+}
+/**
+ * The `/admin` index has no content of its own now that each collection is its own page; send
+ * the editor straight to the first collection's entries list (a Sveltia-style landing).
+ */
+export function adminIndexRedirect(adapter) {
+    const first = adapter.collections[0];
+    if (!first)
+        throw error(404, 'No collections configured');
+    throw redirect(307, `/admin/${first.type}`);
 }
-/** List every collection's markdown files. A failed listing degrades to an inline error. */
-export async function adminListLoad(event, adapter) {
+/** Coerce a frontmatter `date` (gray-matter may parse YAML dates to `Date`) to `YYYY-MM-DD`. */
+function entryDate(value) {
+    if (value instanceof Date)
+        return value.toISOString().slice(0, 10);
+    if (typeof value === 'string')
+        return value;
+    return null;
+}
+/**
+ * List one collection's entries, reading each file's frontmatter for the display title, date,
+ * and draft badge. Reads run in parallel; a single failed read degrades that row to the slug
+ * (rather than failing the page), and a failed directory listing returns an inline `error`.
+ * Collections are small here; the 1,000-entry / Git-Trees sharding concern is risk #11, deferred.
+ */
+export async function collectionListLoad(event, adapter) {
+    const collection = findCollection(adapter, event.params.collection);
+    if (!collection)
+        throw error(404, 'Unknown collection');
+    const kind = collection.kind ?? 'story';
+    const canCreate = can(event.locals.user, kind === 'page' ? 'page:create' : 'story:create');
+    const formError = event.url.searchParams.get('error');
     const token = await readToken(event.platform?.env);
-    const collections = await Promise.all(adapter.collections.map(async ({ type, label, dir }) => {
+    let files;
+    try {
+        files = await listMarkdown(adapter.backend, collection.dir, token);
+    }
+    catch (err) {
+        return {
+            type: collection.type,
+            label: collection.label,
+            kind,
+            entries: [],
+            error: err instanceof Error ? err.message : 'Failed to load',
+            formError,
+            canCreate,
+        };
+    }
+    const entries = await Promise.all(files.map(async (file) => {
+        const fallback = {
+            id: file.id,
+            path: file.path,
+            title: file.id,
+            date: null,
+            draft: false,
+        };
         try {
-            return { type, label, files: await listMarkdown(adapter.backend, dir, token) };
+            const raw = await readRaw(adapter.backend, file.path, token);
+            if (raw === null)
+                return fallback;
+            const { data } = matter(raw);
+            return {
+                id: file.id,
+                path: file.path,
+                title: typeof data.title === 'string' ? data.title : file.id,
+                date: entryDate(data.date),
+                draft: data.draft === true,
+            };
         }
-        catch (err) {
-            // A failed listing (rate limit, network) shouldn't 500 the whole admin.
-            return { type, label, files: [], error: err instanceof Error ? err.message : 'Failed to load' };
+        catch {
+            return fallback;
         }
     }));
-    return { collections };
+    return {
+        type: collection.type,
+        label: collection.label,
+        kind,
+        entries,
+        formError,
+        canCreate,
+    };
+}
+// ── /admin/[collection]?/create (POST) ─────────────────────────────────────
+/** A safe filename stem: starts and ends with a lowercase alphanumeric, hyphens allowed within. */
+const SLUG_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
+/**
+ * The "New entry" form action. Validates the requested slug, rejects one that already exists,
+ * then redirects into the editor in create mode (`?new=1`, where `editLoad` serves a blank
+ * document and `saveCommit`'s create path commits a new file). cairn is filename-based, so the
+ * slug is the filename stem the author types; a title-driven auto-slug is a later (Pass K) concern.
+ */
+export async function createEntry(event, adapter) {
+    const collection = findCollection(adapter, event.params.collection);
+    if (!collection)
+        throw error(404, 'Unknown collection');
+    const kind = collection.kind ?? 'story';
+    requireCapability(event.locals.user, kind === 'page' ? 'page:create' : 'story:create');
+    const form = await event.request.formData();
+    const id = String(form.get('id') ?? '').trim();
+    const back = (message) => redirect(303, `/admin/${collection.type}?error=${encodeURIComponent(message)}`);
+    if (!SLUG_RE.test(id)) {
+        throw back('Enter a slug using lowercase letters, numbers, and hyphens (for example 2026-05-my-entry).');
+    }
+    const token = await readToken(event.platform?.env);
+    const existing = await readRaw(adapter.backend, `${collection.dir}/${id}.md`, token);
+    if (existing !== null)
+        throw back(`An entry named "${id}" already exists.`);
+    const date = String(form.get('date') ?? '').trim();
+    const dateSuffix = kind === 'story' && date ? `&date=${encodeURIComponent(date)}` : '';
+    throw redirect(303, `/admin/edit/${collection.type}/${id}?new=1${dateSuffix}`);
 }
 export async function editLoad(event, adapter) {
     const collection = findCollection(adapter, event.params.type);
@@ -67,15 +173,23 @@ export async function editLoad(event, adapter) {
     const token = await readToken(event.platform?.env);
     const path = `${collection.dir}/${event.params.id}.md`;
     const raw = await readRaw(adapter.backend, path, token);
-    if (raw === null)
+    const isNew = event.url.searchParams.get('new') === '1';
+    // A missing file is a 404 normally, but in create mode (`?new=1`) it's a blank new document.
+    if (raw === null && !isNew)
         throw error(404, 'Content not found');
-    // Split frontmatter from body server-side; the editor form binds to the frontmatter and
-    // the Carta editor binds to the body, and /admin/save reassembles them on commit.
-    const { data: frontmatter, content: body } = matter(raw);
+    // Split frontmatter from body server-side; the editor form binds to the frontmatter and the
+    // Carta editor to the body, and /admin/save reassembles them on commit. A new document starts
+    // empty so the author fills the fields from scratch.
+    const { data: frontmatter, content: body } = raw === null ? { data: {}, content: '' } : matter(raw);
+    const seedDate = event.url.searchParams.get('date');
+    if (isNew && seedDate && frontmatter.date === undefined) {
+        frontmatter.date = seedDate;
+    }
     return {
         type: event.params.type,
         id: event.params.id,
         label: collection.label,
+        kind: collection.kind ?? 'story',
         fields: collection.fields,
         path,
         body,
@@ -83,6 +197,7 @@ export async function editLoad(event, adapter) {
         title: typeof frontmatter.title === 'string' ? frontmatter.title : event.params.id,
         saved: event.url.searchParams.get('saved') === '1',
         error: event.url.searchParams.get('error'),
+        isNew,
     };
 }
 // ── /admin/save (POST) ──────────────────────────────────────────────────────
@@ -98,6 +213,7 @@ export async function saveCommit(event, adapter) {
     const type = String(form.get('type') ?? '');
     const id = String(form.get('id') ?? '');
     const body = String(form.get('body') ?? '');
+    const newSuffix = form.get('new') === '1' ? '&new=1' : '';
     const collection = findCollection(adapter, type);
     if (!collection || !id)
         throw error(400, 'Bad request');
@@ -109,7 +225,7 @@ export async function saveCommit(event, adapter) {
     }
     catch (err) {
         const message = err instanceof Error ? err.message : 'Invalid frontmatter';
-        throw redirect(303, `/admin/edit/${type}/${id}?error=${encodeURIComponent(message)}`);
+        throw redirect(303, `/admin/edit/${type}/${id}?error=${encodeURIComponent(message)}${newSuffix}`);
     }
     const markdown = serializeMarkdown(frontmatter, body);
     const token = await installationToken({
@@ -117,6 +233,116 @@ export async function saveCommit(event, adapter) {
         installationId: env.GITHUB_APP_INSTALLATION_ID,
         privateKeyB64: env.GITHUB_APP_PRIVATE_KEY_B64,
     });
-    await commitFile(adapter.backend, `${collection.dir}/${id}.md`, markdown, { message: `Update ${collection.label.toLowerCase()}: ${id}`, author: { name: user.name, email: user.email } }, token);
+    try {
+        await commitFile(adapter.backend, `${collection.dir}/${id}.md`, markdown, { message: `Update ${collection.label.toLowerCase()}: ${id}`, author: { name: user.name, email: user.email } }, token);
+    }
+    catch (err) {
+        // Concurrent-edit 409 (C3): fail safe. Bounce back with a reload prompt; the editor reloads
+        // the current version and reapplies. Any other error is unexpected, so rethrow.
+        if (err instanceof CommitConflictError) {
+            const message = 'This file changed since you opened it. Reload and reapply your edits.';
+            throw redirect(303, `/admin/edit/${type}/${id}?error=${encodeURIComponent(message)}${newSuffix}`);
+        }
+        throw err;
+    }
     throw redirect(303, `/admin/edit/${type}/${id}?saved=1`);
 }
+/** List page-collection entries for the picker (one directory listing per page collection). */
+async function navPageOptions(adapter, env) {
+    const token = await readToken(env);
+    const pageCollections = adapter.collections.filter((c) => (c.kind ?? 'story') === 'page');
+    const lists = await Promise.all(pageCollections.map(async (c) => {
+        try {
+            const files = await listMarkdown(adapter.backend, c.dir, token);
+            return files.map((f) => ({ label: f.id, url: `/${f.id}` }));
+        }
+        catch {
+            return [];
+        }
+    }));
+    return lists.flat();
+}
+export async function navLoad(event, adapter) {
+    requireCapability(event.locals.user, 'nav:manage');
+    const config = adapter.navMenu;
+    if (!config)
+        throw error(404, 'No navigation menu configured');
+    const maxDepth = config.maxDepth ?? 2;
+    const menu = { name: config.menuName, label: config.label, maxDepth };
+    // Read the menu from the committed YAML. A missing/unparsable file degrades to an empty tree so
+    // the editor still loads (a first edit then creates the menu); only the read itself is best-effort.
+    const token = await readToken(event.platform?.env);
+    let tree = [];
+    try {
+        const raw = await readRaw(adapter.backend, config.configPath, token);
+        if (raw !== null)
+            tree = extractMenu(parseSiteConfig(raw), config.menuName, maxDepth);
+    }
+    catch (err) {
+        console.error(`cairn nav: failed to read "${config.configPath}":`, err);
+    }
+    return {
+        menu,
+        tree,
+        pages: await navPageOptions(adapter, event.platform?.env),
+        saved: event.url.searchParams.get('saved') === '1',
+        error: event.url.searchParams.get('error'),
+    };
+}
+export async function navSave(event, adapter) {
+    const user = requireCapability(event.locals.user, 'nav:manage');
+    const config = adapter.navMenu;
+    if (!config)
+        throw error(404, 'No navigation menu configured');
+    const maxDepth = config.maxDepth ?? 2;
+    const env = event.platform?.env;
+    if (!env?.GITHUB_APP_ID || !env.GITHUB_APP_INSTALLATION_ID || !env.GITHUB_APP_PRIVATE_KEY_B64) {
+        throw error(500, 'GitHub App is not configured');
+    }
+    const form = await event.request.formData();
+    let tree;
+    try {
+        tree = validateNavTree(JSON.parse(String(form.get('tree') ?? '[]')), maxDepth);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : 'Invalid navigation';
+        throw redirect(303, `/admin/nav?error=${encodeURIComponent(message)}`);
+    }
+    const token = await installationToken({
+        appId: env.GITHUB_APP_ID,
+        installationId: env.GITHUB_APP_INSTALLATION_ID,
+        privateKeyB64: env.GITHUB_APP_PRIVATE_KEY_B64,
+    });
+    // Read-modify-commit: replace only this menu in the current file, preserving the rest.
+    const raw = await readRaw(adapter.backend, config.configPath, token);
+    if (raw === null)
+        throw error(404, `Site config not found at ${config.configPath}`);
+    try {
+        await commitFile(adapter.backend, config.configPath, setMenu(raw, config.menuName, tree), { message: `Update ${config.label.toLowerCase()}`, author: { name: user.name, email: user.email } }, token);
+    }
+    catch (err) {
+        // Concurrent-edit 409 (C3): fail safe, same as the content save path.
+        if (err instanceof CommitConflictError) {
+            const message = 'The site config changed since you opened it. Reload and reapply your edits.';
+            throw redirect(303, `/admin/nav?error=${encodeURIComponent(message)}`);
+        }
+        throw err;
+    }
+    throw redirect(303, '/admin/nav?saved=1');
+}
+/**
+ * Deploy-time health check (M2): signs a dummy App JWT to prove the GitHub App key loads and
+ * the PKCS#1→PKCS#8 conversion still works, before an editor hits it on save. Behind the
+ * `/admin` guard (signed-in editors only); returns ok/fail with no secret in the body.
+ */
+export async function healthLoad(event) {
+    const env = event.platform?.env;
+    let githubAppSigning;
+    if (env?.GITHUB_APP_ID && env.GITHUB_APP_PRIVATE_KEY_B64) {
+        githubAppSigning = await signingSelfTest(env.GITHUB_APP_ID, env.GITHUB_APP_PRIVATE_KEY_B64);
+    }
+    else {
+        githubAppSigning = { ok: false, detail: 'GitHub App not configured' };
+    }
+    return { ok: githubAppSigning.ok, checks: { githubAppSigning } };
+}

package/dist/utils.d.ts

@@ -1,3 +1,3 @@
-/** Encode bytes as unpadded base64url (RFC 4648 §5) — the JWT/token wire format. */
+/** Encode bytes as unpadded base64url (RFC 4648 §5), the JWT/token wire format. */
 export declare function bytesToB64url(bytes: Uint8Array): string;
 //# sourceMappingURL=utils.d.ts.map

package/dist/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/lib/utils.ts"],"names":[],"mappings":"AAOA,oFAAoF;AACpF,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAGvD"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/lib/utils.ts"],"names":[],"mappings":"AAOA,mFAAmF;AACnF,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAGvD"}

package/dist/utils.js

@@ -1,10 +1,10 @@
 // cairn-core: internal encoding helpers shared across modules.
 //
-// Deliberately NOT re-exported from index.ts — these are implementation details of the
+// Deliberately NOT re-exported from index.ts. These are implementation details of the
 // auth/github crypto, not part of the public API (auth.ts signs tokens, github.ts builds
 // the App JWT; both need base64url). Keeping them here stops bytesToB64url leaking through
 // the `export *` barrel.
-/** Encode bytes as unpadded base64url (RFC 4648 §5) — the JWT/token wire format. */
+/** Encode bytes as unpadded base64url (RFC 4648 §5), the JWT/token wire format. */
 export function bytesToB64url(bytes) {
     const binary = Array.from(bytes, (b) => String.fromCharCode(b)).join('');
     return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');

package/package.json

@@ -1,8 +1,12 @@
 {
   "name": "@glw907/cairn-cms",
-  "version": "0.4.0",
+  "version": "0.5.1",
   "description": "Embedded, magic-link, GitHub-committing CMS for SvelteKit/Cloudflare sites.",
   "type": "module",
+  "sideEffects": [
+    "**/*.svelte",
+    "**/*.css"
+  ],
   "license": "MIT",
   "author": "Geoff Wright",
   "repository": {
@@ -86,7 +90,21 @@
     "svelte": "^5.0.0"
   },
   "dependencies": {
-    "gray-matter": "^4"
+    "@types/hast": "^3.0.4",
+    "@types/mdast": "^4.0.4",
+    "gray-matter": "^4",
+    "hastscript": "^9.0.1",
+    "mdast-util-directive": "^3.1.0",
+    "rehype-raw": "^7.0.0",
+    "rehype-slug": "^6.0.0",
+    "rehype-stringify": "^10.0.1",
+    "remark-directive": "^4.0.0",
+    "remark-gfm": "^4",
+    "remark-parse": "^11.0.0",
+    "remark-rehype": "^11.1.2",
+    "unified": "^11.0.5",
+    "unist-util-visit": "^5.1.0",
+    "yaml": "^2"
   },
   "devDependencies": {
     "@better-auth/cli": "^1.4.21",
@@ -103,7 +121,6 @@
     "svelte": "^5",
     "svelte-check": "^4",
     "typescript": "^6.0.3",
-    "unified": "^11.0.5",
     "vitest": "^4.1.6"
   }
 }