@michaelthielemann/kestrel 1.2.1

package/layers/ui/app/utils/icons.ts

@@ -0,0 +1,147 @@
+export type IconName =
+  | 'grip' | 'chevron-up' | 'chevron-down' | 'chevron-left' | 'chevron-right' | 'arrow-left'
+  | 'copy' | 'trash' | 'x' | 'plus' | 'pencil' | 'check'
+  | 'home' | 'file-text' | 'folder' | 'folder-plus' | 'panel-left-close' | 'panel-left-open' | 'log-out'
+  | 'sun' | 'moon' | 'calendar' | 'upload' | 'layout-grid' | 'table'
+  // collection icons + list toolbar
+  | 'settings' | 'image' | 'newspaper' | 'columns' | 'filter' | 'search' | 'sliders'
+  // richtext toolbar
+  | 'bold' | 'italic' | 'underline' | 'strikethrough' | 'code' | 'square-code' | 'highlighter'
+  | 'subscript' | 'superscript' | 'list' | 'list-ordered' | 'quote' | 'minus' | 'message-square'
+  | 'align-left' | 'align-center' | 'align-right' | 'align-justify'
+  | 'eraser' | 'undo' | 'redo' | 'link' | 'link-2'
+  | 'external-link' | 'triangle-alert'
+  // password reveal
+  | 'eye' | 'eye-off'
+  // preview device widths + reload
+  | 'monitor' | 'tablet' | 'smartphone' | 'rotate-cw'
+  // block-type tiles
+  | 'clock' | 'user'
+
+export const icons: Record<IconName, string> = {
+  'monitor': '<rect width="20" height="14" x="2" y="3" rx="2"/><line x1="8" x2="16" y1="21" y2="21"/><line x1="12" x2="12" y1="17" y2="21"/>',
+  'tablet': '<rect width="16" height="20" x="4" y="2" rx="2" ry="2"/><line x1="12" x2="12.01" y1="18" y2="18"/>',
+  'smartphone': '<rect width="14" height="20" x="5" y="2" rx="2" ry="2"/><path d="M12 18h.01"/>',
+  'rotate-cw': '<path d="M21 12a9 9 0 1 1-9-9c2.52 0 4.93 1 6.74 2.74L21 8"/><path d="M21 3v5h-5"/>',
+  'clock': '<circle cx="12" cy="12" r="10"/><polyline points="12 6 12 12 16 14"/>',
+  'user': '<path d="M19 21v-2a4 4 0 0 0-4-4H9a4 4 0 0 0-4 4v2"/><circle cx="12" cy="7" r="4"/>',
+  'chevron-up': '<path d="m18 15-6-6-6 6"/>',
+  'chevron-down': '<path d="m6 9 6 6 6-6"/>',
+  'chevron-left': '<path d="m15 18-6-6 6-6"/>',
+  'chevron-right': '<path d="m9 18 6-6-6-6"/>',
+  'arrow-left': '<path d="m12 19-7-7 7-7"/><path d="M19 12H5"/>',
+  'x': '<path d="M18 6 6 18"/><path d="m6 6 12 12"/>',
+  'plus': '<path d="M5 12h14"/><path d="M12 5v14"/>',
+  'check': '<path d="M20 6 9 17l-5-5"/>',
+  'trash': '<path d="M3 6h18"/><path d="M19 6v14c0 1-1 2-2 2H7c-1 0-2-1-2-2V6"/><path d="M8 6V4c0-1 1-2 2-2h4c1 0 2 1 2 2v2"/><line x1="10" x2="10" y1="11" y2="17"/><line x1="14" x2="14" y1="11" y2="17"/>',
+  'copy': '<rect width="14" height="14" x="8" y="8" rx="2" ry="2"/><path d="M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2"/>',
+  'grip': '<circle cx="9" cy="6" r="1"/><circle cx="9" cy="12" r="1"/><circle cx="9" cy="18" r="1"/><circle cx="15" cy="6" r="1"/><circle cx="15" cy="12" r="1"/><circle cx="15" cy="18" r="1"/>',
+  'pencil': '<path d="M21.174 6.812a1 1 0 0 0-3.986-3.987L3.842 16.174a2 2 0 0 0-.5.83l-1.321 4.352a.5.5 0 0 0 .623.622l4.353-1.32a2 2 0 0 0 .83-.497z"/><path d="m15 5 4 4"/>',
+  'home': '<path d="m3 9 9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><path d="M9 22V12h6v10"/>',
+  'file-text': '<path d="M15 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V7Z"/><path d="M14 2v4a2 2 0 0 0 2 2h4"/><path d="M10 9H8"/><path d="M16 13H8"/><path d="M16 17H8"/>',
+  'folder': '<path d="M20 20a2 2 0 0 0 2-2V8a2 2 0 0 0-2-2h-7.9a2 2 0 0 1-1.69-.9L9.6 3.9A2 2 0 0 0 7.93 3H4a2 2 0 0 0-2 2v13a2 2 0 0 0 2 2Z"/>',
+  'panel-left-close': '<rect width="18" height="18" x="3" y="3" rx="2"/><path d="M9 3v18"/><path d="m16 15-3-3 3-3"/>',
+  'panel-left-open': '<rect width="18" height="18" x="3" y="3" rx="2"/><path d="M9 3v18"/><path d="m14 9 3 3-3 3"/>',
+  'log-out': '<path d="M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4"/><path d="m16 17 5-5-5-5"/><path d="M21 12H9"/>',
+  'sun': '<circle cx="12" cy="12" r="4"/><path d="M12 2v2"/><path d="M12 20v2"/><path d="m4.93 4.93 1.41 1.41"/><path d="m17.66 17.66 1.41 1.41"/><path d="M2 12h2"/><path d="M20 12h2"/><path d="m6.34 17.66-1.41 1.41"/><path d="m19.07 4.93-1.41 1.41"/>',
+  'moon': '<path d="M12 3a6.36 6.36 0 0 0 9 9 9 9 0 1 1-9-9Z"/>',
+  'calendar': '<path d="M8 2v4"/><path d="M16 2v4"/><rect width="18" height="18" x="3" y="4" rx="2"/><path d="M3 10h18"/>',
+  'folder-plus': '<path d="M12 10v6"/><path d="M9 13h6"/><path d="M20 20a2 2 0 0 0 2-2V8a2 2 0 0 0-2-2h-7.9a2 2 0 0 1-1.69-.9L9.6 3.9A2 2 0 0 0 7.93 3H4a2 2 0 0 0-2 2v13a2 2 0 0 0 2 2Z"/>',
+  'upload': '<path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="17 8 12 3 7 8"/><line x1="12" x2="12" y1="3" y2="15"/>',
+  'layout-grid': '<rect width="7" height="7" x="3" y="3" rx="1"/><rect width="7" height="7" x="14" y="3" rx="1"/><rect width="7" height="7" x="14" y="14" rx="1"/><rect width="7" height="7" x="3" y="14" rx="1"/>',
+  'table': '<path d="M12 3v18"/><rect width="18" height="18" x="3" y="3" rx="2"/><path d="M3 9h18"/><path d="M3 15h18"/>',
+  'bold': '<path d="M14 12a4 4 0 0 0 0-8H6v8"/><path d="M15 20a4 4 0 0 0 0-8H6v8Z"/>',
+  'italic': '<line x1="19" x2="10" y1="4" y2="4"/><line x1="14" x2="5" y1="20" y2="20"/><line x1="15" x2="9" y1="4" y2="20"/>',
+  'underline': '<path d="M6 4v6a6 6 0 0 0 12 0V4"/><line x1="4" x2="20" y1="21" y2="21"/>',
+  'strikethrough': '<path d="M16 4H9a3 3 0 0 0-2.83 4"/><path d="M14 12a4 4 0 0 1 0 8H6"/><line x1="4" x2="20" y1="12" y2="12"/>',
+  'code': '<polyline points="16 18 22 12 16 6"/><polyline points="8 6 2 12 8 18"/>',
+  'square-code': '<path d="m10 9-3 3 3 3"/><path d="m14 15 3-3-3-3"/><rect width="18" height="18" x="3" y="3" rx="2"/>',
+  'highlighter': '<path d="m9 11-6 6v3h9l3-3"/><path d="m22 12-4.6 4.6a2 2 0 0 1-2.8 0l-5.2-5.2a2 2 0 0 1 0-2.8L14 4"/>',
+  'subscript': '<path d="m4 5 8 8"/><path d="m12 5-8 8"/><path d="M20 19h-4c0-1.5.44-2 1.5-2.5S20 15.33 20 14c0-.47-.17-.93-.48-1.29a2.11 2.11 0 0 0-2.62-.44c-.42.24-.74.62-.9 1.07"/>',
+  'superscript': '<path d="m4 19 8-8"/><path d="m12 19-8-8"/><path d="M20 12h-4c0-1.5.44-2 1.5-2.5S20 8.33 20 7c0-.47-.17-.93-.48-1.29a2.11 2.11 0 0 0-2.62-.44c-.42.24-.74.62-.9 1.07"/>',
+  'list': '<line x1="8" x2="21" y1="6" y2="6"/><line x1="8" x2="21" y1="12" y2="12"/><line x1="8" x2="21" y1="18" y2="18"/><line x1="3" x2="3.01" y1="6" y2="6"/><line x1="3" x2="3.01" y1="12" y2="12"/><line x1="3" x2="3.01" y1="18" y2="18"/>',
+  'list-ordered': '<line x1="10" x2="21" y1="6" y2="6"/><line x1="10" x2="21" y1="12" y2="12"/><line x1="10" x2="21" y1="18" y2="18"/><path d="M4 6h1v4"/><path d="M4 10h2"/><path d="M6 18H4c0-1 2-2 2-3s-1-1.5-2-1"/>',
+  'quote': '<path d="M17 6H3"/><path d="M21 12H8"/><path d="M21 18H8"/><path d="M3 12v6"/>',
+  'message-square': '<path d="M21 15a2 2 0 0 1-2 2H7l-4 4V5a2 2 0 0 1 2-2h14a2 2 0 0 1 2 2z"/>',
+  'minus': '<path d="M5 12h14"/>',
+  'align-left': '<line x1="21" x2="3" y1="6" y2="6"/><line x1="15" x2="3" y1="12" y2="12"/><line x1="17" x2="3" y1="18" y2="18"/>',
+  'align-center': '<line x1="21" x2="3" y1="6" y2="6"/><line x1="17" x2="7" y1="12" y2="12"/><line x1="19" x2="5" y1="18" y2="18"/>',
+  'align-right': '<line x1="21" x2="3" y1="6" y2="6"/><line x1="21" x2="9" y1="12" y2="12"/><line x1="21" x2="7" y1="18" y2="18"/>',
+  'align-justify': '<line x1="3" x2="21" y1="6" y2="6"/><line x1="3" x2="21" y1="12" y2="12"/><line x1="3" x2="21" y1="18" y2="18"/>',
+  'eraser': '<path d="m7 21-4.3-4.3c-1-1-1-2.5 0-3.4l9.6-9.6c1-1 2.5-1 3.4 0l5.6 5.6c1 1 1 2.5 0 3.4L13 21"/><path d="M22 21H7"/><path d="m5 11 9 9"/>',
+  'undo': '<path d="M3 7v6h6"/><path d="M21 17a9 9 0 0 0-9-9 9 9 0 0 0-6 2.3L3 13"/>',
+  'redo': '<path d="M21 7v6h-6"/><path d="M3 17a9 9 0 0 1 9-9 9 9 0 0 1 6 2.3l3 2.7"/>',
+  'link': '<path d="M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71"/><path d="M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71"/>',
+  'link-2': '<path d="M9 17H7A5 5 0 0 1 7 7h2"/><path d="M15 7h2a5 5 0 1 1 0 10h-2"/><line x1="8" x2="16" y1="12" y2="12"/>',
+  'external-link': '<path d="M15 3h6v6"/><path d="M10 14 21 3"/><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h6"/>',
+  'triangle-alert': '<path d="m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3"/><path d="M12 9v4"/><path d="M12 17h.01"/>',
+  'settings': '<path d="M12.22 2h-.44a2 2 0 0 0-2 2v.18a2 2 0 0 1-1 1.73l-.43.25a2 2 0 0 1-2 0l-.15-.08a2 2 0 0 0-2.73.73l-.22.38a2 2 0 0 0 .73 2.73l.15.1a2 2 0 0 1 1 1.72v.51a2 2 0 0 1-1 1.74l-.15.09a2 2 0 0 0-.73 2.73l.22.38a2 2 0 0 0 2.73.73l.15-.08a2 2 0 0 1 2 0l.43.25a2 2 0 0 1 1 1.73V20a2 2 0 0 0 2 2h.44a2 2 0 0 0 2-2v-.18a2 2 0 0 1 1-1.73l.43-.25a2 2 0 0 1 2 0l.15.08a2 2 0 0 0 2.73-.73l.22-.39a2 2 0 0 0-.73-2.73l-.15-.08a2 2 0 0 1-1-1.74v-.5a2 2 0 0 1 1-1.74l.15-.09a2 2 0 0 0 .73-2.73l-.22-.38a2 2 0 0 0-2.73-.73l-.15.08a2 2 0 0 1-2 0l-.43-.25a2 2 0 0 1-1-1.73V4a2 2 0 0 0-2-2z"/><circle cx="12" cy="12" r="3"/>',
+  'image': '<rect width="18" height="18" x="3" y="3" rx="2" ry="2"/><circle cx="9" cy="9" r="2"/><path d="m21 15-3.086-3.086a2 2 0 0 0-2.828 0L6 21"/>',
+  'newspaper': '<path d="M15 18h-5"/><path d="M18 14h-8"/><path d="M15 22H4a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h12a2 2 0 0 1 2 2v18a2 2 0 0 0 4 0v-9a2 2 0 0 0-2-2h-2"/><rect width="8" height="4" x="6" y="6" rx="1"/>',
+  'columns': '<rect width="18" height="18" x="3" y="3" rx="2"/><path d="M9 3v18"/><path d="M15 3v18"/>',
+  'filter': '<polygon points="22 3 2 3 10 12.46 10 19 14 21 14 12.46 22 3"/>',
+  'search': '<circle cx="11" cy="11" r="8"/><path d="m21 21-4.3-4.3"/>',
+  'sliders': '<line x1="21" x2="14" y1="4" y2="4"/><line x1="10" x2="3" y1="4" y2="4"/><line x1="21" x2="12" y1="12" y2="12"/><line x1="8" x2="3" y1="12" y2="12"/><line x1="21" x2="16" y1="20" y2="20"/><line x1="12" x2="3" y1="20" y2="20"/><line x1="14" x2="14" y1="2" y2="6"/><line x1="8" x2="8" y1="10" y2="14"/><line x1="16" x2="16" y1="18" y2="22"/>',
+  'eye': '<path d="M2.062 12.348a1 1 0 0 1 0-.696 10.75 10.75 0 0 1 19.876 0 1 1 0 0 1 0 .696 10.75 10.75 0 0 1-19.876 0"/><circle cx="12" cy="12" r="3"/>',
+  'eye-off': '<path d="M10.733 5.076a10.744 10.744 0 0 1 11.205 6.575 1 1 0 0 1 0 .696 10.747 10.747 0 0 1-1.444 2.49"/><path d="M14.084 14.158a3 3 0 0 1-4.242-4.242"/><path d="M17.479 17.499a10.75 10.75 0 0 1-15.417-5.151 1 1 0 0 1 0-.696 10.75 10.75 0 0 1 4.446-5.143"/><path d="m2 2 20 20"/>',
+}
+
+/** A registry key, or arbitrary (developer-defined) inline SVG. The named-icon overloads keep editor
+ *  autocomplete while allowing a collection to supply its own icon markup. */
+export type IconSpec = IconName | (string & {})
+
+export function isIconName(name: string): name is IconName {
+  return Object.hasOwn(icons, name)
+}
+
+// Known-safe SVG elements/attributes. Names are lowercased for comparison; the original casing is
+// preserved on output (`viewBox`, `linearGradient`, … are case-sensitive in SVG).
+const ALLOWED_SVG_TAGS = new Set([
+  'svg', 'path', 'circle', 'rect', 'line', 'polyline', 'polygon', 'ellipse',
+  'g', 'defs', 'lineargradient', 'radialgradient', 'stop', 'clippath', 'mask',
+  'title', 'desc',
+])
+const ALLOWED_SVG_ATTRS = new Set([
+  'd', 'cx', 'cy', 'r', 'rx', 'ry', 'x', 'y', 'x1', 'y1', 'x2', 'y2', 'fx', 'fy',
+  'width', 'height', 'points', 'transform', 'gradienttransform', 'viewbox', 'preserveaspectratio',
+  'fill', 'fill-rule', 'fill-opacity', 'stroke', 'stroke-width', 'stroke-linecap',
+  'stroke-linejoin', 'stroke-dasharray', 'stroke-dashoffset', 'stroke-opacity', 'stroke-miterlimit',
+  'opacity', 'offset', 'stop-color', 'stop-opacity', 'gradientunits', 'spreadmethod',
+  'clip-path', 'clip-rule', 'id', 'class',
+])
+
+/**
+ * Allowlist-sanitise developer-supplied icon SVG before it reaches `v-html` (Icon.vue). We keep ONLY
+ * known-safe SVG elements and attributes and drop everything else, rather than blocklisting bad patterns
+ * (a denylist is defeated by `/`-separated handlers, entity-encoded `javascript:`, etc.). So `<script>`,
+ * `<image>`, `<animate>`, `<a>`, `<use>`, `<foreignObject>`, every `on*` handler and every URL-bearing
+ * attribute are removed regardless of how they are written; no allowed element/attribute can load a URL
+ * or run script. Collection icons are developer-authored today, but this stays safe if collections become
+ * runtime-defined (the schema-engine roadmap), where `icon` would cross a user-controlled boundary.
+ */
+export function sanitizeIconSvg(svg: string): string {
+  return svg.replace(/<(\/?)([a-zA-Z][\w:-]*)((?:"[^"]*"|'[^']*'|[^>])*?)(\/?)>/g, (_m, close, tag, attrs, selfClose) => {
+    if (!ALLOWED_SVG_TAGS.has(tag.toLowerCase())) return ''
+    if (close) return `</${tag}>`
+    const kept: string[] = []
+    const attrRe = /([a-zA-Z_:][\w:.-]*)\s*=\s*("[^"]*"|'[^']*'|[^\s"'>]+)/g
+    let a: RegExpExecArray | null
+    while ((a = attrRe.exec(attrs))) {
+      if (ALLOWED_SVG_ATTRS.has(a[1].toLowerCase())) kept.push(`${a[1]}=${a[2]}`)
+    }
+    return `<${tag}${kept.length ? ' ' + kept.join(' ') : ''}${selfClose ? '/' : ''}>`
+  })
+}
+
+/**
+ * Resolve an `IconSpec` to the inner SVG markup rendered inside the standard `<svg>` wrapper. A registry
+ * name yields its stored body; anything containing `<` is treated as raw inner-SVG markup (a full
+ * `<svg>…</svg>` is unwrapped to its children so it inherits the wrapper's size/`currentColor`), then
+ * sanitized. Unknown bare strings render nothing.
+ */
+export function resolveIconBody(name: string): string {
+  if (isIconName(name)) return icons[name]
+  if (!name.includes('<')) return ''
+  const inner = name.replace(/^\s*<svg[^>]*>([\s\S]*)<\/svg\s*>\s*$/i, '$1')
+  return sanitizeIconSvg(inner)
+}

package/layers/ui/app/utils/iso-date.ts

@@ -0,0 +1,18 @@
+import { parseDate, parseDateTime, type DateValue } from '@internationalized/date'
+
+export type IsoPrecision = 'date' | 'datetime'
+
+/** ISO string → a `@internationalized/date` value for Reka; invalid/empty → undefined. */
+export function isoToDate(iso: string | null | undefined, precision: IsoPrecision): DateValue | undefined {
+  if (!iso) return undefined
+  try {
+    return precision === 'date' ? parseDate(iso) : parseDateTime(iso)
+  } catch {
+    return undefined
+  }
+}
+
+/** A `@internationalized/date` value → ISO string; null/undefined → null. */
+export function dateToIso(value: DateValue | null | undefined): string | null {
+  return value ? value.toString() : null
+}

package/layers/ui/app/utils/localized.ts

@@ -0,0 +1,13 @@
+import type { Localized } from '../../../core/server/utils/defineCollection'
+
+/**
+ * Resolve a (possibly localized) label for the active admin language. A plain string is returned as-is
+ * (language-agnostic); a `{ <lang>: string }` map resolves to the requested language, then `en`, then any
+ * present value. Returns `undefined` when there is nothing to show, so callers fall back (e.g. to the
+ * collection/block name). One source of label resolution for the nav, list, editor and block panes.
+ */
+export function resolveLocalized(value: Localized | undefined, lang: string): string | undefined {
+  if (value == null) return undefined
+  if (typeof value === 'string') return value
+  return value[lang] ?? value.en ?? Object.values(value)[0]
+}

package/layers/ui/app/utils/record-context.ts

@@ -0,0 +1,15 @@
+import type { InjectionKey, Ref } from 'vue'
+
+/** Editor → field-widget context: lets a widget know the record's id (`'new'` until first save) and whether
+ *  it has been saved. A field widget that manages out-of-band storage (e.g. the secure gallery's namespace)
+ *  uses this to clean up after an abandoned, never-saved draft. Provided by `CollectionEditor`; mirrors the
+ *  `blockEditKey` provide/inject precedent. Auto-imported (no path import needed in an extension). */
+export interface RecordEditContext {
+  id: Ref<string>
+  saved: Ref<boolean>
+  /** The editor's reactive record values, so a widget can read SIBLING fields (e.g. the gallery `slug`,
+   *  which the proofing overlay uses as the submission key). Reactive object — read `values.<field>`. */
+  values: Record<string, unknown>
+}
+
+export const recordEditContextKey = Symbol('kestrel.recordEdit') as InjectionKey<RecordEditContext>

package/layers/ui/app/utils/reorder.ts

@@ -0,0 +1,8 @@
+export function reorder<T>(arr: readonly T[], from: number, to: number): T[] {
+  if (from === to || from < 0 || to < 0 || from >= arr.length || to >= arr.length) {
+    return [...arr]
+  }
+  const result = [...arr]
+  result.splice(to, 0, result.splice(from, 1)[0] as T)
+  return result
+}

package/layers/ui/app/utils/richtext-preserve-class.ts

@@ -0,0 +1,31 @@
+import { Mark, Extension } from '@tiptap/vue-3' // re-exports @tiptap/core; keeps deps unchanged
+
+// StarterKit has no span/TextStyle mark and no `class` attribute on block nodes, so parsing stored
+// markup discards every consumer presentational class (e.g. the hero title's `text--color-white`).
+// These two extensions teach the schema to keep `class` on span wrappers and on block nodes, matching
+// what sanitize.ts already allows (`*: [class]`) so the class survives an edit/focus round-trip.
+const classAttr = {
+  class: {
+    default: null as string | null,
+    parseHTML: (el: HTMLElement) => el.getAttribute('class'),
+    renderHTML: (a: Record<string, unknown>) => (a.class ? { class: a.class } : {}),
+  },
+}
+
+// Inline `<span class="…">` wrapper. Only spans that HAVE a class become this mark, so ordinary spans
+// aren't captured.
+export const RichtextSpanClass = Mark.create({
+  name: 'spanClass',
+  parseHTML: () => [{ tag: 'span[class]' }],
+  renderHTML: ({ HTMLAttributes }) => ['span', HTMLAttributes, 0],
+  addAttributes: () => classAttr,
+})
+
+// Block-level class (e.g. `<p class="text--section-label">`).
+export const RichtextBlockClass = Extension.create({
+  name: 'blockClass',
+  addGlobalAttributes: () => [{
+    types: ['heading', 'paragraph', 'blockquote', 'bulletList', 'orderedList', 'listItem', 'codeBlock'],
+    attributes: classAttr,
+  }],
+})

package/layers/ui/app/utils/useFieldA11y.ts

@@ -0,0 +1,40 @@
+import { computed, useId, type ComputedRef } from 'vue'
+
+interface FieldA11yProps {
+  hint?: string
+  error?: string | null
+  required?: boolean
+  id?: string
+}
+
+interface FieldA11y {
+  fieldId: ComputedRef<string>
+  hintId: ComputedRef<string>
+  errId: ComputedRef<string>
+  describedby: ComputedRef<string | undefined>
+  ariaInvalid: ComputedRef<'true' | undefined>
+  ariaRequired: ComputedRef<'true' | undefined>
+}
+
+/**
+ * Shared accessibility wiring for labelled controls (UiField) and grouped controls (UiFieldset):
+ * a stable id, hint/error ids, the aria-describedby join, and aria-invalid. One source so the
+ * describedby ordering and aria contract cannot drift between the two.
+ */
+export function useFieldA11y(props: FieldA11yProps): FieldA11y {
+  const auto = useId()
+  const fieldId = computed(() => props.id ?? auto)
+  const hintId = computed(() => `${fieldId.value}-hint`)
+  const errId = computed(() => `${fieldId.value}-error`)
+  const describedby = computed(() => {
+    const ids: string[] = []
+    if (props.hint) ids.push(hintId.value)
+    if (props.error) ids.push(errId.value)
+    return ids.length ? ids.join(' ') : undefined
+  })
+  const ariaInvalid = computed(() => (props.error ? 'true' : undefined))
+  // Grouped/non-native controls (role=group, teleported widgets) get required conveyed via aria-required,
+  // since the visual asterisk is aria-hidden and a bare `required` attr on a non-input is ignored by AT.
+  const ariaRequired = computed(() => (props.required ? 'true' : undefined))
+  return { fieldId, hintId, errId, describedby, ariaInvalid, ariaRequired }
+}

package/layers/ui/nuxt.config.ts

@@ -0,0 +1,5 @@
+// The UI design system (tokens / reset / base in app/assets/scss/main.scss) is intentionally NOT loaded
+// app-globally — that would leak Kestrel's CSS reset + base styles onto a consumer's public site and fight
+// their own CSS (e.g. Bootstrap). It is imported by the admin layout (layers/admin/app/layouts/admin.vue)
+// instead, which scopes it to /admin: every admin route uses that layout, and /admin/** is ssr:false.
+export default defineNuxtConfig({})

package/nuxt.config.ts

@@ -0,0 +1,105 @@
+import kestrel from './kestrel.config'
+import { layerKestrelOption } from './layers/core/server/utils/kestrel-config'
+
+// Silence known-harmless, un-actionable THIRD-PARTY build noise (output unaffected — applied to both the
+// Vite client and the Nitro server Rollup passes). Everything else still surfaces — crucially, any
+// circular dependency that touches OUR `layers/` code is NOT dropped, so a real cycle we introduce stays
+// visible. Anything in our own code is fixed, not silenced.
+//  - `#__PURE__`: @vueuse/core (pulled in via reka-ui) ships a `/* #__PURE__ */` annotation in a position
+//    Rollup can't interpret; it just drops the comment.
+//  - `module-preload-polyfill`: Nuxt's own preload-polyfill transform emits no sourcemap (cosmetic).
+//  - Circular dependencies entirely inside dependencies (nitropack's runtime internals: app.mjs ↔
+//    cache.mjs / utils.mjs, etc.) — upstream code we don't author and can't fix.
+const SILENCED_BUILD_WARNINGS = ['#__PURE__', 'module-preload-polyfill']
+// Typed inline — Rollup's `WarningHandlerWithDefault` isn't importable here (rollup is a transitive, not a
+// direct, dep). `{ message?: string }` reads the bit we filter on; `defaultHandler` is structurally the
+// rollup default handler (cast to call it with our wider warning shape).
+const onwarn = (warning: { message?: string }, defaultHandler: (warning: never) => void) => {
+  const msg = warning.message ?? ''
+  if (SILENCED_BUILD_WARNINGS.some((s) => msg.includes(s))) return
+  // Third-party-internal cycles only (no `layers/` segment ⇒ none of our code is in the loop).
+  if (msg.includes('Circular dependency') && !msg.includes('layers/')) return
+  ;(defaultHandler as (w: unknown) => void)(warning)
+}
+
+export default defineNuxtConfig({
+  compatibilityDate: '2026-06-02',
+  future: { compatibilityVersion: 4 },
+  // `noUncheckedIndexedAccess` is a Nuxt tsconfig DEFAULT the project never opted into; the engine's code
+  // (runtime collection-derived tables → `Record<string, Column>` lookups, pervasive index access) was not
+  // written for it, so leaving it on would mean ~100 `!`-assertions that mostly HIDE undefined rather than
+  // catch it. Off → the `typecheck` gate is meaningful (real type errors surface) without that noise; it
+  // also keeps a consumer's own `nuxt typecheck` from drowning in errors against the shipped engine code.
+  // It must be set in BOTH places: `typescript.tsConfig` covers the app/shared/node tsconfigs, and
+  // `nitro.typescript.tsConfig` covers the separately-generated server (Nitro) tsconfig.
+  // Exclude tests from the typecheck (vitest covers them at runtime). The generated config's `include` uses
+  // parent-traversing paths (`../layers/…`), so the exclude globs must too — a bare `**/*.test.ts` won't match.
+  typescript: { tsConfig: { compilerOptions: { noUncheckedIndexedAccess: false }, exclude: ['../**/*.test.ts', '../../**/*.test.ts'] } },
+  // Explicit sub-layer composition so Kestrel works as an installable meta-layer (`extends: ['@michaelthielemann/kestrel']`):
+  // Nuxt does NOT transitively auto-scan an extended package's `layers/` dir, but it DOES follow its
+  // `extends` chain — so for a consumer this list is the ONLY thing that drives sub-layer order (core first).
+  // In-repo it is effectively inert: Nuxt also auto-scans the local `layers/` dir (resolved before the
+  // explicit `extends` and deduped by rootDir), and that auto-scan order is reverse-alphabetical — i.e.
+  // in-repo precedence is ui > public > media > fields > core > collections > auth > admin > access, NOT this order.
+  // The two contexts therefore differ; keep cross-layer basenames unique so the winner can't diverge.
+  extends: [
+    './layers/core',
+    './layers/fields',
+    './layers/ui',
+    './layers/media',
+    './layers/auth',
+    './layers/access',
+    './layers/collections',
+    './layers/admin',
+    './layers/public',
+  ],
+  // Prune `node_modules` (and the sibling `playground` app) from Nuxt's dev file-watcher. Nuxt's default
+  // `ignore` list does NOT include node_modules; when `@parcel/watcher` is unavailable Nuxt falls back to
+  // the granular chokidar watcher, whose recursively-spawned sub-watchers only apply `isIgnored` (not the
+  // `/node_modules/` guard the top watcher uses). Under chokidar 5 that walks the pnpm symlink farm in
+  // `node_modules/.pnpm` — including the `playground/node_modules/kestrel -> ..` cycle — unbounded, which
+  // pegs the event loop and OOMs `nuxt dev` a few minutes after boot. Ignoring node_modules here prunes it
+  // in every watcher mode (and benefits downstream consumers of this meta-layer, who'd hit the same bug).
+  // `/playground` is ANCHORED (leading slash) to this repo's own dev playground at the root — an unanchored
+  // `playground` is a gitignore-style any-depth match that would also exclude a downstream consumer's
+  // directory named `playground` from scanning. (`**/node_modules` independently prunes the OOM-causing farm.)
+  ignore: ['**/node_modules', '/playground'],
+  // `experimental.tasks` enables the `db:migrate` Nitro task — the explicit prod schema step (ADR-0002).
+  nitro: { externals: { external: ['better-sqlite3', 'sharp'] }, experimental: { tasks: true }, rollupConfig: { onwarn }, typescript: { tsConfig: { compilerOptions: { noUncheckedIndexedAccess: false } } } },
+  // Inline each prerendered page's critical CSS instead of a render-blocking <link> (the global CSS is
+  // small, so per-page inlining is cheap and removes a round-trip before first paint). SPA admin is
+  // ssr:false so it is unaffected. Explicit so the behaviour can't drift with a future Nuxt default.
+  features: { inlineStyles: true },
+  // NOTE: public pages ship the normal hydration runtime (`_nuxt`) — consumer projects build their own
+  // interactive Vue components, so a zero-JS (`noScripts`) default would break them. The runtime publisher
+  // depends on this too: `localFetch` only emits the `_nuxt` scripts + inline payload when noScripts is off.
+  // Single non-auth config source; the `kestrel` module (core layer) resolves it (config → KESTREL_* env
+  // → default) into runtimeConfig.media / runtimeConfig.public.locales + the /uploads static serving.
+  // `layerKestrelOption` contributes this file's values ONLY in-repo — when Kestrel is consumed as a
+  // dependency it yields `{}`, so Nuxt's array-concatenating layer merge can't leak the demo `locales`
+  // into a consumer (the consumer's own `kestrel: {}` is then the sole source).
+  kestrel: layerKestrelOption(kestrel, import.meta.url),
+  // Pre-bundle these so the dev server doesn't discover them at runtime and force a full reload.
+  vite: {
+    build: { rollupOptions: { onwarn } },
+    optimizeDeps: {
+      // Nested "kestrel > dep" form: Vite resolves each dep from the `kestrel` PACKAGE's directory
+      // rather than the (consumer) project root. Under pnpm these are kestrel's transitive deps and
+      // are NOT hoisted into a consumer's top-level node_modules, so a bare specifier is
+      // "Unresolvable" from the consumer root. In-repo `kestrel` is not a resolvable package name, so
+      // Vite's nestedResolveBasedir falls back to the repo root where these deps ARE hoisted — same
+      // result. The runtime `import('@tiptap/...')` still reuses the pre-bundle (tryOptimizedResolve
+      // matches the "> dep" id + src dir).
+      include: [
+        'kestrel > @internationalized/date',
+        'kestrel > @tiptap/extension-highlight',
+        'kestrel > @tiptap/extension-subscript',
+        'kestrel > @tiptap/extension-superscript',
+        'kestrel > @tiptap/extension-text-align',
+        'kestrel > @tiptap/starter-kit',
+        'kestrel > @tiptap/vue-3',
+        'kestrel > reka-ui',
+      ],
+    },
+  },
+})

package/package.json

@@ -0,0 +1,122 @@
+{
+  "name": "@michaelthielemann/kestrel",
+  "version": "1.2.1",
+  "description": "A slim, collection-driven Nuxt 4 CMS meta-layer with a runtime schema engine. Add `extends: ['@michaelthielemann/kestrel']`, define collections, and the database migrates itself.",
+  "license": "Apache-2.0",
+  "author": "Michael Thielemann <283621694+MichaelThielemann@users.noreply.github.com>",
+  "homepage": "https://github.com/MichaelThielemann/kestrel#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/MichaelThielemann/kestrel.git"
+  },
+  "bugs": "https://github.com/MichaelThielemann/kestrel/issues",
+  "keywords": [
+    "cms",
+    "nuxt",
+    "nuxt-layer",
+    "static-site-generator",
+    "drizzle",
+    "sqlite",
+    "headless-cms"
+  ],
+  "type": "module",
+  "main": "./nuxt.config.ts",
+  "packageManager": "pnpm@11.9.0",
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "//publish": "Consumed as a meta-layer: `extends: ['@michaelthielemann/kestrel']`. `main` points at the layer's nuxt.config so the BARE specifier resolves — without it c12 can't resolve the package, silently drops the whole layer (\"Cannot extend config from …\"), and every auto-import/component vanishes. Use `main`, NOT `exports` (exports would gate subpaths like `@michaelthielemann/kestrel/scripts/hash-password.mjs` + the deep config-type import). `files` ships the entry + sub-layers + operator scripts; the `!**/*.test.ts` globs strip tests. Releases run from the tag workflow via npm trusted publishing (OIDC), so no npm token exists anywhere.",
+  "files": [
+    "NOTICE",
+    "nuxt.config.ts",
+    "kestrel.config.ts",
+    "layers",
+    "scripts",
+    "!**/*.test.ts",
+    "!**/*.dom.test.ts",
+    "!**/*.nuxt.test.ts"
+  ],
+  "engines": {
+    "node": ">=22.12.0"
+  },
+  "scripts": {
+    "dev": "nuxt dev",
+    "build": "nuxt build",
+    "preview": "nuxt preview",
+    "generate": "nuxt generate",
+    "db:generate": "drizzle-kit generate",
+    "db:migrate": "drizzle-kit migrate",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:e2e": "vitest run --config vitest.e2e.config.ts",
+    "test:nuxt": "vitest run --config vitest.nuxt.config.ts",
+    "typecheck": "node scripts/typecheck.mjs",
+    "hash-password": "node scripts/hash-password.mjs"
+  },
+  "dependencies": {
+    "@babel/parser": "^7.28.0",
+    "@internationalized/date": "^3.12.2",
+    "@tiptap/extension-highlight": "^3.27.3",
+    "@tiptap/extension-subscript": "^3.27.3",
+    "@tiptap/extension-superscript": "^3.27.3",
+    "@tiptap/extension-text-align": "^3.27.3",
+    "@tiptap/pm": "^3.27.3",
+    "@tiptap/starter-kit": "^3.27.3",
+    "@tiptap/vue-3": "^3.27.3",
+    "aws4fetch": "^1.0.20",
+    "better-sqlite3": "^12.11.1",
+    "dompurify": "^3.4.12",
+    "drizzle-orm": "^0.45.2",
+    "drizzle-zod": "^0.8.3",
+    "file-type": "^22.0.1",
+    "jsdom": "^29.1.1",
+    "nanoid": "^5.1.16",
+    "nuxt": "^4.4.8",
+    "reka-ui": "^2.10.1",
+    "sanitize-html": "^2.17.5",
+    "sass": "^1.101.0",
+    "sharp": "^0.35.3",
+    "thumbhash": "^0.1.1",
+    "typescript": "^6.0.3",
+    "zod": "^4.4.3"
+  },
+  "//peers": "Framework singletons the layer sources import by bare specifier. Peers, not dependencies: a second copy breaks identity (two Vue instances; an h3 v1 `createError` handed to an h3 v2 error handler, which surfaces our 400/404/409 as bare 500s). All optional, because kestrel's own `nuxt` dependency already supplies them transitively — the entry pins identity where a copy exists rather than demanding one, and a required peer would ERESOLVE-fail npm installs on any Nuxt whose bundled range we did not anticipate. Each is also a devDependency so this repo resolves it without auto-install-peers writing a phantom root dependency into the lockfile.",
+  "peerDependencies": {
+    "@nuxt/kit": "^4.4.0",
+    "h3": "^1.15.0 || ^2.0.0",
+    "vue": "^3.5.0",
+    "vue-router": "^4.5.0 || ^5.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@nuxt/kit": {
+      "optional": true
+    },
+    "h3": {
+      "optional": true
+    },
+    "vue": {
+      "optional": true
+    },
+    "vue-router": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@nuxt/kit": "^4.4.8",
+    "@nuxt/test-utils": "^3.23.0",
+    "@types/better-sqlite3": "^7.6.13",
+    "@types/jsdom": "^28.0.3",
+    "@types/sanitize-html": "^2.16.1",
+    "@vitejs/plugin-vue": "^6.0.7",
+    "@vue/test-utils": "^2.4.11",
+    "drizzle-kit": "^0.31.10",
+    "h3": "^1.15.11",
+    "happy-dom": "^20.10.6",
+    "playwright-core": "^1.61.1",
+    "vitest": "^3.2.7",
+    "vue": "3.5.35",
+    "vue-router": "^5.1.0",
+    "vue-tsc": "^3.3.7"
+  }
+}

package/scripts/hash-password.mjs

@@ -0,0 +1,26 @@
+import { scryptSync, randomBytes } from 'node:crypto'
+import { createInterface } from 'node:readline'
+
+const N = 2 ** 17
+const r = 8
+const p = 1
+const KEYLEN = 64
+const MAXMEM = 256 * 1024 * 1024
+
+function make(password) {
+  const salt = randomBytes(16)
+  const hash = scryptSync(password, salt, KEYLEN, { N, r, p, maxmem: MAXMEM })
+  return `scrypt$${N}$${r}$${p}$${salt.toString('base64url')}$${hash.toString('base64url')}`
+}
+
+const arg = process.argv[2]
+if (arg) {
+  process.stdout.write(make(arg) + '\n')
+} else {
+  const rl = createInterface({ input: process.stdin, terminal: false })
+  process.stderr.write('Enter password, then press Enter:\n')
+  rl.on('line', (line) => {
+    process.stdout.write(make(line) + '\n')
+    rl.close()
+  })
+}

package/scripts/typecheck.mjs

@@ -0,0 +1,51 @@
+// Typecheck gate. vitest/esbuild and `nuxt build` do NOT typecheck, so real type errors slip through
+// every other gate — this is the one that catches them. It typechecks the PLAYGROUND, which composes
+// the engine layers + both galleries extensions + a real consumer app/server, so this single run covers
+// app, `.vue`, modules, config AND server code.
+//
+// Two passes, because Nuxt 4 splits the tsconfig by environment:
+//   1. `tsc` over the Nitro server project (the app aggregator EXCLUDES server dirs).
+//   2. `vue-tsc` (via `nuxt typecheck`) over the app/`.vue`/modules/config aggregator.
+// Both exclude `*.test.ts` (vitest covers those at runtime) via the nuxt.config `typescript.tsConfig.exclude`
+// and the derived server config below.
+import { execFileSync } from 'node:child_process'
+import { readFileSync, writeFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const root = join(dirname(fileURLToPath(import.meta.url)), '..')
+const playground = join(root, 'playground')
+const bin = (name) => join(root, 'node_modules', '.bin', name)
+const env = { ...process.env, CI: 'true', NUXT_TELEMETRY_DISABLED: '1' }
+
+// 1. (Re)generate the Nuxt/Nitro tsconfigs for the playground.
+execFileSync(bin('nuxt'), ['prepare'], { cwd: playground, stdio: 'inherit', env })
+
+// 2. Server (Nitro) project — derive a test-excluding config alongside the generated one so its relative
+//    include/paths still resolve.
+const generated = join(playground, '.nuxt', 'tsconfig.server.json')
+const cfg = JSON.parse(readFileSync(generated, 'utf8'))
+cfg.exclude = [...(cfg.exclude ?? []), '../../**/*.test.ts', '../**/*.test.ts']
+const gateConfig = join(playground, '.nuxt', 'tsconfig.typecheck.json')
+writeFileSync(gateConfig, JSON.stringify(cfg, null, 2))
+// Both passes always run, and the gate fails at the END: aborting on the first one hides every error of
+// the other, and the two cover disjoint file sets — a red server pass would report zero app errors.
+const failed = []
+function pass(label, cmd, args) {
+  console.log(`› typechecking ${label}…`)
+  try {
+    execFileSync(bin(cmd), args, { cwd: playground, stdio: 'inherit', env })
+  } catch {
+    failed.push(label)
+  }
+}
+
+pass('server (Nitro) project', 'tsc', ['--noEmit', '-p', gateConfig])
+// 3. App / `.vue` / modules / config — vue-tsc via `nuxt typecheck` (needs the committed root tsconfig.json).
+pass('app + .vue (vue-tsc)', 'nuxt', ['typecheck'])
+
+if (failed.length) {
+  console.error(`\n✗ typecheck failed: ${failed.join(', ')}`)
+  process.exit(1)
+}
+console.log('\n✓ typecheck passed (app + .vue + server; *.test.ts excluded)')