@michaelthielemann/kestrel 1.7.0 → 2.1.0

package/layers/fields/server/field-registry/sanitize.ts

@@ -1,16 +1,19 @@
 import sanitizeHtml from 'sanitize-html'
 import { RICHTEXT_LINK_SCHEME } from '../../app/utils/richtext-links'
 
+// Kept deliberately in step with the editor's schema (`ui/Richtext.vue`): a tag allowed here that no
+// extension can parse is not "supported", it is a delayed deletion — the editor drops it on load and the
+// next save persists the loss. `richtext.dom.test.ts` asserts the two lists agree, so widening this one
+// means teaching the editor the tag in the same change. Images belong in a media field or an image
+// block, not in flow text; tables await an editor that can hold them.
 export const RICHTEXT_ALLOWLIST: sanitizeHtml.IOptions = {
   allowedTags: [
     'p', 'br', 'span', 'strong', 'b', 'em', 'i', 'u', 's', 'sub', 'sup', 'mark',
     'blockquote', 'pre', 'code', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6',
-    'ul', 'ol', 'li', 'a', 'img', 'figure', 'figcaption', 'hr',
-    'table', 'thead', 'tbody', 'tfoot', 'tr', 'th', 'td',
+    'ul', 'ol', 'li', 'a', 'hr',
   ],
   allowedAttributes: {
     a: ['href', 'title', 'target', 'rel'],
-    img: ['src', 'alt', 'title', 'width', 'height', 'loading'],
     '*': ['class', 'style'],
   },
   allowedStyles: {

package/layers/fields/server/utils/buildCollection.ts

@@ -51,22 +51,24 @@ export function ensureBuilt(c: CollectionDef | BuiltCollection): BuiltCollection
 }
 
 /**
- * Build the `applyConditions` hook for a collection with conditional required fields, or `undefined`
- * when it has none (so CRUD skips it). The per-field schema relaxed every conditional field to optional
- * (it can't see siblings); this re-enforces `required` for the ones whose condition is met against the
- * whole record. Issues are keyed by the field's def name (so they map to the editor's per-field errors),
- * resolving each value at its column key (`<name>Id` for single relation/media).
+ * Build the `applyConditions` hook — every pre-write check the per-field schema can't do — or `undefined`
+ * when the collection needs none (so CRUD skips it). Two sources, both of which need the whole record:
+ * the per-field schema relaxed every conditional field to optional (it can't see siblings), so `required`
+ * is re-enforced here for the ones whose condition is met; and the collection's own `def.validate`, for a
+ * rule spanning fields. Issues are keyed by the field's def name (so they map to the editor's per-field
+ * errors), resolving each value at its column key (`<name>Id` for single relation/media).
  */
 function buildApplyConditions(def: CollectionDef): BuiltCollection['applyConditions'] {
   const required = Object.entries(def.fields).filter(([, f]) => f.condition && f.required)
-  if (!required.length) return undefined
+  if (!required.length && !def.validate) return undefined
+  if (!required.length) return (record) => ({ issues: def.validate!(record) })
   return (record) => {
     const scope: Record<string, unknown> = {}
     for (const [key, field] of Object.entries(def.fields)) scope[key] = record[resolveColumnName(key, field).jsKey]
     const issues = required
       .filter(([key, field]) => evaluateCondition(field.condition!, scope) && isEmptyValue(record[resolveColumnName(key, field).jsKey]))
       .map(([key]) => ({ path: [key], message: 'This field is required.' }))
-    return { issues }
+    return { issues: [...issues, ...(def.validate?.(record) ?? [])] }
   }
 }
 

package/layers/media/app/components/KestrelImg.vue

@@ -1,6 +1,7 @@
 <script setup lang="ts">
 import { useBlurUp } from '../composables/useBlurUp'
 import { useMediaVariant } from '../composables/useMediaVariant'
+import { aiSourceTypeLabel } from '../utils/ai-disclosure'
 import type { ResolvedMedia } from '../../server/utils/resolve'
 import type { VariantFit, VariantFormat } from '../../../core/server/utils/kestrel-config'
 
@@ -17,6 +18,11 @@ const props = defineProps<{
   formats?: VariantFormat[]
   sizes?: string
   priority?: boolean
+  /** Opt into a structurally-present but UNSTYLED EU AI Act disclosure badge (`.kestrel-img__ai-badge`),
+   *  rendered only when `media.aiDisclosure` is set. Off by default: Kestrel must never publish a claim
+   *  the consumer did not ask for, in a place/language/style it cannot know. The alternative escape hatch
+   *  is to read `media.aiDisclosure` and render your own element — see docs/media-uploads.md. */
+  aiBadge?: boolean
 }>()
 
 const { model } = useMediaVariant(
@@ -44,6 +50,11 @@ const { imgEl, animate, placeholderStyle, onLoad } = useBlurUp(() => props.media
       decoding="async"
       @load="onLoad"
     >
+    <span
+      v-if="aiBadge && media?.aiDisclosure"
+      class="kestrel-img__ai-badge"
+      :data-ai-source-type="media.aiDisclosure.sourceType"
+    >{{ media.aiDisclosure.note ?? aiSourceTypeLabel(media.aiDisclosure.sourceType) }}</span>
   </picture>
 </template>
 
@@ -63,3 +74,21 @@ const { imgEl, animate, placeholderStyle, onLoad } = useBlurUp(() => props.media
   }
 }
 </style>
+
+<!-- Deliberately UNSCOPED: a scoped rule carries the `[data-v-*]` attribute selector, which out-specifies
+     a consumer stylesheet targeting `.kestrel-img__ai-badge` and would make the badge un-restylable.
+     Layout only — no color, background, border, radius or font — so nothing is visible as a "badge" until
+     the consumer's own CSS says so. Scoped to pictures that actually contain one, so a consumer who never
+     sets `ai-badge` gets no rule at all. -->
+<style>
+picture:has(> .kestrel-img__ai-badge) {
+  position: relative;
+  display: inline-block;
+}
+.kestrel-img__ai-badge {
+  position: absolute;
+  inset-block-end: 0;
+  inset-inline-start: 0;
+  pointer-events: none;
+}
+</style>

package/layers/media/app/components/MediaLibrary.vue

@@ -51,18 +51,20 @@ function onOpenItem(item: LibraryItem) {
   viewerError.value = ''
   viewerOpen.value = true
 }
-async function onSaveAlt(alt: string) {
+async function onSaveMeta(alt: string, ai?: { aiSourceType: string | null; aiNote: string | null }) {
   const f = viewerFile.value as LibraryFileRow | null
   if (!f) return
   viewerBusy.value = true
   viewerError.value = ''
   try {
     // Alt lives in the per-locale translations JSON; write the primary locale (the library resolves
-    // alt in that same locale, so this round-trips into the list). The precondition header lets the
-    // server 409 instead of silently losing a concurrent edit from another open viewer tab.
+    // alt in that same locale, so this round-trips into the list). The AI disclosure is NOT per-locale,
+    // so it rides alongside as top-level keys — and only when the viewer actually offered it, so a save
+    // from a consumer with the feature off never clears a recorded disclosure. The precondition header
+    // lets the server 409 instead of silently losing a concurrent edit from another open viewer tab.
     await $fetch(`/api/media/${f.id}`, {
       method: 'PATCH',
-      body: { translations: { [primary]: { alt } } },
+      body: { translations: { [primary]: { alt } }, ...(ai ?? {}) },
       ...(f.updatedAt ? { headers: { 'x-kestrel-if-unmodified-since': String(new Date(f.updatedAt).getTime()) } } : {}),
     })
   } catch (e) {
@@ -82,7 +84,8 @@ function onSelect(item: LibraryItem, mods: { toggle: boolean; range: boolean })
   if (props.pick && props.multiple) {
     if (item.type !== 'file') return
     const s = new Set(picked.value)
-    s.has(item.file.id) ? s.delete(item.file.id) : s.add(item.file.id)
+    if (s.has(item.file.id)) s.delete(item.file.id)
+    else s.add(item.file.id)
     picked.value = s
     return
   }
@@ -288,6 +291,7 @@ const localizedMenu = computed(() => menuItems.value.map((s) => ({
 </script>
 
 <template>
+  <!-- eslint-disable-next-line vuejs-accessibility/click-events-have-key-events, vuejs-accessibility/no-static-element-interactions -- @click.self clears selection as a mouse-only bulk convenience; Space-toggle on each MediaGrid/MediaTable item already gives keyboard users the same end state -->
   <section class="media-library" @click.self="lib.clear()" @dragenter="onDragEnter" @dragover="onDragOver" @dragleave="onDragLeave" @drop="onDrop">
     <MediaPathBar :folder="folder" @navigate="lib.navigate" />
     <MediaToolbar
@@ -301,6 +305,7 @@ const localizedMenu = computed(() => menuItems.value.map((s) => ({
     />
     <UiMenu :items="localizedMenu" @select="onMenuSelect">
       <!-- @contextmenu.capture sets the menu target before Reka's own handler opens the menu, so menuItems is correct when the menu renders -->
+      <!-- eslint-disable-next-line vuejs-accessibility/no-static-element-interactions -- contextmenu fires natively via Shift+F10/the Menu key when a MediaGrid/MediaTable item has focus, so this capture handler is already keyboard-reachable -->
       <div class="media-library__items" @contextmenu.capture="onContextMenu">
         <UiAlert v-if="error" variant="error">{{ error }}</UiAlert>
         <p v-else-if="!loading && !items.length" class="media-library__empty">{{ t('media.folderEmpty') }}</p>
@@ -333,7 +338,7 @@ const localizedMenu = computed(() => menuItems.value.map((s) => ({
       @update:open="(v) => { if (!v) upload.resolveAll('skip') }"
     />
     <MediaNewFolderDialog v-model:open="newFolderOpen" @create="onCreateFolder" />
-    <MediaViewer :open="viewerOpen" :file="viewerFile" :busy="viewerBusy" :error="viewerError" @update:open="(v) => { viewerOpen = v }" @save="onSaveAlt" />
+    <MediaViewer :open="viewerOpen" :file="viewerFile" :busy="viewerBusy" :error="viewerError" @update:open="(v) => { viewerOpen = v }" @save="onSaveMeta" />
     <UiAlert v-if="opError && !deleteOpen && !renameOpen" variant="error">{{ opError }}</UiAlert>
     <MediaDeleteDialog
       :open="deleteOpen"

package/layers/media/app/components/MediaToolbar.vue

@@ -47,7 +47,7 @@ function onFiles(e: Event) {
     <div class="media-toolbar__actions">
       <UiButtonGroup v-model="viewModel" :options="VIEW_OPTIONS" :aria-label="t('mediaToolbar.viewAriaLabel')" />
       <span class="media-toolbar__divider" aria-hidden="true"></span>
-      <input ref="fileInput" type="file" multiple class="media-toolbar__file" @change="onFiles" />
+      <input ref="fileInput" type="file" multiple class="media-toolbar__file" :aria-label="t('mediaToolbar.upload')" @change="onFiles" />
       <UiButton :disabled="disabled" @click="fileInput?.click()"><UiIcon name="upload" :size="16" /> {{ t('mediaToolbar.upload') }}</UiButton>
       <UiButton :disabled="disabled" @click="emit('new-folder')"><UiIcon name="folder-plus" :size="16" /> {{ t('mediaToolbar.newFolder') }}</UiButton>
     </div>

package/layers/media/app/components/MediaViewer.vue

@@ -3,9 +3,15 @@ import { ref, computed, watch } from 'vue'
 import { humanizeSize, type LibraryFile } from '../utils/library'
 
 // Fullscreen-ish preview + general info for a single file. Images additionally expose an editable alt
-// text (the only field worth maintaining from the library); everything else is read-only metadata.
+// text (the only field worth maintaining from the library) and — when the consumer switched the feature
+// on — the EU AI Act Art. 50 disclosure; everything else is read-only metadata.
 const props = defineProps<{ open: boolean; file: LibraryFile | null; busy?: boolean; error?: string | null }>()
-const emit = defineEmits<{ 'update:open': [boolean]; save: [string] }>()
+// The disclosure rides along as a SECOND positional argument rather than reshaping the first: an outside
+// consumer (`extensions/galleries-secure`) handles `save` as `(alt: string)` and simply ignores the extra.
+const emit = defineEmits<{
+  'update:open': [boolean]
+  save: [alt: string, ai?: { aiSourceType: string | null; aiNote: string | null }]
+}>()
 const { t, lang } = useT()
 
 const isImage = computed(() => props.file?.mime.startsWith('image/') ?? false)
@@ -18,12 +24,42 @@ const uploaded = computed(() => {
   return Number.isNaN(d.getTime()) ? '—' : d.toLocaleString(lang.value)
 })
 
+// Gates the disclosure controls only — the data is always resolved server-side, so a consumer who turns
+// the flag back off keeps whatever was recorded, it just stops being editable here.
+const aiEnabled = computed(() => useRuntimeConfig().public.aiDisclosureEnabled === true)
+const showAi = computed(() => isImage.value && aiEnabled.value)
+const AI_SOURCE_TYPES = ['trainedAlgorithmicMedia', 'compositeWithTrainedAlgorithmicMedia', 'algorithmicallyEnhanced'] as const
+// A leading empty option is what makes "no disclosure recorded" both representable and clearable
+// (mirrors how `field/Choice.vue` renders a non-required single choice).
+const aiSourceTypeOptions = computed(() => [
+  { label: '—', value: '' },
+  ...AI_SOURCE_TYPES.map((v) => ({ label: t(`mediaViewer.aiSourceType.${v}`), value: v })),
+])
+
 const alt = ref('')
-// Seed (and re-seed) the draft whenever the dialog opens — immediate so a viewer mounted already-open
-// (or re-opened on a different file) shows the current alt rather than a stale/empty value.
-watch(() => props.open, (o) => { if (o) alt.value = props.file?.alt ?? '' }, { immediate: true })
-const dirty = computed(() => isImage.value && alt.value !== (props.file?.alt ?? ''))
-function save() { if (dirty.value && !props.busy) emit('save', alt.value) }
+const aiSourceType = ref('')
+const aiNote = ref('')
+const fileAlt = computed(() => props.file?.alt ?? '')
+const fileAiSourceType = computed(() => props.file?.aiDisclosure?.sourceType ?? '')
+const fileAiNote = computed(() => props.file?.aiDisclosure?.note ?? '')
+// Seed (and re-seed) the drafts whenever the dialog opens — immediate so a viewer mounted already-open
+// (or re-opened on a different file) shows the current values rather than stale/empty ones.
+watch(() => props.open, (o) => {
+  if (!o) return
+  alt.value = fileAlt.value
+  aiSourceType.value = fileAiSourceType.value
+  aiNote.value = fileAiNote.value
+}, { immediate: true })
+
+const aiDirty = computed(() => showAi.value && (aiSourceType.value !== fileAiSourceType.value || aiNote.value !== fileAiNote.value))
+const dirty = computed(() => isImage.value && (alt.value !== fileAlt.value || aiDirty.value))
+function save() {
+  if (!dirty.value || props.busy) return
+  // With the feature off the payload is omitted entirely, so an alt-only save can never blank a
+  // disclosure the consumer recorded while it was on.
+  if (!showAi.value) { emit('save', alt.value); return }
+  emit('save', alt.value, { aiSourceType: aiSourceType.value || null, aiNote: aiNote.value.trim() || null })
+}
 </script>
 
 <template>
@@ -46,6 +82,18 @@ function save() { if (dirty.value && !props.busy) emit('save', alt.value) }
             <UiTextInput v-model="alt" v-bind="f" @keydown.enter="save" />
           </template>
         </UiField>
+        <div v-if="showAi" class="media-viewer__ai">
+          <UiField :label="t('mediaViewer.aiSourceTypeLabel')" :hint="t('mediaViewer.aiSourceTypeHint')">
+            <template #default="f">
+              <UiSelect v-model="aiSourceType" :options="aiSourceTypeOptions" v-bind="f" />
+            </template>
+          </UiField>
+          <UiField :label="t('mediaViewer.aiNote')" :hint="t('mediaViewer.aiNoteHint')">
+            <template #default="f">
+              <UiTextInput v-model="aiNote" v-bind="f" @keydown.enter="save" />
+            </template>
+          </UiField>
+        </div>
         <UiAlert v-if="error" variant="error">{{ error }}</UiAlert>
         <!-- Optional per-file extra panel (e.g. proofing comments). Empty by default. -->
         <slot name="extra" :file="file" />
@@ -81,6 +129,7 @@ function save() { if (dirty.value && !props.busy) emit('save', alt.value) }
 .media-viewer__preview img { max-width: 100%; max-height: 70svh; object-fit: contain; }
 .media-viewer__ext { padding: var(--space-7); font-size: var(--text-xl); font-weight: var(--weight-bold); color: var(--color-text-muted); }
 .media-viewer__details { display: flex; flex-direction: column; gap: var(--space-4); }
+.media-viewer__ai { display: flex; flex-direction: column; gap: var(--space-3); }
 .media-viewer__info { display: flex; flex-direction: column; gap: var(--space-2); margin: 0; }
 .media-viewer__info > div { display: flex; justify-content: space-between; gap: var(--space-3); font-size: var(--text-sm); }
 .media-viewer__info dt { color: var(--color-text-muted); }

package/layers/media/app/components/field/Media.vue

@@ -117,7 +117,9 @@ defineExpose({ onConfirm, removeId, onDragStart, onDrop, moveItem })
   <UiField :id="id" :label="name" :error="error" :required="required">
     <template #default="f">
       <div class="field-media">
+        <!-- eslint-disable-next-line vuejs-accessibility/no-static-element-interactions -- @dragleave is a mouse-only progressive enhancement; the move-earlier/move-later buttons below give the same reorder fully keyboard access -->
         <ul v-if="resolved.length" ref="itemsEl" class="field-media__items" @dragleave="onDragLeave">
+          <!-- eslint-disable-next-line vuejs-accessibility/no-static-element-interactions -- drag handlers are a mouse-only progressive enhancement; the move-earlier/move-later buttons below give the same reorder fully keyboard access -->
           <li
             v-for="(r, i) in resolved"
             :key="r.id"

package/layers/media/app/composables/useMediaLibrary.ts

@@ -119,7 +119,8 @@ export function useMediaLibrary(opts: { urlSync?: boolean; accept?: 'image' | 'a
   function select(item: LibraryItem) { const k = itemKey(item); selected.value = new Set([k]); anchorKey = k }
   function toggle(item: LibraryItem) {
     const k = itemKey(item); const s = new Set(selected.value)
-    s.has(k) ? s.delete(k) : s.add(k)
+    if (s.has(k)) s.delete(k)
+    else s.add(k)
     selected.value = s; anchorKey = k
   }
   function range(item: LibraryItem) { selected.value = computeRange(orderedKeys.value, anchorKey ?? itemKey(item), itemKey(item), selected.value) }

package/layers/media/app/utils/ai-disclosure.ts

@@ -0,0 +1,19 @@
+import type { AiSourceType } from '../../server/utils/resolve'
+
+/**
+ * Default human-readable label for an EU AI Act source type — the badge text when no editor note was
+ * entered. English-only on purpose: it is a fallback, not a translation layer, and a consumer who wants
+ * their own wording (or locale) writes the `aiNote`, styles `.kestrel-img__ai-badge`, or reads
+ * `ResolvedMedia.aiDisclosure` and renders their own element. Kept pure so it stays unit-testable.
+ *
+ * An unrecognised value is returned VERBATIM rather than mapped to a generic label: the column is plain
+ * text at the DB level, and quietly relabelling an unknown value would state a disclosure nobody made.
+ */
+export function aiSourceTypeLabel(sourceType: AiSourceType | string): string {
+  switch (sourceType) {
+    case 'trainedAlgorithmicMedia': return 'AI-generated'
+    case 'compositeWithTrainedAlgorithmicMedia': return 'Contains AI-generated content'
+    case 'algorithmicallyEnhanced': return 'AI-edited'
+    default: return sourceType
+  }
+}

package/layers/media/app/utils/library.ts

@@ -7,6 +7,8 @@ export type { LibraryFolder }
 export interface LibraryFile {
   id: number; filename: string; mime: string; folder: string; size: number
   width?: number; height?: number; thumbhash?: string; src: string; srcset?: string; alt?: string
+  /** EU AI Act Art. 50 disclosure — always listed; `kestrel.config.ts`'s flag only gates the editor. */
+  aiDisclosure?: { sourceType: string; note: string | null } | null
   createdAt?: string
 }
 export type LibraryItem =

package/layers/media/server/api/media/[id].patch.test.ts

@@ -0,0 +1,66 @@
+import { describe, it, expect, beforeEach } from 'vitest'
+import { eq, getTableColumns } from 'drizzle-orm'
+import { createError } from 'h3'
+import { createTestDb } from '../../../../../test/helpers/db'
+import { create } from '../../../../core/server/utils/crud'
+import builtMedia, { media } from '../../collections/media'
+
+interface FakeEvent { body: Record<string, unknown> }
+
+let db: ReturnType<typeof createTestDb>
+let id: number
+
+// The handler is a Nitro route: its auto-imported helpers are plain globals in a node test.
+Object.assign(globalThis, {
+  defineEventHandler: (handler: unknown) => handler,
+  requireAdmin: () => {},
+  createError,
+  requireId: () => id,
+  readIfUnmodifiedSince: () => undefined,
+  readBody: async (event: FakeEvent) => event.body,
+  useDb: () => db,
+  useRuntimeConfig: () => ({ kestrel: {} }),
+})
+
+const handler = (await import('./[id].patch')).default as unknown as (event: FakeEvent) => Promise<Record<string, unknown>>
+const patch = (body: Record<string, unknown>) => handler({ body })
+
+const cols = getTableColumns(media) as Record<string, never>
+const row = () => db.select().from(media).where(eq(cols.id, id)).get() as Record<string, unknown>
+
+beforeEach(() => {
+  db = createTestDb()
+  const created = create(db, builtMedia, { storageKey: 'a/one.png', folder: 'a', filename: 'one.png', mime: 'image/png', ext: 'png', size: 1 }) as { id: number }
+  id = created.id
+})
+
+describe('PATCH /api/media/:id — EU AI Act disclosure', () => {
+  it('persists both disclosure columns', async () => {
+    await patch({ aiSourceType: 'algorithmicallyEnhanced', aiNote: 'upscaled' })
+    expect(row()).toMatchObject({ aiSourceType: 'algorithmicallyEnhanced', aiNote: 'upscaled' })
+  })
+
+  it('clears the classification with an explicit null', async () => {
+    await patch({ aiSourceType: 'trainedAlgorithmicMedia', aiNote: 'Midjourney v7' })
+    await patch({ aiSourceType: null })
+    expect(row().aiSourceType).toBeNull()
+    expect(row().aiNote).toBe('Midjourney v7') // untouched — only the sent keys are written
+  })
+
+  it('rejects an unknown source type with a 400 instead of writing it', async () => {
+    await expect(patch({ aiSourceType: 'nonsense' })).rejects.toThrowError(expect.objectContaining({ statusCode: 400 }))
+    expect(row().aiSourceType).toBeNull()
+  })
+
+  it('stores a blanked note as null rather than an empty string a badge would render', async () => {
+    await patch({ aiSourceType: 'trainedAlgorithmicMedia', aiNote: 'Midjourney v7' })
+    await patch({ aiNote: '   ' })
+    expect(row().aiNote).toBeNull()
+  })
+
+  it('leaves the columns alone when the body does not mention them', async () => {
+    await patch({ aiSourceType: 'trainedAlgorithmicMedia', aiNote: 'note' })
+    await patch({ translations: { en: { alt: 'a kitten' } } })
+    expect(row()).toMatchObject({ aiSourceType: 'trainedAlgorithmicMedia', aiNote: 'note' })
+  })
+})

package/layers/media/server/api/media/[id].patch.ts

@@ -1,9 +1,32 @@
 import { eq, getTableColumns } from 'drizzle-orm'
-import { media } from '../../collections/media'
+import builtMedia, { media } from '../../collections/media'
 import { mergeTranslations, type Translations } from '../../utils/translations'
 import { emitMediaWrite } from '../../utils/media-write'
 import { requireMediaCollection } from '../../utils/media-enabled'
 
+const AI_KEYS = ['aiSourceType', 'aiNote'] as const
+
+/**
+ * The EU AI Act disclosure columns are top-level (not per-locale), so they are patched as plain siblings of
+ * `translations`. Only the keys the body actually sent are written — omitting one must not clear it. The
+ * allow-list of source types is NOT duplicated here: the collection's own update schema (built from the
+ * `choice` field's `choices`) is the single source of truth, so an unknown value 400s instead of storing.
+ */
+function readAiDisclosure(body: Record<string, unknown> | undefined | null): Record<string, unknown> {
+  const sent = AI_KEYS.filter((k) => Object.hasOwn(body ?? {}, k))
+  if (!sent.length) return {}
+  const parsed = builtMedia.update.safeParse(Object.fromEntries(sent.map((k) => [k, body![k]])))
+  if (!parsed.success) {
+    throw createError({ statusCode: 400, statusMessage: `Invalid AI disclosure: ${parsed.error.issues[0]?.message ?? 'unknown value'}` })
+  }
+  const value = parsed.data as Record<string, unknown>
+  const patch: Record<string, unknown> = {}
+  for (const k of sent) patch[k] = value[k] ?? null
+  // A blanked note must round-trip as "no note", not as an empty string a badge would render as blank text.
+  if (patch.aiNote === '') patch.aiNote = null
+  return patch
+}
+
 export default defineEventHandler(async (event) => {
   requireAdmin(event) // write-authorization backstop (defense-in-depth; see require-admin.ts)
   requireMediaCollection()
@@ -34,6 +57,7 @@ export default defineEventHandler(async (event) => {
     // `en.alt` from the media viewer) keeps the other locales AND the locale's other fields intact.
     patch.translations = mergeTranslations(current?.translations, body.translations as Translations)
   }
+  Object.assign(patch, readAiDisclosure(body))
   const row = db.update(media).set(patch).where(eq(cols.id, id)).returning().get() as Record<string, unknown> | undefined
   if (!row) throw createError({ statusCode: 404, statusMessage: `media ${id} not found` })
   emitMediaWrite({ id }, row) // alt/title/description changed → re-render embedding pages (fresh alt text)

package/layers/media/server/api/media/index.post.ts

@@ -1,6 +1,6 @@
 import { createHash } from 'node:crypto'
 import { eq, inArray, getTableColumns, isNull } from 'drizzle-orm'
-import { media } from '../../collections/media'
+import builtMedia, { media } from '../../collections/media'
 import { useStorageDriver, mediaRuntimeConfig } from '../../../../core/server/utils/storage'
 import { sniffMime, extForMime, resolveAllowedMimes } from '../../utils/sniff'
 import { sanitizeFolder, buildKey, suggestFreeName, withExtension } from '../../utils/naming'
@@ -17,6 +17,8 @@ import { isUniqueViolation } from '../../../../core/server/utils/crud'
 import { withLock, mediaLockKey } from '../../../../core/server/utils/key-lock'
 import { requireMediaCollection } from '../../utils/media-enabled'
 import { emitMediaWrite } from '../../utils/media-write'
+import { detectAiSignal, aiSignalNote } from '../../utils/ai-signal-detect'
+import { aiDisclosureEnabled } from '../../utils/ai-disclosure-enabled'
 
 export default defineEventHandler(async (event) => {
   requireAdmin(event) // write-authorization backstop (defense-in-depth; see require-admin.ts)
@@ -83,12 +85,23 @@ export default defineEventHandler(async (event) => {
   const description = text('description')
   const translations = alt || title || description ? { [primaryLocale()]: { alt, title, description } } : {}
 
+  // EU AI Act Art. 50 disclosure. The classification is validated against the collection's own choice
+  // schema so the allow-list has a single source of truth (same as the PATCH route).
+  const aiSourceType = text('aiSourceType')?.trim() || undefined
+  if (aiSourceType && !builtMedia.update.safeParse({ aiSourceType }).success) {
+    throw createError({ statusCode: 400, statusMessage: `Invalid AI disclosure: unknown source type "${aiSourceType}"` })
+  }
+  const uploadedAiNote = text('aiNote')?.trim() || undefined
+  // Only parse when the feature is on: consumers who leave it off pay nothing for it. What the scan finds
+  // is EVIDENCE for the free-text note — it never asserts `aiSourceType`, which stays a human decision.
+  const signal = aiDisclosureEnabled() && !uploadedAiNote ? await detectAiSignal(bytes, mime).catch(() => null) : null
+
   // Serialize the collision-check → put → insert per storageKey: two concurrent uploads to the SAME key
   // (or a backfill re-deriving it) must not interleave, or last-writer-wins would leave the winning row
   // describing the loser's bytes. Different keys never share a lock, so throughput is unaffected.
   const { row, created } = await withLock(mediaLockKey(storageKey), async (): Promise<{ row: Record<string, unknown>; created: boolean }> => {
     const existing = db.select().from(media).where(eq(cols.storageKey, storageKey)).get() as
-      | { id: number; derivatives?: DerivativeManifest; translations?: Translations }
+      | { id: number; derivatives?: DerivativeManifest; translations?: Translations; aiNote?: string | null }
       | undefined
 
     // An object on disk with no media row (another media's derivative, or an orphan) must never be
@@ -131,7 +144,10 @@ export default defineEventHandler(async (event) => {
     }
 
     if (folder) ensureFolder(db, folder)
-    const values = buildMediaValues({ storageKey, folder, filename, mime, ext, size: bytes.length, checksum, derived, translations })
+    // The scan only ever fills a note that would otherwise be empty — it must not talk over an uploader's
+    // own text, nor over one an editor already curated on the row this upload is replacing.
+    const aiNote = uploadedAiNote ?? (existing?.aiNote ? undefined : signal && aiSignalNote(signal))
+    const values = buildMediaValues({ storageKey, folder, filename, mime, ext, size: bytes.length, checksum, derived, translations, aiSourceType, aiNote })
     try {
       // persistUpload writes the objects then the row; on a create-path failure it removes the freshly-written
       // blobs so a partial upload never strands orphans that permanently 409-block the filename.

package/layers/media/server/collections/media.ts

@@ -22,6 +22,20 @@ const built = buildCollection(defineCollection({
     thumbhash: { type: 'text' },
     derivatives: { type: 'json' },
     translations: { type: 'json' },
+    // EU AI Act Art. 50 disclosure. Top-level, NOT per-locale (`translations`): how an asset was produced
+    // does not change per translation. The vocabulary mirrors the disclosure-relevant subset of IPTC's
+    // Digital Source Type, so a later metadata-embedding slice can map 1:1.
+    aiSourceType: {
+      type: 'choice',
+      options: {
+        choices: [
+          { label: 'Fully AI-generated', value: 'trainedAlgorithmicMedia' },
+          { label: 'AI content composited into real media', value: 'compositeWithTrainedAlgorithmicMedia' },
+          { label: 'AI-enhanced / algorithmically edited', value: 'algorithmicallyEnhanced' },
+        ],
+      },
+    },
+    aiNote: { type: 'text' },
   },
 }))
 

package/layers/media/server/utils/ai-disclosure-enabled.ts

@@ -0,0 +1,16 @@
+import { resolveServerKestrel, serverRuntimeConfig } from '../../../core/server/utils/server-config'
+
+/**
+ * Whether the EU AI Act disclosure feature is switched on for this consumer (`aiDisclosure.enabled`).
+ *
+ * It gates the ADMIN UI and the upload-time signal scan — never the data: `ResolvedMedia.aiDisclosure` is
+ * always resolved from whatever the columns hold, so turning the flag off hides the editor without
+ * touching (or hiding) a disclosure already recorded. Same runtimeConfig-then-own-config fallback as
+ * `mediaCollectionEnabled`, so non-Nitro callers (scripts, build) resolve it too.
+ */
+export function aiDisclosureEnabled(): boolean {
+  const cfg = (serverRuntimeConfig()?.kestrel?.aiDisclosure ?? resolveServerKestrel().aiDisclosure) as
+    | { enabled?: boolean }
+    | undefined
+  return cfg?.enabled === true
+}