create-ailk 0.31.0 → 0.33.0

package/dist/lib/import-mdx.js

@@ -19,6 +19,14 @@
  * reports `unchanged`; a changed layout on a live draft is refused
  * `draft_is_live` and the page fails with that reason.
  *
+ * A section string that holds inline HTML is converted first (#10804) — a
+ * link to `[label](href)`, a line break to a newline, a block to a blank
+ * line, every other tag unwrapped to its text — so the words and the layout
+ * carry no tag, which the hub's structure write refuses. The layout is then
+ * checked against the hub's section-string rules before any write, so a page
+ * the hub would refuse fails with the rule and the path, and a page whose
+ * draft holds no layout yet is never reported `unchanged`.
+ *
  * create-ailk ships one runtime dependency, so the adapter is never imported:
  * the caller injects it, and `loadSiteMdxAdapter` resolves the SITE's
  * installed copy from its `apps/web` at run time (the #6937 precedent), and
@@ -29,7 +37,9 @@
  * `<slug>/index.mdx` becomes a `BlogPosting` / `DocsDetail` page (the
  * directory's own `index.mdx` its `BlogList` / `DocsList` index), its
  * fumadocs frontmatter mapped to the stored vocabulary and written through the
- * same converting path. Every outcome names the root it came from.
+ * same converting path. Every outcome names the root it came from. A key the
+ * vocabulary does not name rides in `siteFields`, and a blog post's tags are
+ * sent (#10806); a key the store cannot keep is named with its reason.
  *
  * Given `publish` (#10659 D2), each page with no Live version is set Live
  * after it is written (`POST …/publish`, the draft tip); a page already Live
@@ -41,7 +51,8 @@
  * a status and a `[a-z0-9_]` error code reach output (SEC-7876-S1).
  *
  * Spec: docs/specs/10203-import-mdx-one-mdx-artifact-spec.md; the editorial
- * walk docs/specs/10701-import-mdx-walks-the-editorial-spec.md.
+ * walk docs/specs/10701-import-mdx-walks-the-editorial-spec.md; its site
+ * fields docs/specs/10806-the-editorial-import-drops-blog-spec.md.
  */
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { createRequire } from "node:module";
@@ -61,6 +72,8 @@ const FRONTMATTER_PACKAGE = "gray-matter";
 const LOCALE = /^[a-z]{2}(-[A-Z]{2})?$/;
 /** `SLUG_PATTERN` in the adapter's `errors.ts`, restated: no runtime dep. */
 const SLUG = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+/** A `parent`'s shape (`ServiceFieldsSchema` in the adapter's `types.ts`), restated: no runtime dep. */
+const PARENT = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 /** Each editorial directory's page type and index type (`runtime-source.ts`). */
 const EDITORIAL_TYPES = {
     blog: { page: "BlogPosting", index: "BlogList" },
@@ -69,10 +82,15 @@ const EDITORIAL_TYPES = {
 /** The slug the runtime reads as a surface's own index. */
 const INDEX_SLUG = "index";
 const INDEX_TYPES = new Set(Object.values(EDITORIAL_TYPES).map((k) => k.index));
+/** Each index type's own slug, its editorial directory: `BlogList/blog` shares `/blog` with `BlogList/index` (#10805 D5). */
+const INDEX_OWN_SLUG = new Map(Object.entries(EDITORIAL_TYPES).map(([dir, k]) => [k.index, dir]));
+/** `PAGE_TAG_TYPES` (the validation package's `site-fields.ts`), restated: the blog collection keeps a sent `tags`. */
+const PAGE_TAG_TYPES = new Set(["BlogPosting", "BlogList"]);
 /**
  * `fumadocsToArtifactFrontmatter` (`apps/web/lib/runtime-source.ts`) restated —
- * fumadocs key to stored key — less `tags`, which the store keeps itself, plus
- * `sections`, which `convert` moves. Any other key is not sent.
+ * fumadocs key to stored key — less `tags`, which only a blog page sends, plus
+ * `sections`, which `convert` moves. Any other key rides in `siteFields`
+ * (#10806 D4).
  */
 const EDITORIAL_FIELDS = {
     title: "title",
@@ -87,6 +105,14 @@ const EDITORIAL_FIELDS = {
 };
 /** Keys not sent and not reported: the path decides both, and a strip marker. */
 const EDITORIAL_IGNORED = new Set(["type", "slug", "oss"]);
+/** Why a key is not sent (#10806 D4); `siteFieldRefusal`'s own reasons are the rest. */
+const NOT_SENT = {
+    parent: "the path decides a blog post's parent",
+    agentTag: "a tag agents act on, or a site tag, is kept by AI",
+    notList: "not a list of tags",
+    full: "siteFields is full (32 keys or 64 KiB)",
+    olderSite: `the site's ${VALIDATION_PACKAGE} predates site fields; update its dependencies and re-run`,
+};
 /** `wksp_<uuidv7>` — the `@working-theory/ids` shape, restated: no runtime dep. */
 const WORKSPACE_ID = /^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 /** A key is visible ASCII only: what an HTTP header can carry, with no space. */
@@ -166,10 +192,13 @@ function mdxFiles(root, prefix = []) {
             : [];
     });
 }
+/** Type, then slug, then a page with no `parent` before a series leaf (#10775 D4). */
 function byTypeThenSlug(a, b) {
     if (a.type !== b.type)
         return a.type < b.type ? -1 : 1;
-    return a.slug < b.slug ? -1 : a.slug > b.slug ? 1 : 0;
+    if (a.slug !== b.slug)
+        return a.slug < b.slug ? -1 : 1;
+    return Number(a.parent !== undefined) - Number(b.parent !== undefined);
 }
 function byPath(a, b) {
     return a.path < b.path ? -1 : a.path > b.path ? 1 : 0;
@@ -239,9 +268,11 @@ function plan(contentRoot, types, defaultLocale) {
     };
 }
 /**
- * The editorial walk (#10701 D2–D3): `L/{blog,docs}/<slug>.mdx` and
+ * The editorial walk (#10701 D2–D3, #10775 D2): `L/{blog,docs}/<slug>.mdx` and
  * `<slug>/index.mdx` are posts and docs, the directory's own `index.mdx` its
- * index page; anything deeper is no page the store can address.
+ * index page, and `L/blog/<series>/<post>.mdx` or `<post>/index.mdx` a post
+ * whose `parent` is the series. Every other file is skipped with the rule it
+ * failed.
  */
 function planEditorial(editorialRoot, types, defaultLocale) {
     const pages = [];
@@ -254,7 +285,7 @@ function planEditorial(editorialRoot, types, defaultLocale) {
     // Sorted by path first, so within one directory `<slug>.mdx` comes before
     // `<slug>/index.mdx` and holds the address (`.` sorts before `/`).
     for (const { segments, link, path } of found.sort(byPath)) {
-        const [locale, dir, file, nested] = segments;
+        const [locale, dir, file, nested, leafFile] = segments;
         const kinds = dir !== undefined && Object.hasOwn(EDITORIAL_TYPES, dir)
             ? EDITORIAL_TYPES[dir]
             : undefined;
@@ -266,31 +297,52 @@ function planEditorial(editorialRoot, types, defaultLocale) {
             skip(path, `locale ${locale} is not imported (only ${defaultLocale})`);
             continue;
         }
+        if (kinds === undefined || locale !== defaultLocale) {
+            skip(path, `not a post or doc: only ${defaultLocale}/blog and ${defaultLocale}/docs are walked`);
+            continue;
+        }
         let type;
         let slug;
-        if (kinds !== undefined && locale === defaultLocale) {
-            if (segments.length === 3 && file === "index.mdx") {
-                type = kinds.index;
-                slug = INDEX_SLUG;
-            }
-            else if (segments.length === 3) {
-                type = kinds.page;
-                slug = file.slice(0, -".mdx".length);
-            }
-            else if (segments.length === 4 && nested === "index.mdx") {
-                type = kinds.page;
-                slug = file;
-            }
+        let parent;
+        if (segments.length === 3 && file === "index.mdx") {
+            type = kinds.index;
+            slug = INDEX_SLUG;
         }
-        if (type === undefined || slug === undefined) {
-            skip(path, `not a post or doc: the editorial walk reads ${defaultLocale}/{blog,docs}/<slug>.mdx and ${defaultLocale}/{blog,docs}/<slug>/index.mdx`);
+        else if (segments.length === 3) {
+            type = kinds.page;
+            slug = file.slice(0, -".mdx".length);
+        }
+        else if (segments.length === 4 && nested === "index.mdx") {
+            type = kinds.page;
+            slug = file;
+        }
+        else if (dir === "docs") {
+            skip(path, "a nested doc: a doc is docs/<slug>.mdx or docs/<slug>/index.mdx");
+            continue;
+        }
+        else if (file === "category") {
+            skip(path, "under blog/category: /blog/category/<tag> is the blog's category index, so no post is served there");
+            continue;
+        }
+        else if (segments.length === 4 ||
+            (segments.length === 5 && leafFile === "index.mdx")) {
+            type = kinds.page;
+            slug = segments.length === 4 ? nested.slice(0, -".mdx".length) : nested;
+            parent = file;
+        }
+        else {
+            skip(path, "too deep: a post is blog/<slug>.mdx, blog/<slug>/index.mdx, or one series down at blog/<series>/<post>.mdx or blog/<series>/<post>/index.mdx");
             continue;
         }
         const invalid = !SLUG.test(slug)
             ? `not a valid slug: ${slug}`
-            : !types.includes(type)
-                ? `the site's adapter has no type ${type}`
-                : undefined;
+            : parent !== undefined && !PARENT.test(parent)
+                ? `not a valid series: ${parent} (a parent is lowercase words joined by single hyphens)`
+                : parent === slug
+                    ? `a post cannot share its series' slug: ${slug}`
+                    : !types.includes(type)
+                        ? `the site's adapter has no type ${type}`
+                        : undefined;
         pages.push({
             root: "editorial",
             path,
@@ -298,6 +350,7 @@ function planEditorial(editorialRoot, types, defaultLocale) {
             slug,
             localeTree: true,
             ...(invalid !== undefined && { invalid }),
+            ...(parent !== undefined && { parent }),
         });
     }
     return { pages: pages.sort(byTypeThenSlug), skipped };
@@ -309,31 +362,118 @@ function dateString(value) {
     const iso = value.toISOString();
     return iso.endsWith("T00:00:00.000Z") ? iso.slice(0, 10) : iso;
 }
+/** Below this depth a value is left as read: the site's rule refuses it as too deep. */
+const DATES_MAX_DEPTH = 8;
+/** `value` with every `Date` to a bounded depth as `dateString` gives it (#10806 D4). */
+function datesAsStrings(value, depth = 1) {
+    if (value instanceof Date)
+        return dateString(value);
+    if (depth > DATES_MAX_DEPTH)
+        return value;
+    if (Array.isArray(value))
+        return value.map((item) => datesAsStrings(item, depth + 1));
+    if (value === null || typeof value !== "object")
+        return value;
+    if (Object.getPrototypeOf(value) !== Object.prototype)
+        return value;
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, datesAsStrings(item, depth + 1)]));
+}
+/** A tag as printed: control characters as `?`, at most 64 characters. */
+function printedTag(tag) {
+    // eslint-disable-next-line no-control-regex -- the controls are what is replaced
+    return String(tag).replace(/[\u0000-\u001f\u007f-\u009f]/g, "?").slice(0, 64);
+}
 /**
  * An editorial file as the adapter would return a page (#10701 D4): its
  * fumadocs frontmatter mapped to the stored vocabulary, the path deciding the
- * type and slug, and the keys not sent named.
+ * type and slug — and, for a blog page, its `parent` (#10775 D3). Every other
+ * key the site's rule accepts rides in `siteFields`, and a blog page sends its
+ * `tags` (#10806 D4); the keys not sent are named with their reasons.
  */
-function editorialSource(page, parsed) {
+function editorialSource(page, parsed, rules) {
     const frontmatter = {
         type: page.type,
         slug: page.slug,
     };
-    const dropped = [];
-    for (const [key, value] of Object.entries(parsed.data)) {
-        const stored = Object.hasOwn(EDITORIAL_FIELDS, key)
-            ? EDITORIAL_FIELDS[key]
-            : undefined;
-        if (stored !== undefined)
-            frontmatter[stored] = dateString(value);
-        else if (!EDITORIAL_IGNORED.has(key))
-            dropped.push(key);
+    const notSent = [];
+    const siteFields = {};
+    const blog = PAGE_TAG_TYPES.has(page.type);
+    for (const [key, raw] of Object.entries(parsed.data)) {
+        if (EDITORIAL_IGNORED.has(key))
+            continue;
+        if (blog && key === "parent") {
+            notSent.push({ key, reason: NOT_SENT.parent });
+        }
+        else if (Object.hasOwn(EDITORIAL_FIELDS, key)) {
+            frontmatter[EDITORIAL_FIELDS[key]] = dateString(raw);
+        }
+        else if (rules === undefined) {
+            notSent.push({ key, reason: NOT_SENT.olderSite });
+        }
+        else if (blog && key === "tags") {
+            if (!Array.isArray(raw)) {
+                notSent.push({ key, reason: NOT_SENT.notList });
+                continue;
+            }
+            // Sent as written, so the stored list is what the store computes; a
+            // tag it keeps for itself is named.
+            frontmatter["tags"] = raw;
+            const kept = new Set(rules.publicPageTags(raw));
+            for (const tag of new Set(raw.filter((tag) => !kept.has(tag)))) {
+                notSent.push({ key: `tags: ${printedTag(tag)}`, reason: NOT_SENT.agentTag });
+            }
+        }
+        else {
+            const value = datesAsStrings(raw);
+            const refused = rules.refusal(key, value);
+            const fits = Object.keys(siteFields).length < rules.maxKeys &&
+                new TextEncoder().encode(JSON.stringify({ ...siteFields, [key]: value })).length <=
+                    rules.maxBytes;
+            if (refused !== null)
+                notSent.push({ key, reason: refused });
+            else if (!fits)
+                notSent.push({ key, reason: NOT_SENT.full });
+            else
+                siteFields[key] = value;
+        }
     }
+    if (page.parent !== undefined)
+        frontmatter["parent"] = page.parent;
+    if (Object.keys(siteFields).length > 0)
+        frontmatter["siteFields"] = siteFields;
     return {
         source: { frontmatter, body: parsed.content },
-        dropped: dropped.sort(),
+        notSent: notSent.sort((a, b) => (a.key < b.key ? -1 : a.key > b.key ? 1 : 0)),
     };
 }
+/** `a (reason); b, c (reason)` — keys in order, one segment per reason. */
+function notSentList(notSent) {
+    const byReason = new Map();
+    for (const { key, reason } of notSent) {
+        byReason.set(reason, [...(byReason.get(reason) ?? []), key]);
+    }
+    return [...byReason]
+        .map(([reason, keys]) => `${keys.join(", ")} (${reason})`)
+        .join("; ");
+}
+/**
+ * The sent site fields and public tags a write's stored content lacks
+ * (#10806 D4): what a hub that predates site fields dropped.
+ */
+function notKept(sent, kept, rules) {
+    const keptFields = kept["siteFields"] !== null && typeof kept["siteFields"] === "object"
+        ? kept["siteFields"]
+        : {};
+    const keptTags = Array.isArray(kept["tags"]) ? kept["tags"] : [];
+    const sentFields = Object.keys((sent["siteFields"] ?? {}));
+    const sentTags = PAGE_TAG_TYPES.has(String(sent["type"])) && Array.isArray(sent["tags"])
+        ? rules.publicPageTags(sent["tags"])
+        : [];
+    return [
+        ...sentFields.filter((key) => !Object.hasOwn(keptFields, key)).sort(),
+        ...sentTags.filter((tag) => !keptTags.includes(tag)).map((tag) => `tags: ${printedTag(tag)}`),
+    ];
+}
 // ── "Unchanged" (D4) ────────────────────────────────────────────────────────
 function sortKeys(value) {
     if (Array.isArray(value))
@@ -349,14 +489,21 @@ function canonical(value) {
     return JSON.stringify(sortKeys(JSON.parse(JSON.stringify(value ?? null))));
 }
 /**
- * Content without `tags`: the store's tagger writes them on every version and
- * drops a sent value (#10342 D5), so they are never the importer's to compare.
+ * Content as compared: the store's tagger writes `tags` on every version
+ * (#10342 D5), so they are dropped — except a blog page that sends them, whose
+ * public tags are the importer's (#10806 D4): compared as `publicTags` gives
+ * them, so a changed category is an update.
  */
-function withoutTags(value) {
+function compared(value, sent, publicTags) {
     if (value === null || typeof value !== "object" || Array.isArray(value))
         return value;
-    const { tags: _tags, ...rest } = value;
-    return rest;
+    const { tags, ...rest } = value;
+    if (publicTags === undefined ||
+        !PAGE_TAG_TYPES.has(String(sent["type"])) ||
+        !Array.isArray(sent["tags"])) {
+        return rest;
+    }
+    return { ...rest, tags: publicTags(Array.isArray(tags) ? tags : []) };
 }
 function safeCode(value) {
     return typeof value === "string" && SAFE_CODE.test(value) ? value : "unknown";
@@ -441,16 +588,18 @@ function wrongLocale(at, answer, locale) {
     }
     return failed(at, `the API does not serve locale ${locale}`, `not sent: the API does not serve locale ${locale}`);
 }
-async function writePage(t, page, locale, content, layout) {
+async function writePage(t, page, locale, content, layout, publicTags) {
     const { root, path, type, slug } = page;
     const pagePath = `${t.base}/content/${encodeURIComponent(type)}/${encodeURIComponent(slug)}`;
     const query = `?locale=${encodeURIComponent(locale)}`;
     const address = `${pagePath}${query}`;
     // The route's `statusOf`: anything but `draft` has a Live version.
     let live = false;
+    let stored;
     const outcome = (result) => ({
         outcome: { root, path, result, type, slug },
         live,
+        stored,
     });
     // The words are written; now the layout, under the token the draft holds
     // (`null` for a page that has none yet).
@@ -464,7 +613,11 @@ async function writePage(t, page, locale, content, layout) {
         if ("network" in put || put.status !== 200)
             return refusedAnswer(page, put);
         return (wrongLocale(page, put, locale) ??
-            outcome(result === "unchanged" && put.data["written"] === true
+            outcome(
+            // #10804 D6 — with no token the hub writes the layout (or refuses a
+            // live tip), so a dry run's `written: false` never makes it unchanged.
+            result === "unchanged" &&
+                (structureToken === null || put.data["written"] === true)
                 ? "updated"
                 : result));
     };
@@ -482,8 +635,9 @@ async function writePage(t, page, locale, content, layout) {
             live = read.data["status"] !== "draft";
             const token = read.data["structureToken"];
             const structureToken = typeof token === "string" ? token : null;
-            if (canonical(withoutTags(read.data["content"])) ===
-                canonical(withoutTags(content))) {
+            stored = read.data["content"];
+            if (canonical(compared(stored, content, publicTags)) ===
+                canonical(compared(content, content, publicTags))) {
                 return done("unchanged", structureToken);
             }
             // The token is the version just compared against, so a draft saved
@@ -491,6 +645,7 @@ async function writePage(t, page, locale, content, layout) {
             const saved = await call(t, "PATCH", address, content, version);
             if ("network" in saved || saved.status !== 200)
                 return refusedAnswer(page, saved);
+            stored = saved.data["content"];
             // A save carries the structure token forward (#10330 D5).
             return (wrongLocale(page, saved, locale) ?? done("updated", structureToken));
         }
@@ -503,9 +658,10 @@ async function writePage(t, page, locale, content, layout) {
         if ("network" in created)
             return refusedAnswer(page, created);
         if (created.status === 201) {
+            stored = created.data["content"];
             return wrongLocale(page, created, locale) ?? done("created");
         }
-        // 409 slug_taken: another type holds this page's registry link (#10268
+        // 409 slug_taken: another page holds this page's registry link (#10268
         // D5) — reported as it is, since a re-read at this address finds nothing.
         // Any other 409: created by someone else since the read — read it once more.
         if (created.status !== 409 || created.code === "slug_taken") {
@@ -531,6 +687,323 @@ export function formatImportMdxReport(result) {
         `created ${created} · updated ${updated} · unchanged ${unchanged} · skipped ${skipped} · failed ${failures}`,
     ].join("\n")}\n`;
 }
+// ── Inline HTML in section strings (#10804) ─────────────────────────────────
+/** `HTML_TAG` (`content-draft.ts`, from `derive-publish.ts`, SEC-10589-01), restated: no runtime dep. */
+const HTML_TAG = /<[A-Za-z!/?]/;
+/** `checkSectionData`'s string and key rules (`content-draft.ts`), restated: no runtime dep. */
+const SECTION_STRING_MAX = 2_000;
+const SECTION_KEY_MAX = 100;
+const SCRIPT_SCHEME = /^(?:javascript|vbscript|data):/;
+/** `FAQ_ALLOWED_HREF` (`faq-questions.ts`), the hrefs `parseFaqAnswer` draws as links, restated. */
+const LINK_HREF = /^(?:\/|#|https?:|mailto:|tel:)/i;
+/** Elements removed with their content (D3). */
+const DROPPED_ELEMENTS = new Set([
+    "script",
+    "style",
+    "template",
+    "iframe",
+    "noscript",
+    "svg",
+    "object",
+    "video",
+    "audio",
+    "canvas",
+]);
+/** Elements whose open or close tag is a paragraph break (D3). */
+const BLOCK_ELEMENTS = new Set([
+    "p",
+    "div",
+    "section",
+    "article",
+    "header",
+    "footer",
+    "blockquote",
+    "figure",
+    "figcaption",
+    "pre",
+    "table",
+    "tr",
+    "dl",
+    "dt",
+    "dd",
+    "h1",
+    "h2",
+    "h3",
+    "h4",
+    "h5",
+    "h6",
+    "ul",
+    "ol",
+    "hr",
+]);
+/** What the layout keeps of a tag (D3): `a` only when it becomes a link. */
+const CARRIED_ELEMENTS = new Set(["a", "br", "p", "ul", "li"]);
+const NAMED_ENTITIES = {
+    amp: "&",
+    lt: "<",
+    gt: ">",
+    quot: '"',
+    apos: "'",
+    nbsp: "\u00a0",
+};
+const ENTITY = /&(?:#(\d+)|#[xX]([0-9A-Fa-f]+)|(amp|lt|gt|quot|apos|nbsp));/g;
+const TAG_NAME = /\/?([A-Za-z][A-Za-z0-9-]*)/y;
+const TAG_END = /[ \t\r\n\f]*(\/?)>/y;
+/**
+ * One attribute, or one stray character a browser would skip. A `<` ends the
+ * scan whether it is unquoted or inside a quoted value, so a `<` that begins
+ * no tag costs only the gap to the next one and the tokenizer stays linear in
+ * the string (spec §9). D3 needs a quoted value to hold `>`, never `<`.
+ */
+const TAG_ATTR = /[ \t\r\n\f]*(?:([^ \t\r\n\f"'<>/=]+)(?:[ \t\r\n\f]*=[ \t\r\n\f]*(?:"([^"<]*)"|'([^'<]*)'|([^ \t\r\n\f<>]+)))?|[^ \t\r\n\f<>])/y;
+const NEWLINE = 1;
+const PARAGRAPH = 2;
+function decodeEntities(text) {
+    return text.replace(ENTITY, (source, dec, hex, name) => {
+        if (name !== undefined)
+            return NAMED_ENTITIES[name];
+        const point = dec !== undefined ? Number(dec) : parseInt(hex, 16);
+        return point > 0 &&
+            point <= 0x10ffff &&
+            (point < 0xd800 || point > 0xdfff)
+            ? String.fromCodePoint(point)
+            : source;
+    });
+}
+/** The tag at `at` (`<`, `/`?, a name, attributes, `/`?, `>`), or `undefined` when `<` begins none. */
+function readTag(value, at) {
+    TAG_NAME.lastIndex = at + 1;
+    const name = TAG_NAME.exec(value)?.[1];
+    if (name === undefined)
+        return undefined;
+    let href;
+    for (let i = TAG_NAME.lastIndex;; i = TAG_ATTR.lastIndex) {
+        TAG_END.lastIndex = i;
+        const end = TAG_END.exec(value);
+        if (end !== null) {
+            return {
+                end: TAG_END.lastIndex,
+                close: value[at + 1] === "/",
+                selfClosing: end[1] === "/",
+                name: name.toLowerCase(),
+                ...(href !== undefined && { href }),
+            };
+        }
+        TAG_ATTR.lastIndex = i;
+        const attr = TAG_ATTR.exec(value);
+        if (attr === null)
+            return undefined;
+        if (href === undefined && attr[1]?.toLowerCase() === "href") {
+            href = attr[2] ?? attr[3] ?? attr[4] ?? "";
+        }
+    }
+}
+/**
+ * A section string's inline HTML as the constrained Markdown the upstream
+ * renderers read (#10804 D3): a link with an allowed href becomes
+ * `[label](href)`, `<br>` a newline, a block or list item a paragraph break,
+ * and every other tag goes, its text kept. A string with no tag comes back
+ * byte-identical; the result never holds one. `notCarried` names, sorted,
+ * every tag the layout does not keep.
+ */
+export function inlineHtmlToMarkdown(value) {
+    if (!HTML_TAG.test(value))
+        return { text: value, notCarried: [] };
+    const pieces = [];
+    const notCarried = new Set();
+    const text = (raw) => {
+        const decoded = decodeEntities(raw.replace(/[ \t\r\n\f]+/g, " "));
+        decoded.split("\n").forEach((part, i) => {
+            if (i > 0)
+                pieces.push(NEWLINE);
+            if (part !== "")
+                pieces.push(part);
+        });
+    };
+    let link;
+    const closeLink = () => {
+        if (link === undefined)
+            return;
+        const label = pieces.slice(link.at);
+        const words = label.every((p) => typeof p === "string")
+            ? label.join("")
+            : "";
+        if (words !== "" &&
+            !words.includes("]") &&
+            LINK_HREF.test(link.href) &&
+            !/[\s)]/.test(link.href)) {
+            pieces.splice(link.at, label.length, `[${words}](${link.href})`);
+        }
+        else {
+            notCarried.add("a");
+        }
+        link = undefined;
+    };
+    let from = 0;
+    for (let lt = value.indexOf("<"); lt !== -1; lt = value.indexOf("<", Math.max(lt + 1, from))) {
+        if (value.startsWith("<!--", lt)) {
+            text(value.slice(from, lt));
+            const end = value.indexOf("-->", lt + 4);
+            from = end === -1 ? value.length : end + 3;
+            continue;
+        }
+        const tag = readTag(value, lt);
+        if (tag === undefined)
+            continue;
+        text(value.slice(from, lt));
+        from = tag.end;
+        const { name } = tag;
+        if (!CARRIED_ELEMENTS.has(name))
+            notCarried.add(name);
+        if (DROPPED_ELEMENTS.has(name)) {
+            if (!tag.close && !tag.selfClosing) {
+                const close = new RegExp(`</${name}[ \\t\\r\\n\\f]*>`, "gi");
+                close.lastIndex = from;
+                from = close.exec(value) === null ? value.length : close.lastIndex;
+            }
+        }
+        else if (name === "a") {
+            closeLink();
+            if (!tag.close) {
+                link = { at: pieces.length, href: decodeEntities(tag.href ?? "") };
+            }
+        }
+        else if (name === "br") {
+            pieces.push(NEWLINE);
+        }
+        else if (name === "li") {
+            // An item with no text leaves no bullet.
+            if (tag.close && pieces.at(-1) === "- ")
+                pieces.pop();
+            pieces.push(PARAGRAPH);
+            if (!tag.close)
+                pieces.push("- ");
+        }
+        else if (BLOCK_ELEMENTS.has(name)) {
+            pieces.push(PARAGRAPH);
+        }
+    }
+    text(value.slice(from));
+    closeLink();
+    // Spaces never touch a newline; a run holding a paragraph break, or two or
+    // more newlines, is one blank line; the ends are trimmed.
+    const parts = [];
+    let run;
+    for (const piece of pieces) {
+        if (typeof piece !== "string") {
+            if (run === undefined) {
+                while (parts.length > 0) {
+                    const last = parts[parts.length - 1].replace(/ +$/, "");
+                    if (last !== "") {
+                        parts[parts.length - 1] = last;
+                        break;
+                    }
+                    parts.pop();
+                }
+                run = { newlines: 0, paragraph: false };
+            }
+            if (piece === PARAGRAPH)
+                run.paragraph = true;
+            else
+                run.newlines += 1;
+            continue;
+        }
+        let words = piece;
+        if (run !== undefined) {
+            words = words.replace(/^ +/, "");
+            if (words === "")
+                continue;
+            if (parts.length > 0) {
+                parts.push(run.paragraph || run.newlines > 1 ? "\n\n" : "\n");
+            }
+            run = undefined;
+        }
+        else if (words.startsWith(" ") && parts.at(-1)?.endsWith(" ") === true) {
+            words = words.slice(1);
+        }
+        parts.push(words);
+    }
+    return {
+        text: parts
+            .join("")
+            .replace(/^[ \n]+|[ \n]+$/g, "")
+            .replace(/<(?=[A-Za-z!/?])/g, "<\u2060"),
+        notCarried: [...notCarried].sort(),
+    };
+}
+const isPlainObject = (value) => value !== null &&
+    typeof value === "object" &&
+    [Object.prototype, null].includes(Object.getPrototypeOf(value));
+/**
+ * Each section with every string in its `data` that holds a tag converted by
+ * `inlineHtmlToMarkdown` (#10804 D2); keys and tag-free strings are kept as
+ * they are. `notCarried` is the sorted union of the names it did not carry.
+ */
+export function sectionsWithoutHtml(sections) {
+    const names = new Set();
+    const walk = (value) => {
+        if (typeof value === "string") {
+            const out = inlineHtmlToMarkdown(value);
+            for (const name of out.notCarried)
+                names.add(name);
+            return out.text;
+        }
+        if (Array.isArray(value))
+            return value.map(walk);
+        if (!isPlainObject(value))
+            return value;
+        return Object.fromEntries(Object.entries(value).map(([key, child]) => [key, walk(child)]));
+    };
+    return {
+        sections: sections.map((section) => isPlainObject(section) && "data" in section
+            ? { ...section, data: walk(section.data) }
+            : section),
+        notCarried: [...names].sort(),
+    };
+}
+/** The first string or key rule of the hub's that `value` breaks, at `path`. */
+function refusalAt(value, path) {
+    if (typeof value === "string") {
+        // A URL parser drops tabs, newlines and leading control characters.
+        // eslint-disable-next-line no-control-regex -- the control range is the point
+        const scheme = value.replace(/[\u0000- ]/g, "").toLowerCase();
+        const message = value.length > SECTION_STRING_MAX
+            ? `A section string may hold at most ${SECTION_STRING_MAX} characters`
+            : HTML_TAG.test(value)
+                ? "A section string may not hold an HTML tag"
+                : SCRIPT_SCHEME.test(scheme)
+                    ? "A section string may not use a script-bearing URL scheme"
+                    : undefined;
+        return message === undefined ? undefined : `${message} (${path})`;
+    }
+    if (value === null || typeof value !== "object")
+        return undefined;
+    const array = Array.isArray(value);
+    for (const [key, child] of Object.entries(value)) {
+        if (!array && (key.length > SECTION_KEY_MAX || HTML_TAG.test(key))) {
+            return `A section key must be a short plain name (${path}.${key})`;
+        }
+        const refusal = refusalAt(child, array ? `${path}[${key}]` : `${path}.${key}`);
+        if (refusal !== undefined)
+            return refusal;
+    }
+    return undefined;
+}
+/**
+ * The first section-string or key rule of the hub's structure write
+ * (`checkSectionData`) the layout breaks, as `<message> (sections[i].data<path>)`,
+ * or `undefined` (#10804 D5). The depth and size bounds are not restated.
+ */
+export function layoutRefusal(layout) {
+    for (const [index, section] of layout.sections.entries()) {
+        if (!isPlainObject(section) || section["data"] === undefined)
+            continue;
+        const refusal = refusalAt(section["data"], `sections[${index}].data`);
+        if (refusal !== undefined)
+            return refusal;
+    }
+    return undefined;
+}
 // ── The importer ────────────────────────────────────────────────────────────
 /** One whitespace-collapsed line of at most `ADAPTER_REASON_MAX` characters. */
 function adapterReason(err, stage = "adapter") {
@@ -540,14 +1013,19 @@ function adapterReason(err, stage = "adapter") {
 /**
  * What the page stores (#10534): with `sections` and a codec, its words after
  * the body's own text and its sections as the layout; else the page as read.
+ * Both come from one array, its inline HTML converted (#10804 D2).
  */
 function convert(source, codec) {
-    const { sections, ...frontmatter } = source.frontmatter;
-    if (!Array.isArray(sections) ||
-        sections.length === 0 ||
+    const { sections: authored, ...frontmatter } = source.frontmatter;
+    if (!Array.isArray(authored) ||
+        authored.length === 0 ||
         codec === undefined) {
-        return { content: { ...source.frontmatter, body: source.body } };
+        return {
+            content: { ...source.frontmatter, body: source.body },
+            notCarried: [],
+        };
     }
+    const { sections, notCarried } = sectionsWithoutHtml(authored);
     let words;
     try {
         words = codec(sections);
@@ -562,6 +1040,7 @@ function convert(source, codec) {
             body: lead === "" ? words : `${lead}\n\n${words}`,
         },
         layout: { kind: "sections", sections },
+        notCarried,
     };
 }
 export async function importMdx(opts) {
@@ -583,15 +1062,17 @@ export async function importMdx(opts) {
         ? { pages: [], skipped: [] }
         : planEditorial(editorialRoot, types, defaultLocale);
     const parseFrontmatter = opts.adapters.parseFrontmatter;
+    const rules = opts.adapters.siteFields;
     // #10701 D3 — one route path holds one page, so an editorial index the run
-    // will write supersedes a content page of its type at another slug (the
-    // scaffold's teaser), which the create would refuse `slug_taken`.
+    // will write supersedes the content page of its type at the surface's own
+    // slug (the scaffold's teaser), which the create would refuse `slug_taken`.
+    // Any other slug of the type has a link of its own (#10805 D5).
     const indexTypes = new Set(parseFrontmatter === undefined
         ? []
         : editorial.pages
             .filter((p) => p.invalid === undefined && INDEX_TYPES.has(p.type))
             .map((p) => p.type));
-    const superseded = (p) => indexTypes.has(p.type) && p.slug !== INDEX_SLUG;
+    const superseded = (p) => indexTypes.has(p.type) && p.slug === INDEX_OWN_SLUG.get(p.type);
     const pages = [
         ...content.pages.filter((p) => !superseded(p)),
         ...editorial.pages,
@@ -648,15 +1129,15 @@ export async function importMdx(opts) {
             }
             let read;
             try {
-                read = editorialSource(page, parseFrontmatter(readFileSync(join(editorialRoot, page.path), "utf8")));
+                read = editorialSource(page, parseFrontmatter(readFileSync(join(editorialRoot, page.path), "utf8")), rules);
             }
             catch (err) {
                 fail(adapterReason(err, "editorial"));
                 continue;
             }
             source = read.source;
-            if (read.dropped.length > 0) {
-                onLine(`${page.path}: not imported — ${read.dropped.join(", ")} (the editorial walk sends only the fields the store keeps from a caller)`);
+            if (read.notSent.length > 0) {
+                onLine(`${page.path}: not imported — ${notSentList(read.notSent)}`);
             }
         }
         else {
@@ -679,13 +1160,37 @@ export async function importMdx(opts) {
             fail(converted.reason);
             continue;
         }
+        if (converted.notCarried.length > 0) {
+            onLine(`${outcomePath(page)}: inline HTML not carried — ${converted.notCarried.join(", ")} (the layout holds no HTML; their text is kept)`);
+        }
         if (converted.layout === undefined &&
             Array.isArray(source.frontmatter["sections"]) &&
             source.frontmatter["sections"].length > 0) {
             onLine(`${page.path}: keeps its words in sections — the site's ${VALIDATION_PACKAGE} has no words codec; update its dependencies and re-run`);
         }
-        const result = await writePage(t, page, defaultLocale, converted.content, converted.layout);
+        // #10804 D5 — a layout the hub would refuse fails here, in a dry run and
+        // under --apply alike, before its words are saved.
+        const refusal = converted.layout === undefined
+            ? undefined
+            : layoutRefusal(converted.layout);
+        if (refusal !== undefined) {
+            fail(`layout: ${refusal}`);
+            continue;
+        }
+        const result = await writePage(t, page, defaultLocale, converted.content, converted.layout, rules?.publicPageTags);
         halt = result.halt;
+        // #10806 D4 — an older hub strips what it has no member for; say so.
+        // An answer that carries no content says nothing about what was kept.
+        const dropped = rules === undefined ||
+            page.root !== "editorial" ||
+            "reason" in result.outcome ||
+            result.stored === null ||
+            typeof result.stored !== "object"
+            ? []
+            : notKept(converted.content, result.stored, rules);
+        if (dropped.length > 0) {
+            onLine(`${page.path}: not kept by the hub: ${dropped.join(", ")} (the hub predates site fields; update it and re-run)`);
+        }
         if (opts.publish !== true || "reason" in result.outcome) {
             record(result.outcome);
             continue;
@@ -773,16 +1278,19 @@ export async function loadSiteMdxAdapter(siteRoot) {
         !types.every((type) => typeof type === "string")) {
         throw new ImportMdxRefusedError(`import-mdx: ${CONTENT_ADAPTERS_PACKAGE} in ${web} does not export createMdxAdapter and SCHEMA_ORG_TYPES. Install the site's dependencies (pnpm install) first. Nothing was sent.`);
     }
-    // The codec the adapter's own validation package carries (#10534); one
-    // that predates it, or none, leaves pages unconverted and the run says so.
-    let codec;
+    // The codec the adapter's own validation package carries (#10534), and its
+    // site-field rule (#10806 D4); one that predates either, or none, leaves
+    // pages unconverted or site fields unsent, and the run says so.
+    let validation = {};
     try {
-        const validation = createRequire(entry).resolve(VALIDATION_PACKAGE);
-        codec = (await import(pathToFileURL(validation).href))["sectionsToMarkdown"];
+        const path = createRequire(entry).resolve(VALIDATION_PACKAGE);
+        validation = (await import(pathToFileURL(path).href));
     }
     catch {
-        // Not resolvable from the adapter: no codec.
+        // Not resolvable from the adapter: no codec and no site-field rule.
     }
+    const codec = validation["sectionsToMarkdown"];
+    const { siteFieldRefusal: refusal, publicPageTags, SITE_FIELDS_MAX_KEYS: maxKeys, SITE_FIELDS_MAX_BYTES: maxBytes, } = validation;
     // The adapter's own frontmatter parser (#10701 D1), for the editorial tree;
     // none leaves every editorial page failed, and the run says so.
     let matter;
@@ -798,6 +1306,17 @@ export async function loadSiteMdxAdapter(siteRoot) {
         ...(typeof codec === "function" && {
             sectionsToMarkdown: codec,
         }),
+        ...(typeof refusal === "function" &&
+            typeof publicPageTags === "function" &&
+            typeof maxKeys === "number" &&
+            typeof maxBytes === "number" && {
+            siteFields: {
+                refusal: refusal,
+                publicPageTags: publicPageTags,
+                maxKeys,
+                maxBytes,
+            },
+        }),
         ...(typeof matter === "function" && {
             parseFrontmatter: (raw) => {
                 const { data, content } = matter(raw);