@glw907/cairn-cms 0.41.0 → 0.51.0

package/dist/components/preview-doc.d.ts

@@ -0,0 +1,27 @@
+import type { ResolvedPreview } from '../content/types.js';
+/** One width the preview frame can take. */
+export interface PreviewDevice {
+    id: 'desktop' | 'tablet' | 'phone' | 'small';
+    /** The device menu label, also the frame caption's first half. */
+    label: string;
+    /** Frame width in CSS pixels; null fills the pane (Desktop). */
+    width: number | null;
+}
+/** A preview device's id, the value the page persists. */
+export type PreviewDeviceId = PreviewDevice['id'];
+/** The four widths the device menu offers, in menu order. Desktop leads as the default. */
+export declare const previewDevices: PreviewDevice[];
+/** The table row for a device id. The id type makes a miss impossible; the fallback satisfies find. */
+export declare function previewDevice(id: PreviewDeviceId): PreviewDevice;
+/** A device's user-facing text, shared by the toolbar's menu items and the frame caption: the
+ *  label with its width when one is fixed, so the value reaches assistive tech at pick time. */
+export declare function deviceLabel(d: PreviewDevice): string;
+/**
+ * Build the preview iframe's srcdoc: a complete document linking the site's stylesheets around
+ * the rendered entry html. The html comes from the site's floored render pipeline, which already
+ * stripped scripts and event handlers, so it embeds unescaped; the frame's empty `sandbox` is
+ * belt and braces over that floor. The parameter is the flat `ResolvedPreview` shape `editLoad`
+ * ships, so the per-concept map can never reach the frame document by construction.
+ * `preview` null (a site without the adapter knob) yields a styleless but complete document.
+ */
+export declare function buildPreviewDoc(html: string, preview: ResolvedPreview | null): string;

package/dist/components/preview-doc.js

@@ -0,0 +1,64 @@
+// cairn-cms: the edit page's preview-frame document. The admin's chrome isolation keeps the
+// site's CSS out of the admin document, so EditPage renders the preview inside a sandboxed
+// iframe whose document links the site's own stylesheets from the adapter's preview knob. This
+// module builds that iframe's srcdoc as one pure string, so its shape is unit-testable, and it
+// carries the device table the frame's width control offers.
+import { escapeHtml } from '../escape.js';
+/** The four widths the device menu offers, in menu order. Desktop leads as the default. */
+export const previewDevices = [
+    { id: 'desktop', label: 'Desktop', width: null },
+    { id: 'tablet', label: 'Tablet', width: 768 },
+    { id: 'phone', label: 'Phone', width: 390 },
+    { id: 'small', label: 'Small phone', width: 320 },
+];
+/** The table row for a device id. The id type makes a miss impossible; the fallback satisfies find. */
+export function previewDevice(id) {
+    return previewDevices.find((d) => d.id === id) ?? previewDevices[0];
+}
+/** A device's user-facing text, shared by the toolbar's menu items and the frame caption: the
+ *  label with its width when one is fixed, so the value reaches assistive tech at pick time. */
+export function deviceLabel(d) {
+    return d.width === null ? d.label : `${d.label} · ${d.width} px`;
+}
+/**
+ * Build the preview iframe's srcdoc: a complete document linking the site's stylesheets around
+ * the rendered entry html. The html comes from the site's floored render pipeline, which already
+ * stripped scripts and event handlers, so it embeds unescaped; the frame's empty `sandbox` is
+ * belt and braces over that floor. The parameter is the flat `ResolvedPreview` shape `editLoad`
+ * ships, so the per-concept map can never reach the frame document by construction.
+ * `preview` null (a site without the adapter knob) yields a styleless but complete document.
+ */
+export function buildPreviewDoc(html, preview) {
+    const links = (preview?.stylesheets ?? [])
+        .map((href) => `<link rel="stylesheet" href="${escapeHtml(href)}">`)
+        .join('\n');
+    const bodyAttrs = preview?.bodyClass ? ` class="${escapeHtml(preview.bodyClass)}"` : '';
+    const content = preview?.containerClass
+        ? `<div class="${escapeHtml(preview.containerClass)}">${html}</div>`
+        : html;
+    // The reset sits BEFORE the site links so the site's CSS wins every collision: it only clears
+    // the default body margin and pins a white ground for sheets that assume one.
+    //
+    // The base tag is what makes links inert. The empty sandbox alone does not: a sandboxed
+    // context may still navigate itself, and a srcdoc document resolves relative hrefs against the
+    // parent's base URL, so a clicked fragment or root link could render the admin login inside
+    // the frame. Targeting every link at a new tab turns each click into a popup, and the sandbox
+    // (which grants no allow-popups) blocks it, so a proofing click goes nowhere.
+    return [
+        '<!doctype html>',
+        '<html>',
+        '<head>',
+        '<meta charset="utf-8">',
+        '<meta name="viewport" content="width=device-width, initial-scale=1">',
+        '<base target="_blank">',
+        '<style>body{margin:0;background:#fff}</style>',
+        links,
+        '</head>',
+        `<body${bodyAttrs}>`,
+        content,
+        '</body>',
+        '</html>',
+    ]
+        .filter((line) => line !== '')
+        .join('\n');
+}

package/dist/content/compose.js

@@ -31,6 +31,7 @@ export function composeRuntime({ adapter, siteConfig, extensions = [] }) {
         registry: adapter.registry,
         icons: adapter.icons,
         navMenu: adapter.navMenu,
+        preview: adapter.preview,
         assets: adapter.assets,
         adminPanels,
         fieldTypes,

package/dist/content/links.d.ts

@@ -18,3 +18,11 @@ export declare function escapeLinkText(text: string): string;
 /** The cairn links a markdown body points at, in first-occurrence order, deduped by concept/id.
  *  Parses the body as mdast, so a token inside a code span or fence is never matched. */
 export declare function extractCairnLinks(body: string): CairnRef[];
+/**
+ * Rewrite every cairn: link whose href is exactly `oldHref` so its href becomes `newHref`, keeping
+ * the display text and any link title byte-for-byte. Rename calls this to repoint a renamed entry's
+ * inbound tokens. Parsed with the same remark pipeline as extractCairnLinks, so a token inside a code
+ * span is not a link node and is never touched. Each matching node's source span is rewritten from
+ * last to first, replacing only the `](oldHref` run so the label and title stay exact.
+ */
+export declare function rewriteCairnLink(doc: string, oldHref: string, newHref: string): string;

package/dist/content/links.js

@@ -50,3 +50,31 @@ export function extractCairnLinks(body) {
     });
     return refs;
 }
+/**
+ * Rewrite every cairn: link whose href is exactly `oldHref` so its href becomes `newHref`, keeping
+ * the display text and any link title byte-for-byte. Rename calls this to repoint a renamed entry's
+ * inbound tokens. Parsed with the same remark pipeline as extractCairnLinks, so a token inside a code
+ * span is not a link node and is never touched. Each matching node's source span is rewritten from
+ * last to first, replacing only the `](oldHref` run so the label and title stay exact.
+ */
+export function rewriteCairnLink(doc, oldHref, newHref) {
+    const tree = unified().use(remarkParse).use(remarkGfm).parse(doc);
+    const spans = [];
+    visit(tree, 'link', (node) => {
+        if (node.url !== oldHref)
+            return;
+        const start = node.position?.start?.offset;
+        const end = node.position?.end?.offset;
+        if (start == null || end == null)
+            return;
+        spans.push({ start, end });
+    });
+    spans.sort((a, b) => b.start - a.start);
+    let out = doc;
+    for (const span of spans) {
+        const src = out.slice(span.start, span.end);
+        const rewritten = src.replace(`](${oldHref}`, `](${newHref}`);
+        out = out.slice(0, span.start) + rewritten + out.slice(span.end);
+    }
+    return out;
+}

package/dist/content/types.d.ts

@@ -133,6 +133,34 @@ export interface NavMenuConfig {
     /** Max nesting depth allowed in the editor; defaults to 2. */
     maxDepth?: number;
 }
+/**
+ * How the edit page's preview frame reproduces the live site's content styling. The admin
+ * deliberately never loads the site's CSS (chrome isolation), so a design-accurate preview needs
+ * the site to name its stylesheets for the preview frame; without this knob the preview renders
+ * unstyled markup. The frame's srcdoc pins a white body background as a deliberately overridable
+ * default, so a site whose ground is not white should state its body background in its own
+ * stylesheet.
+ */
+export interface PreviewConfig {
+    /** Absolute or root-relative URLs of the site's compiled stylesheets, linked inside the
+     *  preview document. A Vite `?url` import of the site's CSS resolves the hashed asset URL. */
+    stylesheets: string[];
+    /** Class list applied to the preview document's body, for theme or typography roots. */
+    bodyClass?: string;
+    /** Class list for a wrapper element around the rendered content, reproducing the site's
+     *  content container (a prose or measure class). Omitted renders the content bare. */
+    containerClass?: string;
+    /** Per-concept overrides of bodyClass and containerClass, keyed by concept id. An entry's
+     *  preview resolves the override for its concept over the top-level values; stylesheets are
+     *  always shared. */
+    byConcept?: Record<string, {
+        bodyClass?: string;
+        containerClass?: string;
+    }>;
+}
+/** The flat preview shape `editLoad` ships to the edit page: the top-level `PreviewConfig`
+ *  values with the entry's concept override applied, and no `byConcept` map. */
+export type ResolvedPreview = Omit<PreviewConfig, 'byConcept'>;
 /** Reserved asset slot (seam 4). Typed and unused in the rebuild; R7/R9 read it later with no contract change. */
 export interface AssetConfig {
     /** Repo-relative asset roots, e.g. ["static/images"]. */
@@ -154,8 +182,8 @@ export interface CairnAdapter {
     backend: BackendConfig;
     sender: SenderConfig;
     /** The site's one renderer: the editor preview and every public page call it (design decision 4).
-     *  `resolve` rewrites cairn: links to live permalinks; the build passes a site-index resolver, the
-     *  preview a manifest one. */
+     *  `resolve` rewrites cairn: links to live permalinks; the build passes a site-resolver-backed
+     *  one, the preview a manifest one. */
     render(md: string, opts?: {
         stagger?: boolean;
         resolve?: LinkResolve;
@@ -168,6 +196,9 @@ export interface CairnAdapter {
     /** The site's glyph name to SVG path-data map, for the admin icon picker and the renderer. */
     icons?: IconSet;
     navMenu?: NavMenuConfig;
+    /** The live site's content styling for the preview frame. The admin's chrome isolation keeps
+     *  the site's CSS out of the admin document, so the preview frame links these instead. */
+    preview?: PreviewConfig;
     assets?: AssetConfig;
 }
 /**
@@ -263,6 +294,8 @@ export interface CairnRuntime {
     /** The site's glyph name to SVG path-data map, for the admin icon picker and the renderer. */
     icons?: IconSet;
     navMenu?: NavMenuConfig;
+    /** The live site's content styling for the preview frame; passed through from the adapter. */
+    preview?: PreviewConfig;
     assets?: AssetConfig;
     /** Admin panels contributed by extensions (Mode 2). Empty until Plan 09 wires the dispatch route. */
     adminPanels?: AdminPanel[];

package/dist/delivery/data.d.ts

@@ -1,7 +1,7 @@
 export { createContentIndex, fromGlob } from './content-index.js';
 export type { RawFile, ContentSummary, ContentEntry, ContentIndex, ContentProblem } from './content-index.js';
-export { createSiteIndex } from './site-index.js';
-export type { SiteIndex, ConceptIndex } from './site-index.js';
+export { createSiteResolver, buildLinkResolver } from './site-resolver.js';
+export type { SiteResolver, ConceptIndex } from './site-resolver.js';
 export { createSiteIndexes } from './site-indexes.js';
 export type { SiteIndexes, SiteGlobs } from './site-indexes.js';
 export { siteDescriptors } from './site-descriptors.js';
@@ -15,9 +15,7 @@ export { buildSeoMeta } from './seo.js';
 export type { SeoInput, SeoMeta } from './seo.js';
 export { readSeoFields, resolveImageUrl } from './seo-fields.js';
 export type { SeoFields } from './seo-fields.js';
-export { paginate } from './paginate.js';
-export type { Page } from './paginate.js';
 export { rssResponse, jsonFeedResponse, sitemapResponse, robotsResponse } from './responses.js';
 export { jsonLdScript } from './json-ld.js';
 export { permalink } from '../content/permalink.js';
-export { buildSiteManifest, buildLinkResolver } from './manifest.js';
+export { buildSiteManifest } from './manifest.js';

package/dist/delivery/data.js

@@ -2,7 +2,7 @@
 // projections a SvelteKit site or a plain-Node tool reads, with no @sveltejs/kit and no .svelte in
 // the graph. The full ./delivery barrel re-exports this and adds the route loaders.
 export { createContentIndex, fromGlob } from './content-index.js';
-export { createSiteIndex } from './site-index.js';
+export { createSiteResolver, buildLinkResolver } from './site-resolver.js';
 export { createSiteIndexes } from './site-indexes.js';
 export { siteDescriptors } from './site-descriptors.js';
 export { deriveExcerpt, wordCount } from './excerpt.js';
@@ -11,8 +11,7 @@ export { buildSitemap } from './sitemap.js';
 export { buildRobots } from './robots.js';
 export { buildSeoMeta } from './seo.js';
 export { readSeoFields, resolveImageUrl } from './seo-fields.js';
-export { paginate } from './paginate.js';
 export { rssResponse, jsonFeedResponse, sitemapResponse, robotsResponse } from './responses.js';
 export { jsonLdScript } from './json-ld.js';
 export { permalink } from '../content/permalink.js';
-export { buildSiteManifest, buildLinkResolver } from './manifest.js';
+export { buildSiteManifest } from './manifest.js';

package/dist/delivery/feeds.js

@@ -2,13 +2,7 @@
 // channel and a list of items, so they unit-test without a render or a network. The caller
 // (a template +server.ts shim) assembles items from the content index and passes absolute
 // URLs built from PUBLIC_ORIGIN.
-function escapeXml(value) {
-    return value
-        .replace(/&/g, '&')
-        .replace(/</g, '&lt;')
-        .replace(/>/g, '&gt;')
-        .replace(/"/g, '&quot;');
-}
+import { escapeXml } from './xml.js';
 /** Make a string safe inside a CDATA section by splitting any `]]>` across two sections. */
 function cdataSafe(value) {
     return value.replace(/]]>/g, ']]]]><![CDATA[>');

package/dist/delivery/index.d.ts

@@ -1,3 +1,3 @@
 export * from './data.js';
-export { createPublicRoutes } from '../sveltekit/public-routes.js';
-export type { PublicRoutesDeps, ListData, TagData, TagIndexData, EntryData, } from '../sveltekit/public-routes.js';
+export { createPublicRoutes } from './public-routes.js';
+export type { PublicRoutesDeps, ListData, TagData, TagIndexData, EntryData, } from './public-routes.js';

package/dist/delivery/index.js

@@ -3,4 +3,4 @@
 // lives at ./delivery/head. Importing this pulls @sveltejs/kit through the route loaders, so a
 // plain-Node tool imports from ./delivery/data instead.
 export * from './data.js';
-export { createPublicRoutes } from '../sveltekit/public-routes.js';
+export { createPublicRoutes } from './public-routes.js';

package/dist/delivery/manifest.d.ts

@@ -1,12 +1,7 @@
 import type { Manifest } from '../content/manifest.js';
-import type { LinkResolve } from '../content/links.js';
-import type { SiteIndex } from './site-index.js';
 import type { SiteConfig } from '../nav/site-config.js';
 import type { CairnAdapter } from '../content/types.js';
 import type { SiteGlobs } from './site-indexes.js';
 /** Build the whole-corpus manifest from a site's adapter, config, and per-concept globs. Drafts are
  *  included and flagged, so the admin picker and the guards see the full graph. */
 export declare function buildSiteManifest<A extends CairnAdapter>(adapter: A, config: SiteConfig, globs: SiteGlobs<A>): Manifest;
-/** A resolver backed by the site index, for the build. A miss throws, so a dangling cairn: token
- *  fails the prerender (the build backstop). The preview uses manifestLinkResolver, which marks. */
-export declare function buildLinkResolver(site: SiteIndex): LinkResolve;

package/dist/delivery/manifest.js

@@ -1,8 +1,7 @@
-// cairn-cms: the build-side manifest builder and the build link resolver (content-graph design).
-// buildSiteManifest mirrors createSiteIndexes: it maps the site descriptors over the per-concept
-// globs and projects each file to a manifest row. buildLinkResolver reads the site index, which is
-// fresh from the files at build, and throws on a missing target so a dangling cairn: token fails
-// the build (the backstop). The admin preview uses manifestLinkResolver instead.
+// cairn-cms: the build-side manifest builder (content-graph design). buildSiteManifest mirrors
+// createSiteIndexes: it maps the site descriptors over the per-concept globs and projects each
+// file to a manifest row. The build-time cairn: link resolver lives beside the site resolver in
+// site-resolver.ts; the admin preview uses manifestLinkResolver instead.
 import { siteDescriptors } from './site-descriptors.js';
 import { fromGlob } from './content-index.js';
 import { parseMarkdown } from '../content/frontmatter.js';
@@ -15,7 +14,7 @@ export function buildSiteManifest(adapter, config, globs) {
     for (const descriptor of siteDescriptors(adapter, config)) {
         const record = globRecord[descriptor.id] ?? {};
         for (const file of fromGlob(record)) {
-            // Validate the same way createContentIndex does, so the manifest and the site index agree on
+            // Validate the same way createContentIndex does, so the manifest and the site resolver agree on
             // which entries exist. A validation failure is excluded from both; otherwise the preview would
             // resolve a link the build then rejects as a missing target.
             const { frontmatter, body } = parseMarkdown(file.raw);
@@ -26,13 +25,3 @@ export function buildSiteManifest(adapter, config, globs) {
     }
     return manifest;
 }
-/** A resolver backed by the site index, for the build. A miss throws, so a dangling cairn: token
- *  fails the prerender (the build backstop). The preview uses manifestLinkResolver, which marks. */
-export function buildLinkResolver(site) {
-    return (ref) => {
-        const url = site.concept(ref.concept)?.byId(ref.id)?.permalink;
-        if (!url)
-            throw new Error(`cairn link target not found: cairn:${ref.concept}/${ref.id}`);
-        return url;
-    };
-}

package/dist/{sveltekit → delivery}/public-routes.d.ts

@@ -1,10 +1,10 @@
-import type { ContentSummary, ContentEntry } from '../delivery/content-index.js';
-import type { SiteIndex } from '../delivery/site-index.js';
-import type { SeoMeta } from '../delivery/seo.js';
+import type { ContentSummary, ContentEntry } from './content-index.js';
+import type { SiteResolver } from './site-resolver.js';
+import type { SeoMeta } from './seo.js';
 import type { LinkResolve } from '../content/links.js';
 /** Injected dependencies for the public loaders. */
 export interface PublicRoutesDeps {
-    site: SiteIndex;
+    site: SiteResolver;
     render: (md: string, opts?: {
         stagger?: boolean;
         resolve?: LinkResolve;

package/dist/{sveltekit → delivery}/public-routes.js

@@ -1,12 +1,12 @@
-// cairn-cms: public route loaders (dated-slug design). The factory closes over the site-level
-// index, the runtime render, and the origin. entryLoad and entries are site-wide: one catch-all
+// cairn-cms: public route loaders (dated-slug design). The factory closes over the site
+// resolver, the runtime render, and the origin. entryLoad and entries are site-wide: one catch-all
 // `[...path]` route resolves any concept by request path through `byPermalink`. The archive, tag,
-// and tag-index loaders stay concept-scoped, keyed by concept id. The index is built in site code
-// from globs, so it stays in the prerender graph and out of the runtime Worker.
+// and tag-index loaders stay concept-scoped, keyed by concept id. The resolver is built in site
+// code from globs, so it stays in the prerender graph and out of the runtime Worker.
 import { error } from '@sveltejs/kit';
-import { buildSeoMeta } from '../delivery/seo.js';
-import { readSeoFields, resolveImageUrl } from '../delivery/seo-fields.js';
-import { buildLinkResolver } from '../delivery/manifest.js';
+import { buildSeoMeta } from './seo.js';
+import { readSeoFields, resolveImageUrl } from './seo-fields.js';
+import { buildLinkResolver } from './site-resolver.js';
 /** Build the public loaders for a site's unified index. */
 export function createPublicRoutes(deps) {
     const { site, render, origin, siteName, description, feeds, defaultImage } = deps;

package/dist/delivery/site-indexes.d.ts

@@ -2,7 +2,7 @@ import type { CairnAdapter, ConceptConfig } from '../content/types.js';
 import type { Infer } from '../content/schema.js';
 import type { SiteConfig } from '../nav/site-config.js';
 import type { ContentIndex } from './content-index.js';
-import type { SiteIndex } from './site-index.js';
+import type { SiteResolver } from './site-resolver.js';
 /** A per-concept raw glob record (`{ path: raw }`) keyed by concept id, from `import.meta.glob`. */
 export type SiteGlobs<A extends CairnAdapter> = {
     [K in keyof A['content']]?: Record<string, string>;
@@ -12,13 +12,13 @@ export type SiteGlobs<A extends CairnAdapter> = {
 export type SiteIndexes<A extends CairnAdapter> = {
     [K in keyof A['content']]: ContentIndex<NonNullable<A['content'][K]> extends ConceptConfig<infer S> ? Infer<S> : Record<string, unknown>>;
 } & {
-    readonly site: SiteIndex;
+    readonly site: SiteResolver;
 };
 /**
  * Build typed per-concept indexes and a site resolver from one adapter. Pass the per-concept raw
  * globs as `{ posts: import.meta.glob('...?raw', { eager: true }), ... }`; Vite needs the literal
  * glob at the call site, so the engine cannot glob on the site's behalf. `validate: false` opts out
- * of the build gate, exactly as on `createSiteIndex`.
+ * of the build gate, exactly as on `createSiteResolver`.
  */
 export declare function createSiteIndexes<const A extends CairnAdapter>(adapter: A, config: SiteConfig, globs: SiteGlobs<A>, opts?: {
     validate?: boolean;

package/dist/delivery/site-indexes.js

@@ -1,11 +1,11 @@
 import { siteDescriptors } from './site-descriptors.js';
 import { createContentIndex, fromGlob } from './content-index.js';
-import { createSiteIndex } from './site-index.js';
+import { createSiteResolver } from './site-resolver.js';
 /**
  * Build typed per-concept indexes and a site resolver from one adapter. Pass the per-concept raw
  * globs as `{ posts: import.meta.glob('...?raw', { eager: true }), ... }`; Vite needs the literal
  * glob at the call site, so the engine cannot glob on the site's behalf. `validate: false` opts out
- * of the build gate, exactly as on `createSiteIndex`.
+ * of the build gate, exactly as on `createSiteResolver`.
  */
 export function createSiteIndexes(adapter, config, globs, opts = {}) {
     const descriptors = siteDescriptors(adapter, config);
@@ -25,6 +25,6 @@ export function createSiteIndexes(adapter, config, globs, opts = {}) {
         byConcept[descriptor.id] = index;
         conceptIndexes.push({ descriptor, index });
     }
-    const site = createSiteIndex(conceptIndexes, opts);
+    const site = createSiteResolver(conceptIndexes, opts);
     return { ...byConcept, site };
 }

package/dist/delivery/{site-index.d.ts → site-resolver.d.ts}

@@ -1,12 +1,13 @@
 import type { ConceptDescriptor } from '../content/types.js';
 import type { ContentEntry, ContentIndex, ContentSummary } from './content-index.js';
+import type { LinkResolve } from '../content/links.js';
 /** One concept's descriptor paired with its built index. */
 export interface ConceptIndex {
     descriptor: ConceptDescriptor;
     index: ContentIndex;
 }
 /** The cross-concept query surface a catch-all route and the sitemap read. */
-export interface SiteIndex {
+export interface SiteResolver {
     /** Resolve a request path (with or without a trailing slash) to its entry, or undefined. */
     byPermalink(path: string): ContentEntry | undefined;
     /** Newer/older neighbors within the entry's own concept, for prev/next links. */
@@ -28,6 +29,9 @@ export interface SiteIndex {
  * unless `validate` is `false`, on any non-draft entry whose frontmatter fails its concept's
  * validator, so malformed content fails the build instead of shipping.
  */
-export declare function createSiteIndex(concepts: ConceptIndex[], opts?: {
+export declare function createSiteResolver(concepts: ConceptIndex[], opts?: {
     validate?: boolean;
-}): SiteIndex;
+}): SiteResolver;
+/** A resolver backed by the site resolver, for the build. A miss throws, so a dangling cairn: token
+ *  fails the prerender (the build backstop). The preview uses manifestLinkResolver, which marks. */
+export declare function buildLinkResolver(site: SiteResolver): LinkResolve;

package/dist/delivery/{site-index.js → site-resolver.js}

@@ -21,11 +21,11 @@ function siteProblems(concepts) {
  * unless `validate` is `false`, on any non-draft entry whose frontmatter fails its concept's
  * validator, so malformed content fails the build instead of shipping.
  */
-export function createSiteIndex(concepts, opts = {}) {
+export function createSiteResolver(concepts, opts = {}) {
     if (opts.validate !== false) {
         const problems = siteProblems(concepts);
         if (problems.length > 0) {
-            throw new Error(`site index: ${problems.length} invalid frontmatter field(s):\n  ${problems.join('\n  ')}`);
+            throw new Error(`site resolver: ${problems.length} invalid frontmatter field(s):\n  ${problems.join('\n  ')}`);
         }
     }
     const byPath = new Map();
@@ -35,7 +35,7 @@ export function createSiteIndex(concepts, opts = {}) {
         for (const summary of index.all()) {
             const existing = byPath.get(summary.permalink);
             if (existing) {
-                throw new Error(`site index: "${existing.id}" and "${summary.id}" both resolve to "${summary.permalink}"`);
+                throw new Error(`site resolver: "${existing.id}" and "${summary.id}" both resolve to "${summary.permalink}"`);
             }
             byPath.set(summary.permalink, { index, id: summary.id });
         }
@@ -60,3 +60,13 @@ export function createSiteIndex(concepts, opts = {}) {
         },
     };
 }
+/** A resolver backed by the site resolver, for the build. A miss throws, so a dangling cairn: token
+ *  fails the prerender (the build backstop). The preview uses manifestLinkResolver, which marks. */
+export function buildLinkResolver(site) {
+    return (ref) => {
+        const url = site.concept(ref.concept)?.byId(ref.id)?.permalink;
+        if (!url)
+            throw new Error(`cairn link target not found: cairn:${ref.concept}/${ref.id}`);
+        return url;
+    };
+}

package/dist/delivery/sitemap.js

@@ -1,8 +1,6 @@
 // cairn-cms: sitemap builder (public-delivery design). Pure over a URL list; the caller
 // derives the list from the content index and the routable concepts.
-function escapeXml(value) {
-    return value.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
-}
+import { escapeXml } from './xml.js';
 /** Build a sitemap XML document from a list of URLs. */
 export function buildSitemap(urls) {
     const entries = urls

package/dist/delivery/xml.d.ts

@@ -0,0 +1,2 @@
+/** Escape the XML-significant characters for element text and double-quoted attribute values. */
+export declare function escapeXml(value: string): string;

package/dist/delivery/xml.js

@@ -0,0 +1,11 @@
+// cairn-cms: the one XML text escape the feed and sitemap builders share. The strongest of the
+// two copies it replaced (the old sitemap copy skipped quotes), so both documents stay safe in
+// element text and double-quoted attributes.
+/** Escape the XML-significant characters for element text and double-quoted attribute values. */
+export function escapeXml(value) {
+    return value
+        .replaceAll('&', '&')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;')
+        .replaceAll('"', '&quot;');
+}

package/dist/diagnostics/conditions.js

@@ -69,6 +69,14 @@ export const REGISTRY = {
         remediation: "Set csrf: { checkOrigin: false } in svelte.config.js and wire createAuthGuard into src/hooks.server.ts; cairn's guard owns the Origin and double-submit token checks.",
         docsAnchor: 'cloudflare-readiness.md#hand-cairn-the-csrf-authority',
     },
+    'config.public-origin-invalid': {
+        id: 'config.public-origin-invalid',
+        severity: 'blocker',
+        title: 'PUBLIC_ORIGIN is missing or invalid',
+        why: 'PUBLIC_ORIGIN is unset, does not parse as a URL, or uses http on a non-local host. The magic-link confirmation links and the absolute feed URLs derive from it, config-only so a forged Host header cannot redirect a link, and sign-in cannot mint a usable link without it.',
+        remediation: "Set PUBLIC_ORIGIN to the site's canonical https origin in the wrangler config vars (with .dev.vars carrying the local http override), then re-deploy; http passes only on localhost or 127.0.0.1.",
+        docsAnchor: 'cloudflare-readiness.md#set-the-public-origin',
+    },
     'config.site-config-invalid': {
         id: 'config.site-config-invalid',
         severity: 'blocker',
@@ -77,6 +85,14 @@ export const REGISTRY = {
         remediation: 'Correct site.config.yaml; the parse or validation error names the failing field or URL-policy rule.',
         docsAnchor: 'cloudflare-readiness.md#validate-the-site-config',
     },
+    'config.dependency-floors-unmet': {
+        id: 'config.dependency-floors-unmet',
+        severity: 'blocker',
+        title: 'A framework dependency sits below the engine floor',
+        why: 'The lockfile resolves svelte or @sveltejs/kit below the range the engine declares as a peer. Consumer sites compile the shipped .svelte sources, so a below-floor compiler bites silently at build time; svelte 5.56.1 miscompiles parenthesized boolean groupings, which is why the svelte floor is ^5.56.3.',
+        remediation: "Raise the devDependency range in the site's package.json to the engine peer range and reinstall so the lockfile re-resolves, for example `npm install --save-dev svelte@^5.56.3`.",
+        docsAnchor: 'cloudflare-readiness.md#meet-the-dependency-floors',
+    },
     'edge.hsts-off': {
         id: 'edge.hsts-off',
         severity: 'warning',
@@ -102,6 +118,14 @@ export const REGISTRY = {
         docsAnchor: 'cloudflare-readiness.md#install-the-github-app',
         logEvent: 'github.unreachable',
     },
+    'admin.login-probe-failed': {
+        id: 'admin.login-probe-failed',
+        severity: 'blocker',
+        title: 'Live admin login probe failed',
+        why: 'A live request to the deployed admin did not answer with the working sign-in envelope (the login page, its CSRF cookie and hidden field, and the request action), so a real editor cannot sign in either. A probe failure has many possible causes; the detail line names the assertion that failed.',
+        remediation: 'Read the failed assertion in the detail line, run the full doctor against the same site, and work through the deploy guide; the other checks narrow the cause.',
+        docsAnchor: 'cloudflare-readiness.md#probe-the-deployed-admin',
+    },
 };
 // The registry is shared identity, never working state; freeze every entry and the map itself.
 for (const entry of Object.values(REGISTRY))

package/dist/doctor/bin.js

@@ -7,8 +7,10 @@
 // before the process ends.
 import { readFile } from 'node:fs/promises';
 import { resolve } from 'node:path';
+import { liveProbeCheck } from './check-probe.js';
 import { liveSendCheck } from './check-send.js';
-import { contextFromEnv, defaultChecks, formatReport, parseArgs, runDoctor } from './index.js';
+import { readWranglerConfig } from './wrangler-config.js';
+import { contextFromEnv, defaultChecks, deriveMissingInputs, formatReport, parseArgs, runDoctor, } from './index.js';
 async function main() {
     let args;
     try {
@@ -20,23 +22,39 @@ async function main() {
         return;
     }
     const cwd = process.cwd();
+    const readFileUnderCwd = async (relPath) => {
+        try {
+            return await readFile(resolve(cwd, relPath), 'utf8');
+        }
+        catch (err) {
+            if (err.code === 'ENOENT')
+                return null;
+            throw err;
+        }
+    };
+    // Fill inputs the flags and env left missing from the repo itself: from and repo off the
+    // adapter (through the vite arm, which exists only on this bin path, never in a Worker)
+    // and the account id off the wrangler config. The API token stays env-only.
+    const derived = await deriveMissingInputs(contextFromEnv(process.env, args, cwd), {
+        adapterFacts: async () => {
+            const { readAdapterFacts } = await import('../vite/index.js');
+            return readAdapterFacts(cwd);
+        },
+        wranglerAccountId: async () => (await readWranglerConfig(readFileUnderCwd))?.accountId,
+    });
     const ctx = {
-        ...contextFromEnv(process.env, args, cwd),
+        ...derived,
         fetch: globalThis.fetch,
-        readFile: async (relPath) => {
-            try {
-                return await readFile(resolve(cwd, relPath), 'utf8');
-            }
-            catch (err) {
-                if (err.code === 'ENOENT')
-                    return null;
-                throw err;
-            }
-        },
+        readFile: readFileUnderCwd,
     };
     const checks = defaultChecks();
     if (args.sendTest)
         checks.push(liveSendCheck(args.sendTest));
+    // The probe is an opt-in network POST against a live site, so it joins only on --probe;
+    // the bare flag hands the URL resolution (the PUBLIC_ORIGIN input) to the check itself.
+    if (args.probe !== undefined) {
+        checks.push(liveProbeCheck(args.probe === true ? undefined : args.probe));
+    }
     const { results, failed } = await runDoctor(checks, ctx);
     console.log(formatReport(results));
     process.exitCode = failed > 0 ? 1 : 0;