@glw907/cairn-cms 0.68.0 → 0.76.0

package/dist/render/rehype-dispatch.d.ts

@@ -29,10 +29,10 @@ export declare function headRow(title: ElementContent[], icon?: Element, level?:
 export declare function markFirstList(children: ElementContent[]): Element | undefined;
 /**
  * Rehype transformer: dispatch each stamped element through its registry `build`
- *  fn. When `stagger` is on, each top-level primitive gets a `data-rise` attribute
- *  carrying its document-order index (0, 1, 2, …); the site's CSS maps that ordinal
- *  to an entrance delay. The index is inert, so a consumer's sanitize floor can keep
+ *  fn. Each top-level primitive gets a `data-rise` attribute carrying its
+ *  document-order index (0, 1, 2, …); the site's CSS maps that ordinal to an
+ *  entrance delay. The index is inert, so a consumer's sanitize floor can keep
  *  `data-rise` while dropping `style`. Nested primitives never get it. Non-primitive
  *  content (lede, intro paragraphs, the page-toc nav) passes through untouched.
  */
-export declare function rehypeDispatch(registry: ComponentRegistry, stagger?: boolean): (tree: Root) => void;
+export declare function rehypeDispatch(registry: ComponentRegistry): (tree: Root) => void;

package/dist/render/rehype-dispatch.js

@@ -56,7 +56,7 @@ export function markFirstList(children) {
 }
 // Recurse into a node's children, transforming any nested primitive sections
 // (a grid inside a card, panels inside a split). Nested primitives never carry the
-// entrance stagger; only top-level ones do (stamped in the transformer below).
+// entrance ordinal; only top-level ones do (stamped in the transformer below).
 function transformChildren(children, registry) {
     return children.map((c) => {
         if (isElement(c) && c.properties?.dataPrimitive)
@@ -70,11 +70,11 @@ function transformChildren(children, registry) {
 // 'true'/'false'; everything else is the literal string the author wrote.
 function readAttributes(node, def) {
     const out = {};
-    for (const field of def.attributes ?? []) {
-        const value = strProp(node, dataAttrProp(field.key));
+    for (const [name, field] of Object.entries(def.attributes ?? {})) {
+        const value = strProp(node, dataAttrProp(name));
         if (value == null)
             continue;
-        out[field.key] = field.type === 'boolean' ? value === 'true' : value;
+        out[name] = field.type === 'boolean' ? value === 'true' : value;
     }
     return out;
 }
@@ -126,6 +126,31 @@ function partitionSlots(node) {
         },
     };
 }
+// Serialize a hydrate component's declared attributes into the island prop payload. A `number` field is
+// coerced from its stamped string to a JSON number here; a `boolean` already arrived as a real boolean
+// from readAttributes (which coerces 'true'/'false' upstream), and every other field stays the literal
+// string the author wrote. The result is JSON.stringify-ed into data-cairn-props and parsed on the client.
+function serializeIslandProps(def, attributes) {
+    const out = {};
+    for (const [key, value] of Object.entries(attributes)) {
+        const type = def.attributes?.[key]?.type;
+        out[key] = type === 'number' && typeof value === 'string' ? Number(value) : value;
+    }
+    return out;
+}
+// Wrap a hydrate component's static fallback in its island boundary. The boundary carries the directive
+// name and the JSON prop payload; a 'visible' island also carries data-cairn-hydrate="visible". The
+// boundary attributes are inert data-* and survive both the sanitize floor (this runs after it) and the
+// sink guard (which strips only style/on*). The fallback is build()'s no-JS, first-paint representation.
+function islandBoundary(name, def, attributes, fallback) {
+    const properties = {
+        dataCairnIsland: name,
+        dataCairnProps: JSON.stringify(serializeIslandProps(def, attributes)),
+    };
+    if (def.hydrate === 'visible')
+        properties.dataCairnHydrate = 'visible';
+    return { type: 'element', tagName: 'div', properties, children: [fallback] };
+}
 function transformNode(node, registry) {
     node.children = transformChildren(node.children, registry);
     const name = strProp(node, 'dataPrimitive');
@@ -139,24 +164,24 @@ function transformNode(node, registry) {
         items: parts.items,
         node,
     };
-    return def.build(ctx);
+    const built = def.build(ctx);
+    return def.hydrate ? islandBoundary(name, def, ctx.attributes, built) : built;
 }
 /**
  * Rehype transformer: dispatch each stamped element through its registry `build`
- *  fn. When `stagger` is on, each top-level primitive gets a `data-rise` attribute
- *  carrying its document-order index (0, 1, 2, …); the site's CSS maps that ordinal
- *  to an entrance delay. The index is inert, so a consumer's sanitize floor can keep
+ *  fn. Each top-level primitive gets a `data-rise` attribute carrying its
+ *  document-order index (0, 1, 2, …); the site's CSS maps that ordinal to an
+ *  entrance delay. The index is inert, so a consumer's sanitize floor can keep
  *  `data-rise` while dropping `style`. Nested primitives never get it. Non-primitive
  *  content (lede, intro paragraphs, the page-toc nav) passes through untouched.
  */
-export function rehypeDispatch(registry, stagger) {
+export function rehypeDispatch(registry) {
     return (tree) => {
         let idx = 0;
         tree.children = tree.children.map((child) => {
             if (isElement(child) && child.properties?.dataPrimitive) {
                 const el = transformNode(child, registry);
-                if (stagger)
-                    el.properties = { ...el.properties, dataRise: String(idx++) };
+                el.properties = { ...el.properties, dataRise: String(idx++) };
                 return el;
             }
             if (isElement(child))

package/dist/render/remark-directives.js

@@ -63,8 +63,7 @@ export function remarkDirectiveStamp(registry) {
             const def = registry.get(node.name);
             const attrs = node.attributes ?? {};
             const role = attrs.role || undefined;
-            const iconField = registry.iconField(node.name);
-            const iconKey = iconField?.key ?? 'icon';
+            const iconKey = registry.iconField(node.name) ?? 'icon';
             let icon = attrs[iconKey] || undefined;
             if (!icon && role)
                 icon = registry.defaultIcon(node.name, role);
@@ -78,10 +77,10 @@ export function remarkDirectiveStamp(registry) {
             // back to that default the same way a missing one does. data-attr-<key> survives to the
             // element; build() consumes it and returns a fresh element, so the marker never reaches the
             // published DOM.
-            for (const field of def?.attributes ?? []) {
-                const raw = field === iconField ? icon : attrs[field.key];
+            for (const name of Object.keys(def?.attributes ?? {})) {
+                const raw = name === iconKey ? icon : attrs[name];
                 if (raw != null)
-                    properties[dataAttrProp(field.key)] = raw;
+                    properties[dataAttrProp(name)] = raw;
             }
             const data = node.data ?? (node.data = {});
             data.hName = 'div';

package/dist/render/sanitize-schema.js

@@ -17,7 +17,7 @@ const FIXED_MARKERS = ['dataPrimitive', 'dataSlot', 'dataRole', 'dataRise'];
  * allowlist but not weaken the core strip.
  */
 export function buildSanitizeSchema(registry, extend) {
-    const attrMarkers = registry.defs.flatMap((d) => (d.attributes ?? []).map((a) => dataAttrProp(a.key)));
+    const attrMarkers = registry.defs.flatMap((d) => Object.keys(d.attributes ?? {}).map((key) => dataAttrProp(key)));
     const markers = [...FIXED_MARKERS, ...attrMarkers];
     const attributes = defaultSchema.attributes ?? {};
     // defaultSchema's `a` entry carries a className tuple (`['className', 'data-footnote-backref']`)

package/dist/sveltekit/cairn-admin.d.ts

@@ -2,7 +2,7 @@ import { type ContentRoutesDeps, type LayoutData, type ListData, type EditData,
 import { type NavLoadData } from './nav-routes.js';
 import type { AuthBranding, SendMagicLink } from '../email.js';
 import type { AuthEnv, Editor } from '../auth/types.js';
-import type { GithubKeyEnv } from '../github/credentials.js';
+import type { BackendEnv } from '../github/credentials.js';
 import type { CairnRuntime } from '../content/types.js';
 import type { CookieJar, EventBase } from './types.js';
 /**
@@ -10,19 +10,19 @@ import type { CookieJar, EventBase } from './types.js';
  * (ContentEvent minus params, which the dispatcher synthesizes, plus RequestContext's cookies
  * and setHeaders). A real SvelteKit RequestEvent satisfies it.
  */
-export interface AdminEvent extends EventBase<GithubKeyEnv & AuthEnv> {
+export interface AdminEvent extends EventBase<BackendEnv & AuthEnv> {
     cookies: CookieJar;
     setHeaders(headers: Record<string, string>): void;
 }
 /**
  * Injectable dependencies. Branding defaults from the runtime's siteName and sender, so a
- *  site overrides it only to change the magic-link email identity; `send` and `mintToken`
- *  are the same seams the underlying factories take.
+ *  site overrides it only to change the magic-link email identity; `send` is the same seam the
+ *  underlying auth factory takes. The content backend rides `event.locals.backend` (the dev double)
+ *  or the adapter's provider, so it is not a dep here.
  */
 export interface CairnAdminDeps {
     branding?: AuthBranding;
     send?: SendMagicLink;
-    mintToken?: ContentRoutesDeps['mintToken'];
     /**
      * Build the Anthropic client for the tidy action. Forwarded to the content routes; a site that
      *  enables tidy injects a stub here to avoid a real network call. Defaults to the real SDK client.

package/dist/sveltekit/cairn-admin.js

@@ -23,13 +23,12 @@ export function createCairnAdmin(runtime, deps = {}) {
     };
     const auth = createAuthRoutes({ branding, send: deps.send });
     const content = createContentRoutes(runtime, {
-        mintToken: deps.mintToken,
         anthropic: deps.anthropic,
         tidyTimeoutMs: deps.tidyTimeoutMs,
     });
     const editors = createEditorRoutes();
     // The nav surface exists only when the site configures a menu; without one its view is a 404.
-    const nav = runtime.navMenu ? createNavRoutes(runtime, { mintToken: deps.mintToken }) : null;
+    const nav = runtime.navMenu ? createNavRoutes(runtime) : null;
     /**
      * Build the event a wrapped content load reads. The catch-all route carries only a rest
      *  param, so `concept` and `id` are synthesized from the parsed view. The override names
@@ -49,8 +48,8 @@ export function createCairnAdmin(runtime, deps = {}) {
     }
     /**
      * Serve the admin view the pathname names, or a 404 for any shape the parser refuses.
-     *  The authed views run the layout load and the view load concurrently; both mint a GitHub
-     *  token, and the installation-token cache coalesces the mints into one signing.
+     *  The authed views run the layout load and the view load concurrently; both resolve the same
+     *  backend, and the installation-token cache coalesces their lazy mints into one signing.
      */
     async function load(event) {
         const view = parseAdminPath(event.url.pathname, runtime.concepts);

package/dist/sveltekit/content-routes.d.ts

@@ -1,6 +1,7 @@
 import { fail } from '@sveltejs/kit';
 import { type AdvisoryNotice } from '../content/advisories.js';
-import { type GithubKeyEnv } from '../github/credentials.js';
+import type { BackendEnv } from '../github/credentials.js';
+import type { Backend } from '../github/backend.js';
 import { type LinkTarget, type InboundLink } from '../content/manifest.js';
 import { type GettingStarted } from '../content/getting-started.js';
 import { type MarkdownReferenceRow } from '../components/markdown-reference.js';
@@ -13,7 +14,7 @@ import type { RepointPlacement, AltPlacement } from '../content/media-rewrite.js
 import type { BranchRef } from '../media/rewrite-plan.js';
 import type { BulkDeleteSkip } from '../media/bulk-delete-plan.js';
 import type { CookieJar, EventBase } from './types.js';
-import type { CairnRuntime, FrontmatterField, ResolvedPreview } from '../content/types.js';
+import type { CairnRuntime, NamedField, ResolvedPreview } from '../content/types.js';
 import type { Role } from '../auth/types.js';
 export type { AdvisoryNotice, AdvisoryAction } from '../content/advisories.js';
 /** A sidebar concept entry: just enough to render the nav without shipping validators to the client. */
@@ -90,7 +91,7 @@ export interface EditData {
     conceptId: string;
     id: string;
     label: string;
-    fields: FrontmatterField[];
+    fields: NamedField[];
     frontmatter: Record<string, unknown>;
     body: string;
     title: string;
@@ -259,7 +260,7 @@ export interface HelpData {
     supportContact?: string;
 }
 /** The structural event the content routes read; a real SvelteKit RequestEvent satisfies it. */
-export interface ContentEvent extends EventBase<GithubKeyEnv> {
+export interface ContentEvent extends EventBase<BackendEnv> {
     params: Record<string, string>;
     /**
      * SvelteKit's cookie jar. The layout load reads the persisted admin theme and issues the CSRF
@@ -303,10 +304,12 @@ export interface TidyClient {
 }
 export interface ContentRoutesDeps {
     /**
-     * Mint a GitHub App installation token from the Worker env. Defaults to the real signer.
-     *  A bare string works too; the routes await whatever comes back.
+     * Override the resolved content backend. A test injects a live `Backend` (a `makeGithubBackend`
+     *  over a fetch double, or an in-memory fake) so the read and commit paths run with no real token
+     *  mint. When set it replaces the per-handler `locals.backend ?? runtime.backend.connect(env)`
+     *  resolve; a production caller leaves it unset and the dev double rides `event.locals.backend`.
      */
-    mintToken?: (env: GithubKeyEnv) => string | Promise<string>;
+    backend?: Backend;
     /**
      * Build the Anthropic client for the tidy action from the resolved API key. Defaults to the real
      *  SDK client. Injected in tests so `messages.create` is stubbed and no network call (or real key)
@@ -579,5 +582,4 @@ export declare function createContentRoutes(runtime: CairnRuntime, deps?: Conten
     mediaAltApply: (event: ContentEvent) => Promise<ReturnType<typeof fail> | never>;
     addDictionaryWord: (event: ContentEvent) => Promise<ReturnType<typeof fail> | DictionaryAddResult>;
     tidyAction: (event: ContentEvent) => Promise<ReturnType<typeof fail> | TidyResult>;
-    mintToken: (env: GithubKeyEnv) => string | Promise<string>;
 };