@rigel-cms/rigel 0.1.4-beta.1 → 1.0.0-rc.1

package/src/editor/lib/SchemaPanel.svelte

@@ -19,6 +19,7 @@
   import { resolvePath } from "../../schema/paths";
   import { isSeoField } from "../../manifest/seo";
   import type { ContentDocument, DocumentDef, Schema } from "../../schema/types";
+  import { slugify } from "../../slugs";
 
   let {
     schema, docType, values, docId, selected, creating, pending, documents, focusToken, devMode, onchange, onselect, oneditdocument,
@@ -46,7 +47,7 @@
   const selectedField = $derived(selected?.docId === docId ? fieldForPath(schema, docType, values, selected.path) : null);
   const selectedSection = $derived(selected?.sectionKey ? sectionTypeDef(schema, sections.find((section) => section._key === selected?.sectionKey)?._type) : undefined);
   const selectedValue = $derived(selected && selectedField ? resolvePath(values, selected.path).value : undefined);
-  const docFields = $derived(docType.fields.filter((field) => field.key !== "sections"));
+  const docFields = $derived(docType.fields.filter((field) => field.key !== "sections" && (docType.shared || field.key !== "slug")));
   const seoFields = $derived(docType.shared ? [] : docFields.filter(field => isSeoField(field.key)));
 
   $effect(() => {
@@ -97,6 +98,10 @@
   {#if seoFields.length}<PropertiesTabs bind:tab />{/if}
   <section class="document-properties" hidden={tab !== "content"}>
     <h3>{docType.shared ? "Content" : "Page properties"}</h3>
+    {#if !docType.shared}
+      <label><span>URL slug</span><input type="text" value={String(values.slug ?? docId.slice(docType.name.length + 1))} oninput={(event) => onchange({ ...values, slug: event.currentTarget.value })} onblur={() => { if (Object.hasOwn(values, "slug")) onchange({ ...values, slug: slugify(String(values.slug)) }); }} /></label>
+      <p class="hint">Changes the URL, not the document identifier or filename. The website route must use the slug metadata.</p>
+    {/if}
     {#each docFields.filter(field => docType.shared || !isSeoField(field.key)) as field (field.key)}
       <div data-schema-path={field.key}>
         <SchemaField {schema} {documents} {devMode} {field} base={field.key} value={values[field.key]} onvalue={(next) => onchange(replaceAt(values, field.key, next))} />

package/src/editor/lib/Select.svelte

@@ -2,12 +2,15 @@
   import { tick } from "svelte";
   import Icon from "./Icon.svelte";
   import type { ICONS } from "./icons";
+  import type { TooltipSide, TooltipAlign } from "./tooltip";
 
-  let { label = "", ariaLabel = label, title, "data-tooltip": tooltip = title, icon, value = "", options, multiple = false, disabled = false, onchange = () => {} }: {
+  let { label = "", ariaLabel = label, title, "data-tooltip": tooltip = title, "data-tooltip-position": tooltipPosition, "data-tooltip-align": tooltipAlign, icon, value = "", options, multiple = false, disabled = false, onchange = () => {} }: {
     label?: string;
     ariaLabel?: string;
     title?: string;
     "data-tooltip"?: string;
+    "data-tooltip-position"?: TooltipSide;
+    "data-tooltip-align"?: TooltipAlign;
     icon?: keyof typeof ICONS;
     value?: string | string[];
     options: { value: string; label: string; icon?: keyof typeof ICONS; disabled?: boolean }[];
@@ -121,7 +124,7 @@
 
 <div class="custom-select" onfocusout={() => { if (open) requestAnimationFrame(() => { if (trigger.ownerDocument.activeElement?.tagName === "IFRAME") close(); }); }}>
   {#if label}<span class="select-label" id={`${id}-label`}>{label}</span>{/if}
-  <button bind:this={trigger} type="button" class="select-trigger" class:icon-only={!!icon} role="combobox" aria-label={label ? undefined : ariaLabel} aria-labelledby={label ? `${id}-label` : undefined} aria-haspopup="listbox" aria-expanded={open} aria-controls={`${id}-list`} aria-activedescendant={open && active >= 0 ? `${id}-option-${active}` : undefined} popovertarget={`${id}-list`} data-tooltip={tooltip} {disabled} onclick={event => { event.preventDefault(); menu.matches(":popover-open") ? close() : void reveal(); }} onkeydown={onkey}>
+  <button bind:this={trigger} type="button" class="select-trigger" class:icon-only={!!icon} role="combobox" aria-label={label ? undefined : ariaLabel} aria-labelledby={label ? `${id}-label` : undefined} aria-haspopup="listbox" aria-expanded={open} aria-controls={`${id}-list`} aria-activedescendant={open && active >= 0 ? `${id}-option-${active}` : undefined} popovertarget={`${id}-list`} data-tooltip={tooltip} data-tooltip-position={tooltipPosition} data-tooltip-align={tooltipAlign} {disabled} onclick={event => { event.preventDefault(); menu.matches(":popover-open") ? close() : void reveal(); }} onkeydown={onkey}>
     {#if icon}<Icon name={icon} size={18} />{:else}<span>{text || (multiple ? `Select ${label.toLowerCase() || "options"}…` : "Choose…")}</span><Icon name="caretDown" size={12} />{/if}
   </button>
   <select hidden aria-hidden="true" tabindex="-1" aria-label={ariaLabel} {multiple} {disabled} {value} onchange={event => { value = multiple ? Array.from(event.currentTarget.selectedOptions, option => option.value) : event.currentTarget.value; onchange(value); }}>

package/src/editor/lib/VisualEditor.svelte

@@ -25,7 +25,7 @@
     previewPath: string | null;
     websitePath?: string | null;
     body?: "" | import("../../article-body").ArticleBody;
-    properties?: Snippet<[SelectedField | null, number, boolean, () => void]>;
+    properties?: Snippet<[SelectedField | null, number, boolean, () => void, boolean]>;
     bodyInline?: boolean;
     onbody?: (body: ArticleBody) => void;
     creating: boolean;
@@ -39,7 +39,9 @@
   let stage: HTMLDivElement;
   let loaded = $state(false);
   let bodyAvailable = $state(false);
-  const inlineBodyEnabled = $derived(bodyInline && loaded && bodyAvailable);
+  let error = $state("");
+  const inlineBodyEnabled = $derived(bodyInline && !!previewPath && loaded && bodyAvailable && !error);
+  const inlineBodyLoading = $derived(bodyInline && !!previewPath && !loaded && !error);
   let bodyEditor: ReturnType<typeof mount> | undefined;
   let bodyThemeObserver: MutationObserver | undefined;
   let editingBody: HTMLElement | null = null;
@@ -47,7 +49,6 @@
   let bodyAttributes: [string, string | null][] = [];
   let bodyScope: HTMLElement | null = null;
   let removeTooltips: (() => void) | undefined;
-  let error = $state("");
   let mode = $state<"browse" | "edit">("edit");
   let panelOpen = $state(true);
   let editorWidth = $state(0);
@@ -152,6 +153,7 @@
     const doc = docElement();
     if (!doc) return;
     patchPreview(doc, previewValues ?? values, body, { documents, primary: docId, editingBody });
+    for (const button of doc.querySelectorAll<HTMLButtonElement>('[data-rigel-edit-video]')) button.hidden = !inlineBodyEnabled || mode !== "edit";
     const signature = (Array.isArray(values.sections) ? (values.sections as Record<string, unknown>[]) : [])
       .map((section) => `${section._key}:${section._type}`)
       .join(",");
@@ -202,6 +204,7 @@
     if (bodyEditor) { element.focus(); return; }
     const doc = element.ownerDocument;
     const blockIndex = event ? [...element.children].findIndex(child => child.contains(event.target as Node)) : 0;
+    const editVideo = !!(event?.target as Element | undefined)?.closest('[data-rigel-edit-video]');
     const caret = event && doc.caretPositionFromPoint?.(event.clientX, event.clientY);
     let offset = 0;
     if (caret && element.children[blockIndex]?.contains(caret.offsetNode)) {
@@ -226,7 +229,8 @@
     const host = doc.createElement("div"); host.className = "rigel rigel-inline";
     scope.append(host); doc.body.append(scope); bodyScope = scope;
     removeTooltips = tooltipRoot(host).destroy;
-    bodyEditor = mount(BlockEditor, { target: host, props: { editableRoot: element, get value() { return body as ArticleBody; }, oninput: (next: ArticleBody) => onbody(next) } });
+    const mounted = mount(BlockEditor, { target: host, props: { editableRoot: element, get value() { return body as ArticleBody; }, oninput: (next: ArticleBody) => onbody(next) } });
+    bodyEditor = mounted;
     bodyThemeObserver = new MutationObserver(syncTheme);
     bodyThemeObserver.observe(document.documentElement, { attributes: true, attributeFilter: ["data-theme", "data-contrast"] });
     await tick();
@@ -241,6 +245,7 @@
       }
       const selection = doc.defaultView?.getSelection(); selection?.removeAllRanges(); selection?.addRange(range);
     }
+    if (editVideo) mounted.editVideoAt(blockIndex);
   }
   function focusBody() {
     const target = docElement()?.querySelector<HTMLElement>('[data-rigel-richtext="$body"]');
@@ -452,7 +457,7 @@
       {#if !previewPath}
         <p class="visual-error" role="status">{creating ? "New page — Save writes the file. The route renders once the site has it." : "No preview URL is mapped to this document. Use the properties panel to edit."}</p>
       {:else}
-        <PreviewFrame bind:frame url={previewPath} {reloadToken} title="Website page editor" onload={onLoad} onloading={() => { stopBodyEdit(); inline = null; loaded = false; error = ""; }} onerror={(message) => { loaded = false; error = message; }} />
+        <PreviewFrame bind:frame url={previewPath} {reloadToken} title="Website page editor" onload={onLoad} onloading={() => { stopBodyEdit(); inline = null; loaded = false; bodyAvailable = false; error = ""; }} onerror={(message) => { loaded = false; error = message; }} />
       {/if}
       {#if inline}
         <input
@@ -475,7 +480,7 @@
     <div class="properties-divider" role="separator" tabindex="0" aria-label="Properties panel width" aria-orientation="vertical" aria-valuemin="280" aria-valuemax={panelMax} aria-valuenow={panelWidth} aria-valuetext={`${Math.round(panelWidth)} pixels`} onpointerdown={startResize} onpointermove={moveResize} onpointerup={endResize} onpointercancel={endResize} onlostpointercapture={endResize} onkeydown={keyResize}></div>
   {/if}
   {#if panelOpen && properties}
-    {@render properties(selected, focusToken, inlineBodyEnabled, focusBody)}
+    {@render properties(selected, focusToken, inlineBodyEnabled || inlineBodyLoading, focusBody, inlineBodyLoading)}
   {:else if panelOpen && schema && docType}
     <SchemaPanel
       {schema}

package/src/editor/lib/embed-preview.ts

@@ -0,0 +1,57 @@
+import { embedProviderLabel, embedWatchUrl, safeEmbed } from "./embeds";
+
+export function createVideoOverlay(doc: Document, label: string, url: string, editable = false): HTMLElement {
+  const overlay = doc.createElement("div");
+  overlay.contentEditable = "false";
+  overlay.style.cssText = "position:absolute;inset:0;display:grid;place-items:center;padding:1rem;background:#0006";
+  const card = doc.createElement("div");
+  card.style.cssText = "box-sizing:border-box;width:100%;max-width:360px;padding:1rem;background:#18181b;color:white;border:1px solid #52525b;font:14px/1.5 system-ui;text-align:left";
+  const heading = doc.createElement("strong");
+  heading.textContent = label;
+  const link = doc.createElement("div");
+  link.textContent = url;
+  link.style.cssText = "margin:0.5rem 0 1rem;overflow-wrap:anywhere;color:#e4e4e7";
+  const edit = doc.createElement("button");
+  edit.type = "button";
+  edit.dataset.rigelEditVideo = "";
+  edit.addEventListener("pointerdown", event => event.stopPropagation());
+  edit.addEventListener("keydown", event => {
+    event.stopPropagation();
+    if (event.key === "Enter" || event.key === " ") { event.preventDefault(); edit.click(); }
+  });
+  edit.textContent = "Edit video";
+  edit.hidden = !editable;
+  edit.style.cssText = "min-height:44px;padding:0.5rem 0.75rem;border:1px solid #d4d4d8;background:white;color:#18181b;font:inherit;cursor:pointer";
+  card.append(heading, link, edit);
+  overlay.append(card);
+  return overlay;
+}
+
+export function createEmbedPreview(value: unknown, doc: Document, editable = false): HTMLElement {
+  const figure = doc.createElement("figure");
+  figure.className = "media-embed";
+  figure.style.cssText = "max-width:100%;min-width:0;margin-inline:0";
+  const ref = safeEmbed(value);
+  if (!ref) return figure;
+  const title = typeof (value as { title?: unknown }).title === "string" ? (value as { title: string }).title : "";
+  figure.dataset.rigelEmbed = ref.provider;
+  figure.dataset.rigelVideoId = ref.id;
+  const poster = doc.createElement("div");
+  poster.style.cssText = "position:relative;width:100%;min-width:0;aspect-ratio:16/9;min-height:220px;overflow:hidden;background:#18181b";
+  if (ref.provider === "youtube") {
+    const image = doc.createElement("img");
+    image.src = `https://i.ytimg.com/vi/${ref.id}/hqdefault.jpg`;
+    image.alt = "";
+    image.loading = "lazy";
+    image.referrerPolicy = "no-referrer";
+    image.style.cssText = "position:absolute;inset:0;width:100%;height:100%;object-fit:cover;margin:0";
+    image.onerror = () => { image.hidden = true; };
+    poster.append(image);
+  }
+  const caption = doc.createElement("figcaption");
+  caption.textContent = `${embedProviderLabel(ref)} · ${title || "Video"}`;
+  caption.style.cssText = "margin-top:0.5rem;font-size:0.875rem;line-height:1.5";
+  poster.append(createVideoOverlay(doc, `${embedProviderLabel(ref)} Video`, embedWatchUrl(ref), editable));
+  figure.append(poster, caption);
+  return figure;
+}

package/src/editor/lib/embeds.ts

@@ -0,0 +1,47 @@
+export type EmbedProvider = "youtube" | "vimeo";
+export type EmbedRef = { provider: EmbedProvider; id: string };
+
+const YOUTUBE_ID = /^[A-Za-z0-9_-]{11}$/;
+const VIMEO_ID = /^\d{6,12}$/;
+const YOUTUBE_HOSTS = new Set(["youtube.com", "www.youtube.com", "m.youtube.com", "youtu.be", "music.youtube.com", "youtube-nocookie.com", "www.youtube-nocookie.com"]);
+const VIMEO_HOSTS = new Set(["vimeo.com", "www.vimeo.com", "player.vimeo.com"]);
+
+export function parseEmbedUrl(value: string): EmbedRef | undefined {
+  const raw = value.trim();
+  if (!/^https?:\/\//i.test(raw) || /[\s\\\u0000-\u001f\u007f]/.test(raw)) return undefined;
+  let url: URL;
+  try { url = new URL(raw); } catch { return undefined; }
+  const host = url.hostname.toLowerCase();
+  if (YOUTUBE_HOSTS.has(host)) {
+    const parts = url.pathname.split("/").filter(Boolean);
+    const candidate = host === "youtu.be" ? parts[0] : url.searchParams.get("v") ?? (["embed", "shorts", "live", "v"].includes(parts[0] ?? "") ? parts[1] : undefined);
+    return candidate && YOUTUBE_ID.test(candidate) ? { provider: "youtube", id: candidate } : undefined;
+  }
+  if (VIMEO_HOSTS.has(host)) {
+    const parts = url.pathname.split("/").filter(Boolean);
+    const candidate = parts[0] === "video" ? parts[1] : /^\d{6,12}$/.test(parts.at(-1) ?? "") ? parts.at(-1) : undefined;
+    return candidate && VIMEO_ID.test(candidate) ? { provider: "vimeo", id: candidate } : undefined;
+  }
+  return undefined;
+}
+
+export function embedSrc(ref: EmbedRef, privacy = true): string {
+  if (ref.provider === "youtube") return `https://www.${privacy ? "youtube-nocookie.com" : "youtube.com"}/embed/${ref.id}?rel=0`;
+  return `https://player.vimeo.com/video/${ref.id}${privacy ? "?dnt=1" : ""}`;
+}
+
+export function embedWatchUrl(ref: EmbedRef): string {
+  return ref.provider === "youtube" ? `https://www.youtube.com/watch?v=${ref.id}` : `https://vimeo.com/${ref.id}`;
+}
+
+export function embedProviderLabel(ref: EmbedRef): string {
+  return ref.provider === "youtube" ? "YouTube" : "Vimeo";
+}
+
+export function safeEmbed(ref: unknown): EmbedRef | undefined {
+  if (!ref || typeof ref !== "object") return undefined;
+  const { provider, id } = ref as EmbedRef;
+  if (provider === "youtube" && typeof id === "string" && YOUTUBE_ID.test(id)) return { provider, id };
+  if (provider === "vimeo" && typeof id === "string" && VIMEO_ID.test(id)) return { provider, id };
+  return undefined;
+}

package/src/editor/lib/github-backend.ts

@@ -1,16 +1,18 @@
 import type { Manifest } from "../../manifest/types";
+import { serializeContentJson } from "../../json-output";
 import type { Selection } from "../../manifest/navigation";
 import { validateBody, type ArticleBody } from "../../article-body";
 import { validateMenu } from "../../manifest/menu";
 import { validateCollectionValues } from "../../manifest/collections";
 import { documentIndex, isPlainObject, validateDocument, validateDocumentId, validateSchema } from "../../schema/validate";
 import { applyValues, readValues } from "../../routes/serialize";
+import { assertUniqueUrlSlugs, normalizeUrlSlug, validateDocumentSlugs } from "../../slugs";
 
 export interface GitContext { token: string; repo: string; branch: string }
 
-type FileSnapshot = { sha: string; text: string };
-type PendingWrite = { sha: string; text: string | null; creating: boolean };
-type Snapshot = { target: string; files: Map<string, FileSnapshot>; paths: Set<string>; pending: Map<string, PendingWrite> };
+type FileSnapshot = { sha: string; text: string; mode: string };
+type PendingWrite = { sha: string; text: string | null; creating: boolean; head: string; mode: string };
+type Snapshot = { target: string; head: string; writes: Promise<void>; files: Map<string, FileSnapshot>; paths: Set<string>; pending: Map<string, PendingWrite> };
 const REMOTE_SNAPSHOT = Symbol("rigel-remote-snapshot");
 const SHA = /^[a-f0-9]{40}$/;
 const SLUG = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
@@ -71,11 +73,11 @@ function sha(value: unknown): string {
   return value;
 }
 
-async function draftHead(ctx: GitContext, manifest: Manifest): Promise<string> {
+async function draftHead(ctx: GitContext, manifest: Manifest, create = true): Promise<string> {
   const cfg = config(ctx, manifest);
   const ref = `/git/ref/heads/${encodeURIComponent(ctx.branch)}`;
   try { return sha((await gh(ctx, ref))?.object?.sha); }
-  catch (error) { if (!(error instanceof GitError) || error.status !== 404) throw error; }
+  catch (error) { if (!create || !(error instanceof GitError) || error.status !== 404) throw error; }
   const base = sha((await gh(ctx, `/git/ref/heads/${encodeURIComponent(cfg.publishBranch)}`))?.object?.sha);
   try { await gh(ctx, "/git/refs", {method:"POST", body:JSON.stringify({ref:`refs/heads/${ctx.branch}`,sha:base})}); }
   catch (error) { if (!(error instanceof GitError) || ![409,422].includes(error.status)) throw error; }
@@ -105,13 +107,13 @@ function parseJson(text: string): unknown {
   try { return JSON.parse(text); } catch { throw new Error("Invalid remote content JSON"); }
 }
 
-export async function loadManifestRemote(ctx: GitContext, blueprint: Manifest): Promise<Manifest> {
+export async function loadManifestRemote(ctx: GitContext, blueprint: Manifest, createDraft = true): Promise<Manifest> {
   const cfg = config(ctx, blueprint);
-  const head = await draftHead(ctx, blueprint);
+  const head = await draftHead(ctx, blueprint, createDraft);
   const tree = await gh(ctx, `/git/trees/${head}?recursive=1`);
   if (!tree || tree.truncated !== false || !Array.isArray(tree.tree)) throw new Error("Incomplete GitHub tree; content cannot be loaded safely");
   const manifest = structuredClone(blueprint);
-  const snapshot: Snapshot = {target:target(ctx,manifest),files:new Map(),paths:new Set(),pending:new Map()};
+  const snapshot: Snapshot = {target:target(ctx,manifest),head,writes:Promise.resolve(),files:new Map(),paths:new Set(),pending:new Map()};
   const entries = new Map<string, any>();
   for (const entry of tree.tree) {
     if (!entry || typeof entry.path !== "string" || entry.path.split("/").some((part: string) => !part || part === "." || part === "..") || /[\\\u0000-\u001f]/.test(entry.path) || !["blob","tree","commit"].includes(entry.type) || !SHA.test(entry.sha) || !["100644","100755","120000","040000","160000"].includes(entry.mode)) throw new Error("Malformed GitHub tree entry");
@@ -132,7 +134,7 @@ export async function loadManifestRemote(ctx: GitContext, blueprint: Manifest):
     const expected = sha(entry.sha);
     const blob = await gh(ctx, `/git/blobs/${expected}`);
     if (sha(blob?.sha) !== expected) throw new Error("GitHub blob SHA mismatch");
-    const text = decode(blob); snapshot.files.set(path,{sha:expected,text}); return text;
+    const text = decode(blob); snapshot.files.set(path,{sha:expected,text,mode:entry.mode}); return text;
   };
   const list = (folder: string, pattern = SLUG) => {
     const prefix = [cfg.repoRoot,folder].filter(Boolean).join("/") + "/";
@@ -156,6 +158,7 @@ export async function loadManifestRemote(ctx: GitContext, blueprint: Manifest):
   }
   documentIndex(manifest.documents);
   for (const doc of manifest.documents) validateDocument(manifest.schema!,doc.type,doc.slug,doc.data,manifest.documents);
+  if (manifest.schema) validateDocumentSlugs(manifest.schema, manifest.documents, manifest.preview);
   for (const collection of manifest.collections ?? []) {
     const folder = cfg.collections.find(c => c.name === collection.name)?.folder;
     if (!folder) throw new Error("Missing configured GitHub collection");
@@ -166,6 +169,7 @@ export async function loadManifestRemote(ctx: GitContext, blueprint: Manifest):
       validateBody(post.body); validateCollectionValues(collection.fields,post.frontmatter,manifest.documents);
       collection.posts.push({slug:file.slug,frontmatter:post.frontmatter,body:post.body});
     }
+    assertUniqueUrlSlugs(collection.posts.map(post => ({ slug: post.slug, values: post.frontmatter })));
   }
   if (cfg.menus) {
     manifest.menus = {maxDepth:cfg.menus.maxDepth,entries:[]};
@@ -188,8 +192,17 @@ function loaded(ctx: GitContext, manifest: Manifest): Snapshot {
 
 async function mutate(ctx: GitContext, manifest: Manifest, path: string, text: string | null, creating: boolean) {
   const snapshot = loaded(ctx,manifest);
+  const head = sha((await gh(ctx, `/git/ref/heads/${encodeURIComponent(ctx.branch)}`))?.object?.sha);
+  const uncertain = snapshot.pending.get(path);
+  if (head !== snapshot.head && head !== uncertain?.head) throw new Error("GitHub draft branch conflict; reload before saving. Your unsaved edits are still here.");
   const endpoint = `/contents/${path.split("/").map(encodeURIComponent).join("/")}`;
   const verify = async (pending: PendingWrite) => {
+    const current = sha((await gh(ctx, `/git/ref/heads/${encodeURIComponent(ctx.branch)}`))?.object?.sha);
+    if (current !== pending.head) {
+      if (current !== snapshot.head) throw new Error("GitHub draft branch conflict; reload before saving.");
+      const result = await gh(ctx, `/git/refs/heads/${encodeURIComponent(ctx.branch)}`, { method: "PATCH", body: JSON.stringify({ sha: pending.head, force: false }) });
+      if (sha(result?.object?.sha) !== pending.head) throw new Error("GitHub branch update could not be verified; retry or reload.");
+    }
     let verified;
     try { verified = await gh(ctx,`${endpoint}?ref=${encodeURIComponent(ctx.branch)}`); }
     catch (error) {
@@ -200,11 +213,11 @@ async function mutate(ctx: GitContext, manifest: Manifest, path: string, text: s
       snapshot.files.delete(path); snapshot.paths.delete(path);
     } else {
       if (verified?.type !== "file" || sha(verified.sha) !== pending.sha || decode(verified) !== pending.text) throw new Error("GitHub save changed before verification; reload");
-      snapshot.files.set(path,{sha:pending.sha,text:pending.text}); snapshot.paths.add(path);
+      snapshot.files.set(path,{sha:pending.sha,text:pending.text,mode:pending.mode}); snapshot.paths.add(path);
     }
+    snapshot.head = pending.head;
     snapshot.pending.delete(path);
   };
-  const uncertain = snapshot.pending.get(path);
   if (uncertain) {
     await verify(uncertain);
     if (uncertain.text === text && (!creating || uncertain.creating)) return;
@@ -212,14 +225,27 @@ async function mutate(ctx: GitContext, manifest: Manifest, path: string, text: s
   }
   const previous = snapshot.files.get(path);
   if (creating ? snapshot.paths.has(path) : !previous) throw new Error(creating ? "Content already exists; choose another slug" : "Reload this content before changing it");
-  const payload = {message:`rigel: ${text === null ? "delete" : "save"} ${path}`,branch:ctx.branch,...(!creating ? {sha:previous!.sha} : {}),...(text === null ? {} : {content:encode(text)})};
-  const result = await gh(ctx,endpoint,{method:text === null ? "DELETE" : "PUT",body:JSON.stringify(payload)});
-  const pending = {sha:text === null ? previous!.sha : sha(result?.content?.sha),text,creating};
+  const blob = text === null ? null : sha((await gh(ctx, "/git/blobs", { method: "POST", body: JSON.stringify({ content: encode(text), encoding: "base64" }) }))?.sha);
+  const mode = previous?.mode ?? "100644";
+  const base = sha((await gh(ctx, `/git/commits/${snapshot.head}`))?.tree?.sha);
+  const tree = sha((await gh(ctx, "/git/trees", { method: "POST", body: JSON.stringify({ base_tree: base, tree: [{ path, mode, type: "blob", sha: blob }] }) }))?.sha);
+  const commit = sha((await gh(ctx, "/git/commits", { method: "POST", body: JSON.stringify({ message: `rigel: ${text === null ? "delete" : "save"} ${path}`, tree, parents: [snapshot.head] }) }))?.sha);
+  const pending = {sha:blob ?? previous!.sha,text,creating,head:commit,mode};
   snapshot.pending.set(path,pending);
   await verify(pending);
 }
 
-export async function saveRemoteSelection(ctx: GitContext, manifest: Manifest, selection: Selection, values: Record<string, unknown>, body: ArticleBody | "", creating: boolean): Promise<void> {
+export async function saveRemoteSelection(...args: Parameters<typeof saveSelection>): Promise<void> {
+  const key = writeKey(args[0]);
+  if (publishing.has(key)) throw new Error("Wait for publishing to finish before saving.");
+  const snapshot = loaded(args[0], args[1]);
+  saving.set(key, (saving.get(key) ?? 0) + 1);
+  const result = snapshot.writes.then(() => saveSelection(...args));
+  snapshot.writes = result.catch(() => {});
+  try { await result; } finally { saving.set(key, (saving.get(key) ?? 1) - 1); }
+}
+
+async function saveSelection(ctx: GitContext, manifest: Manifest, selection: Selection, values: Record<string, unknown>, body: ArticleBody | "", creating: boolean): Promise<void> {
   const cfg = config(ctx,manifest);
   const snapshot = loaded(ctx,manifest);
   if (!isPlainObject(values)) throw new Error("Content values must be an object");
@@ -238,26 +264,200 @@ export async function saveRemoteSelection(ctx: GitContext, manifest: Manifest, s
     if (!folder || !collection) throw new Error("Unknown collection");
     validateBody(body); validateCollectionValues(collection.fields,values,manifest.documents ?? []);
     path = filePath(ctx,manifest,folder,selection.slug,"json",POST_SLUG);
-    data = {frontmatter:{...values,slug:selection.slug},body};
+    const frontmatter = { ...values };
+    if (Object.hasOwn(frontmatter, "slug")) frontmatter.slug = normalizeUrlSlug(frontmatter.slug);
+    const prefix = filePath(ctx,manifest,folder,"placeholder","json",POST_SLUG).replace(/placeholder\.json$/, "");
+    const others = [...snapshot.files].filter(([file]) => file.startsWith(prefix) && file !== path && file.endsWith(".json")).map(([file, value]) => ({ slug: file.slice(prefix.length, -5), values: (parseJson(value.text) as { frontmatter: Record<string, unknown> }).frontmatter }));
+    assertUniqueUrlSlugs([...others, { slug: selection.slug, values: frontmatter }]);
+    data = {frontmatter,body};
   } else if (selection.kind === "document") {
     if (!manifest.schema) throw new Error("No document schema configured");
     const document = validateDocumentId(manifest.schema,selection.id);
     if (!document || document.type.name !== selection.type) throw new Error("Unknown document type or slug");
     if (creating && (document.type.creatable === false || document.type.singleton)) throw new Error("Creating entries is disabled for this document type");
-    data = {...values,_id:selection.id,_type:selection.type,slug:document.slug};
+    const next = {...values,_id:selection.id,_type:selection.type} as Record<string, unknown>;
+    if (!document.type.shared && Object.hasOwn(next, "slug")) next.slug = normalizeUrlSlug(next.slug);
+    data = next;
     validateDocument(manifest.schema,selection.type,document.slug,data as Record<string,unknown>,manifest.documents ?? []);
     path = filePath(ctx,manifest,document.type.folder,document.slug);
+    const documents = manifest.schema.documents.flatMap(type => {
+      const prefix = filePath(ctx,manifest,type.folder,"placeholder").replace(/placeholder\.json$/, "");
+      return [...snapshot.files].filter(([file]) => file.startsWith(prefix) && file !== path && file.endsWith(".json")).map(([file, value]) => ({ id: `${type.name}:${file.slice(prefix.length,-5)}`, type: type.name, slug: file.slice(prefix.length,-5), data: parseJson(value.text) as Record<string, unknown> }));
+    });
+    validateDocumentSlugs(manifest.schema, [...documents, { id: selection.id, type: selection.type, slug: document.slug, data: next }], manifest.preview);
   } else if (selection.kind === "menu") {
     if (!cfg.menus || creating) throw new Error("Menus must be configured by the site developer");
     data = validateMenu({...values,slug:selection.slug},cfg.menus.maxDepth);
     path = filePath(ctx,manifest,cfg.menus.folder,selection.slug);
   } else throw new Error("Select editable content before saving");
-  await mutate(ctx,manifest,path,JSON.stringify(data,null,2) + "\n",creating);
+  await mutate(ctx,manifest,path,serializeContentJson(data,cfg.jsonOutput),creating);
+}
+
+export interface PublishFile { filename: string; status: "added" | "modified" | "removed" | "renamed"; previous_filename?: string }
+export interface PublishReview {
+  repo: string; branch: string; publishBranch: string; head: string; base: string;
+  files: PublishFile[]; needsSync: boolean; prNumber?: number; creationUncertain?: boolean;
+}
+
+async function publishHeads(ctx: GitContext, publishBranch: string, request: typeof gh) {
+  const head = sha((await request(ctx, `/git/ref/heads/${encodeURIComponent(ctx.branch)}`))?.object?.sha);
+  const base = sha((await request(ctx, `/git/ref/heads/${encodeURIComponent(publishBranch)}`))?.object?.sha);
+  return { head, base };
+}
+
+async function publishTree(ctx: GitContext, head: string, request: typeof gh) {
+  const data = await request(ctx, `/git/trees/${head}?recursive=1`);
+  if (data?.truncated !== false || !Array.isArray(data.tree)) throw new Error("Incomplete GitHub tree. Publishing is unavailable; review this change on GitHub.");
+  const files = new Map<string, string>();
+  const paths = new Set<string>();
+  for (const entry of data.tree) {
+    if (!entry || typeof entry.path !== "string" || !entry.path || /[\u0000-\u001f\u007f\\\\]/.test(entry.path) || entry.path.split("/").some((p: string) => !p || p === "." || p === "..") || paths.has(entry.path) || !["blob", "tree", "commit"].includes(entry.type) || !["100644", "100755", "120000", "040000", "160000"].includes(entry.mode)) throw new Error("Malformed GitHub publish tree");
+    if (!({ blob: ["100644", "100755", "120000"], tree: ["040000"], commit: ["160000"] } as Record<string, string[]>)[entry.type]?.includes(entry.mode)) throw new Error("Malformed GitHub publish tree mode");
+    paths.add(entry.path);
+    const id = sha(entry.sha);
+    if (entry.type !== "tree") files.set(entry.path, `${entry.mode}:${entry.type}:${id}`);
+  }
+  return files;
+}
+
+export async function reviewRemotePublish(ctx: GitContext, manifest: Manifest, assertActive: () => void = () => {}): Promise<PublishReview> {
+  const cfg = config(ctx, manifest);
+  const request: typeof gh = (context, path, init) => { assertActive(); return gh(context, path, init); };
+  const repository = await request(ctx, "");
+  if (repository?.permissions?.push !== true) throw new Error("Publishing requires repository write access.");
+  if (repository.allow_squash_merge !== true) throw new Error("Squash merging is disabled. Ask the repository owner to enable it before publishing.");
+  if (repository.delete_branch_on_merge !== false) throw new Error("Ask the repository owner to disable automatic head-branch deletion before publishing, so the drafts branch is preserved.");
+  const { head, base } = await publishHeads(ctx, cfg.publishBranch, request);
+  const [source, destination] = await Promise.all([publishTree(ctx, head, request), publishTree(ctx, base, request)]);
+  const changed = new Set([...source.keys(), ...destination.keys()].filter(path => source.get(path) !== destination.get(path)));
+  const review: PublishReview = { repo: ctx.repo, branch: ctx.branch, publishBranch: cfg.publishBranch, head, base, files: [], needsSync: false };
+  if (changed.size) {
+    const comparison = await request(ctx, `/compare/${base}...${head}?per_page=1&page=1`);
+    if (sha(comparison?.base_commit?.sha) !== base) throw new Error("GitHub comparison does not match the reviewed target.");
+    review.needsSync = sha(comparison?.merge_base_commit?.sha) !== base;
+    if (review.needsSync) {
+      review.files = [...changed].sort().map(filename => ({ filename, status: !source.has(filename) ? "removed" : !destination.has(filename) ? "added" : "modified" }));
+    } else {
+      if (!Array.isArray(comparison.files) || comparison.files.length >= 300) throw new Error("GitHub comparisons of 300 or more files are not supported. Publish this change on GitHub; no partial list is shown.");
+      const covered = new Set<string>();
+      for (const file of comparison.files) {
+        if (!file || typeof file.filename !== "string" || covered.has(file.filename) || !changed.has(file.filename) || !["added", "removed", "modified", "renamed"].includes(file.status)) throw new Error("Incomplete or unsupported GitHub file comparison. Publish this change on GitHub.");
+        covered.add(file.filename);
+        if (file.status === "renamed") {
+          if (typeof file.previous_filename !== "string" || !changed.has(file.previous_filename) || covered.has(file.previous_filename)) throw new Error("Incomplete GitHub rename comparison");
+          covered.add(file.previous_filename);
+        }
+        review.files.push({ filename: file.filename, status: file.status, ...(file.status === "renamed" ? { previous_filename: file.previous_filename } : {}) });
+      }
+      if (covered.size !== changed.size) throw new Error("Incomplete GitHub file comparison. Publishing is unavailable; no partial list is shown.");
+    }
+    if (review.files.length >= 300) throw new Error("Publishing 300 or more files is not supported. Review and publish this change on GitHub.");
+  }
+  const current = await publishHeads(ctx, cfg.publishBranch, request);
+  if (current.head !== head || current.base !== base) throw new Error("Branches changed during review. Review changes again before publishing.");
+  assertActive();
+  return review;
+}
+
+const publishing = new Set<string>();
+const saving = new Map<string, number>();
+const writeKey = (ctx: GitContext) => `${ctx.repo}:${ctx.branch}`;
+
+export async function confirmRemotePublish(ctx: GitContext, manifest: Manifest, review: PublishReview, assertActive: () => void = () => {}): Promise<"published" | "synced"> {
+  const cfg = config(ctx, manifest), key = writeKey(ctx);
+  if (publishing.has(key) || saving.get(key)) throw new Error("Wait for the current save or publish to finish.");
+  if (review.repo !== ctx.repo || review.branch !== ctx.branch || review.publishBranch !== cfg.publishBranch || !review.files.length) throw new Error("Review saved changes before publishing.");
+  sha(review.head); sha(review.base);
+  publishing.add(key);
+  const request: typeof gh = (context, path, init) => { assertActive(); return gh(context, path, init); };
+  const unchanged = async () => {
+    const current = await publishHeads(ctx, cfg.publishBranch, request);
+    if (current.head !== review.head || current.base !== review.base) throw new Error("Branches changed. Review changes again before publishing.");
+  };
+  const matches = (pr: any) => pr?.head?.repo?.full_name?.toLowerCase() === ctx.repo.toLowerCase() && pr?.base?.repo?.full_name?.toLowerCase() === ctx.repo.toLowerCase() && pr.head.ref === ctx.branch && pr.base.ref === cfg.publishBranch;
+  const validate = (pr: any) => {
+    if (!matches(pr) || !Number.isSafeInteger(pr.number) || pr.number <= 0 || pr.head.sha !== review.head) throw new Error("Pull request no longer matches this review. Review changes again.");
+    return pr;
+  };
+  const merged = (pr: any) => {
+    validate(pr);
+    if (pr.merged === true && pr.state === "closed") { sha(pr.merge_commit_sha); return true; }
+    return false;
+  };
+  const find = async () => {
+    const found: any[] = [];
+    for (let page = 1; page <= 100; page++) {
+      const query = new URLSearchParams({ state: "open", head: `${ctx.repo.split("/")[0]}:${ctx.branch}`, base: cfg.publishBranch, per_page: "100", page: String(page) });
+      const list = await request(ctx, `/pulls?${query}`);
+      if (!Array.isArray(list)) throw new Error("Incomplete GitHub pull request listing");
+      found.push(...list.filter(matches));
+      if (found.length > 1) throw new Error("Multiple matching pull requests. Resolve them on GitHub before publishing.");
+      if (list.length < 100) return found[0];
+    }
+    throw new Error("Incomplete GitHub pull request listing; publishing stopped.");
+  };
+  try {
+    if (review.prNumber) {
+      const previous = await request(ctx, `/pulls/${review.prNumber}`);
+      if (merged(previous)) return "published";
+    }
+    await unchanged();
+    const repository = await request(ctx, "");
+    if (repository?.permissions?.push !== true || repository.allow_squash_merge !== true || repository.delete_branch_on_merge !== false) throw new Error("Publishing settings or access changed. Enable squash merges, disable automatic branch deletion and verify write access, then review again.");
+    let pr = review.prNumber ? await request(ctx, `/pulls/${review.prNumber}`) : await find();
+    if (!pr) {
+      if (review.creationUncertain) throw new Error("The previous pull request creation is unconfirmed. Check GitHub before retrying; no duplicate was created.");
+      await unchanged();
+      review.creationUncertain = true;
+      try {
+        pr = await request(ctx, "/pulls", { method: "POST", body: JSON.stringify({ title: `Publish ${ctx.branch} to ${cfg.publishBranch}`, head: ctx.branch, base: cfg.publishBranch, draft: false, maintainer_can_modify: false }) });
+      } catch (error) {
+        pr = await find();
+        if (!pr) throw error;
+      }
+    }
+    validate(pr);
+    review.prNumber = pr.number;
+    pr = validate(await request(ctx, `/pulls/${pr.number}`));
+    if (merged(pr)) return "published";
+    if (pr.state !== "open" || pr.draft || pr.base.sha !== review.base) throw new Error("Pull request or target changed. Review changes again before publishing.");
+    if (review.needsSync) {
+      await unchanged();
+      await request(ctx, `/pulls/${pr.number}/update-branch`, { method: "PUT", body: JSON.stringify({ expected_head_sha: review.head }) });
+      const updated = await request(ctx, `/pulls/${pr.number}`);
+      if (!matches(updated) || updated.state !== "open" || sha(updated.head.sha) === review.head) throw new Error("GitHub is still syncing drafts, or the sync could not be verified. Wait, reload draft content and review again. Nothing was published.");
+      return "synced";
+    }
+    if (pr.mergeable !== true || pr.mergeable_state !== "clean") throw new Error("GitHub has not allowed this merge. Resolve conflicts, required checks, reviews or branch protections on GitHub, then retry. No protection is bypassed.");
+    await unchanged();
+    let failure: unknown;
+    try {
+      const result = await request(ctx, `/pulls/${pr.number}/merge`, { method: "PUT", body: JSON.stringify({ merge_method: "squash", sha: review.head }) });
+      if (result?.merged !== true) failure = new Error("GitHub did not merge the pull request. Check required checks, reviews and branch protections, then retry.");
+    } catch (error) { failure = error; }
+    let verified;
+    try { verified = await request(ctx, `/pulls/${pr.number}`); }
+    catch (error) {
+      if (error instanceof GitError && error.status === 401) throw error;
+      throw new Error(`Publish outcome is unconfirmed. Check pull request #${pr.number} on GitHub, or retry to verify it before starting another publish.`);
+    }
+    if (merged(verified)) return "published";
+    if (failure) throw failure;
+    throw new Error("The publish result could not be verified. Check this pull request on GitHub before retrying.");
+  } catch (error) {
+    if (error instanceof GitError && [403, 404].includes(error.status)) throw new GitError("Publishing requires GitHub App Contents and Pull requests read/write permissions, installation-owner approval and repository write access. Reconnect after approval. Branch protections still apply.", error.status);
+    if (error instanceof GitError && [405, 409, 422].includes(error.status)) throw new GitError("GitHub rejected publishing. Check conflicts, required checks/reviews, branch protections and squash settings. Review changes again if either branch moved.", error.status);
+    throw error;
+  } finally { publishing.delete(key); }
 }
 
 export async function deleteRemotePost(ctx: GitContext, manifest: Manifest, collection: string, slug: string): Promise<void> {
+  const key = writeKey(ctx);
+  if (publishing.has(key)) throw new Error("Wait for publishing to finish before deleting.");
   const cfg = config(ctx,manifest);
   const folder = cfg.collections.find(c => c.name === collection)?.folder;
   if (!folder || !manifest.collections?.some(c => c.name === collection)) throw new Error("Unknown collection");
-  await mutate(ctx,manifest,filePath(ctx,manifest,folder,slug,"json",POST_SLUG),null,false);
-}
+  saving.set(key, (saving.get(key) ?? 0) + 1);
+  try { await mutate(ctx,manifest,filePath(ctx,manifest,folder,slug,"json",POST_SLUG),null,false); }
+  finally { saving.set(key, (saving.get(key) ?? 1) - 1); }
+}