@michaelthielemann/kestrel 1.6.0 → 2.0.0

package/layers/public/server/utils/publish/pending.ts

@@ -0,0 +1,74 @@
+/**
+ * "Saved but not published": the state a deferred-publish model needs to name. Saving writes the DB,
+ * publishing writes the static file, so the two stamps drift apart on purpose — a record edited after its
+ * page was last published keeps serving the published version until someone publishes again.
+ *
+ * The tolerance is not cosmetic: `publish_status.updated_at` is stored in whole seconds while a record's
+ * `updatedAt` is milliseconds, so the publish that directly followed a save can carry a stamp up to a
+ * second BEHIND it. Without the slack every freshly published page would report unpublished changes.
+ */
+const TOLERANCE_MS = 1000
+
+export function hasPendingChanges(savedAtMs: number | null | undefined, publishedAtMs: number | null | undefined, toleranceMs = TOLERANCE_MS): boolean {
+  // Never published (no status row) → nothing to protect: there is no older artifact this edit could
+  // overtake, so the route is a normal render candidate, not a pending change.
+  if (savedAtMs == null || publishedAtMs == null) return false
+  return savedAtMs > publishedAtMs + toleranceMs
+}
+
+/** The subset of `savedAt` routes whose record moved on after the route's last publish. Pure. */
+export function pendingRoutes(savedAt: Map<string, number>, publishedAt: Map<string, number>): string[] {
+  const out: string[] = []
+  for (const [route, saved] of savedAt) {
+    if (hasPendingChanges(saved, publishedAt.get(route) ?? null)) out.push(route)
+  }
+  return out
+}
+
+export interface HeldRoutes {
+  /** Routes to leave un-rendered: their record is serving an older published version somewhere. */
+  hold: Set<string>
+  /** Previously-published routes that are still the live artifact of a held record — never prune these. */
+  keep: Set<string>
+}
+
+/**
+ * Withholding by RECORD rather than by route string, which is what a rename needs. `pendingRoutes` compares
+ * a route against its own publish stamp, so a renamed record — whose new route has no stamp at all — falls
+ * through the "never published, nothing to protect" carve-out: the unpublished rename gets rendered and the
+ * old route, still the live one, is left looking abandoned to the prune. The carve-out is about a FIRST
+ * deploy having no older version; a rename has one, at the previous route.
+ *
+ * So a record's prior published routes are consulted too: if the record has moved on since the newest of
+ * them, the new route is held back and those prior routes are protected from the prune. A record with no
+ * prior published route keeps the carve-out — otherwise a first deploy would produce an empty site.
+ *
+ * Pure: `routesForTag` is the deps index's lookup, passed in.
+ */
+export function heldRoutes(
+  savedAt: Map<string, number>,
+  publishedAt: Map<string, number>,
+  recordTag: Map<string, string>,
+  routesForTag: (tag: string) => Iterable<string>,
+  toleranceMs = TOLERANCE_MS,
+): HeldRoutes {
+  const hold = new Set<string>()
+  const keep = new Set<string>()
+  for (const [route, saved] of savedAt) {
+    const own = publishedAt.get(route) ?? null
+    if (own != null) {
+      if (hasPendingChanges(saved, own, toleranceMs)) hold.add(route)
+      continue
+    }
+    // No stamp of its own: either genuinely never published, or published under a previous route.
+    const tag = recordTag.get(route)
+    if (!tag) continue
+    const priors = [...routesForTag(tag)].filter((r) => r !== route && publishedAt.has(r))
+    if (!priors.length) continue // first publish of this record — nothing to protect
+    const newest = Math.max(...priors.map((r) => publishedAt.get(r)!))
+    if (!hasPendingChanges(saved, newest, toleranceMs)) continue
+    hold.add(route)
+    for (const prior of priors) keep.add(prior)
+  }
+  return { hold, keep }
+}

package/layers/public/server/utils/publish/publish-runtime.ts

@@ -0,0 +1,28 @@
+import type { PublishQueue } from './queue'
+import type { DepsStore } from './deps'
+
+/**
+ * The process-wide handle on the running publish machinery. The `zz.publish` Nitro plugin owns the queue
+ * and the deps index (it builds the output driver and does the logging), but the explicit publish action —
+ * `POST /api/publish` — has to reach both from inside a request: the queue to enqueue the run, the deps
+ * index to find the routes this record was baked into. Mirrors core's `write-events` registry: module
+ * state, set once at boot.
+ *
+ * `null` wherever the runtime publisher does not run at all (dev, or `output.auto` off). That is not an
+ * error — it is what the endpoint reports back so the editor can say "nothing is generated here" instead
+ * of pretending a publish happened.
+ */
+export interface PublishRuntime {
+  queue: PublishQueue
+  deps: DepsStore
+}
+
+let runtime: PublishRuntime | null = null
+
+export function setPublishRuntime(next: PublishRuntime | null): void {
+  runtime = next
+}
+
+export function usePublishRuntime(): PublishRuntime | null {
+  return runtime
+}

package/layers/public/server/utils/publish/publish-status.ts

@@ -43,6 +43,24 @@ export function renderOutcome(status: number, hasBody: boolean): 'success' | 'er
   return 'skip'
 }
 
+/**
+ * Every route's last successful-or-failed publish time, in ms — the "last published" half of the
+ * saved-vs-published comparison a deferred publish needs. Same missing-table resilience as the writers:
+ * an unmigrated deploy yields an empty map, which reads as "nothing was ever published here" and so
+ * holds nothing back.
+ */
+export function lastPublishedAt(db: BetterSQLite3Database): Map<string, number> {
+  const out = new Map<string, number>()
+  try {
+    for (const row of db.select({ route: publishStatus.route, updatedAt: publishStatus.updatedAt }).from(publishStatus).all()) {
+      if (row.updatedAt instanceof Date) out.set(row.route, row.updatedAt.getTime())
+    }
+  } catch (error) {
+    console.warn('[kestrel] could not read publish status:', (error as Error).message)
+  }
+  return out
+}
+
 /** Clear a route's status row — its static file was pruned (unpublish / delete / slug change), so it is no
  *  longer live. Idempotent; same missing-table resilience as `recordPublishStatus`. */
 export function clearPublishStatus(db: BetterSQLite3Database, route: string): void {

package/layers/public/server/utils/publish/publisher.ts

@@ -12,8 +12,9 @@ import { withResolveScope } from '../../../../core/server/utils/resolve-scope'
 import { runAsRenderer } from '../../../../access/server/utils/render-context'
 import { htmlKeyForRoute } from './route-keys'
 import { staleRoutes, type DepsStore } from './deps'
-import { recordPublishStatus, clearPublishStatus, renderOutcome } from './publish-status'
+import { recordPublishStatus, clearPublishStatus, renderOutcome, lastPublishedAt } from './publish-status'
 import { routesToPrune, type Invalidation } from './invalidation'
+import { pendingRoutes, heldRoutes } from './pending'
 
 /**
  * The runtime static publisher: renders public routes from the LIVE server (`localFetch`, the same
@@ -28,6 +29,7 @@ interface OutputRc {
   dir: string
   publicDir: string
   auto: boolean
+  publishOnSave: boolean
   reconcileMinutes: number
   verbose: boolean
   s3: { bucket: string; region: string; endpoint: string; prefix: string; accessKeyId: string; secretAccessKey: string; sessionToken: string }
@@ -69,6 +71,11 @@ export async function renderRoute(route: string): Promise<{ body: Buffer | null;
  *  route set is INCOMPLETE, so it must never be used as the authority for what to delete. */
 export interface PublishedRoutes {
   routes: string[]
+  /** Each route's record `updatedAt` in ms — the "last saved" half of the saved-vs-published comparison. */
+  savedAt: Map<string, number>
+  /** Each route's owning record as its deps tag (`<coll>:<id>`) — route strings move on a rename, records
+   *  do not, so withholding a renamed page needs the identity behind the route. */
+  recordTag: Map<string, string>
   /** Names of collections whose route query threw (drifted schema, locked DB) — routes are missing. */
   failed: string[]
 }
@@ -82,6 +89,8 @@ export function allPublishedRoutes(): PublishedRoutes {
   const prefixPrimary = prefixPrimaryLocale()
   const pub = publicReadableResources()
   const routes = new Set<string>([localePath('/', primary, primary, prefixPrimary)]) // `/` or `/<primary>`
+  const savedAt = new Map<string, number>()
+  const recordTag = new Map<string, string>()
   const failed: string[] = []
   for (const c of allCollections()) {
     if (!c.def.pageLike || !isPubliclyReadable(c.def.name, pub)) continue
@@ -94,6 +103,10 @@ export function allPublishedRoutes(): PublishedRoutes {
     const proj: Record<string, unknown> = { path: cols.path }
     if (c.def.translatable) proj.locale = cols.locale
     if (c.def.status) proj.status = cols.status
+    // `updatedAt` is a system column on every built collection, but this projection also runs against
+    // hand-rolled tables in tests — guard it exactly like `locale`, or its absence throws the select.
+    if (Object.hasOwn(cols, 'updatedAt')) proj.updatedAt = cols.updatedAt
+    if (Object.hasOwn(cols, 'id')) proj.id = cols.id
     let rows: Record<string, unknown>[]
     try { rows = db.select(proj as never).from(c.table).all() as Record<string, unknown>[] }
     catch (error) {
@@ -106,10 +119,17 @@ export function allPublishedRoutes(): PublishedRoutes {
     for (const row of rows) {
       if (c.def.status && row.status !== 'published') continue
       const route = pageRowHref(row, primary, prefixPrimary) // the shared (path, locale) → route rule
-      if (route) routes.add(route)
+      if (!route) continue
+      routes.add(route)
+      const saved = row.updatedAt
+      if (saved instanceof Date) savedAt.set(route, saved.getTime())
+      else if (typeof saved === 'number') savedAt.set(route, saved)
+      // The same tag the publisher records against a rendered route, so a route can be traced back to its
+      // record even after a rename moved the route string.
+      if (typeof row.id === 'number') recordTag.set(route, `${c.def.name}:${row.id}`)
     }
   }
-  return { routes: [...routes], failed }
+  return { routes: [...routes], savedAt, recordTag, failed }
 }
 
 /** Render + write the given routes (skips non-200). When `deps` is given, each render is wrapped in a
@@ -226,7 +246,7 @@ export async function publishFull(driver: StorageDriver = outputDriver(), deps?:
   // runs late (layer-then-filename order) — finish populating the registry first. Moving the read before
   // an await would silently render an empty registry. See docs/architecture.md → "Server plugins".
   await syncStaticAssets(driver, cfg.publicDir)
-  const { routes, failed } = allPublishedRoutes()
+  const { routes, savedAt, recordTag, failed } = allPublishedRoutes()
   if (failed.length) {
     // Keep on doubt: with a collection missing from the enumeration, every one of its live pages looks
     // stale, so a prune would wipe it from the output. Rendering still proceeds — a stale extra file is
@@ -234,12 +254,27 @@ export async function publishFull(driver: StorageDriver = outputDriver(), deps?:
     console.error(`[kestrel] publish: prune skipped — routes of ${failed.join(', ')} could not be enumerated; existing files kept`)
   }
 
+  // A full run resynchronizes the output with the DB, so without this it would push every saved-but-
+  // unpublished edit live — exactly what deferring the publish exists to prevent. Those routes keep the
+  // file their last publish wrote.
+  // …unless the consumer opted out of the split (`output.publishOnSave`): there, a save IS a publish, so
+  // "saved after the last publish" means a republish is merely in flight, not deliberately withheld.
+  // Computed BEFORE the prune, because a held record's live file may sit at a route the DB no longer names
+  // (an unpublished rename), and that file is what the site is still serving. Without `deps` there is no
+  // way to find those prior routes, so only same-route withholding applies — the pre-rename behaviour.
+  const { hold, keep } = cfg.publishOnSave
+    ? { hold: new Set<string>(), keep: new Set<string>() }
+    : heldRoutes(savedAt, lastPublishedAt(useDb()), recordTag, (tag) => deps?.routesForTags([tag]) ?? [])
+  if (hold.size) {
+    console.info(`[kestrel] publish: ${hold.size} route(s) held at their published version (unpublished changes): ${[...hold].join(', ')}`)
+  }
+
   // Targeted prune: a route we previously published that is no longer in the published set — a page
   // unpublished, deleted, or whose slug changed — must lose its static file. Safe because it only deletes
   // files this publisher wrote (tracked in deps, durable across restarts). Output ≡ DB; no opt-in toggle.
   let pruned = 0
   if (deps && !failed.length) {
-    const stale = staleRoutes(deps.routes(), routes)
+    const stale = staleRoutes(deps.routes(), routes).filter((route) => !keep.has(route))
     if (stale.length) {
       await prunePages(stale, driver)
       for (const route of stale) deps.forget(route)
@@ -247,11 +282,13 @@ export async function publishFull(driver: StorageDriver = outputDriver(), deps?:
     }
   }
 
+  const renderRoutes = routes.filter((route) => !hold.has(route))
+
   // Reset the discovery accumulator so this full run reconciles ONLY what it actually renders — an earlier
   // incremental (tag) publish also feeds the accumulator, and a variant it recorded whose usage was later
   // removed would otherwise survive and be re-registered here (defeating usage-driven narrowing).
   clearVariants()
-  const written = await publishRoutes(routes, driver, deps)
+  const written = await publishRoutes(renderRoutes, driver, deps)
   const rendered = written.length
   await publishMeta(driver)
   // Auto-discovery: a FULL render just visited every published route, so the capture accumulator now holds
@@ -260,8 +297,10 @@ export async function publishFull(driver: StorageDriver = outputDriver(), deps?:
   // by the un-rendered routes. ONLY narrow when EVERY route rendered: a partial failure leaves the accumulator
   // incomplete, so reconciling would deregister variants still referenced by the stale (kept) published HTML,
   // which a later backfill would then delete out from under the live page. An un-enumerated collection is
-  // the same partial-coverage case: its pages were never visited, so their variants are missing too.
-  if (!failed.length && rendered === routes.length) saveDiscoveredVariants(useDb())
+  // the same partial-coverage case: its pages were never visited, so their variants are missing too — and
+  // so is a route held back at its published version: its live file still references the variants this run
+  // never saw.
+  if (!failed.length && !hold.size && rendered === renderRoutes.length) saveDiscoveredVariants(useDb())
   return { rendered, pruned }
 }
 
@@ -270,13 +309,39 @@ export async function publishFull(driver: StorageDriver = outputDriver(), deps?:
  *  (their `<lastmod>` may have changed). */
 export interface PublishResult { rendered: string[]; pruned: string[]; counts: { rendered: number; pruned: number } }
 
+/**
+ * Drop the routes a tag match dragged in that are holding their published version back. Withholding is a
+ * property of the ROUTE, not of the full publish: a route whose record was saved after its last publish
+ * serves that published file until someone publishes it. Without this, publishing one record re-renders
+ * every route tagged with the collection — and every route reads the `site` singleton — from the live DB,
+ * so a routine Publish writes an unrelated record's withheld body to the live site.
+ *
+ * A route named in `render` is exempt: it IS what the publish was for, and pressing Publish is what clears
+ * the withholding. The prune set is untouched — removal has no publish intent left to protect, so an
+ * unpublished or deleted record's page still goes at once (ADR-0008).
+ *
+ * The cost, deliberately accepted: a withheld route keeps the baked links and hreflang of its last
+ * publish, so a link to a record that has since been unpublished stays stale until the referrer itself is
+ * published. That is the same staleness its body already carries — a frozen route is one publish
+ * generation throughout, rather than a mix of two. Rendering a referrer from its published state while
+ * resolving fresh links needs a published snapshot per record, which is ADR-0008's "Future".
+ */
+function withheldRemoved(inv: Extract<Invalidation, { type: 'tags' }>, routes: string[]): string[] {
+  if (outputConfig().publishOnSave) return routes // that mode never defers a publish in the first place
+  // An un-enumerable collection contributes no `savedAt` entry, so its routes are simply not withheld —
+  // the same direction publishFull takes, and the non-destructive one (a stale re-render, never a delete).
+  const held = new Set(pendingRoutes(allPublishedRoutes().savedAt, lastPublishedAt(useDb())))
+  const explicit = new Set(inv.render)
+  return routes.filter((route) => explicit.has(route) || !held.has(route))
+}
+
 export async function publishInvalidation(inv: Invalidation, driver: StorageDriver = outputDriver(), deps?: DepsStore): Promise<PublishResult> {
   if (inv.type === 'noop') return { rendered: [], pruned: [], counts: { rendered: 0, pruned: 0 } }
   if (inv.type === 'full') {
     const r = await publishFull(driver, deps) // full: counts only (don't list every route)
     return { rendered: [], pruned: [], counts: { rendered: r.rendered, pruned: r.pruned } }
   }
-  const routes = [...new Set([...(deps?.routesForTags(inv.tags) ?? []), ...inv.render])]
+  const routes = withheldRemoved(inv, [...new Set([...(deps?.routesForTags(inv.tags) ?? []), ...inv.render])])
   const rendered = await publishRoutes(routes, driver, deps)
   let pruned: string[] = []
   // Never prune a route we just wrote live — render wins a coalesced render+prune collision (see routesToPrune).

package/layers/ui/app/components/field/Datetime.vue

@@ -59,10 +59,12 @@ const rangeEnd = computed<string | null>({
   <UiFieldset v-else :id="id" :label="name" :error="error" :required="required">
     <template #default="f">
       <template v-if="isTime">
+        <!-- eslint-disable-next-line vuejs-accessibility/label-has-for -- native wrapping label around a custom UiTimeInput; no `for`/`id` pair needed, invisible to static analysis -->
         <label class="field-datetime__sub">
           <span class="field-datetime__sublabel">{{ t('field.datetime.range_start') }}</span>
           <UiTimeInput v-model="rangeStart" :disabled="disabled" v-bind="f" />
         </label>
+        <!-- eslint-disable-next-line vuejs-accessibility/label-has-for -- native wrapping label around a custom UiTimeInput; no `for`/`id` pair needed, invisible to static analysis -->
         <label class="field-datetime__sub">
           <span class="field-datetime__sublabel">{{ t('field.datetime.range_end') }}</span>
           <UiTimeInput v-model="rangeEnd" :disabled="disabled" v-bind="f" />

package/layers/ui/app/components/field/Repeater.vue

@@ -126,6 +126,7 @@ function insertRowAt(at: number) {
       {{ name }}<span v-if="required" aria-hidden="true">*</span>
     </legend>
 
+    <!-- eslint-disable-next-line vuejs-accessibility/no-static-element-interactions -- @dragleave is a mouse-only progressive enhancement; the move-up/move-down buttons below give the same reorder fully keyboard access -->
     <div ref="rowsEl" class="ui-repeater__rows" @dragleave="onDragLeave">
       <template v-for="(row, i) in rows" :key="keys[i]">
         <div class="ui-repeater__insert-zone">
@@ -140,6 +141,7 @@ function insertRowAt(at: number) {
           </button>
         </div>
 
+        <!-- eslint-disable-next-line vuejs-accessibility/no-static-element-interactions -- drag handlers are a mouse-only progressive enhancement; the move-up/move-down buttons below give the same reorder fully keyboard access -->
         <div
           class="ui-repeater__row-wrap"
           :class="{ 'ui-repeater__row-wrap--over': overIndex === i && dragIndex !== i }"

package/layers/ui/app/components/ui/Checkbox.vue

@@ -25,6 +25,7 @@ watch(() => props.indeterminate, syncIndeterminate)
 </script>
 
 <template>
+  <!-- eslint-disable-next-line vuejs-accessibility/form-control-has-label -- id/label land via UiField's attrs fallthrough (single root element), invisible to static analysis -->
   <input
     ref="input"
     v-model="model"

package/layers/ui/app/components/ui/CheckboxGroup.vue

@@ -23,6 +23,7 @@ function toggle(value: string, checked: boolean) {
 
 <template>
   <div class="ui-checkbox-group" role="group">
+    <!-- eslint-disable-next-line vuejs-accessibility/label-has-for -- native wrapping label around a custom UiCheckbox; no `for`/`id` pair needed, invisible to static analysis -->
     <label v-for="o in options" :key="o.value" class="ui-checkbox-group__item">
       <UiCheckbox
         :model-value="selected.includes(o.value)"

package/layers/ui/app/components/ui/Combobox.vue

@@ -117,7 +117,9 @@ function moveChip(from: number, to: number) {
     class="ui-combobox"
   >
     <ComboboxAnchor class="ui-combobox__anchor" :data-multiple="multiple || undefined" :aria-invalid="invalid || undefined">
+      <!-- eslint-disable-next-line vuejs-accessibility/no-static-element-interactions, vuejs-accessibility/no-redundant-roles -- @dragleave is a mouse-only progressive enhancement (the chip-move buttons below give the same reorder fully keyboard access); role="list" is NOT redundant here, `list-style: none` below strips the implicit list semantics in WebKit, see the "WebKit list-semantics fix" test -->
       <ul v-if="multiple && selected.length" ref="chips" class="ui-combobox__chips" role="list" @dragleave="onDragLeave">
+        <!-- eslint-disable-next-line vuejs-accessibility/no-static-element-interactions -- drag handlers are a mouse-only progressive enhancement; the chip-move buttons below give the same reorder fully keyboard access -->
         <li
           v-for="(s, i) in selected"
           :key="s.value"

package/layers/ui/app/components/ui/Field.vue

@@ -22,6 +22,7 @@ const slotProps = computed(() => ({
 
 <template>
   <div class="ui-field" :data-invalid="error ? 'true' : undefined">
+    <!-- eslint-disable-next-line vuejs-accessibility/label-has-for -- the matching control is the default slot's content, invisible to static analysis across the slot boundary -->
     <label v-if="label" :for="fieldId" class="ui-field__label">
       {{ label }}<span v-if="required" class="ui-field__required" aria-hidden="true">*</span>
     </label>

package/layers/ui/app/components/ui/Fieldset.vue

@@ -10,7 +10,8 @@ const props = defineProps<{
   id?: string
 }>()
 
-const { fieldId, hintId, errId, describedby, ariaInvalid, ariaRequired } = useFieldA11y(props)
+// No `fieldId`: a group has no single control to point a label `for` at (see below).
+const { hintId, errId, describedby, ariaInvalid, ariaRequired } = useFieldA11y(props)
 
 // No `id` — a group has no single control to point a label `for` at; the
 // <legend> labels the group natively. Consumers spread these onto the group root.

package/layers/ui/app/components/ui/Icon.vue

@@ -17,7 +17,8 @@ const hasA11yName = computed(() => props.label != null || attrs.role != null ||
 <template>
   <!-- v-html body is either a static registry icon or developer-supplied SVG allowlist-sanitised by
        resolveIconBody → sanitizeIconSvg (no script-capable elements/attributes survive). -->
-  <svg
+  <!-- eslint-disable-next-line vue/no-v-html -- sanitized via resolveIconBody -> sanitizeIconSvg (allowlist-only tags/attrs) -->
+  <svg v-html="body"
     class="ui-icon"
     :data-icon="dataIcon"
     :width="dim"
@@ -31,7 +32,6 @@ const hasA11yName = computed(() => props.label != null || attrs.role != null ||
     :role="label ? 'img' : undefined"
     :aria-label="label || undefined"
     :aria-hidden="hasA11yName ? undefined : 'true'"
-    v-html="body"
   />
 </template>
 

package/layers/ui/app/components/ui/NumberInput.vue

@@ -55,6 +55,7 @@ function onKeydown(e: KeyboardEvent) {
 
 <template>
   <div v-if="suffix" class="ui-number-wrap" :class="{ 'ui-number-wrap--slim': slim }" :data-disabled="disabled || undefined">
+    <!-- eslint-disable-next-line vuejs-accessibility/form-control-has-label -- id/label land via v-bind="$attrs" from the wrapping UiField, invisible to static analysis -->
     <input
       v-model="text"
       type="number"
@@ -70,6 +71,7 @@ function onKeydown(e: KeyboardEvent) {
     >
     <span class="ui-number-wrap__suffix" aria-hidden="true">{{ suffix }}</span>
   </div>
+  <!-- eslint-disable-next-line vuejs-accessibility/form-control-has-label -- id/label land via v-bind="$attrs" from the wrapping UiField, invisible to static analysis -->
   <input
     v-else
     v-model="text"

package/layers/ui/app/components/ui/Richtext.vue

@@ -8,6 +8,7 @@ import { Superscript } from '@tiptap/extension-superscript'
 import { TextAlign } from '@tiptap/extension-text-align'
 import RichtextToolbar from './RichtextToolbar.vue'
 import { RichtextSpanClass, RichtextBlockClass } from '../../utils/richtext-preserve-class'
+import { RICHTEXT_LINK_SCHEME } from '../../../../fields/app/utils/richtext-links'
 
 const props = withDefaults(
   defineProps<{
@@ -24,6 +25,11 @@ const props = withDefaults(
 )
 const model = defineModel<string | null>()
 
+// TipTap emits `update` for non-content changes too — `setEditable`/`setOptions` emit directly, past the
+// transaction pipeline and its docChanged guard — and that echo reaches the edit form as a user edit.
+// Only a changed doc is one, so every emit is checked against the doc it last saw.
+let lastDoc: unknown = null
+
 // StarterKit (v3) already bundles Link + Underline; only the rest are added here.
 const editor = useEditor({
   content: model.value ?? '',
@@ -33,7 +39,13 @@ const editor = useEditor({
   extensions: [
     StarterKit.configure({
       heading: { levels: [1, 2, 3, 4, 5, 6] },
-      link: { openOnClick: false },
+      // `protocols`: the Link mark validates every href against its own scheme allowlist, which has no
+      // `kestrel:`. Without this it drops the whole anchor when stored content is loaded and makes the
+      // toolbar's `setLink` a silent no-op — opening and saving a record would destroy its internal links.
+      // `target`/`rel` null: the sanitizer owns that policy — it decorates absolute http(s) links and
+      // strips the attributes from every other kind. The mark's own defaults would stamp them on ANY
+      // anchor, so a stored internal/relative/mailto link came back changed and read as an unsaved edit.
+      link: { openOnClick: false, protocols: [RICHTEXT_LINK_SCHEME], HTMLAttributes: { target: null, rel: null } },
     }),
     Highlight,
     Subscript,
@@ -41,7 +53,12 @@ const editor = useEditor({
     TextAlign.configure({ types: ['heading', 'paragraph'] }),
     RichtextSpanClass, RichtextBlockClass, // preserve consumer presentational classes on round-trip
   ],
+  onCreate: ({ editor }) => {
+    lastDoc = editor.state.doc
+  },
   onUpdate: ({ editor }) => {
+    if (editor.state.doc === lastDoc) return
+    lastDoc = editor.state.doc
     model.value = editor.isEmpty ? '' : editor.getHTML()
   },
 })
@@ -53,10 +70,15 @@ watch(model, (value) => {
   const current = e.isEmpty ? '' : e.getHTML()
   // `emitUpdate: false`: this value came FROM the model, so re-emitting it would reach the edit form as
   // a user edit — clearing the redo stack and turning a restored null back into ''.
-  if (next !== current) e.commands.setContent(next, { emitUpdate: false })
+  if (next !== current) {
+    e.commands.setContent(next, { emitUpdate: false })
+    lastDoc = e.state.doc
+  }
 })
 
-watch(() => props.disabled, (d) => editor.value?.setEditable(!d))
+// `false` — the second arg suppresses the update event; `disabled` tracks the form's `saving` flag, so
+// the post-save toggle would otherwise re-dirty the form that was just rebaselined.
+watch(() => props.disabled, (d) => editor.value?.setEditable(!d, false))
 
 // Apply the accessible name + textbox semantics directly to the ProseMirror surface, reactively (the
 // error-driven describedby/invalid arrive after mount). `editor.view.dom` is the contenteditable element.

package/layers/ui/app/components/ui/Select.vue

@@ -17,6 +17,7 @@ const model = defineModel<string | null>()
 
 <template>
   <span class="ui-select">
+    <!-- eslint-disable-next-line vuejs-accessibility/form-control-has-label -- id/label land via v-bind="$attrs" from the wrapping UiField, invisible to static analysis -->
     <select v-model="model" :disabled="disabled" class="ui-select__field" v-bind="$attrs">
       <option v-if="placeholder" value="" disabled>{{ placeholder }}</option>
       <option v-for="o in options" :key="o.value" :value="o.value">{{ o.label }}</option>

package/layers/ui/app/components/ui/TextInput.vue

@@ -31,6 +31,7 @@ const inputType = computed(() => (revealable.value && revealed.value ? 'text' :
 
 <template>
   <div class="ui-input-wrap">
+    <!-- eslint-disable-next-line vuejs-accessibility/form-control-has-label -- id/label land via v-bind="$attrs" from the wrapping UiField, invisible to static analysis -->
     <input
       v-model="model"
       :type="inputType"

package/layers/ui/app/components/ui/Textarea.vue

@@ -12,6 +12,7 @@ const model = defineModel<string | null>()
 </script>
 
 <template>
+  <!-- eslint-disable-next-line vuejs-accessibility/form-control-has-label -- id/label land via Vue's default attrs fallthrough (single root element) from the wrapping UiField -->
   <textarea
     v-model="model"
     :rows="rows"

package/layers/ui/app/components/ui/TimeInput.vue

@@ -5,6 +5,7 @@ const model = defineModel<string | null>()
 </script>
 
 <template>
+  <!-- eslint-disable-next-line vuejs-accessibility/form-control-has-label -- id/label land via Vue's default attrs fallthrough (single root element) from the wrapping UiField -->
   <input v-model="model" type="time" :disabled="disabled" class="ui-time">
 </template>
 

package/layers/ui/app/i18n/de.ts

@@ -4,6 +4,7 @@ import type { Catalog } from '../composables/useT'
 export const de: Catalog = {
   'common.new': '{label} anlegen',
   'common.save': 'Speichern',
+  'common.publish': 'Veröffentlichen',
   'common.cancel': 'Abbrechen',
   'common.create': 'Erstellen',
   'common.delete': 'Löschen',
@@ -142,6 +143,11 @@ export const de: Catalog = {
   'pageSettings.statusPublished': 'Veröffentlicht',
 
   'editor.openInNewTab': 'In neuem Tab öffnen',
+  'editor.previewUnsaved': 'Ungespeicherte Änderungen in neuem Tab ansehen',
+  'editor.previewFailed': 'Vorschau konnte nicht geöffnet werden.',
+  'editor.publishFailed': 'Veröffentlichen fehlgeschlagen.',
+  'editor.publishNotGenerated': 'Statischer Output ist in dieser Umgebung aus — es wurde nichts geschrieben.',
+  'editor.publishDraft': 'Ein Entwurf hat keine öffentliche Seite. Zum Veröffentlichen den Status auf Veröffentlicht setzen.',
   // editor status light — LEFT lamp: ONE word + details tooltip (save/publish status)
   'editorStatus.word.saving': 'Speichert…',
   'editorStatus.word.unsaved': 'Ungespeichert',
@@ -156,12 +162,16 @@ export const de: Catalog = {
   // editor status light — RIGHT lamp: ONE word + details tooltip (static-page generation status)
   'editorStatus.word.live': 'Live',
   'editorStatus.word.generating': 'Generiert…',
+  'editorStatus.word.notPublished': 'Nicht veröffentlicht',
   'editorStatus.word.notBuilt': 'Nicht gebaut',
   'editorStatus.word.notLive': 'Nicht live',
   'editorStatus.word.error': 'Fehler',
+  'editorStatus.word.outdated': 'Veraltet',
   'editorStatus.live.liveS3': 'Live — Seite auf S3 abgelegt.',
   'editorStatus.live.liveLocal': 'Live — Seite in den statischen Output geschrieben.',
   'editorStatus.live.pending': 'Wird veröffentlicht…',
+  'editorStatus.live.outdated': 'Gespeichert, aber nicht veröffentlicht — live steht noch die zuletzt veröffentlichte Fassung.',
+  'editorStatus.live.notPublished': 'Nie veröffentlicht — mit Veröffentlichen kommt die Seite auf die Live-Site.',
   'editorStatus.live.notBuilt': 'In dieser Umgebung nicht generiert — die statische Seite wird beim Deploy gebaut.',
   'editorStatus.live.error': 'Generieren der statischen Seite fehlgeschlagen.',
   'editorStatus.live.draft': 'Entwurf — nicht generiert. Erscheint erst nach Veröffentlichung auf der Live-Seite.',

package/layers/ui/app/i18n/en.ts

@@ -7,6 +7,7 @@ export const en: Catalog = {
   // common / shared
   'common.new': 'New {label}',
   'common.save': 'Save',
+  'common.publish': 'Publish',
   'common.cancel': 'Cancel',
   'common.create': 'Create',
   'common.delete': 'Delete',
@@ -154,6 +155,11 @@ export const en: Catalog = {
 
   // editor action bar — live preview + status "Ampel"
   'editor.openInNewTab': 'Open in new tab',
+  'editor.previewUnsaved': 'Preview unsaved changes in a new tab',
+  'editor.previewFailed': 'Could not open the preview.',
+  'editor.publishFailed': 'Publishing failed.',
+  'editor.publishNotGenerated': 'Static output is off in this environment — nothing was written.',
+  'editor.publishDraft': 'A draft has no public page. Publish it by setting its status to Published.',
   // editor Ampel — LEFT lamp: one WORD + a details tooltip (save + publish lifecycle of this record)
   'editorStatus.word.saving': 'Saving…',
   'editorStatus.word.unsaved': 'Unsaved',
@@ -168,12 +174,16 @@ export const en: Catalog = {
   // editor Ampel — RIGHT lamp: one WORD + a details tooltip (generated state of the static page)
   'editorStatus.word.live': 'Live',
   'editorStatus.word.generating': 'Generating…',
+  'editorStatus.word.notPublished': 'Not published',
   'editorStatus.word.notBuilt': 'Not built',
   'editorStatus.word.notLive': 'Not live',
   'editorStatus.word.error': 'Error',
+  'editorStatus.word.outdated': 'Outdated',
   'editorStatus.live.liveS3': 'Live — page uploaded to S3.',
   'editorStatus.live.liveLocal': 'Live — page written to the static output.',
   'editorStatus.live.pending': 'Publishing in progress…',
+  'editorStatus.live.outdated': 'Saved but not published — the live page still shows the last published version.',
+  'editorStatus.live.notPublished': 'Never published — press Publish to put this page on the live site.',
   'editorStatus.live.notBuilt': 'Not generated in this environment — the static page is built on deploy.',
   'editorStatus.live.error': 'Publishing the static page failed.',
   'editorStatus.live.draft': 'Draft — not generated. It stays off the live site until published.',