@michaelthielemann/kestrel 1.7.0 → 2.1.0

package/layers/admin/app/pages/admin/[collection]/[id].vue

@@ -43,12 +43,10 @@ const heading = computed(() =>
       : t('editor.editRecord', { collection: singular.value, id }),
 )
 
-// Open the record's real public URL in a new tab — the live preview (drafts included, served to the
-// authenticated admin by the public render path). Withheld until there's a saved, routable page.
-function openPreview() {
-  const url = editorRef.value?.previewUrl
-  if (url) window.open(url, '_blank', 'noopener,noreferrer')
-}
+// The external-tab button always works now: with unsaved edits it opens a preview TICKET (no save, no
+// publish), otherwise the record's own URL — so the tooltip has to say which of the two you'd get.
+const previewTitle = computed(() => t(editorRef.value?.dirty ? 'editor.previewUnsaved' : 'editor.openInNewTab'))
+
 const skipGuard = ref(false)
 
 // Delete flows through the shared batch op + the same confirm dialog the list uses, so the delete logic
@@ -120,10 +118,12 @@ async function confirmDelete() {
       <div class="record__actions">
         <UiButton type="button" variant="ghost" size="sm" icon="undo" :disabled="saving || !editorRef?.canUndo" :title="t('history.undo')" :aria-label="t('history.undo')" @click="editorRef?.undo()" />
         <UiButton type="button" variant="ghost" size="sm" icon="redo" :disabled="saving || !editorRef?.canRedo" :title="t('history.redo')" :aria-label="t('history.redo')" @click="editorRef?.redo()" />
-        <UiButton v-if="editorRef?.previewUrl" type="button" variant="ghost" size="sm" icon="external-link" :title="t('editor.openInNewTab')" :aria-label="t('editor.openInNewTab')" @click="openPreview" />
+        <UiButton type="button" variant="ghost" size="sm" icon="external-link" :title="previewTitle" :aria-label="previewTitle" :loading="editorRef?.previewOpening" @click="editorRef?.openPreview()" />
         <UiButton type="button" variant="secondary" size="sm" icon="x" :disabled="saving" @click="toList">{{ t('common.cancel') }}</UiButton>
         <UiButton v-if="id !== 'new'" variant="danger" size="sm" icon="trash" :loading="deleting" @click="onDelete">{{ t('common.delete') }}</UiButton>
         <UiButton type="submit" :form="EDITOR_FORM_ID" variant="primary" size="sm" icon="check" :loading="saving">{{ t('common.save') }}</UiButton>
+        <!-- Publishing is its own decision: Save persists, Publish writes the static page (ADR-0008). -->
+        <UiButton v-if="editorRef?.canPublish !== false" type="button" variant="secondary" size="sm" icon="upload" :loading="editorRef?.publishing" :disabled="saving" @click="editorRef?.publish()">{{ t('common.publish') }}</UiButton>
         <EditorStatus class="record__ampel" :dirty="editorRef?.dirty ?? false" :saving="saving" :has-status="editorRef?.hasStatus ?? false" :status="editorRef?.status" :saved-status="editorRef?.savedStatus" :page-like="editorRef?.pageLike ?? false" :live="editorRef?.live" />
       </div>
     </div>

package/layers/admin/app/pages/admin/[collection]/publish-preview.nuxt.test.ts

@@ -0,0 +1,142 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest'
+import { useState } from '#imports'
+import { flushPromises } from '@vue/test-utils'
+import { readBody } from 'h3'
+import { mountSuspended, registerEndpoint, mockNuxtImport } from '@nuxt/test-utils/runtime'
+import RecordPage from './[id].vue'
+
+// A pageLike, status-bearing collection — the page-builder case the Save/Publish split is for.
+const pagesSchema = {
+  name: 'pages', mode: 'multi', translatable: false, pageLike: true, seo: false, status: true,
+  blocks: { enabled: false }, label: { singular: 'Page', plural: 'Pages' },
+  fields: { title: { type: 'text', required: true, translatable: false, unique: false } },
+}
+registerEndpoint('/api/collections', () => ({ data: [pagesSchema] }))
+
+const calls = vi.hoisted(() => ({
+  publishOnSave: false,
+  writes: [] as Record<string, unknown>[],
+  publishes: [] as Record<string, unknown>[],
+  tickets: [] as Record<string, unknown>[],
+}))
+
+registerEndpoint('/api/pages/1', async (event) => {
+  if (event.method === 'PATCH') {
+    const b = await readBody(event)
+    calls.writes.push(b)
+    return { id: 1, ...b, updatedAt: '2026-08-13T10:00:00.000Z' }
+  }
+  return { id: 1, title: 'Existing', path: '/existing', status: 'draft', updatedAt: '2026-08-13T09:00:00.000Z' }
+})
+registerEndpoint('/api/pages', () => ({ data: [], total: 0, page: 1, perPage: 25 }))
+registerEndpoint('/api/pages/1/dead-refs', () => [])
+registerEndpoint('/api/publish-status', () => ({ route: '/existing', status: 'success', pending: !calls.publishOnSave, generates: true, publishOnSave: calls.publishOnSave, updatedAt: '2026-08-13T09:30:00.000Z' }))
+registerEndpoint('/api/publish', async (event) => {
+  calls.publishes.push(await readBody(event))
+  return { queued: true, generates: true, routes: ['/existing'], pruned: [], drafts: [] }
+})
+registerEndpoint('/api/preview', async (event) => {
+  if (event.method === 'POST') {
+    calls.tickets.push(await readBody(event))
+    return { token: 'pv_abc', expiresAt: Date.now() + 600_000 }
+  }
+  return null
+})
+
+const h = vi.hoisted(() => ({ params: { collection: 'pages', id: '1' }, nav: [] as unknown[] }))
+mockNuxtImport('useRoute', () => () => ({ params: h.params, query: {}, fullPath: `/admin/${h.params.collection}/${h.params.id}` }))
+mockNuxtImport('navigateTo', () => (to: unknown) => { h.nav.push(to); return Promise.resolve() })
+
+let opened: Array<{ url: string }>
+let lastTab: { location: { replace: (url: string) => void }; close: () => void } | null
+
+beforeEach(() => {
+  h.params = { collection: 'pages', id: '1' }
+  h.nav.length = 0
+  calls.publishOnSave = false
+  calls.writes.length = 0
+  calls.publishes.length = 0
+  calls.tickets.length = 0
+  opened = []
+  lastTab = null
+  useState('kestrel-collections').value = null
+  useState('kestrel-blocks').value = null
+  vi.spyOn(window, 'open').mockImplementation(((url?: string) => {
+    // The real code opens a blank tab synchronously and redirects it once the ticket is minted.
+    if (url) { opened.push({ url }); return null }
+    lastTab = { location: { replace: (to: string) => opened.push({ url: to }) }, close: () => {} }
+    return lastTab as unknown as Window
+  }) as typeof window.open)
+})
+
+const settle = async () => {
+  await new Promise((r) => setTimeout(r, 20))
+  await flushPromises()
+}
+const button = (w: Awaited<ReturnType<typeof mountSuspended>>, label: string) =>
+  w.findAll('.ui-button').find((b) => b.text() === label)
+
+describe('record editor — Save and Publish are separate actions', () => {
+  it('offers Publish next to Save', async () => {
+    const w = await mountSuspended(RecordPage)
+    await flushPromises()
+    const labels = w.find('.record__actions').findAll('.ui-button').map((b) => b.text()).filter(Boolean)
+    expect(labels).toContain('Publish')
+    expect(labels.indexOf('Publish')).toBe(labels.indexOf('Save') + 1)
+  })
+
+  // `output.publishOnSave` is the way back to the pre-2.0 model, where a save republished on its own.
+  it('drops the Publish button when the consumer turned the split off', async () => {
+    calls.publishOnSave = true
+    const w = await mountSuspended(RecordPage)
+    await settle()
+    expect(w.find('.record__actions').findAll('.ui-button').map((b) => b.text())).not.toContain('Publish')
+  })
+
+  it('Save writes the record and asks for no publish at all', async () => {
+    const w = await mountSuspended(RecordPage)
+    await flushPromises()
+    await w.find('input[type="text"]').setValue('Edited')
+    // The header Save is a `type=submit` bound to the form by id — which only the real browser follows.
+    await w.find('form.editor').trigger('submit')
+    await settle()
+    expect(calls.writes).toHaveLength(1)
+    expect(calls.writes[0]).toMatchObject({ title: 'Edited', status: 'draft' }) // status untouched by a save
+    expect(calls.publishes).toEqual([])
+  })
+
+  it('Publish saves first, promotes the draft, and then writes the static output', async () => {
+    const w = await mountSuspended(RecordPage)
+    await flushPromises()
+    await w.find('input[type="text"]').setValue('Ready to go')
+    await button(w, 'Publish')!.trigger('click')
+    await settle()
+    expect(calls.writes[0]).toMatchObject({ title: 'Ready to go', status: 'published' })
+    expect(calls.publishes).toEqual([{ collection: 'pages', id: 1 }])
+  })
+})
+
+describe('record editor — previewing in a new tab', () => {
+  it('opens the saved URL directly when there is nothing unsaved', async () => {
+    const w = await mountSuspended(RecordPage)
+    await flushPromises()
+    const preview = w.findAll('.ui-button').find((b) => b.attributes('aria-label') === 'Open in new tab')!
+    await preview.trigger('click')
+    await settle()
+    expect(opened.map((o) => o.url)).toContain('/existing')
+    expect(calls.tickets).toEqual([])
+  })
+
+  it('mints a ticket for unsaved changes instead of saving them', async () => {
+    const w = await mountSuspended(RecordPage)
+    await flushPromises()
+    await w.find('input[type="text"]').setValue('Not saved')
+    await flushPromises()
+    const preview = w.findAll('.ui-button').find((b) => b.attributes('aria-label') === 'Preview unsaved changes in a new tab')!
+    await preview.trigger('click')
+    await settle()
+    expect(calls.writes).toEqual([]) // the whole point: no save
+    expect(calls.tickets[0]).toMatchObject({ collection: 'pages', id: 1, values: { title: 'Not saved' } })
+    expect(opened.at(-1)!.url).toBe('/existing?kestrel-preview-token=pv_abc')
+  })
+})

package/layers/admin/app/utils/edit-form.ts

@@ -17,6 +17,8 @@ export interface FetchErrorInfo {
   statusCode?: number
   statusMessage?: string
   issues: ServerIssue[]
+  /** The error body when it is NOT a Zod-issue array — e.g. `{ savedUpdatedAt }` from a failed write effect. */
+  data?: Record<string, unknown>
 }
 
 // The wire `SerializedField` is structurally what every Field* widget and `validateField` read
@@ -26,13 +28,18 @@ export function asFieldDef(field: SerializedField): FieldDef {
 }
 
 // Read an ofetch/H3 error envelope: top-level statusCode/statusMessage, Zod issues nested at err.data.data.
+// The BODY's statusMessage wins over the response's: ofetch maps `statusMessage` from `response.statusText`,
+// and HTTP/2 has no reason phrase — behind any h2 proxy that arrives as '' and the real message is only in
+// the JSON. Anything else under `data` (not an issue array) is handed back for the caller to act on.
 export function readFetchError(e: unknown): FetchErrorInfo {
   const err = e as { statusCode?: number; statusMessage?: string; data?: { data?: ServerIssue[] } & Record<string, unknown> }
-  const raw = err.data?.data ?? err.data
+  const body = Array.isArray(err.data) ? undefined : err.data
+  const raw = body?.data ?? err.data
   return {
     statusCode: err.statusCode,
-    statusMessage: err.statusMessage,
+    statusMessage: (body?.statusMessage as string | undefined) || err.statusMessage,
     issues: Array.isArray(raw) ? (raw as ServerIssue[]) : [],
+    ...(body && !Array.isArray(body.data) ? { data: body } : {}),
   }
 }
 

package/layers/admin/app/utils/editor-expose.ts

@@ -23,4 +23,12 @@ export interface EditorExpose {
   live: PublishStatusData | null
   /** The record's own title (see `recordTitle`), or `''` — the header then shows "Edit {collection} #{id}". */
   recordTitle: string
+  /** Save, then write the static output (ADR-0008) — a draft is promoted to published on the way. */
+  publish: () => Promise<void>
+  publishing: boolean
+  /** False when `output.publishOnSave` is on — a save republishes, so the hosts hide the Publish button. */
+  canPublish: boolean
+  /** Open the record in a new tab: the saved URL, or the unsaved state carried by a preview ticket. */
+  openPreview: () => Promise<void>
+  previewOpening: boolean
 }

package/layers/core/modules/auto-discovery/extract-block.ts

@@ -100,7 +100,9 @@ function evalObjectExpr(content: string, node: Node, scope: Record<string, unkno
   const src = content.slice(node.start, node.end)
   const names = Object.keys(scope)
   try {
-    // eslint-disable-next-line @typescript-eslint/no-implied-eval, no-new-func
+    // `src` is a slice of the CONSUMER's own block-SFC source, evaluated once here at build/discovery time
+    // to recover the object literal's runtime shape — never attacker- or request-supplied, so this is not
+    // an eval-injection surface.
     const fn = new Function(...names, `return (${src})`)
     const out = fn(...names.map((k) => scope[k]))
     if (!out || typeof out !== 'object') throw new Error('expected an object literal')
@@ -109,6 +111,7 @@ function evalObjectExpr(content: string, node: Node, scope: Record<string, unkno
     throw new Error(
       `${where}: could not evaluate the block declaration. Field/block args must be self-contained literals + ` +
         `field-factory calls (no imported constants, computed values, or TS type-args). Cause: ${(e as Error).message}`,
+      { cause: e },
     )
   }
 }
@@ -126,7 +129,7 @@ export function extractBlockDef(sfcSource: string, fileBase: string): ExtractedB
   try {
     ast = parse(content, { sourceType: 'module', plugins: ['typescript'] })
   } catch (e) {
-    throw new Error(`${fileBase}: could not parse <script setup> — ${(e as Error).message}`)
+    throw new Error(`${fileBase}: could not parse <script setup> — ${(e as Error).message}`, { cause: e })
   }
 
   const props = macroCall(ast, 'defineProps')

package/layers/core/modules/kestrel/index.ts

@@ -56,6 +56,13 @@ export default defineNuxtModule<KestrelConfig>({
     pub.siteName = c.siteName ?? ''
     // Reference desktop width (px) for the admin page-builder preset; the editor's scale-to-fit shrinks it.
     pub.previewDesktopWidth = c.preview.desktopWidth
+    // Whether the admin shows the EU AI Act disclosure controls on a media asset; the data itself is
+    // always resolved server-side, so flipping this off only hides the editor.
+    pub.aiDisclosureEnabled = c.aiDisclosure.enabled
+    // Article metadata is an APP-side concern on both ends — the admin SEO panel decides whether to offer
+    // the fields, the public page decides whether to publish them as JSON-LD — so the flag has to be
+    // client-visible. It gates a disclosure, not a secret.
+    pub.seoArticleMeta = c.seo.articleMeta
 
     // Server-only resolved settings, so server utils read the CONSUMER's `kestrel: {}` (via this module)
     // rather than importing Kestrel's own `kestrel.config.ts` file. Essential when Kestrel is consumed as
@@ -67,6 +74,10 @@ export default defineNuxtModule<KestrelConfig>({
     srv.siteDescription = c.siteDescription
     // Built-in collection toggles (pages/media) — read by the register plugin to gate built-ins.
     srv.collections = c.collections
+    // Read by the upload route to decide whether to run the AI-signal scan at all.
+    srv.aiDisclosure = c.aiDisclosure
+    // Answer-engine toggles; `llmsFull` is server-only (it gates a Nitro route and what the publisher writes).
+    srv.seo = c.seo
     // Static-publish target for the runtime publisher (server-only). S3 creds are env-only; prefer the
     // output-specific creds, fall back to the shared media creds so a single S3 account "just works".
     srv.output = {
@@ -74,6 +85,7 @@ export default defineNuxtModule<KestrelConfig>({
       dir: c.output.dir,
       publicDir: c.output.publicDir,
       auto: c.output.auto,
+      publishOnSave: c.output.publishOnSave,
       reconcileMinutes: c.output.reconcileMinutes,
       verbose: c.output.verbose,
       s3: {

package/layers/core/server/api/[collection]/index.put.test.ts

@@ -0,0 +1,76 @@
+import { describe, it, expect, beforeEach } from 'vitest'
+import { createError } from 'h3'
+import Database from 'better-sqlite3'
+import { drizzle } from 'drizzle-orm/better-sqlite3'
+import { buildCollection } from '../../../../fields/server/utils/buildCollection'
+import { defineCollection } from '../../utils/defineCollection'
+import { putSingleton } from '../../utils/crud'
+import { requireCollection } from '../../utils/http'
+import { clearRegistry, registerCollection } from '../../utils/registry'
+import { clearWriteListeners } from '../../utils/write-events'
+import { registerWriteEffect, clearWriteEffects, runWriteEffects } from '../../utils/write-effects'
+import { desiredSchema } from '../../schema/desired'
+import { diffSchema } from '../../schema/diff'
+import { renderSqlite } from '../../schema/render-sqlite'
+
+const settings = buildCollection(defineCollection({
+  name: 'settings', mode: 'single',
+  fields: { title: { type: 'text', required: true } },
+}))
+
+interface FakeEvent { query: Record<string, unknown>; body: unknown; context: { params: Record<string, string> } }
+
+let db: ReturnType<typeof drizzle>
+
+// Bind the auto-imported helpers to the REAL implementations, so this proves the actual wiring rather
+// than a stub (same rationale as options.get.test.ts).
+Object.assign(globalThis, {
+  defineEventHandler: (handler: unknown) => handler,
+  createError,
+  getQuery: (event: FakeEvent) => event.query,
+  readBody: (event: FakeEvent) => Promise.resolve(event.body),
+  useDb: () => db,
+  requireAdmin: () => {},
+  requireCollection,
+  readIfUnmodifiedSince: () => undefined,
+  putSingleton,
+  runWriteEffects,
+})
+
+const handler = (await import('./index.put')).default as unknown as (event: FakeEvent) => Promise<Record<string, unknown>>
+const put = (collection: string, body: unknown) => handler({ query: {}, body, context: { params: { collection } } })
+
+beforeEach(() => {
+  const sqlite = new Database(':memory:')
+  for (const stmt of renderSqlite(diffSchema(desiredSchema([settings.table]), {}))) sqlite.exec(stmt)
+  db = drizzle(sqlite)
+  clearRegistry()
+  registerCollection(settings)
+  clearWriteListeners()
+  clearWriteEffects()
+})
+
+describe('PUT /api/[collection] — singleton save', () => {
+  it('writes the row and returns it', async () => {
+    await expect(put('settings', { title: 'Hello' })).resolves.toMatchObject({ title: 'Hello' })
+  })
+
+  it('runs post-write effects with the saved row', async () => {
+    const seen: unknown[] = []
+    registerWriteEffect((e) => { seen.push([e.def.name, e.row.title]) })
+    await put('settings', { title: 'Hello' })
+    expect(seen).toEqual([['settings', 'Hello']])
+  })
+
+  it('fails the save when an effect rejects — a stale side effect must not report success', async () => {
+    registerWriteEffect(() => { throw createError({ statusCode: 500, statusMessage: 'artifact is stale' }) })
+    await expect(put('settings', { title: 'Hello' })).rejects.toMatchObject({ statusCode: 500, statusMessage: 'artifact is stale' })
+  })
+
+  it('does not run effects when validation rejects the body', async () => {
+    let ran = false
+    registerWriteEffect(() => { ran = true })
+    await expect(put('settings', { title: '' })).rejects.toMatchObject({ statusCode: 400 })
+    expect(ran).toBe(false)
+  })
+})

package/layers/core/server/api/[collection]/index.put.ts

@@ -3,5 +3,22 @@ export default defineEventHandler(async (event) => {
   const collection = requireCollection(event)
   const query = getQuery(event)
   const body = await readBody(event)
-  return putSingleton(useDb(), collection, query.locale as string | undefined, body, { expectedUpdatedAt: readIfUnmodifiedSince(event) })
+  const saved = putSingleton(useDb(), collection, query.locale as string | undefined, body, { expectedUpdatedAt: readIfUnmodifiedSince(event) })
+  // Awaited, and a rejection is the save's response: a singleton whose write has an external side effect
+  // (the redirects artifact the edge serves) is not really saved until that side effect landed, and the
+  // write-event bus swallows throws by design. See write-effects.ts.
+  try {
+    await runWriteEffects(collection.def, saved)
+  } catch (error) {
+    // The row IS committed and its `updatedAt` bumped, but the client only rebaselines on success — so
+    // hand the new baseline back with the error, or the retry these failures ask for would 409 on a
+    // precondition that is stale by construction.
+    const err = error as { statusCode?: number; statusMessage?: string; data?: Record<string, unknown> }
+    throw createError({
+      statusCode: err.statusCode ?? 500,
+      statusMessage: err.statusMessage ?? 'The record was saved but a follow-up step failed',
+      data: { ...(err.data ?? {}), savedUpdatedAt: new Date(saved.updatedAt as string | number).getTime() },
+    })
+  }
+  return saved
 })

package/layers/core/server/schema/introspect.ts

@@ -1,4 +1,4 @@
-import type { ColumnShape, IndexShape, TableShape, SchemaSnapshot } from './model'
+import type { ColumnShape, IndexShape, SchemaSnapshot } from './model'
 
 // Read the *actual* schema of a live SQLite database into the normalized model, so `diffSchema` can
 // compare it against the desired schema (ADR-0002). Typed structurally (prepare + pragma) to keep the

package/layers/core/server/schema/sync.ts

@@ -1,4 +1,4 @@
-import { type IntrospectDb } from './introspect'
+import type { IntrospectDb } from './introspect'
 import { diffSchema } from './diff'
 import { sqlite, type Dialect } from './dialect'
 import type { SchemaSnapshot, SchemaOp } from './model'

package/layers/core/server/utils/collection-types.ts

@@ -20,8 +20,9 @@ export interface BuiltCollection {
   insert: CollectionSchema
   update: CollectionSchema
   select: CollectionSchema
-  /** Re-enforce `required` for conditional fields whose condition is met against the whole record
-   *  (the per-field schema can't see siblings). Returns Zod-shaped issues keyed by the field's def
-   *  name. Present only when the collection has conditional required fields. */
+  /** Every pre-write check the per-field schema can't do because it sees one field at a time: `required`
+   *  re-enforced for conditional fields whose condition is met against the whole record, plus the
+   *  collection's own `def.validate`. Returns Zod-shaped issues keyed by the field's def name. Present
+   *  only when the collection has conditional required fields or a `validate`. */
   applyConditions?: (record: Record<string, unknown>) => { issues: ConditionIssue[] }
 }

package/layers/core/server/utils/crud.ts

@@ -465,10 +465,11 @@ export function removeMany(db: DB, c: BuiltCollection, ids: number[]): { count:
 }
 
 /**
- * Publish / unpublish a batch of rows by persisting their `status` — NOT a separate publish path. Writing
- * `status` and emitting the SAME write event the editor save emits IS the publish: classifyWrite →
- * planInvalidation → the publish queue coalesces N emits into one incremental publish (PUBLISH renders the
- * self route, UNPUBLISH prunes the old route). ALL-OR-NOTHING like `removeMany` (a missing id 404s before
+ * Publish / unpublish a batch of rows by persisting their `status` — the record's public INTENT, not the
+ * static file. Since ADR-0008 those are two steps: this write emits the same event an editor save emits,
+ * and the public layer's listener acts on the removal half only (UNPUBLISH prunes the route at once, so a
+ * page taken offline can never stay live). Making a page appear is the explicit publish action
+ * (`POST /api/publish`). ALL-OR-NOTHING like `removeMany` (a missing id 404s before
  * any write). Validation (`assertConditions`) runs on PUBLISH ONLY — unpublishing must never be blockable
  * (you must always be able to take a broken page offline). Omits `update()`'s slug/transform branches,
  * which are provably inert for a status-only change.

package/layers/core/server/utils/defineCollection.ts

@@ -97,7 +97,7 @@ export type FieldDef =
   | (BaseFieldDef & { type: 'number'; options?: { min?: number; max?: number; integer?: boolean; decimals?: number; unit?: string; units?: string[] } })
   | (BaseFieldDef & { type: 'boolean' })
   | (BaseFieldDef & { type: 'datetime'; options?: { precision?: 'date' | 'datetime' | 'time'; range?: boolean } })
-  | (BaseFieldDef & { type: 'choice'; options: { choices: { label: string; value: string }[]; multiple?: boolean; display?: 'select' | 'buttons' | 'checkboxes' } })
+  | (BaseFieldDef & { type: 'choice'; options: { choices: { label: Localized; value: string }[]; multiple?: boolean; display?: 'select' | 'buttons' | 'checkboxes' } })
   | (BaseFieldDef & { type: 'link'; options?: { types?: LinkType[]; collections?: string[] } })
   | (BaseFieldDef & { type: 'media'; options?: { multiple?: boolean; accept?: 'image' | 'any' } })
   | (BaseFieldDef & { type: 'relation'; relation: { collection: string; many?: boolean; labelField?: string } })
@@ -158,6 +158,13 @@ export interface CollectionDef {
    *  so adding a field never hides it. Absent → today's one-field-per-row. (Deviates from Pruvious, which
    *  nests this under a `dashboard` wrapper — Kestrel keeps its flat CollectionDef idiom.) */
   fieldLayout?: FieldLayoutDSL
+  /** Whole-record validation the per-field Zod schema cannot express, because a field validator only ever
+   *  sees its own value — e.g. a rule set whose rows have to compile as a unit. Runs server-side BEFORE
+   *  the write, next to the conditional-required check, and its issues become the same field-scoped 400
+   *  the editor already renders. Server-only: a function, never serialized.
+   *  Note the asymmetry: `record` is keyed by COLUMN name (`authorId` for a single relation/media field —
+   *  see `resolveColumnName`), while an issue's `path[0]` is the FIELD key the editor renders against. */
+  validate?: (record: Record<string, unknown>) => Array<{ path: (string | number)[]; message: string }>
   /** Display labels. `new` is the complete, per-locale "create" phrase (e.g. de `'Neue Seite'` /
    *  `'Neuer Beitrag'`) — supplying the whole phrase sidesteps German gender agreement, which no
    *  `'Neu {x}'` template can get right. Falls back to a generic phrase from `singular` when absent. */

package/layers/core/server/utils/kestrel-config.ts

@@ -123,6 +123,11 @@ export interface KestrelConfig {
     publicDir?: string
     /** Auto-publish affected pages on every content write (default true). */
     auto?: boolean
+    /** Opt out of the save/publish split (ADR-0008): `true` makes every content write republish the pages
+     *  it affects, as before 2.0 — the editor's Publish button then has nothing left to do and is hidden.
+     *  Default false: saving writes the DB, publishing writes the static files.
+     *  Env `KESTREL_OUTPUT_PUBLISH_ON_SAVE`. */
+    publishOnSave?: boolean
     /** Run a FULL reconcile every N minutes (default 0 = off) — self-heals a missed invalidation. */
     reconcileMinutes?: number
     /** Verbose publish logging: emit a timestamped per-route line (rendered / pruned) on each incremental
@@ -133,10 +138,32 @@ export interface KestrelConfig {
   /** Disable Kestrel's built-in collections (default on). Set in `kestrel: {}` (consumer nuxt.config) or
    *  `kestrel.config.ts`; per-setting env `KESTREL_COLLECTIONS_PAGES` / `_MEDIA` overrides. */
   collections?: { pages?: boolean; media?: boolean }
+  /** Search / answer-engine surface. Both flags default to **false** and stay off until a consumer turns
+   *  them on: each one publishes something the site did not publish before, and an upgrade must never
+   *  start disclosing it. Everything else on this surface (canonical, OG, hreflang, sitemap, robots,
+   *  llms.txt, the WebSite/WebPage JSON-LD graph) is unconditional — it only restates what the page head
+   *  already says. */
+  seo?: {
+    /** Offer editors `author` / `publishedDate` / `keywords` on the SEO panel and publish them as
+     *  schema.org `author` / `datePublished` / `keywords` (which also promotes the page's JSON-LD node
+     *  from `WebPage` to `Article`). Some consumers must not attribute content at all — internal
+     *  authorship, confidentiality — so nothing is emitted and the fields are not even shown unless this
+     *  is on. Env `KESTREL_SEO_ARTICLE_META`. */
+    articleMeta?: boolean
+    /** Serve and publish `/llms-full.txt`: the full Markdown body of every published, indexable page in
+     *  one file (the llmstxt.org long form). Off by default — it aggregates the whole site into a single
+     *  scrapeable artifact, and it reads every page's block content on every publish, which the link-only
+     *  `llms.txt` deliberately avoids. Env `KESTREL_SEO_LLMS_FULL`. */
+    llmsFull?: boolean
+  }
   /** Admin page-builder live preview. `desktopWidth` is the reference viewport width (px) the "Desktop"
    *  preset renders at before the editor's scale-to-fit shrinks it to the pane; default 1440. Env:
    *  `KESTREL_PREVIEW_DESKTOP_WIDTH`. */
   preview?: { desktopWidth?: number }
+  /** EU AI Act Art. 50 disclosure fields on media assets — OFF by default. Kestrel only stores/manages
+   *  this metadata; it never burns a label/watermark into an image and never auto-emits it into public
+   *  output — see docs/media-uploads.md. Env: `KESTREL_AI_DISCLOSURE`. */
+  aiDisclosure?: { enabled?: boolean }
 }
 
 export interface ResolvedKestrel {
@@ -158,14 +185,20 @@ export interface ResolvedKestrel {
     dir: string
     publicDir: string
     auto: boolean
+    publishOnSave: boolean
     reconcileMinutes: number
     verbose: boolean
     s3: ResolvedS3Settings
   }
   /** Resolved built-in-collection toggles (default on). The register plugin skips a built-in whose flag is false. */
   collections: { pages: boolean; media: boolean }
+  /** Resolved answer-engine toggles, both default-off (see `KestrelConfig.seo`). */
+  seo: { articleMeta: boolean; llmsFull: boolean }
   /** Resolved admin-preview settings (surfaced to the client via `runtimeConfig.public`). */
   preview: { desktopWidth: number }
+  /** Gates the media-disclosure UI in the admin ONLY. `ResolvedMedia.aiDisclosure` is always resolved from
+   *  the columns, so turning this off hides the editor controls without touching existing data. */
+  aiDisclosure: { enabled: boolean }
 }
 
 type Env = Record<string, string | undefined>
@@ -394,6 +427,7 @@ export function resolveKestrel(config: KestrelConfig | undefined, env: Env, root
     dir: resolveMaybe(rootDir, clean(env.KESTREL_OUTPUT_DIR) ?? clean(o.dir) ?? '.data/published'),
     publicDir: resolveMaybe(rootDir, clean(env.KESTREL_OUTPUT_PUBLIC_DIR) ?? clean(o.publicDir) ?? '.output/public'),
     auto: envBool(env.KESTREL_OUTPUT_AUTO, o.auto ?? true),
+    publishOnSave: envBool(env.KESTREL_OUTPUT_PUBLISH_ON_SAVE, o.publishOnSave ?? false),
     reconcileMinutes: resolveNonNegInt(o.reconcileMinutes, env.KESTREL_OUTPUT_RECONCILE_MINUTES),
     verbose: envBool(env.KESTREL_OUTPUT_VERBOSE, o.verbose ?? false),
     s3: resolveS3Settings(o.s3, env, 'KESTREL_OUTPUT_S3'),
@@ -404,7 +438,14 @@ export function resolveKestrel(config: KestrelConfig | undefined, env: Env, root
     media: envBool(env.KESTREL_COLLECTIONS_MEDIA, c.collections?.media ?? true),
   }
 
+  const seo = {
+    articleMeta: envBool(env.KESTREL_SEO_ARTICLE_META, c.seo?.articleMeta ?? false),
+    llmsFull: envBool(env.KESTREL_SEO_LLMS_FULL, c.seo?.llmsFull ?? false),
+  }
+
   const preview = { desktopWidth: resolvePosInt(c.preview?.desktopWidth, env.KESTREL_PREVIEW_DESKTOP_WIDTH, 1440) }
 
-  return { dbPath, siteUrl, siteName, siteDescription, supportedLocales, primaryLocale, prefixPrimary, media, output, collections, preview }
+  const aiDisclosure = { enabled: envBool(env.KESTREL_AI_DISCLOSURE, c.aiDisclosure?.enabled ?? false) }
+
+  return { dbPath, siteUrl, siteName, siteDescription, supportedLocales, primaryLocale, prefixPrimary, media, output, collections, seo, preview, aiDisclosure }
 }

package/layers/core/server/utils/seo.ts

@@ -7,13 +7,31 @@ export interface SeoMeta {
   noindex?: boolean
   /** Media id of the social-share image (og:image / twitter card); resolved under `seo.$media.image`. */
   image?: number | null
+  /** Article metadata — schema.org `author` / `datePublished` / `keywords` on the page's JSON-LD node.
+   *  Only offered and only published when `kestrel.seo.articleMeta` is on; the column always ROUND-TRIPS
+   *  them, so turning the flag off hides and unpublishes existing values instead of destroying them. */
+  author?: string
+  /** ISO date (`YYYY-MM-DD`) or ISO datetime; `''` is the editor's cleared state. */
+  publishedDate?: string
+  /** Free-form comma-separated list (the spelling schema.org accepts verbatim). */
+  keywords?: string
 }
 
+// A date is validated here rather than at emission time so a mistyped value surfaces in the editor,
+// where it can be fixed — not silently as a missing `datePublished` in an artifact nobody looks at.
+const isoDateish = z.string().refine(
+  (v) => v === '' || /^\d{4}-\d{2}-\d{2}([T ]\d{2}:\d{2}(:\d{2})?(\.\d+)?(Z|[+-]\d{2}:?\d{2})?)?$/.test(v),
+  { message: 'Expected a date (YYYY-MM-DD)' },
+)
+
 export const seoSchema = z.object({
   title: z.string().optional(),
   description: z.string().optional(),
   noindex: z.boolean().optional(),
   image: z.number().int().positive().nullish(),
+  author: z.string().optional(),
+  publishedDate: isoDateish.optional(),
+  keywords: z.string().optional(),
 })
 
 // The synthetic field set the row populator walks over the `seo` system column (PROPS key-mode), so the

package/layers/core/server/utils/write-effects.ts

@@ -0,0 +1,40 @@
+import type { CollectionDef } from './defineCollection'
+
+/**
+ * Post-write EFFECTS — the fail-able sibling of the write-event bus (`write-events.ts`).
+ *
+ * A write LISTENER is fire-and-forget on purpose: a publish failure must never break a content write, so
+ * `emitWrite` swallows throws. That is exactly wrong for a write whose external side effect is part of
+ * the contract — a redirects artifact the edge serves is stale the moment it fails, and an editor who saw
+ * a green save has no way to know. An EFFECT is awaited by the route and its rejection becomes the save's
+ * error response.
+ *
+ * Deliberately narrow: only the singleton PUT runs effects. Widening it to create/update/delete would make
+ * every content write fail-able, which is the invariant the listener bus exists to protect.
+ *
+ * The DB row is already committed when effects run (better-sqlite3 writes are synchronous and CRUD holds
+ * no transaction), so a failing effect means "saved, but the side effect is stale" — never a rollback.
+ * The message an effect throws has to say so.
+ */
+export interface WriteEffectEvent {
+  def: CollectionDef
+  /** The row as saved. */
+  row: Record<string, unknown>
+}
+
+type WriteEffect = (event: WriteEffectEvent) => Promise<void> | void
+
+const effects: WriteEffect[] = []
+
+export function registerWriteEffect(fn: WriteEffect): void {
+  effects.push(fn)
+}
+
+export function clearWriteEffects(): void {
+  effects.length = 0
+}
+
+/** Run the registered effects in order. Rejects on the first failure, leaving the rest unrun. */
+export async function runWriteEffects(def: CollectionDef, row: Record<string, unknown>): Promise<void> {
+  for (const fn of effects) await fn({ def, row })
+}

package/layers/fields/server/field-registry/index.ts

@@ -161,6 +161,7 @@ export const fieldTypes: Record<string, FieldTypeDescriptor> = {
             type: z.literal('external'),
             // http(s) only, no control chars, no embedded credentials — the value ends up in a static <a href>.
             url: z.string().trim().pipe(z.url({ protocol: /^https?$/ })).refine((v) => {
+              // eslint-disable-next-line no-control-regex -- deliberately rejects control characters embedded in a URL destined for a static <a href>
               if (/[\u0000-\u001f]/.test(v)) return false
               const u = new URL(v)
               return !u.username && !u.password
@@ -168,7 +169,7 @@ export const fieldTypes: Record<string, FieldTypeDescriptor> = {
             label,
           }),
           z.object({ type: z.literal('email'), email: z.string().trim().pipe(z.email()), label }),
-          z.object({ type: z.literal('tel'), tel: z.string().trim().min(1).regex(/^[+0-9 ()\-.\/]+$/).refine((v) => /[0-9]/.test(v), 'Tel must contain at least one digit'), label }),
+          z.object({ type: z.literal('tel'), tel: z.string().trim().min(1).regex(/^[+0-9 ()\-./]+$/).refine((v) => /[0-9]/.test(v), 'Tel must contain at least one digit'), label }),
         ]),
         f,
       )