@michaelthielemann/kestrel 1.6.0 → 2.0.0

package/layers/admin/app/pages/admin/[collection]/publish-preview.nuxt.test.ts

@@ -0,0 +1,142 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest'
+import { useState } from '#imports'
+import { flushPromises } from '@vue/test-utils'
+import { readBody } from 'h3'
+import { mountSuspended, registerEndpoint, mockNuxtImport } from '@nuxt/test-utils/runtime'
+import RecordPage from './[id].vue'
+
+// A pageLike, status-bearing collection — the page-builder case the Save/Publish split is for.
+const pagesSchema = {
+  name: 'pages', mode: 'multi', translatable: false, pageLike: true, seo: false, status: true,
+  blocks: { enabled: false }, label: { singular: 'Page', plural: 'Pages' },
+  fields: { title: { type: 'text', required: true, translatable: false, unique: false } },
+}
+registerEndpoint('/api/collections', () => ({ data: [pagesSchema] }))
+
+const calls = vi.hoisted(() => ({
+  publishOnSave: false,
+  writes: [] as Record<string, unknown>[],
+  publishes: [] as Record<string, unknown>[],
+  tickets: [] as Record<string, unknown>[],
+}))
+
+registerEndpoint('/api/pages/1', async (event) => {
+  if (event.method === 'PATCH') {
+    const b = await readBody(event)
+    calls.writes.push(b)
+    return { id: 1, ...b, updatedAt: '2026-08-13T10:00:00.000Z' }
+  }
+  return { id: 1, title: 'Existing', path: '/existing', status: 'draft', updatedAt: '2026-08-13T09:00:00.000Z' }
+})
+registerEndpoint('/api/pages', () => ({ data: [], total: 0, page: 1, perPage: 25 }))
+registerEndpoint('/api/pages/1/dead-refs', () => [])
+registerEndpoint('/api/publish-status', () => ({ route: '/existing', status: 'success', pending: !calls.publishOnSave, generates: true, publishOnSave: calls.publishOnSave, updatedAt: '2026-08-13T09:30:00.000Z' }))
+registerEndpoint('/api/publish', async (event) => {
+  calls.publishes.push(await readBody(event))
+  return { queued: true, generates: true, routes: ['/existing'], pruned: [], drafts: [] }
+})
+registerEndpoint('/api/preview', async (event) => {
+  if (event.method === 'POST') {
+    calls.tickets.push(await readBody(event))
+    return { token: 'pv_abc', expiresAt: Date.now() + 600_000 }
+  }
+  return null
+})
+
+const h = vi.hoisted(() => ({ params: { collection: 'pages', id: '1' }, nav: [] as unknown[] }))
+mockNuxtImport('useRoute', () => () => ({ params: h.params, query: {}, fullPath: `/admin/${h.params.collection}/${h.params.id}` }))
+mockNuxtImport('navigateTo', () => (to: unknown) => { h.nav.push(to); return Promise.resolve() })
+
+let opened: Array<{ url: string }>
+let lastTab: { location: { replace: (url: string) => void }; close: () => void } | null
+
+beforeEach(() => {
+  h.params = { collection: 'pages', id: '1' }
+  h.nav.length = 0
+  calls.publishOnSave = false
+  calls.writes.length = 0
+  calls.publishes.length = 0
+  calls.tickets.length = 0
+  opened = []
+  lastTab = null
+  useState('kestrel-collections').value = null
+  useState('kestrel-blocks').value = null
+  vi.spyOn(window, 'open').mockImplementation(((url?: string) => {
+    // The real code opens a blank tab synchronously and redirects it once the ticket is minted.
+    if (url) { opened.push({ url }); return null }
+    lastTab = { location: { replace: (to: string) => opened.push({ url: to }) }, close: () => {} }
+    return lastTab as unknown as Window
+  }) as typeof window.open)
+})
+
+const settle = async () => {
+  await new Promise((r) => setTimeout(r, 20))
+  await flushPromises()
+}
+const button = (w: Awaited<ReturnType<typeof mountSuspended>>, label: string) =>
+  w.findAll('.ui-button').find((b) => b.text() === label)
+
+describe('record editor — Save and Publish are separate actions', () => {
+  it('offers Publish next to Save', async () => {
+    const w = await mountSuspended(RecordPage)
+    await flushPromises()
+    const labels = w.find('.record__actions').findAll('.ui-button').map((b) => b.text()).filter(Boolean)
+    expect(labels).toContain('Publish')
+    expect(labels.indexOf('Publish')).toBe(labels.indexOf('Save') + 1)
+  })
+
+  // `output.publishOnSave` is the way back to the pre-2.0 model, where a save republished on its own.
+  it('drops the Publish button when the consumer turned the split off', async () => {
+    calls.publishOnSave = true
+    const w = await mountSuspended(RecordPage)
+    await settle()
+    expect(w.find('.record__actions').findAll('.ui-button').map((b) => b.text())).not.toContain('Publish')
+  })
+
+  it('Save writes the record and asks for no publish at all', async () => {
+    const w = await mountSuspended(RecordPage)
+    await flushPromises()
+    await w.find('input[type="text"]').setValue('Edited')
+    // The header Save is a `type=submit` bound to the form by id — which only the real browser follows.
+    await w.find('form.editor').trigger('submit')
+    await settle()
+    expect(calls.writes).toHaveLength(1)
+    expect(calls.writes[0]).toMatchObject({ title: 'Edited', status: 'draft' }) // status untouched by a save
+    expect(calls.publishes).toEqual([])
+  })
+
+  it('Publish saves first, promotes the draft, and then writes the static output', async () => {
+    const w = await mountSuspended(RecordPage)
+    await flushPromises()
+    await w.find('input[type="text"]').setValue('Ready to go')
+    await button(w, 'Publish')!.trigger('click')
+    await settle()
+    expect(calls.writes[0]).toMatchObject({ title: 'Ready to go', status: 'published' })
+    expect(calls.publishes).toEqual([{ collection: 'pages', id: 1 }])
+  })
+})
+
+describe('record editor — previewing in a new tab', () => {
+  it('opens the saved URL directly when there is nothing unsaved', async () => {
+    const w = await mountSuspended(RecordPage)
+    await flushPromises()
+    const preview = w.findAll('.ui-button').find((b) => b.attributes('aria-label') === 'Open in new tab')!
+    await preview.trigger('click')
+    await settle()
+    expect(opened.map((o) => o.url)).toContain('/existing')
+    expect(calls.tickets).toEqual([])
+  })
+
+  it('mints a ticket for unsaved changes instead of saving them', async () => {
+    const w = await mountSuspended(RecordPage)
+    await flushPromises()
+    await w.find('input[type="text"]').setValue('Not saved')
+    await flushPromises()
+    const preview = w.findAll('.ui-button').find((b) => b.attributes('aria-label') === 'Preview unsaved changes in a new tab')!
+    await preview.trigger('click')
+    await settle()
+    expect(calls.writes).toEqual([]) // the whole point: no save
+    expect(calls.tickets[0]).toMatchObject({ collection: 'pages', id: 1, values: { title: 'Not saved' } })
+    expect(opened.at(-1)!.url).toBe('/existing?kestrel-preview-token=pv_abc')
+  })
+})

package/layers/admin/app/utils/editor-expose.ts

@@ -23,4 +23,12 @@ export interface EditorExpose {
   live: PublishStatusData | null
   /** The record's own title (see `recordTitle`), or `''` — the header then shows "Edit {collection} #{id}". */
   recordTitle: string
+  /** Save, then write the static output (ADR-0008) — a draft is promoted to published on the way. */
+  publish: () => Promise<void>
+  publishing: boolean
+  /** False when `output.publishOnSave` is on — a save republishes, so the hosts hide the Publish button. */
+  canPublish: boolean
+  /** Open the record in a new tab: the saved URL, or the unsaved state carried by a preview ticket. */
+  openPreview: () => Promise<void>
+  previewOpening: boolean
 }

package/layers/collections/server/plugins/02.register-relation-populate.ts

@@ -8,10 +8,13 @@ import { getOne } from '../../../core/server/utils/crud'
 // stale/deleted id (getOne 404 → null via `skipMissing`, other errors propagate — fail-loud), and runs at
 // `depth - 1`, so `populateRow` bails at 0 and cycles terminate. Registered per-type; the shared field-tree
 // walker (fields layer) dispatches it.
+// The reachability predicate is the registry-driven public set, NOT the guard's full decision — the guard
+// also folds in `registeredGrants()`, which this omits. So a collection opened to anonymous by a registered
+// grant is served on its own route but stays unexpanded here: fail-closed drift, never a widening.
 export default defineNitroPlugin(() => {
-  registerFieldPopulator('relation', buildRelationFieldPopulator((collection, id, depth, locale) => {
+  registerFieldPopulator('relation', buildRelationFieldPopulator((collection, id, depth, locale, publicOnly) => {
     const built = getCollection(collection)
     if (!built) return null
-    return skipMissing(() => getOne(useDb(), built, id, depth, locale, true) as Record<string, unknown>)
-  }))
+    return skipMissing(() => getOne(useDb(), built, id, depth, locale, true, publicOnly) as Record<string, unknown>)
+  }, (collection) => isPubliclyReadable(collection, publicReadableResources())))
 })

package/layers/collections/server/utils/populate-relations.ts

@@ -11,6 +11,7 @@ export type ResolveRecord = (
   id: number,
   depth: number,
   locale: string,
+  publicOnly: boolean,
 ) => Record<string, unknown> | null
 
 /**
@@ -36,31 +37,43 @@ export function skipMissing(fetch: () => Record<string, unknown>): Record<string
  * fails the whole read. The related read passes `ctx.depth - 1`; `populateRow` bails at depth 0, so a
  * relation cycle terminates. Registered per-type via `registerFieldPopulator('relation', …)`; the shared
  * field-tree walker drives it over top-level fields, block props, slots, and repeater entries.
+ *
+ * Under `ctx.publicOnly` a relation into a collection `isPublicCollection` rejects is left unexpanded
+ * (raw id only, NO `$<name>` sibling at all — a relation field targets exactly one collection, so a
+ * `many` relation is all-or-nothing): expansion must not reach a record the caller could not have
+ * requested directly. The check runs BEFORE `resolve`, so a withheld target never enters the memo.
  */
-export function buildRelationFieldPopulator(resolveRecord: ResolveRecord): FieldPopulator {
-  // The same target (collection+id+depth+locale) is resolved once — build-wide during a generate run
+export function buildRelationFieldPopulator(
+  resolveRecord: ResolveRecord,
+  isPublicCollection: (collection: string) => boolean,
+): FieldPopulator {
+  // The same target (collection+id+depth+locale+scope) is resolved once — build-wide during a generate run
   // (memoDuringPrerender), request-/publish-run-wide via the resolve scope (which also budgets the
   // distinct fan-out of one live request and replays read-tags on hits, so publish deps stay complete).
   // memoResolver OUTERMOST: the per-scope budget verdict must stay scope-local. If memoDuringPrerender
   // wrapped memoResolver, a build-wide memoize would cache a budget-skip `null` and poison every later
   // page of a `nuxt generate`. With this order the build-wide memo only ever caches REAL resolver results.
-  const key = (collection: string, id: number, depth: number, locale: string) => `rel:${collection}:${id}:${depth}:${locale}`
+  // `publicOnly` is part of the key because the same record populates DIFFERENTLY under it (its own
+  // non-public relations are withheld) — sharing one entry would serve one scope's record to the other.
+  const key = (collection: string, id: number, depth: number, locale: string, publicOnly: boolean) => `rel:${collection}:${id}:${depth}:${locale}:${publicOnly}`
   const resolve = memoResolver(memoDuringPrerender(resolveRecord, key), key)
   return (bag, key, field, ctx, keyMode) => {
     if (!fieldIs(field, 'relation')) return
     const collection = field.relation.collection
+    const publicOnly = ctx.publicOnly === true
+    if (publicOnly && !isPublicCollection(collection)) return
     const depth = ctx.depth - 1
     if (field.relation.many) {
       const ids = bag[key]
       if (Array.isArray(ids)) {
         bag['$' + key] = ids
           .filter((n): n is number => typeof n === 'number')
-          .map((id) => resolve(collection, id, depth, ctx.locale))
+          .map((id) => resolve(collection, id, depth, ctx.locale, publicOnly))
           .filter((r): r is Record<string, unknown> => r != null)
       }
     } else {
       const id = bag[keyMode === 'columns' ? `${key}Id` : key]
-      if (typeof id === 'number') bag['$' + key] = resolve(collection, id, depth, ctx.locale)
+      if (typeof id === 'number') bag['$' + key] = resolve(collection, id, depth, ctx.locale, publicOnly)
     }
   }
 }

package/layers/core/modules/auto-discovery/extract-block.ts

@@ -100,7 +100,9 @@ function evalObjectExpr(content: string, node: Node, scope: Record<string, unkno
   const src = content.slice(node.start, node.end)
   const names = Object.keys(scope)
   try {
-    // eslint-disable-next-line @typescript-eslint/no-implied-eval, no-new-func
+    // `src` is a slice of the CONSUMER's own block-SFC source, evaluated once here at build/discovery time
+    // to recover the object literal's runtime shape — never attacker- or request-supplied, so this is not
+    // an eval-injection surface.
     const fn = new Function(...names, `return (${src})`)
     const out = fn(...names.map((k) => scope[k]))
     if (!out || typeof out !== 'object') throw new Error('expected an object literal')
@@ -109,6 +111,7 @@ function evalObjectExpr(content: string, node: Node, scope: Record<string, unkno
     throw new Error(
       `${where}: could not evaluate the block declaration. Field/block args must be self-contained literals + ` +
         `field-factory calls (no imported constants, computed values, or TS type-args). Cause: ${(e as Error).message}`,
+      { cause: e },
     )
   }
 }
@@ -126,7 +129,7 @@ export function extractBlockDef(sfcSource: string, fileBase: string): ExtractedB
   try {
     ast = parse(content, { sourceType: 'module', plugins: ['typescript'] })
   } catch (e) {
-    throw new Error(`${fileBase}: could not parse <script setup> — ${(e as Error).message}`)
+    throw new Error(`${fileBase}: could not parse <script setup> — ${(e as Error).message}`, { cause: e })
   }
 
   const props = macroCall(ast, 'defineProps')

package/layers/core/modules/kestrel/index.ts

@@ -74,6 +74,7 @@ export default defineNuxtModule<KestrelConfig>({
       dir: c.output.dir,
       publicDir: c.output.publicDir,
       auto: c.output.auto,
+      publishOnSave: c.output.publishOnSave,
       reconcileMinutes: c.output.reconcileMinutes,
       verbose: c.output.verbose,
       s3: {

package/layers/core/server/api/[collection]/[id].get.ts

@@ -4,5 +4,8 @@ export default defineEventHandler((event) => {
   const depth = Number(query.depth ?? 0)
   const locale = query.locale as string | undefined
   const publishedOnly = publishedOnlyForScope(event.context.readScope)
-  return getOne(useDb(), collection, requireId(event), depth, locale, publishedOnly)
+  // See index.get.ts: the public-set restriction follows the ROLE, so the renderer keeps full population;
+  // a missing principal fails closed onto it.
+  const publicOnly = (event.context.principal?.role ?? 'anonymous') === 'anonymous'
+  return getOne(useDb(), collection, requireId(event), depth, locale, publishedOnly, publicOnly)
 })

package/layers/core/server/api/[collection]/index.get.ts

@@ -3,9 +3,14 @@ export default defineEventHandler((event) => {
   const query = getQuery(event)
   const db = useDb()
   const publishedOnly = publishedOnlyForScope(event.context.readScope)
+  // Keyed on the ROLE, not the read scope: the renderer reads published-only too, but it produces the
+  // static site and must still see every relation the output embeds. Only a visitor the guard scopes to
+  // the public collection set is barred from reaching further through a populated relation. Fail-CLOSED
+  // on a missing principal, like `publishedOnlyForScope` above — an absent one is a guard regression.
+  const publicOnly = (event.context.principal?.role ?? 'anonymous') === 'anonymous'
 
   if (collection.def.mode === 'single') {
-    return getSingleton(db, collection, query.locale as string | undefined, publishedOnly, query.depth ? Number(query.depth) : 0)
+    return getSingleton(db, collection, query.locale as string | undefined, publishedOnly, query.depth ? Number(query.depth) : 0, publicOnly)
   }
 
   return list(db, collection, {
@@ -15,5 +20,5 @@ export default defineEventHandler((event) => {
     perPage: query.perPage ? Number(query.perPage) : undefined,
     filter: parseFilter(query as Record<string, unknown>),
     depth: query.depth ? Number(query.depth) : 0,
-  }, publishedOnly)
+  }, publishedOnly, publicOnly)
 })

package/layers/core/server/api/[collection]/populate-scope.test.ts

@@ -0,0 +1,119 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import { createError } from 'h3'
+import Database from 'better-sqlite3'
+import { drizzle } from 'drizzle-orm/better-sqlite3'
+import { buildCollection } from '../../../../fields/server/utils/buildCollection'
+import { defineCollection } from '../../utils/defineCollection'
+import { create, getOne, getSingleton, list, parseFilter, putSingleton } from '../../utils/crud'
+import { requireCollection, requireId } from '../../utils/http'
+import { clearRegistry, registerCollection } from '../../utils/registry'
+import { clearPopulator, registerPopulator, type PopulateCtx } from '../../utils/populate'
+import { desiredSchema } from '../../schema/desired'
+import { diffSchema } from '../../schema/diff'
+import { renderSqlite } from '../../schema/render-sqlite'
+
+const posts = buildCollection(defineCollection({
+  name: 'posts', mode: 'multi', translatable: false,
+  fields: { title: { type: 'text', required: true } },
+}))
+const settings = buildCollection(defineCollection({
+  name: 'settings', mode: 'single', translatable: false,
+  fields: { siteName: { type: 'text' } },
+}))
+
+interface FakeEvent {
+  query: Record<string, unknown>
+  context: { params: Record<string, string>; readScope?: string; principal?: { userId: string | null; role: string } }
+}
+
+let db: ReturnType<typeof drizzle>
+const seen: PopulateCtx[] = []
+
+// The handlers are Nitro routes: their auto-imported helpers are plain globals in a node test. Every read
+// entry point is the REAL one, so this exercises the actual crud → populate threading.
+Object.assign(globalThis, {
+  defineEventHandler: (handler: unknown) => handler,
+  createError,
+  getQuery: (event: FakeEvent) => event.query,
+  useDb: () => db,
+  requireCollection,
+  requireId,
+  list,
+  getOne,
+  getSingleton,
+  parseFilter,
+  // Published-only for EVERY role, so a flag that tracked the read scope instead of the role would be
+  // indistinguishable here — the renderer/admin cases below would then fail.
+  publishedOnlyForScope: () => true,
+})
+
+const listHandler = (await import('./index.get')).default as unknown as (event: FakeEvent) => unknown
+const detailHandler = (await import('./[id].get')).default as unknown as (event: FakeEvent) => unknown
+
+let postId: number
+
+beforeEach(() => {
+  clearRegistry()
+  clearPopulator()
+  seen.length = 0
+  const sqlite = new Database(':memory:')
+  for (const stmt of renderSqlite(diffSchema(desiredSchema([posts.table, settings.table]), {}))) sqlite.exec(stmt)
+  db = drizzle(sqlite)
+  registerCollection(posts)
+  registerCollection(settings)
+  postId = (create(db, posts, { title: 'A' }) as Record<string, unknown>).id as number
+  putSingleton(db, settings, undefined, { siteName: 'Kestrel' })
+  registerPopulator((row, ctx) => { seen.push(ctx); return row })
+})
+afterEach(() => {
+  clearRegistry()
+  clearPopulator()
+})
+
+const eventFor = (collection: string, role: string | undefined, params: Record<string, string> = {}): FakeEvent => ({
+  query: { depth: 1 },
+  context: {
+    params: { collection, ...params },
+    readScope: 'published',
+    principal: role ? { userId: null, role } : undefined,
+  },
+})
+
+describe('read routes — public-only populate scope', () => {
+  it('marks an anonymous list read public-only', () => {
+    listHandler(eventFor('posts', 'anonymous'))
+    expect(seen[0]?.publicOnly).toBe(true)
+  })
+
+  it('marks an anonymous detail read public-only', () => {
+    detailHandler(eventFor('posts', 'anonymous', { id: String(postId) }))
+    expect(seen[0]?.publicOnly).toBe(true)
+  })
+
+  it('marks an anonymous singleton read public-only', () => {
+    listHandler(eventFor('settings', 'anonymous'))
+    expect(seen[0]?.publicOnly).toBe(true)
+  })
+
+  // The renderer produces the static site: stripping its relation sidecars would silently empty the
+  // generated HTML, so its read stays unrestricted even though it too is published-only.
+  it('leaves a renderer read unrestricted', () => {
+    listHandler(eventFor('posts', 'renderer'))
+    detailHandler(eventFor('posts', 'renderer', { id: String(postId) }))
+    expect(seen.map((c) => c.publicOnly)).toEqual([false, false])
+  })
+
+  it('leaves an admin read unrestricted', () => {
+    listHandler(eventFor('posts', 'admin'))
+    detailHandler(eventFor('posts', 'admin', { id: String(postId) }))
+    expect(seen.map((c) => c.publicOnly)).toEqual([false, false])
+  })
+
+  // A principal-less request is a guard regression, never a trusted caller — it must fail the same
+  // direction as the `publishedOnly` flag the handler derives beside it.
+  it('treats a missing principal as public-only', () => {
+    listHandler(eventFor('posts', undefined))
+    detailHandler(eventFor('posts', undefined, { id: String(postId) }))
+    expect(seen.map((c) => c.publicOnly)).toEqual([true, true])
+  })
+})

package/layers/core/server/api/references/broken.get.ts

@@ -1,3 +1,9 @@
 // Every reference in the index whose target is currently deleted or unpublished — the global broken-
 // references report. Admin-only (the `references` resource is not in the public set). Derived on read.
-export default defineEventHandler(() => findBrokenRefs(useDb()) ?? [])
+// A `null` scan means the index itself could not be read (e.g. record_refs not migrated yet); answering
+// `[]` there would report a verified-clean site when nothing was actually checked.
+export default defineEventHandler(() => {
+  const rows = findBrokenRefs(useDb())
+  if (rows === null) throw createError({ statusCode: 503, statusMessage: 'Reference index unavailable' })
+  return rows
+})

package/layers/core/server/schema/dialect.ts

@@ -7,9 +7,11 @@ import { renderSqlite } from './render-sqlite'
 // `SchemaOp[]` over the normalized model, independent of any database. A `Dialect` is what binds that
 // core to a concrete backend — it knows how to read the backend's live schema back into the model
 // (`introspect`), how to turn ops into the backend's DDL (`render`), and how to quote an identifier.
-// `sync.ts` is threaded with a Dialect (defaulting to `sqlite`), so adding a second backend means writing
-// one new Dialect — not touching diff/sync. SQLite is the only implementation today; `postgres` is a
-// reserved, fail-loud slot.
+// `sync.ts` is threaded with a Dialect (defaulting to `sqlite`), so DDL rendering, introspection and
+// identifier quoting are swappable without touching the diff. The seam stops there: `diff.ts` emits
+// `rebuild_table` because SQLite has no ALTER/DROP COLUMN, and sync's pre-flight feasibility probes are
+// SQLite SQL (`PRAGMA table_info`, `json_extract`) — a second backend needs both adjusted alongside its
+// new Dialect. SQLite is the only implementation today; `postgres` is a reserved, fail-loud slot.
 export interface Dialect {
   /** Stable identifier, e.g. `sqlite` | `postgres`. */
   readonly name: string

package/layers/core/server/schema/introspect.ts

@@ -1,8 +1,9 @@
-import type { ColumnShape, IndexShape, TableShape, SchemaSnapshot } from './model'
+import type { ColumnShape, IndexShape, SchemaSnapshot } from './model'
 
 // Read the *actual* schema of a live SQLite database into the normalized model, so `diffSchema` can
-// compare it against the desired schema (ADR-0002). Typed structurally (prepare + pragma) so it accepts
-// any better-sqlite3 connection without importing the native module here.
+// compare it against the desired schema (ADR-0002). Typed structurally (prepare + pragma) to keep the
+// native module out of this file — but the shape is narrower than better-sqlite3's own (which types
+// `pragma` as returning `unknown`), so a real connection only reaches these entry points through a cast.
 
 interface Row { [key: string]: unknown }
 export interface IntrospectDb {

package/layers/core/server/schema/sync.ts

@@ -1,4 +1,4 @@
-import { type IntrospectDb } from './introspect'
+import type { IntrospectDb } from './introspect'
 import { diffSchema } from './diff'
 import { sqlite, type Dialect } from './dialect'
 import type { SchemaSnapshot, SchemaOp } from './model'

package/layers/core/server/utils/crud.ts

@@ -123,7 +123,7 @@ function filterKindMap(c: BuiltCollection): Record<string, FilterKind> {
   return map
 }
 
-export function list(db: DB, c: BuiltCollection, q: ListQuery, publishedOnly = false) {
+export function list(db: DB, c: BuiltCollection, q: ListQuery, publishedOnly = false, publicOnly = false) {
   const cols = columns(c)
   // A listing depends on the whole collection (any add/remove/edit changes it) — tag it collection-level.
   if (q.capture !== false) captureRead(c.def.name)
@@ -187,7 +187,7 @@ export function list(db: DB, c: BuiltCollection, q: ListQuery, publishedOnly = f
   // fan-out is budgeted — an anonymous `?depth=10&perPage=500` read can no longer multiply into an
   // unbounded number of synchronous DB reads (each blocks the single event-loop thread).
   const data = withResolveScope(
-    () => rawData.map((r) => populateRow(r as Record<string, unknown>, { depth, locale: populateLocale, def: c.def })),
+    () => rawData.map((r) => populateRow(r as Record<string, unknown>, { depth, locale: populateLocale, def: c.def, publicOnly })),
     resolveBudgetFor(perPage), // scale the ceiling with the page size so a full legitimate page always populates
     `list ${c.def.name}`,
   ) as Row[]
@@ -258,7 +258,7 @@ function attachTranslationStatus(db: DB, c: BuiltCollection, rows: Row[], publis
   }
 }
 
-export function getOne(db: DB, c: BuiltCollection, id: number, depth = 0, locale?: string, publishedOnly = false): Row {
+export function getOne(db: DB, c: BuiltCollection, id: number, depth = 0, locale?: string, publishedOnly = false, publicOnly = false): Row {
   captureRead(c.def.name, id) // a detail read depends on exactly this record
   const cols = columns(c)
   const row = db.select().from(table(c)).where(eq(cols.id, id)).get() as Row | undefined
@@ -270,7 +270,7 @@ export function getOne(db: DB, c: BuiltCollection, id: number, depth = 0, locale
   const loc = c.def.translatable ? resolveLocale(locale) : primaryLocale()
   // Nested reads (the relation populator's recursive getOne) reuse the enclosing request's scope.
   return withResolveScope(
-    () => populateRow(row as Record<string, unknown>, { depth: safeDepth, locale: loc, def: c.def }),
+    () => populateRow(row as Record<string, unknown>, { depth: safeDepth, locale: loc, def: c.def, publicOnly }),
     resolveBudgetFor(1),
     `get ${c.def.name}:${id}`,
   ) as Row
@@ -465,10 +465,11 @@ export function removeMany(db: DB, c: BuiltCollection, ids: number[]): { count:
 }
 
 /**
- * Publish / unpublish a batch of rows by persisting their `status` — NOT a separate publish path. Writing
- * `status` and emitting the SAME write event the editor save emits IS the publish: classifyWrite →
- * planInvalidation → the publish queue coalesces N emits into one incremental publish (PUBLISH renders the
- * self route, UNPUBLISH prunes the old route). ALL-OR-NOTHING like `removeMany` (a missing id 404s before
+ * Publish / unpublish a batch of rows by persisting their `status` — the record's public INTENT, not the
+ * static file. Since ADR-0008 those are two steps: this write emits the same event an editor save emits,
+ * and the public layer's listener acts on the removal half only (UNPUBLISH prunes the route at once, so a
+ * page taken offline can never stay live). Making a page appear is the explicit publish action
+ * (`POST /api/publish`). ALL-OR-NOTHING like `removeMany` (a missing id 404s before
  * any write). Validation (`assertConditions`) runs on PUBLISH ONLY — unpublishing must never be blockable
  * (you must always be able to take a broken page offline). Omits `update()`'s slug/transform branches,
  * which are provably inert for a status-only change.
@@ -516,7 +517,7 @@ export function resolveTranslations(db: DB, c: BuiltCollection, id: number): Rec
   return result
 }
 
-export function getSingleton(db: DB, c: BuiltCollection, locale?: string, publishedOnly = false, depth = 0): Row | null {
+export function getSingleton(db: DB, c: BuiltCollection, locale?: string, publishedOnly = false, depth = 0, publicOnly = false): Row | null {
   captureRead(c.def.name) // a singleton (nav/settings/footer) is global — any page that reads it depends on it
   const cols = columns(c)
   const loc = c.def.translatable ? resolveLocale(locale) : primaryLocale()
@@ -527,7 +528,7 @@ export function getSingleton(db: DB, c: BuiltCollection, locale?: string, publis
   // Populate like list()/getOne() so a singleton's media/relation/link fields resolve at depth > 0 — the
   // canonical settings-singleton (site logo, nav link repeater) relies on this exactly as any collection does.
   return withResolveScope(
-    () => populateRow(row as Record<string, unknown>, { depth: clampDepth(depth), locale: loc, def: c.def }),
+    () => populateRow(row as Record<string, unknown>, { depth: clampDepth(depth), locale: loc, def: c.def, publicOnly }),
     resolveBudgetFor(1),
     `singleton ${c.def.name}`,
   ) as Row

package/layers/core/server/utils/kestrel-config.ts

@@ -6,7 +6,8 @@ import { resolve } from 'node:path'
 /**
  * Non-secret S3 settings (used when `media.driver === 's3'`). The access-key id and secret are
  * deliberately **absent** here — they are env-only (`KESTREL_S3_ACCESS_KEY_ID` /
- * `KESTREL_S3_SECRET_ACCESS_KEY`), read at driver construction, never in committed config.
+ * `KESTREL_S3_SECRET_ACCESS_KEY`), read at module setup — unconditionally, whatever the driver — and
+ * frozen into `runtimeConfig`, never in committed config.
  */
 export interface KestrelS3Config {
   /** Target bucket name. */
@@ -122,8 +123,12 @@ export interface KestrelConfig {
     publicDir?: string
     /** Auto-publish affected pages on every content write (default true). */
     auto?: boolean
-    /** Run a FULL reconcile every N minutes (default 0 = off) — self-heals missed invalidations and
-     *  picks up time-based `publishDate` publishing that no write event would trigger. */
+    /** Opt out of the save/publish split (ADR-0008): `true` makes every content write republish the pages
+     *  it affects, as before 2.0 — the editor's Publish button then has nothing left to do and is hidden.
+     *  Default false: saving writes the DB, publishing writes the static files.
+     *  Env `KESTREL_OUTPUT_PUBLISH_ON_SAVE`. */
+    publishOnSave?: boolean
+    /** Run a FULL reconcile every N minutes (default 0 = off) — self-heals a missed invalidation. */
     reconcileMinutes?: number
     /** Verbose publish logging: emit a timestamped per-route line (rendered / pruned) on each incremental
      *  republish, on top of the summary line. Default false (`KESTREL_OUTPUT_VERBOSE`). */
@@ -158,6 +163,7 @@ export interface ResolvedKestrel {
     dir: string
     publicDir: string
     auto: boolean
+    publishOnSave: boolean
     reconcileMinutes: number
     verbose: boolean
     s3: ResolvedS3Settings
@@ -394,6 +400,7 @@ export function resolveKestrel(config: KestrelConfig | undefined, env: Env, root
     dir: resolveMaybe(rootDir, clean(env.KESTREL_OUTPUT_DIR) ?? clean(o.dir) ?? '.data/published'),
     publicDir: resolveMaybe(rootDir, clean(env.KESTREL_OUTPUT_PUBLIC_DIR) ?? clean(o.publicDir) ?? '.output/public'),
     auto: envBool(env.KESTREL_OUTPUT_AUTO, o.auto ?? true),
+    publishOnSave: envBool(env.KESTREL_OUTPUT_PUBLISH_ON_SAVE, o.publishOnSave ?? false),
     reconcileMinutes: resolveNonNegInt(o.reconcileMinutes, env.KESTREL_OUTPUT_RECONCILE_MINUTES),
     verbose: envBool(env.KESTREL_OUTPUT_VERBOSE, o.verbose ?? false),
     s3: resolveS3Settings(o.s3, env, 'KESTREL_OUTPUT_S3'),

package/layers/core/server/utils/populate.ts

@@ -1,6 +1,8 @@
 import type { CollectionDef, FieldDef } from './defineCollection'
 
-export interface PopulateCtx { depth: number; locale: string; def: CollectionDef }
+/** `publicOnly`: the read is served to a principal that may only reach the public collection set, so a
+ *  populator must not expand a reference into a collection the guard would have refused it directly. */
+export interface PopulateCtx { depth: number; locale: string; def: CollectionDef; publicOnly?: boolean }
 export type Populator = (row: Record<string, unknown>, ctx: PopulateCtx) => Record<string, unknown>
 
 // A composed list: each registered populator runs in turn over the row (e.g. media attaches `$media`,

package/layers/fields/server/field-registry/index.ts

@@ -161,6 +161,7 @@ export const fieldTypes: Record<string, FieldTypeDescriptor> = {
             type: z.literal('external'),
             // http(s) only, no control chars, no embedded credentials — the value ends up in a static <a href>.
             url: z.string().trim().pipe(z.url({ protocol: /^https?$/ })).refine((v) => {
+              // eslint-disable-next-line no-control-regex -- deliberately rejects control characters embedded in a URL destined for a static <a href>
               if (/[\u0000-\u001f]/.test(v)) return false
               const u = new URL(v)
               return !u.username && !u.password
@@ -168,7 +169,7 @@ export const fieldTypes: Record<string, FieldTypeDescriptor> = {
             label,
           }),
           z.object({ type: z.literal('email'), email: z.string().trim().pipe(z.email()), label }),
-          z.object({ type: z.literal('tel'), tel: z.string().trim().min(1).regex(/^[+0-9 ()\-.\/]+$/).refine((v) => /[0-9]/.test(v), 'Tel must contain at least one digit'), label }),
+          z.object({ type: z.literal('tel'), tel: z.string().trim().min(1).regex(/^[+0-9 ()\-./]+$/).refine((v) => /[0-9]/.test(v), 'Tel must contain at least one digit'), label }),
         ]),
         f,
       )