@glw907/cairn-cms 0.41.0 → 0.50.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@glw907/cairn-cms",
-  "version": "0.41.0",
+  "version": "0.50.0",
   "description": "Embedded, magic-link, GitHub-committing CMS for SvelteKit/Cloudflare sites.",
   "type": "module",
   "sideEffects": [
@@ -80,6 +80,10 @@
       "types": "./dist/vite/index.d.ts",
       "default": "./dist/vite/index.js"
     },
+    "./ambient": {
+      "types": "./dist/ambient.d.ts",
+      "default": "./dist/ambient.js"
+    },
     "./package.json": "./package.json"
   },
   "bin": {

package/src/lib/ambient.ts

@@ -0,0 +1,19 @@
+// The one-line App.Locals augmentation a consumer site imports from src/app.d.ts:
+//
+//   import '@glw907/cairn-cms/ambient';
+//
+// The guard sets `event.locals.editor`, and this declaration types it, so a site no longer
+// hand-writes the `declare global` block. The field is optional: the engine's own structural
+// event types read it as `editor?: Editor | null`, and a request the guard has not touched
+// carries no editor at all.
+import type { Editor } from './auth/types.js';
+
+declare global {
+  namespace App {
+    interface Locals {
+      editor?: Editor | null;
+    }
+  }
+}
+
+export {};

package/src/lib/components/AdminLayout.svelte

@@ -279,7 +279,7 @@ identical on every host regardless of the site's own theme.
             <kbd class="ml-auto hidden rounded border border-[var(--cairn-card-border)] px-1.5 text-[0.6875rem] font-medium sm:inline">&#8984;K</kbd>
           </button>
         </div>
-        {#if pendingCount > 0 && data.concepts.length > 0}
+        {#if pendingCount > 0}
           <div class="flex-none">
             <button type="button" class="btn btn-primary btn-sm" aria-haspopup="dialog" onclick={() => publishAllDialog?.showModal()}>
               Publish site ({pendingCount})
@@ -349,9 +349,7 @@ identical on every host regardless of the site's own theme.
         <form method="dialog" class="modal-backdrop"><button tabindex="-1" aria-label="Close">close</button></form>
       </dialog>
 
-      <!-- The form action below reads data.concepts[0], so zero configured concepts (with a stray
-           pending ref) must hide the dialog along with its trigger. -->
-      {#if pendingCount > 0 && data.concepts.length > 0}
+      {#if pendingCount > 0}
         <dialog bind:this={publishAllDialog} class="modal" aria-labelledby="cairn-publish-all-title">
           <div class="modal-box">
             <div class="mb-3 flex items-center justify-between">
@@ -367,9 +365,9 @@ identical on every host regardless of the site's own theme.
                 {/each}
               </ul>
             {/each}
-            <!-- The publishAll action is mounted on every concept-list shim; the first concept's
-                 route hosts the site-wide POST so the topbar works from any admin page. -->
-            <form method="POST" action={`/admin/${data.concepts[0].id}?/publishAll`} class="mt-4 flex justify-end gap-2">
+            <!-- The publishAll named action is valid on every authed admin view, so the confirm
+                 posts to the current page and the topbar works from anywhere. -->
+            <form method="POST" action="?/publishAll" class="mt-4 flex justify-end gap-2">
               <CsrfField token={data.csrf} />
               <button type="button" class="btn btn-sm" onclick={() => publishAllDialog?.close()}>Cancel</button>
               <button type="submit" class="btn btn-sm btn-primary">Publish site</button>
@@ -455,7 +453,7 @@ identical on every host regardless of the site's own theme.
               <div class="text-xs capitalize text-[var(--color-subtle)]">{data.user.role}</div>
             </div>
           </div>
-          <form method="POST" action="/admin/auth/logout" class="mt-4">
+          <form method="POST" action="?/logout" class="mt-4">
             <CsrfField token={data.csrf} />
             <button type="submit" class="btn btn-ghost btn-sm btn-block justify-start">
               <LogOutIcon class="h-4 w-4" /> Sign out

package/src/lib/components/CairnAdmin.svelte

@@ -0,0 +1,67 @@
+<!--
+@component
+The single-mount admin page. A site's catch-all `/admin/[...path]` route renders this one
+component for every admin view, feeding it the discriminated `AdminData` from `createCairnAdmin`'s
+load. It is a pure switcher on `data.view`: the public auth pages mount bare, and the authed views
+mount inside `AdminLayout`. No styling or wrapper elements of its own.
+-->
+<script lang="ts">
+  import AdminLayout from './AdminLayout.svelte';
+  import LoginPage from './LoginPage.svelte';
+  import ConfirmPage from './ConfirmPage.svelte';
+  import ConceptList from './ConceptList.svelte';
+  import EditPage from './EditPage.svelte';
+  import ManageEditors from './ManageEditors.svelte';
+  import NavTree from './NavTree.svelte';
+  import type { AdminData } from '../sveltekit/cairn-admin.js';
+  import type { ContentFormFailure } from '../sveltekit/content-routes.js';
+  import type { ComponentRegistry } from '../render/registry.js';
+  import type { IconSet } from '../render/glyph.js';
+  import type { LinkResolve } from '../content/links.js';
+
+  interface Props {
+    /** The discriminated view data from `createCairnAdmin`'s load. */
+    data: AdminData;
+    /** The last action's result, forwarded to whichever view rendered: the shared content-action
+     *  failure family (every failure carries `error`), merged with the auth and editors results,
+     *  so the route's one `form` export covers every view. */
+    form?:
+      | (ContentFormFailure & {
+          sent?: boolean;
+          status?: 'sent' | 'send_error' | 'throttled';
+          ok?: boolean;
+        })
+      | null;
+    /** The site's design-accurate render pipeline, for the edit view's preview pane. */
+    render?: (md: string, opts?: { stagger?: boolean; resolve?: LinkResolve }) => string | Promise<string>;
+    /** The site's component registry, for the edit view's insert palette. */
+    registry?: ComponentRegistry;
+    /** The site's icon set, for the edit view's guided form fields. */
+    icons?: IconSet;
+  }
+
+  let { data, form = null, render, registry, icons }: Props = $props();
+</script>
+
+{#if data.view === 'login'}
+  <LoginPage data={data.page} {form} />
+{:else if data.view === 'confirm'}
+  <ConfirmPage data={data.page} />
+{:else}
+  <AdminLayout data={data.layout}>
+    {#if data.view === 'list'}
+      <!-- The single mount reuses this component across /admin/posts -> /admin/pages, so the
+           concept id keys the list: crossing concepts remounts it and drops the old query,
+           sort, page, and dialog state. -->
+      {#key data.page.conceptId}
+        <ConceptList data={data.page} {form} />
+      {/key}
+    {:else if data.view === 'edit'}
+      <EditPage data={{ ...data.page, siteName: data.layout.siteName }} {render} {registry} {icons} {form} />
+    {:else if data.view === 'editors'}
+      <ManageEditors data={data.page} {form} />
+    {:else if data.view === 'nav'}
+      <NavTree data={data.page} />
+    {/if}
+  </AdminLayout>
+{/if}

package/src/lib/components/ConceptList.svelte

@@ -7,8 +7,7 @@ content sizes. The header New button opens a dialog holding the create form.
 -->
 <script lang="ts">
   import { slugify } from '../content/ids.js';
-  import type { EntrySummary, ListData } from '../sveltekit/content-routes.js';
-  import type { InboundLink } from '../content/manifest.js';
+  import type { DeleteRefusal, EntrySummary, ListData } from '../sveltekit/content-routes.js';
   import CsrfField from './CsrfField.svelte';
   import DeleteDialog from './DeleteDialog.svelte';
   import CairnLogo from './CairnLogo.svelte';
@@ -17,10 +16,10 @@ content sizes. The header New button opens a dialog holding the create form.
   interface Props {
     /** The list load's data: the concept, its entries, and any inline or form errors. */
     data: ListData;
-    /** The `?/delete` action result. A blocked delete returns the refused entry id and the inbound
-     *  links that link to it (the flat `fail(409, { inboundLinks, id })` shape), so the list names
+    /** The `?/delete` action result. A blocked delete returns the `DeleteRefusal` payload (the
+     *  shared `error` summary, the refused entry id, and its inbound linkers), so the list names
      *  the blockers and refuses (block-until-clean). */
-    form?: { id?: string; inboundLinks?: InboundLink[] } | null;
+    form?: Partial<DeleteRefusal> | null;
   }
 
   let { data, form = null }: Props = $props();

package/src/lib/components/ConfirmPage.svelte

@@ -40,7 +40,7 @@ in a hidden field and consumes nothing; only the explicit POST verifies (spec §
     {:else}
       <h1 class="text-lg font-semibold">Almost there</h1>
       <p class="mt-1 mb-5 text-sm text-[var(--color-muted)]">Confirm to finish signing in to {data.siteName}.</p>
-      <form method="POST">
+      <form method="POST" action="?/confirm">
         <input type="hidden" name="token" value={data.token} />
         <CsrfField token={data.csrf} />
         <button type="submit" class="btn btn-primary btn-block">Confirm sign-in</button>

package/src/lib/components/EditPage.svelte

@@ -29,7 +29,7 @@ transient flashes, and the editor card's footer holds the word count and the Mar
   import { directiveLineKind, findInlineDirectives } from './markdown-directives.js';
   import type { ComponentRegistry } from '../render/registry.js';
   import type { IconSet } from '../render/glyph.js';
-  import type { EditData } from '../sveltekit/content-routes.js';
+  import type { ContentFormFailure, EditData } from '../sveltekit/content-routes.js';
   import type { TextareaField, TagsField, FreeTagsField } from '../content/types.js';
   import type { LinkResolve } from '../content/links.js';
   import { manifestLinkResolver } from '../content/manifest.js';
@@ -43,9 +43,9 @@ transient flashes, and the editor card's footer holds the word count and the Mar
     render?: (md: string, opts?: { stagger?: boolean; resolve?: LinkResolve }) => string | Promise<string>;
     /** The site's icon set, for the guided form's icon fields. */
     icons?: IconSet;
-    /** The `?/save` or `?/delete` action result. Carries the save guard's broken links when a save was
-     *  blocked, or the delete guard's inbound linkers when a delete was refused. */
-    form?: { brokenLinks?: string[]; body?: string; inboundLinks?: import('../content/manifest.js').InboundLink[]; renameError?: string } | null;
+    /** The last content action's failure: the save guard's broken links, the delete guard's
+     *  inbound linkers, or a rename refusal, each carrying the shared `error` summary. */
+    form?: ContentFormFailure | null;
   }
 
   let { data, registry, render, icons, form }: Props = $props();
@@ -220,8 +220,12 @@ transient flashes, and the editor card's footer holds the word count and the Mar
   // not refused. When set, a delete was blocked by a link that appeared since the page loaded.
   const deleteRefusedLinks = $derived(form?.inboundLinks ?? []);
 
-  // A rename that hit a collision or an invalid slug returns form.renameError.
-  const renameError = $derived(form?.renameError ?? '');
+  // The shared failure summary, rendered only when no richer banner claims the failure: the save
+  // and delete guards get their own banners from brokenLinks and inboundLinks below, so this
+  // surfaces the rest (a rename refusal, today).
+  const formError = $derived(
+    form?.error && !form.brokenLinks?.length && !form.inboundLinks?.length ? form.error : '',
+  );
 
   // The entry this surface is editing. SvelteKit reuses the page component across a same-route
   // navigation (the delete-refused and broken-link banners link entry to entry), so the per-entry
@@ -279,7 +283,7 @@ transient flashes, and the editor card's footer holds the word count and the Mar
   );
   const assertiveMessage = $derived.by(() => {
     if (data.error) return data.error;
-    if (renameError) return renameError;
+    if (formError) return formError;
     if (deleteRefusedLinks.length) {
       const count = deleteRefusedLinks.length;
       return `This ${data.label.toLowerCase()} could not be deleted. ${count} ${count === 1 ? 'page links' : 'pages link'} to it.`;
@@ -529,8 +533,8 @@ transient flashes, and the editor card's footer holds the word count and the Mar
 {#if data.error}
   <div class="alert alert-error mb-4 text-sm">{data.error}</div>
 {/if}
-{#if renameError}
-  <div class="alert alert-error mb-4 text-sm">{renameError}</div>
+{#if formError}
+  <div class="alert alert-error mb-4 text-sm">{formError}</div>
 {/if}
 {#if deleteRefusedLinks.length}
   <div class="alert alert-error mb-4 flex-col items-start text-sm">

package/src/lib/components/LoginPage.svelte

@@ -1,6 +1,6 @@
 <!--
 @component
-The magic-link sign-in page. A plain form POST to the page's default action (the engine's
+The magic-link sign-in page. A plain form POST to the named `?/request` action (the engine's
 `requestAction`); no client SDK. The success message is identical whether or not the email is on
 the allowlist, so the page never leaks membership (spec §7.1).
 -->
@@ -101,7 +101,7 @@ the allowlist, so the page never leaks membership (spec §7.1).
       {#if data.error && !form?.status}
         <div role="alert" class="alert alert-error mb-3 text-sm">That link expired. Request a new one below.</div>
       {/if}
-      <form method="POST" class="flex flex-col gap-3">
+      <form method="POST" action="?/request" class="flex flex-col gap-3">
         <CsrfField token={data.csrf} />
         <label class="flex flex-col gap-1">
           <span class="text-sm font-medium">Email</span>

package/src/lib/components/ManageEditors.svelte

@@ -3,7 +3,8 @@
 The owner-gated editor management surface: a table of editors with role-flip and remove actions,
 and an add-editor form. The acting owner's own row disables its destructive controls; the
 last-owner anti-lockout rule itself is enforced server-side (editors-routes). Actions post to the
-named `?/setRole`, `?/remove`, and `?/add` actions.
+named `?/setRole`, `?/removeEditor`, and `?/addEditor` actions, the names the single-mount
+dispatcher defines.
 -->
 <script lang="ts">
   import CsrfField from './CsrfField.svelte';
@@ -53,7 +54,7 @@ named `?/setRole`, `?/remove`, and `?/add` actions.
                 {editor.role === 'owner' ? 'Make editor' : 'Make owner'}
               </button>
             </form>
-            <form method="POST" action="?/remove">
+            <form method="POST" action="?/removeEditor">
               <CsrfField />
               <input type="hidden" name="email" value={editor.email} />
               <button type="submit" class="btn btn-ghost btn-xs text-error" disabled={isSelf} aria-label={`Remove ${editor.displayName}`}>
@@ -67,7 +68,7 @@ named `?/setRole`, `?/remove`, and `?/add` actions.
   </table>
 </div>
 
-<form method="POST" action="?/add" class="rounded-box border border-[var(--cairn-card-border)] bg-base-100 grid gap-3 p-4 shadow-[var(--cairn-shadow)] sm:grid-cols-[1fr_1fr_auto_auto] sm:items-end">
+<form method="POST" action="?/addEditor" class="rounded-box border border-[var(--cairn-card-border)] bg-base-100 grid gap-3 p-4 shadow-[var(--cairn-shadow)] sm:grid-cols-[1fr_1fr_auto_auto] sm:items-end">
   <CsrfField />
   <label class="flex flex-col gap-1">
     <span class="text-sm font-medium">Name</span>

package/src/lib/components/index.ts

@@ -1,5 +1,6 @@
 // Admin Svelte components (Plan 05). The Warm Stone theme ships as a CSS side effect imported
 // by the components that set `data-theme="cairn-admin"`.
+export { default as CairnAdmin } from './CairnAdmin.svelte';
 export { default as AdminLayout } from './AdminLayout.svelte';
 export { default as LoginPage } from './LoginPage.svelte';
 export { default as ConfirmPage } from './ConfirmPage.svelte';

package/src/lib/components/markdown-format.ts

@@ -197,30 +197,3 @@ export function unwrapCairnLink(doc: string, href: string): string {
   }
   return out;
 }
-
-/**
- * Rewrite every cairn: link whose href is exactly `oldHref` so its href becomes `newHref`, keeping
- * the display text and any link title byte-for-byte. Rename calls this to repoint a renamed entry's
- * inbound tokens. Parsed with the same remark pipeline as extractCairnLinks, so a token inside a code
- * span is not a link node and is never touched. Each matching node's source span is rewritten from
- * last to first, replacing only the `](oldHref` run so the label and title stay exact.
- */
-export function rewriteCairnLink(doc: string, oldHref: string, newHref: string): string {
-  const tree = unified().use(remarkParse).use(remarkGfm).parse(doc);
-  const spans: { start: number; end: number }[] = [];
-  visit(tree, 'link', (node: Link) => {
-    if (node.url !== oldHref) return;
-    const start = node.position?.start?.offset;
-    const end = node.position?.end?.offset;
-    if (start == null || end == null) return;
-    spans.push({ start, end });
-  });
-  spans.sort((a, b) => b.start - a.start);
-  let out = doc;
-  for (const span of spans) {
-    const src = out.slice(span.start, span.end);
-    const rewritten = src.replace(`](${oldHref}`, `](${newHref}`);
-    out = out.slice(0, span.start) + rewritten + out.slice(span.end);
-  }
-  return out;
-}

package/src/lib/content/links.ts

@@ -6,6 +6,7 @@ import { unified } from 'unified';
 import remarkParse from 'remark-parse';
 import remarkGfm from 'remark-gfm';
 import { visit } from 'unist-util-visit';
+import type { Link } from 'mdast';
 import { isValidId } from './ids.js';
 
 /** A resolved reference to a content entry by its concept and permanent id. */
@@ -59,3 +60,30 @@ export function extractCairnLinks(body: string): CairnRef[] {
   });
   return refs;
 }
+
+/**
+ * Rewrite every cairn: link whose href is exactly `oldHref` so its href becomes `newHref`, keeping
+ * the display text and any link title byte-for-byte. Rename calls this to repoint a renamed entry's
+ * inbound tokens. Parsed with the same remark pipeline as extractCairnLinks, so a token inside a code
+ * span is not a link node and is never touched. Each matching node's source span is rewritten from
+ * last to first, replacing only the `](oldHref` run so the label and title stay exact.
+ */
+export function rewriteCairnLink(doc: string, oldHref: string, newHref: string): string {
+  const tree = unified().use(remarkParse).use(remarkGfm).parse(doc);
+  const spans: { start: number; end: number }[] = [];
+  visit(tree, 'link', (node: Link) => {
+    if (node.url !== oldHref) return;
+    const start = node.position?.start?.offset;
+    const end = node.position?.end?.offset;
+    if (start == null || end == null) return;
+    spans.push({ start, end });
+  });
+  spans.sort((a, b) => b.start - a.start);
+  let out = doc;
+  for (const span of spans) {
+    const src = out.slice(span.start, span.end);
+    const rewritten = src.replace(`](${oldHref}`, `](${newHref}`);
+    out = out.slice(0, span.start) + rewritten + out.slice(span.end);
+  }
+  return out;
+}

package/src/lib/content/types.ts

@@ -176,8 +176,8 @@ export interface CairnAdapter {
   backend: BackendConfig;
   sender: SenderConfig;
   /** The site's one renderer: the editor preview and every public page call it (design decision 4).
-   *  `resolve` rewrites cairn: links to live permalinks; the build passes a site-index resolver, the
-   *  preview a manifest one. */
+   *  `resolve` rewrites cairn: links to live permalinks; the build passes a site-resolver-backed
+   *  one, the preview a manifest one. */
   render(md: string, opts?: { stagger?: boolean; resolve?: LinkResolve }): string | Promise<string>;
   /** Repo-relative path to the committed content manifest. Defaults to src/content/.cairn/index.json
    *  in composeRuntime. It sits outside any concept directory, so content enumeration never globs it. */

package/src/lib/delivery/data.ts

@@ -3,8 +3,8 @@
 // the graph. The full ./delivery barrel re-exports this and adds the route loaders.
 export { createContentIndex, fromGlob } from './content-index.js';
 export type { RawFile, ContentSummary, ContentEntry, ContentIndex, ContentProblem } from './content-index.js';
-export { createSiteIndex } from './site-index.js';
-export type { SiteIndex, ConceptIndex } from './site-index.js';
+export { createSiteResolver, buildLinkResolver } from './site-resolver.js';
+export type { SiteResolver, ConceptIndex } from './site-resolver.js';
 export { createSiteIndexes } from './site-indexes.js';
 export type { SiteIndexes, SiteGlobs } from './site-indexes.js';
 export { siteDescriptors } from './site-descriptors.js';
@@ -18,9 +18,7 @@ export { buildSeoMeta } from './seo.js';
 export type { SeoInput, SeoMeta } from './seo.js';
 export { readSeoFields, resolveImageUrl } from './seo-fields.js';
 export type { SeoFields } from './seo-fields.js';
-export { paginate } from './paginate.js';
-export type { Page } from './paginate.js';
 export { rssResponse, jsonFeedResponse, sitemapResponse, robotsResponse } from './responses.js';
 export { jsonLdScript } from './json-ld.js';
 export { permalink } from '../content/permalink.js';
-export { buildSiteManifest, buildLinkResolver } from './manifest.js';
+export { buildSiteManifest } from './manifest.js';

package/src/lib/delivery/feeds.ts

@@ -2,6 +2,7 @@
 // channel and a list of items, so they unit-test without a render or a network. The caller
 // (a template +server.ts shim) assembles items from the content index and passes absolute
 // URLs built from PUBLIC_ORIGIN.
+import { escapeXml } from './xml.js';
 
 /** Feed channel metadata. URLs are absolute. */
 export interface FeedChannel {
@@ -24,14 +25,6 @@ export interface FeedItem {
   tags?: string[];
 }
 
-function escapeXml(value: string): string {
-  return value
-    .replace(/&/g, '&')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;');
-}
-
 /** Make a string safe inside a CDATA section by splitting any `]]>` across two sections. */
 function cdataSafe(value: string): string {
   return value.replace(/]]>/g, ']]]]><![CDATA[>');

package/src/lib/delivery/index.ts

@@ -3,11 +3,11 @@
 // lives at ./delivery/head. Importing this pulls @sveltejs/kit through the route loaders, so a
 // plain-Node tool imports from ./delivery/data instead.
 export * from './data.js';
-export { createPublicRoutes } from '../sveltekit/public-routes.js';
+export { createPublicRoutes } from './public-routes.js';
 export type {
   PublicRoutesDeps,
   ListData,
   TagData,
   TagIndexData,
   EntryData,
-} from '../sveltekit/public-routes.js';
+} from './public-routes.js';

package/src/lib/delivery/manifest.ts

@@ -1,15 +1,12 @@
-// cairn-cms: the build-side manifest builder and the build link resolver (content-graph design).
-// buildSiteManifest mirrors createSiteIndexes: it maps the site descriptors over the per-concept
-// globs and projects each file to a manifest row. buildLinkResolver reads the site index, which is
-// fresh from the files at build, and throws on a missing target so a dangling cairn: token fails
-// the build (the backstop). The admin preview uses manifestLinkResolver instead.
+// cairn-cms: the build-side manifest builder (content-graph design). buildSiteManifest mirrors
+// createSiteIndexes: it maps the site descriptors over the per-concept globs and projects each
+// file to a manifest row. The build-time cairn: link resolver lives beside the site resolver in
+// site-resolver.ts; the admin preview uses manifestLinkResolver instead.
 import { siteDescriptors } from './site-descriptors.js';
 import { fromGlob } from './content-index.js';
 import { parseMarkdown } from '../content/frontmatter.js';
 import { emptyManifest, manifestEntryFromFile } from '../content/manifest.js';
 import type { Manifest } from '../content/manifest.js';
-import type { LinkResolve } from '../content/links.js';
-import type { SiteIndex } from './site-index.js';
 import type { SiteConfig } from '../nav/site-config.js';
 import type { CairnAdapter } from '../content/types.js';
 import type { SiteGlobs } from './site-indexes.js';
@@ -22,7 +19,7 @@ export function buildSiteManifest<A extends CairnAdapter>(adapter: A, config: Si
   for (const descriptor of siteDescriptors(adapter, config)) {
     const record = globRecord[descriptor.id] ?? {};
     for (const file of fromGlob(record)) {
-      // Validate the same way createContentIndex does, so the manifest and the site index agree on
+      // Validate the same way createContentIndex does, so the manifest and the site resolver agree on
       // which entries exist. A validation failure is excluded from both; otherwise the preview would
       // resolve a link the build then rejects as a missing target.
       const { frontmatter, body } = parseMarkdown(file.raw);
@@ -32,13 +29,3 @@ export function buildSiteManifest<A extends CairnAdapter>(adapter: A, config: Si
   }
   return manifest;
 }
-
-/** A resolver backed by the site index, for the build. A miss throws, so a dangling cairn: token
- *  fails the prerender (the build backstop). The preview uses manifestLinkResolver, which marks. */
-export function buildLinkResolver(site: SiteIndex): LinkResolve {
-  return (ref) => {
-    const url = site.concept(ref.concept)?.byId(ref.id)?.permalink;
-    if (!url) throw new Error(`cairn link target not found: cairn:${ref.concept}/${ref.id}`);
-    return url;
-  };
-}

package/src/lib/{sveltekit → delivery}/public-routes.ts

@@ -1,20 +1,20 @@
-// cairn-cms: public route loaders (dated-slug design). The factory closes over the site-level
-// index, the runtime render, and the origin. entryLoad and entries are site-wide: one catch-all
+// cairn-cms: public route loaders (dated-slug design). The factory closes over the site
+// resolver, the runtime render, and the origin. entryLoad and entries are site-wide: one catch-all
 // `[...path]` route resolves any concept by request path through `byPermalink`. The archive, tag,
-// and tag-index loaders stay concept-scoped, keyed by concept id. The index is built in site code
-// from globs, so it stays in the prerender graph and out of the runtime Worker.
+// and tag-index loaders stay concept-scoped, keyed by concept id. The resolver is built in site
+// code from globs, so it stays in the prerender graph and out of the runtime Worker.
 import { error } from '@sveltejs/kit';
-import type { ContentSummary, ContentEntry } from '../delivery/content-index.js';
-import type { SiteIndex } from '../delivery/site-index.js';
-import { buildSeoMeta } from '../delivery/seo.js';
-import type { SeoMeta } from '../delivery/seo.js';
-import { readSeoFields, resolveImageUrl } from '../delivery/seo-fields.js';
-import { buildLinkResolver } from '../delivery/manifest.js';
+import type { ContentSummary, ContentEntry } from './content-index.js';
+import type { SiteResolver } from './site-resolver.js';
+import { buildSeoMeta } from './seo.js';
+import type { SeoMeta } from './seo.js';
+import { readSeoFields, resolveImageUrl } from './seo-fields.js';
+import { buildLinkResolver } from './site-resolver.js';
 import type { LinkResolve } from '../content/links.js';
 
 /** Injected dependencies for the public loaders. */
 export interface PublicRoutesDeps {
-  site: SiteIndex;
+  site: SiteResolver;
   render: (md: string, opts?: { stagger?: boolean; resolve?: LinkResolve }) => string | Promise<string>;
   origin: string;
   /** Site name for og:site_name and the SEO head. */

package/src/lib/delivery/site-indexes.ts

@@ -1,7 +1,7 @@
 // cairn-cms: the full-auto typed site index (schema-source-of-truth design). It maps over a
 // defineAdapter-typed adapter to give one typed per-concept index, with frontmatter typed as the
 // concept's inferred schema type, plus a site resolver for the catch-all route. It is the typed
-// convenience over createContentIndex and createSiteIndex, not a replacement: both stay the
+// convenience over createContentIndex and createSiteResolver, not a replacement: both stay the
 // lower-level escape hatch. It imports only pure content and delivery code, so the delivery
 // bundle stays backend-free.
 import type { CairnAdapter, ConceptConfig } from '../content/types.js';
@@ -9,9 +9,9 @@ import type { Infer } from '../content/schema.js';
 import type { SiteConfig } from '../nav/site-config.js';
 import { siteDescriptors } from './site-descriptors.js';
 import { createContentIndex, fromGlob } from './content-index.js';
-import { createSiteIndex } from './site-index.js';
+import { createSiteResolver } from './site-resolver.js';
 import type { ContentIndex } from './content-index.js';
-import type { ConceptIndex, SiteIndex } from './site-index.js';
+import type { ConceptIndex, SiteResolver } from './site-resolver.js';
 
 /** A per-concept raw glob record (`{ path: raw }`) keyed by concept id, from `import.meta.glob`. */
 export type SiteGlobs<A extends CairnAdapter> = {
@@ -24,13 +24,13 @@ export type SiteIndexes<A extends CairnAdapter> = {
   [K in keyof A['content']]: ContentIndex<
     NonNullable<A['content'][K]> extends ConceptConfig<infer S> ? Infer<S> : Record<string, unknown>
   >;
-} & { readonly site: SiteIndex };
+} & { readonly site: SiteResolver };
 
 /**
  * Build typed per-concept indexes and a site resolver from one adapter. Pass the per-concept raw
  * globs as `{ posts: import.meta.glob('...?raw', { eager: true }), ... }`; Vite needs the literal
  * glob at the call site, so the engine cannot glob on the site's behalf. `validate: false` opts out
- * of the build gate, exactly as on `createSiteIndex`.
+ * of the build gate, exactly as on `createSiteResolver`.
  */
 export function createSiteIndexes<const A extends CairnAdapter>(
   adapter: A,
@@ -59,6 +59,6 @@ export function createSiteIndexes<const A extends CairnAdapter>(
     byConcept[descriptor.id] = index;
     conceptIndexes.push({ descriptor, index });
   }
-  const site = createSiteIndex(conceptIndexes, opts);
+  const site = createSiteResolver(conceptIndexes, opts);
   return { ...byConcept, site } as SiteIndexes<A>;
 }

package/src/lib/delivery/{site-index.ts → site-resolver.ts}

@@ -1,9 +1,11 @@
-// cairn-cms: the site-level content index (dated-slug design). It unions every concept's
-// per-concept index into one cross-concept resolver: a single byPermalink map a catch-all route
-// matches a request path against, one entries() list the prerenderer walks, and the per-concept
-// indexes for concept-scoped archive, tag, and feed loaders. A duplicate permalink throws at build.
+// cairn-cms: the cross-concept site resolver (dated-slug design). It unions every concept's
+// per-concept index into one resolver: a single byPermalink map a catch-all route matches a
+// request path against, one entries() list the prerenderer walks, and the per-concept indexes
+// for concept-scoped archive, tag, and feed loaders. A duplicate permalink throws at build.
+// buildLinkResolver lives here too, since it closes over the resolver.
 import type { ConceptDescriptor } from '../content/types.js';
 import type { ContentEntry, ContentIndex, ContentSummary } from './content-index.js';
+import type { LinkResolve } from '../content/links.js';
 
 /** One concept's descriptor paired with its built index. */
 export interface ConceptIndex {
@@ -12,7 +14,7 @@ export interface ConceptIndex {
 }
 
 /** The cross-concept query surface a catch-all route and the sitemap read. */
-export interface SiteIndex {
+export interface SiteResolver {
   /** Resolve a request path (with or without a trailing slash) to its entry, or undefined. */
   byPermalink(path: string): ContentEntry | undefined;
   /** Newer/older neighbors within the entry's own concept, for prev/next links. */
@@ -49,11 +51,11 @@ function siteProblems(concepts: ConceptIndex[]): string[] {
  * unless `validate` is `false`, on any non-draft entry whose frontmatter fails its concept's
  * validator, so malformed content fails the build instead of shipping.
  */
-export function createSiteIndex(concepts: ConceptIndex[], opts: { validate?: boolean } = {}): SiteIndex {
+export function createSiteResolver(concepts: ConceptIndex[], opts: { validate?: boolean } = {}): SiteResolver {
   if (opts.validate !== false) {
     const problems = siteProblems(concepts);
     if (problems.length > 0) {
-      throw new Error(`site index: ${problems.length} invalid frontmatter field(s):\n  ${problems.join('\n  ')}`);
+      throw new Error(`site resolver: ${problems.length} invalid frontmatter field(s):\n  ${problems.join('\n  ')}`);
     }
   }
   const byPath = new Map<string, { index: ContentIndex; id: string }>();
@@ -64,7 +66,7 @@ export function createSiteIndex(concepts: ConceptIndex[], opts: { validate?: boo
       const existing = byPath.get(summary.permalink);
       if (existing) {
         throw new Error(
-          `site index: "${existing.id}" and "${summary.id}" both resolve to "${summary.permalink}"`,
+          `site resolver: "${existing.id}" and "${summary.id}" both resolve to "${summary.permalink}"`,
         );
       }
       byPath.set(summary.permalink, { index, id: summary.id });
@@ -90,3 +92,13 @@ export function createSiteIndex(concepts: ConceptIndex[], opts: { validate?: boo
     },
   };
 }
+
+/** A resolver backed by the site resolver, for the build. A miss throws, so a dangling cairn: token
+ *  fails the prerender (the build backstop). The preview uses manifestLinkResolver, which marks. */
+export function buildLinkResolver(site: SiteResolver): LinkResolve {
+  return (ref) => {
+    const url = site.concept(ref.concept)?.byId(ref.id)?.permalink;
+    if (!url) throw new Error(`cairn link target not found: cairn:${ref.concept}/${ref.id}`);
+    return url;
+  };
+}