@glw907/cairn-cms 0.41.0 → 0.51.0

package/src/lib/sveltekit/https-required-page.ts

@@ -4,7 +4,8 @@
 // not match, so the editor would otherwise hit an opaque 403. This page names the problem, says why
 // https is needed, and gives the exact Cloudflare fix. The shared shell lives in
 // static-admin-page.ts. See guard.ts.
-import { escapeHtml, renderStaticAdminPage } from './static-admin-page.js';
+import { escapeHtml } from '../escape.js';
+import { renderStaticAdminPage } from './static-admin-page.js';
 
 /**
  * Render the full HTML document for the HTTPS-required page.

package/src/lib/sveltekit/index.ts

@@ -12,9 +12,15 @@ export type {
   EditData,
   ContentEvent,
   ContentRoutesDeps,
+  SaveFailure,
+  DeleteRefusal,
+  RenameFailure,
+  ContentFormFailure,
 } from './content-routes.js';
 export { createNavRoutes } from './nav-routes.js';
 export type { NavLoadData, NavPageOption, NavRoutesDeps } from './nav-routes.js';
+export { parseAdminPath, type AdminView } from './admin-dispatch.js';
+export { createCairnAdmin, type CairnAdminDeps, type AdminData } from './cairn-admin.js';
 export { healthLoad, type HealthData } from './health.js';
 export type { RequestContext, CookieJar, HandleInput } from './types.js';
 // Re-exported here, not from root, so the public ContentRoutesDeps consumer can name it.

package/src/lib/sveltekit/nav-routes.ts

@@ -5,12 +5,12 @@ import { redirect, error } from '@sveltejs/kit';
 import { appCredentials, type GithubKeyEnv } from '../github/credentials.js';
 import { cachedInstallationToken } from '../github/signing.js';
 import { listMarkdown, readRaw, commitFile } from '../github/repo.js';
-import { CommitConflictError } from '../github/types.js';
+import { isConflict } from '../github/types.js';
 import { log } from '../log/index.js';
 import { parseSiteConfig, extractMenu, validateNavTree, setMenu, type NavNode } from '../nav/site-config.js';
+import { requireSession } from './guard.js';
 import type { CairnRuntime } from '../content/types.js';
 import type { ContentEvent } from './content-routes.js';
-import type { Editor } from '../auth/types.js';
 
 /** One page option for the URL picker datalist. */
 export interface NavPageOption {
@@ -29,19 +29,9 @@ export interface NavLoadData {
 
 /** Injectable dependencies; tests stub the token mint to avoid signing a real key. */
 export interface NavRoutesDeps {
-  mintToken?: (env: GithubKeyEnv) => Promise<string>;
-}
-
-/** The signed-in editor the guard resolved, or a login redirect. */
-function sessionOf(event: ContentEvent): Editor {
-  const editor = event.locals.editor;
-  if (!editor) throw redirect(303, '/admin/login');
-  return editor;
-}
-
-/** Match a commit conflict by class and by name (bundling can alias the class identity). */
-function isConflict(err: unknown): boolean {
-  return err instanceof CommitConflictError || (err as { name?: string } | null)?.name === 'CommitConflictError';
+  /** Mint a GitHub App installation token from the Worker env. Defaults to the real signer.
+   *  A bare string works too; the routes await whatever comes back. */
+  mintToken?: (env: GithubKeyEnv) => string | Promise<string>;
 }
 
 export function createNavRoutes(runtime: CairnRuntime, deps: NavRoutesDeps = {}) {
@@ -66,7 +56,7 @@ export function createNavRoutes(runtime: CairnRuntime, deps: NavRoutesDeps = {})
 
   /** Load the nav editor. A missing or unparsable config degrades to an empty tree so it still opens. */
   async function navLoad(event: ContentEvent): Promise<NavLoadData> {
-    sessionOf(event);
+    requireSession(event);
     const config = runtime.navMenu;
     if (!config) throw error(404, 'No navigation menu configured');
     const maxDepth = config.maxDepth ?? 2;
@@ -80,12 +70,25 @@ export function createNavRoutes(runtime: CairnRuntime, deps: NavRoutesDeps = {})
     }
 
     let tree: NavNode[] = [];
+    let raw: string | null = null;
     try {
-      const raw = await readRaw(runtime.backend, config.configPath, token);
-      if (raw !== null) tree = extractMenu(parseSiteConfig(raw), config.menuName, maxDepth);
+      raw = await readRaw(runtime.backend, config.configPath, token);
     } catch {
-      // A malformed or unreadable config degrades to an empty tree; the first save writes a clean menu.
-      tree = [];
+      // An unreadable config degrades to an empty tree; the first save writes a clean menu.
+      raw = null;
+    }
+    if (raw !== null) {
+      try {
+        tree = extractMenu(parseSiteConfig(raw), config.menuName, maxDepth);
+      } catch (err) {
+        // A malformed config keeps the same degrade (the nav page failing closed would be worse
+        // for the editor), but the swallow names the operator fault in the log.
+        log.error('config.invalid', {
+          conditionId: 'config.site-config-invalid',
+          error: String(err),
+        });
+        tree = [];
+      }
     }
 
     return {
@@ -99,7 +102,7 @@ export function createNavRoutes(runtime: CairnRuntime, deps: NavRoutesDeps = {})
 
   /** Save the nav tree: validate, then read-modify-commit the one menu with the session editor as author. */
   async function navSave(event: ContentEvent): Promise<never> {
-    const editor = sessionOf(event);
+    const editor = requireSession(event);
     const config = runtime.navMenu;
     if (!config) throw error(404, 'No navigation menu configured');
     const maxDepth = config.maxDepth ?? 2;

package/src/lib/sveltekit/static-admin-page.ts

@@ -2,15 +2,7 @@
 // self-contained document with inlined Warm Stone tokens for both colour schemes and the system
 // font stack, served raw before SvelteKit renders. The cairn glyph is the same public-domain
 // Temaki mark the admin chrome uses. See docs/internal/admin-design-system.md.
-
-/** Escape a string for safe interpolation into HTML text and double-quoted attributes. */
-export function escapeHtml(value: string): string {
-  return value
-    .replace(/&/g, '&')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;');
-}
+import { escapeHtml } from '../escape.js';
 
 // The cairn stone-stack glyph (Temaki, CC0), drawn in currentColor like CairnLogo.svelte.
 const CAIRN_GLYPH =

package/src/lib/sveltekit/types.ts

@@ -16,16 +16,25 @@ export interface CookieJar {
   delete(name: string, opts: { path: string }): void;
 }
 
-export interface RequestContext {
+/** The Cloudflare platform wrapper an event carries; `context` is the legacy alias for `ctx`. */
+export interface PlatformContext<Env> {
+  env?: Env;
+  ctx?: { waitUntil(promise: Promise<unknown>): void };
+  context?: { waitUntil(promise: Promise<unknown>): void };
+}
+
+/** The structural core every engine event type extends, parameterized by the Worker env the
+ *  surface reads. Each shared field is defined once here; the extensions add only what their
+ *  surface needs (cookies, params, setHeaders). */
+export interface EventBase<Env> {
   url: URL;
   request: Request;
-  cookies: CookieJar;
   locals: { editor?: Editor | null };
-  platform?: {
-    env?: AuthEnv;
-    ctx?: { waitUntil(promise: Promise<unknown>): void };
-    context?: { waitUntil(promise: Promise<unknown>): void };
-  };
+  platform?: PlatformContext<Env>;
+}
+
+export interface RequestContext extends EventBase<AuthEnv> {
+  cookies: CookieJar;
   // Required so a site cannot silently drop the confirm page's Referrer-Policy header
   // (spec 7.1). A real SvelteKit RequestEvent always supplies it.
   setHeaders(headers: Record<string, string>): void;

package/src/lib/vite/index.ts

@@ -61,21 +61,17 @@ export const result = ${resultExpr};
 `;
 }
 
-/** Evaluate the virtual module in the given mode inside the consumer's own Vite resolution, then
- *  return the module's `result`. It reuses the consumer's loaded config (so `$lib`, the config
- *  module, `import.meta.glob`, and `?raw` resolve exactly as the build does) and strips the
- *  cairnManifest plugin from the nested server's plugin list, so its buildStart never recurses.
- *  This runs at build time and in the bin, never in the request lifecycle. */
-async function evalVirtual(
-  opts: CairnManifestOptions,
-  mode: 'verify' | 'write',
-  root: string,
-): Promise<string> {
+/** Evaluate a virtual module source inside the consumer's own Vite resolution, then return the
+ *  module's `result`. It reuses the consumer's loaded config (so `$lib`, the config module,
+ *  `import.meta.glob`, and `?raw` resolve exactly as the build does) and strips the cairnManifest
+ *  plugin from the nested server's plugin list, so its buildStart never recurses. This runs at
+ *  build time and in the bins, never in the request lifecycle. */
+async function evalVirtual(source: string, root: string): Promise<string> {
   const { createServer, loadConfigFromFile } = await import('vite');
   // Load the consumer's real Vite config so the nested server inherits SvelteKit's resolution
   // (the $lib alias, the app root, the ?raw and import.meta.glob handling). Drop cairnManifest from
   // it so the nested server's buildStart does not recurse, and add a plugin that serves only the
-  // virtual module in the requested mode.
+  // given virtual module source.
   const loaded = await loadConfigFromFile({ command: 'build', mode: 'production' }, undefined, root);
   const inlineConfig = loaded?.config ?? {};
   const server = await createServer({
@@ -84,7 +80,7 @@ async function evalVirtual(
     configFile: false,
     logLevel: 'silent',
     server: { middlewareMode: true, hmr: false, watch: null },
-    plugins: [...stripCairnManifest(inlineConfig.plugins ?? []), cairnVirtualOnly(opts, mode)],
+    plugins: [...stripCairnManifest(inlineConfig.plugins ?? []), cairnVirtualOnly(source)],
   });
   try {
     const mod = (await server.ssrLoadModule(VIRTUAL_ID)) as { result: string };
@@ -115,13 +111,13 @@ export function stripCairnManifest(plugins: PluginOption | PluginOption[]): Plug
 /** Verify the committed manifest against the corpus from a Vite context, throwing on drift. The bin
  *  and the plugin share this; the spike proved it runs cleanly inside the consumer's config. */
 export async function verifyManifestFromVite(opts: CairnManifestOptions, root: string): Promise<void> {
-  await evalVirtual(opts, 'verify', root);
+  await evalVirtual(virtualSource(opts, 'verify'), root);
 }
 
 /** Regenerate the serialized manifest from the corpus in a Vite context, sharing the build's
  *  resolution. The cairn-manifest bin (a later task) will call this and write the result. */
 export async function buildManifestFromVite(opts: CairnManifestOptions, root: string): Promise<string> {
-  return evalVirtual(opts, 'write', root);
+  return evalVirtual(virtualSource(opts, 'write'), root);
 }
 
 /** The cairnManifest plugin. It serves the verify virtual module to the app graph and, in
@@ -198,16 +194,74 @@ function findCairnOptions(plugins: unknown): CairnManifestOptions | null {
   return null;
 }
 
-/** A minimal plugin that serves only the virtual module in one mode, for the nested SSR load. It
+/** A minimal plugin that serves only the given virtual module source, for the nested SSR load. It
  *  carries no buildStart, so the nested server never recurses into the verify. */
-function cairnVirtualOnly(opts: CairnManifestOptions, mode: 'verify' | 'write'): Plugin {
+function cairnVirtualOnly(source: string): Plugin {
   return {
     name: 'cairn-manifest-virtual',
     resolveId(id) {
       if (id === VIRTUAL_ID) return RESOLVED_ID;
     },
     load(id) {
-      if (id === RESOLVED_ID) return virtualSource(opts, mode);
+      if (id === RESOLVED_ID) return source;
     },
   };
 }
+
+/** The repo and sender facts cairn-doctor derives off the consumer's adapter. */
+export interface AdapterFacts {
+  /** `cairn.backend.owner`. */
+  owner?: string;
+  /** `cairn.backend.repo`. */
+  repo?: string;
+  /** `cairn.sender.from`. */
+  from?: string;
+}
+
+/** Build the virtual module that reads only the adapter facts the doctor derives. It imports the
+ *  configured config module and exports the string-typed `owner`, `repo`, and `from` as JSON, so
+ *  nothing else of the adapter (least of all a secret) crosses the boundary. */
+function adapterFactsSource(opts: CairnManifestOptions): string {
+  return `
+import { cairn } from ${JSON.stringify(opts.configModule)};
+const backend = cairn?.backend ?? {};
+const sender = cairn?.sender ?? {};
+const facts = {};
+if (typeof backend.owner === 'string') facts.owner = backend.owner;
+if (typeof backend.repo === 'string') facts.repo = backend.repo;
+if (typeof sender.from === 'string') facts.from = sender.from;
+export const result = JSON.stringify(facts);
+`;
+}
+
+/** Read `{ owner, repo, from }` off the consumer's adapter by evaluating a tiny virtual module
+ *  through the consumer's own Vite resolution, the same machinery the cairn-manifest bin uses.
+ *  cairn-doctor calls this to fill inputs the operator did not pass. Derivation is best-effort:
+ *  any failure (no Vite config, no cairnManifest plugin, a config module that throws) returns
+ *  null, so the doctor degrades to flags instead of crashing. This runs only on the bin path,
+ *  never in a Worker. */
+export async function readAdapterFacts(cwd: string = process.cwd()): Promise<AdapterFacts | null> {
+  try {
+    const { loadConfigFromFile } = await import('vite');
+    const loaded = await loadConfigFromFile(
+      { command: 'build', mode: 'production' },
+      undefined,
+      cwd,
+      'silent',
+    );
+    if (!loaded) return null;
+    const opts = findCairnOptions(loaded.config.plugins);
+    if (!opts) return null;
+    const parsed = JSON.parse(await evalVirtual(adapterFactsSource(opts), cwd)) as Record<
+      string,
+      unknown
+    >;
+    const facts: AdapterFacts = {};
+    if (typeof parsed.owner === 'string') facts.owner = parsed.owner;
+    if (typeof parsed.repo === 'string') facts.repo = parsed.repo;
+    if (typeof parsed.from === 'string') facts.from = parsed.from;
+    return facts;
+  } catch {
+    return null;
+  }
+}

package/dist/delivery/paginate.d.ts

@@ -1,12 +0,0 @@
-/** A page of items plus its navigation state. */
-export interface Page<T> {
-    items: T[];
-    page: number;
-    perPage: number;
-    total: number;
-    totalPages: number;
-    hasPrev: boolean;
-    hasNext: boolean;
-}
-/** Slice `items` into the 1-based `page` of size `perPage`, clamping the page into bounds. */
-export declare function paginate<T>(items: T[], page: number, perPage: number): Page<T>;

package/dist/delivery/paginate.js

@@ -1,20 +0,0 @@
-// cairn-cms: pagination helper (public-delivery design). Pure slice math; the template renders
-// the controls. An out-of-range page clamps into bounds.
-/** Slice `items` into the 1-based `page` of size `perPage`, clamping the page into bounds. */
-export function paginate(items, page, perPage) {
-    const total = items.length;
-    // A non-positive page size would make totalPages Infinity, so clamp it to one.
-    const size = Math.max(1, Math.floor(perPage) || 1);
-    const totalPages = Math.max(1, Math.ceil(total / size));
-    const current = Math.min(Math.max(1, Math.floor(page) || 1), totalPages);
-    const start = (current - 1) * size;
-    return {
-        items: items.slice(start, start + size),
-        page: current,
-        perPage: size,
-        total,
-        totalPages,
-        hasPrev: current > 1,
-        hasNext: current < totalPages,
-    };
-}

package/dist/render/index.d.ts

@@ -1,5 +0,0 @@
-export * from './registry.js';
-export * from './glyph.js';
-export * from './remark-directives.js';
-export * from './rehype-dispatch.js';
-export * from './pipeline.js';

package/dist/render/index.js

@@ -1,8 +0,0 @@
-// cairn-cms render engine: a directive-driven markdown to HTML pipeline whose
-// component vocabulary is supplied by a site's component registry. The site owns the
-// component builders, class names, icon set, and CSS; the engine owns the machinery.
-export * from './registry.js';
-export * from './glyph.js';
-export * from './remark-directives.js';
-export * from './rehype-dispatch.js';
-export * from './pipeline.js';

package/src/lib/delivery/paginate.ts

@@ -1,32 +0,0 @@
-// cairn-cms: pagination helper (public-delivery design). Pure slice math; the template renders
-// the controls. An out-of-range page clamps into bounds.
-
-/** A page of items plus its navigation state. */
-export interface Page<T> {
-  items: T[];
-  page: number;
-  perPage: number;
-  total: number;
-  totalPages: number;
-  hasPrev: boolean;
-  hasNext: boolean;
-}
-
-/** Slice `items` into the 1-based `page` of size `perPage`, clamping the page into bounds. */
-export function paginate<T>(items: T[], page: number, perPage: number): Page<T> {
-  const total = items.length;
-  // A non-positive page size would make totalPages Infinity, so clamp it to one.
-  const size = Math.max(1, Math.floor(perPage) || 1);
-  const totalPages = Math.max(1, Math.ceil(total / size));
-  const current = Math.min(Math.max(1, Math.floor(page) || 1), totalPages);
-  const start = (current - 1) * size;
-  return {
-    items: items.slice(start, start + size),
-    page: current,
-    perPage: size,
-    total,
-    totalPages,
-    hasPrev: current > 1,
-    hasNext: current < totalPages,
-  };
-}

package/src/lib/render/index.ts

@@ -1,8 +0,0 @@
-// cairn-cms render engine: a directive-driven markdown to HTML pipeline whose
-// component vocabulary is supplied by a site's component registry. The site owns the
-// component builders, class names, icon set, and CSS; the engine owns the machinery.
-export * from './registry.js';
-export * from './glyph.js';
-export * from './remark-directives.js';
-export * from './rehype-dispatch.js';
-export * from './pipeline.js';