@michaelthielemann/kestrel 1.7.0 → 2.1.0

package/layers/public/server/api/preview.get.ts

@@ -0,0 +1,28 @@
+import { usePreviewStore, previewOwner } from '../utils/preview-token'
+
+/**
+ * Read back a preview ticket (ADR-0008) — the public page fetches it during SSR when the URL carries
+ * `?kestrel-preview-token=…` and renders the editor's unsaved state instead of the stored record. Admin-
+ * only and session-bound; an expired, foreign or unknown token is `null`, which the page treats as
+ * "nothing to preview" and falls back to the saved content rather than failing the render.
+ */
+export default defineEventHandler((event) => {
+  requireAdmin(event) // write-authorization backstop (defense-in-depth; see require-admin.ts)
+  const token = getQuery(event).token
+  if (typeof token !== 'string' || !token) return null
+  const payload = usePreviewStore().read(token, previewOwner(event))
+  if (!payload) return null
+
+  // The editor sends what a SAVE would send — raw ids for media and relations — so the ticket goes through
+  // the same read population a stored record does. Without it the preview would render a page with the
+  // images and internal links stripped, which is worse than useless for judging a layout.
+  const c = getCollection(payload.collection)
+  if (!c) return { payload }
+  const locale = payload.locale || primaryLocale()
+  const values = withResolveScope(
+    () => populateRow({ ...payload.values }, { depth: 1, locale, def: c.def }),
+    resolveBudgetFor(1),
+    `preview ${payload.collection}`,
+  )
+  return { payload: { ...payload, values } }
+})

package/layers/public/server/api/preview.post.ts

@@ -0,0 +1,93 @@
+import { usePreviewStore, previewOwner, type PreviewPayload } from '../utils/preview-token'
+import type { BuiltCollection } from '../../../core/server/utils/collection-types'
+import { fieldIs, type FieldDef } from '../../../core/server/utils/defineCollection'
+import { resolveColumnName } from '../../../fields/server/field-registry/naming'
+import { sanitizeRichtext } from '../../../fields/server/field-registry/sanitize'
+import { getBlock } from '../../../fields/server/utils/defineBlock'
+
+/** Editor payloads are form state, not uploads — a block tree with populated media is far below this. */
+const MAX_PAYLOAD_BYTES = 2_000_000
+
+/**
+ * Sanitize every richtext leaf reachable from `scope` (top-level fields + nested repeater entries), in
+ * place. Mirrors the WALK shape of crud.ts's `applyFieldTransforms`/`transformNested`, but not the
+ * mechanism: richtext's sanitizer is wired into the Zod validator (`z.string().transform(sanitizeRichtext)`
+ * in field-registry/index.ts), not the field-type's `transform` hook that walk calls — and running the
+ * collection's Zod schema here isn't an option anyway, see `sanitizePreviewValues` below. So this calls
+ * `sanitizeRichtext` directly wherever a `richtext` field is present, and only there; every other field
+ * passes through untouched.
+ */
+function sanitizeRichtextFields(fields: Record<string, FieldDef>, scope: Record<string, unknown>): void {
+  for (const [key, fieldDef] of Object.entries(fields)) {
+    const { jsKey } = resolveColumnName(key, fieldDef)
+    if (!Object.hasOwn(scope, jsKey)) continue
+    if (fieldIs(fieldDef, 'richtext')) {
+      if (typeof scope[jsKey] === 'string') scope[jsKey] = sanitizeRichtext(scope[jsKey] as string)
+    } else if (fieldIs(fieldDef, 'repeater')) {
+      const entries = scope[jsKey]
+      if (Array.isArray(entries)) {
+        for (const entry of entries) if (entry && typeof entry === 'object') sanitizeRichtextFields(fieldDef.options.fields, entry as Record<string, unknown>)
+      }
+    }
+  }
+}
+
+/** Same walk as `transformBlocks` in crud.ts: each block's props (by its registered field defs) + its
+ *  slots' nested blocks, recursively. An unregistered block type is left as-is (matches crud.ts). */
+function sanitizeRichtextInBlocks(blocks: unknown): void {
+  if (!Array.isArray(blocks)) return
+  for (const block of blocks) {
+    if (!block || typeof block !== 'object') continue
+    const b = block as { type?: string; props?: unknown; slots?: unknown }
+    const def = typeof b.type === 'string' ? getBlock(b.type) : undefined
+    if (def && b.props && typeof b.props === 'object') sanitizeRichtextFields(def.fields, b.props as Record<string, unknown>)
+    if (b.slots && typeof b.slots === 'object') for (const sub of Object.values(b.slots as Record<string, unknown>)) sanitizeRichtextInBlocks(sub)
+  }
+}
+
+/**
+ * Apply the richtext sanitizer to a preview ticket's `values` — the fix for the ticket bypassing it
+ * entirely (it normally runs as a Zod `.transform()` on WRITE, `create`/`update`/`putSingleton` in
+ * crud.ts; a ticket never reaches those). Deliberately NOT a schema parse: `values` is the editor's
+ * in-progress, possibly-invalid draft (a missing required field, an out-of-range number, …), and a preview
+ * exists precisely so a draft can be inspected BEFORE it would pass a save — a strict or even a `.partial()`
+ * parse would legitimately reject some of what it must accept. Sanitizing is not a validity constraint
+ * though (it only narrows stored bytes, the same way a save would), so a direct field-tree walk gets the
+ * safety without the rejection risk. Walks top-level fields, repeater entries, and (when the collection
+ * uses the block editor) block props + nested slots — everywhere a richtext leaf can live.
+ */
+function sanitizePreviewValues(collection: BuiltCollection, values: Record<string, unknown>): void {
+  sanitizeRichtextFields(collection.def.fields, values)
+  if (collection.def.blocks?.enabled && Object.hasOwn(values, 'content')) sanitizeRichtextInBlocks(values.content)
+}
+
+/**
+ * Mint a preview ticket for the editor's UNSAVED state (ADR-0008). The editor posts what it currently
+ * holds and opens the page at `?kestrel-preview-token=<token>` in a new tab; nothing is written to the DB,
+ * so previewing never doubles as an unasked-for save. Admin-only (default-deny API guard + the backstop),
+ * and the ticket is bound to this session.
+ *
+ *   body: { collection, id: number | null, locale?, values }
+ *   200:  { token, expiresAt }
+ */
+export default defineEventHandler(async (event) => {
+  requireAdmin(event) // write-authorization backstop (defense-in-depth; see require-admin.ts)
+  const body = (await readBody(event)) as Partial<PreviewPayload> | null
+
+  const name = typeof body?.collection === 'string' ? body.collection : ''
+  const collection = getCollection(name) as BuiltCollection | undefined
+  if (!collection) throw createError({ statusCode: 404, statusMessage: `Unknown collection: ${name}` })
+
+  const values = body?.values
+  if (!values || typeof values !== 'object' || Array.isArray(values)) {
+    throw createError({ statusCode: 400, statusMessage: 'preview requires a `values` object' })
+  }
+  if (JSON.stringify(values).length > MAX_PAYLOAD_BYTES) {
+    throw createError({ statusCode: 413, statusMessage: 'Preview payload too large' })
+  }
+  sanitizePreviewValues(collection, values as Record<string, unknown>)
+
+  const id = typeof body?.id === 'number' && Number.isInteger(body.id) ? body.id : null
+  const locale = typeof body?.locale === 'string' ? body.locale : undefined
+  return usePreviewStore().mint(previewOwner(event), { collection: name, id, locale, values })
+})

package/layers/public/server/api/publish-status.get.ts

@@ -2,6 +2,7 @@ import { eq, getTableColumns } from 'drizzle-orm'
 import type { AnySQLiteTable } from 'drizzle-orm/sqlite-core'
 import { publishStatus } from '../database/publish-status'
 import { routeForRecord } from '../utils/publish/route-for-record'
+import { hasPendingChanges } from '../utils/publish/pending'
 
 /**
  * Admin-only read of the LIVE publish state of a record's static page (`?collection=&id=`). Admin-only by
@@ -17,28 +18,41 @@ export default defineEventHandler((event) => {
   // (`driver`) and whether the runtime publisher actually produces files HERE (prod + `output.auto`). In dev
   // (or with auto off) nothing is ever generated, so the lamp shows a calm "Not built" instead of a stuck
   // "Generating". Read straight from runtimeConfig — no need to pull in the whole publisher module.
-  const output = (useRuntimeConfig().kestrel as { output?: { driver?: 'local' | 's3'; auto?: boolean } }).output
-  const env = { driver: (output?.driver ?? 'local') as 'local' | 's3', generates: !import.meta.dev && !!output?.auto }
+  const output = (useRuntimeConfig().kestrel as { output?: { driver?: 'local' | 's3'; auto?: boolean; publishOnSave?: boolean } }).output
+  // `publishOnSave` also tells the editor whether to offer a Publish button at all: with the split turned
+  // off there is nothing left for it to do.
+  const publishOnSave = !!output?.publishOnSave
+  const env = { driver: (output?.driver ?? 'local') as 'local' | 's3', generates: !import.meta.dev && !!output?.auto, publishOnSave }
 
   const q = getQuery(event)
   const name = typeof q.collection === 'string' ? q.collection : ''
   const id = Number(typeof q.id === 'string' ? q.id : NaN)
   const c = getCollection(name)
-  if (!c || !c.def.pageLike || !Number.isInteger(id) || id <= 0) return { route: null, status: null, ...env }
+  if (!c || !c.def.pageLike || !Number.isInteger(id) || id <= 0) return { route: null, status: null, pending: false, neverPublished: false, ...env }
 
   const db = useDb()
   const table = c.table as AnySQLiteTable
   const cols = getTableColumns(table) as Record<string, never>
-  const row = db.select().from(table).where(eq(cols.id, id)).get() as { path?: unknown; locale?: unknown } | undefined
+  const row = db.select().from(table).where(eq(cols.id, id)).get() as { path?: unknown; locale?: unknown; updatedAt?: unknown } | undefined
   const route = routeForRecord(row, true, primaryLocale(), prefixPrimaryLocale())
-  if (!route) return { route: null, status: null, ...env }
+  if (!route) return { route: null, status: null, pending: false, neverPublished: false, ...env }
 
+  // Saved after it was last published: with publishing deferred to an explicit action, that is the normal
+  // working state of a page being edited — the live file is the previous version until someone publishes.
+  const savedAt = row?.updatedAt instanceof Date ? row.updatedAt.getTime() : null
   try {
     const st = db.select().from(publishStatus).where(eq(publishStatus.route, route)).get()
-    if (!st) return { route, status: null, ...env }
-    return { route, status: st.status, error: st.error, updatedAt: st.updatedAt, target: st.target, ...env }
+    // A routable page with no row was never published. Before the split that was indistinguishable from
+    // "a publish is running" — a save always enqueued one — but now nothing is in flight and nothing will be
+    // until someone presses Publish, so the lamp must not claim progress that is not happening.
+    if (!st) return { route, status: null, pending: false, neverPublished: true, ...env }
+    // With the split off, a save republishes on its own, so a newer save means a republish is in flight —
+    // reporting that as "unpublished changes" would ask the user to act on something already happening.
+    const pending = !publishOnSave && hasPendingChanges(savedAt, st.updatedAt instanceof Date ? st.updatedAt.getTime() : null)
+    return { route, status: st.status, error: st.error, updatedAt: st.updatedAt, target: st.target, pending, neverPublished: false, ...env }
   } catch {
-    // publish_status not migrated yet → treat as "no status" rather than a 500.
-    return { route, status: null, ...env }
+    // publish_status not migrated yet → treat as "no status" rather than a 500. Not "never published"
+    // either: the table is unreadable, so the page's real state is unknown, not known to be absent.
+    return { route, status: null, pending: false, neverPublished: false, ...env }
   }
 })

package/layers/public/server/api/publish.post.ts

@@ -0,0 +1,84 @@
+import { inArray, getTableColumns } from 'drizzle-orm'
+import type { AnySQLiteTable } from 'drizzle-orm/sqlite-core'
+import { MAX_BULK_IDS } from '../../../core/app/utils/list-limits'
+import { classifyWrite, planInvalidation } from '../utils/publish/invalidation'
+import { staleRoutes } from '../utils/publish/deps'
+import { usePublishRuntime } from '../utils/publish/publish-runtime'
+import { allPublishedRoutes } from '../utils/publish/publisher'
+
+/**
+ * Publish records: write their static files (and everything whose baked output embeds them) to the
+ * configured output — the deliberate second half of the split ADR-0008 introduced. Saving persists to the
+ * DB and leaves the live site alone; THIS is what changes what visitors see.
+ *
+ *   body: { collection: string, ids?: number[], id?: number }
+ *   200:  { queued, generates, routes, pruned, drafts }
+ *
+ * The record's publish INTENT (`status`) is not touched here — that is a field the editor saves like any
+ * other, so a page goes live by being published while published. A draft is therefore reported back
+ * (`drafts`) rather than silently promoted: it has no public output to write.
+ *
+ * All-or-nothing on lookup (an unknown id 404s before anything is enqueued), like the bulk write actions.
+ */
+export default defineEventHandler(async (event) => {
+  requireAdmin(event) // write-authorization backstop (defense-in-depth; see require-admin.ts)
+  const body = await readBody(event)
+  const name = typeof (body as { collection?: unknown })?.collection === 'string' ? (body as { collection: string }).collection : ''
+  const c = getCollection(name)
+  if (!c) throw createError({ statusCode: 404, statusMessage: `Unknown collection: ${name}` })
+
+  const raw = (body as { ids?: unknown; id?: unknown })?.ids ?? [(body as { id?: unknown })?.id]
+  const ids = parseIdList(raw, MAX_BULK_IDS)
+
+  const db = useDb()
+  const table = c.table as AnySQLiteTable
+  const cols = getTableColumns(table) as Record<string, never>
+  const rows = db.select().from(table).where(inArray(cols.id, ids)).all() as Record<string, unknown>[]
+  const found = new Set(rows.map((r) => r.id as number))
+  const missing = ids.filter((id) => !found.has(id))
+  if (missing.length) throw createError({ statusCode: 404, statusMessage: `${c.def.name} not found: ${missing.join(', ')}` })
+
+  // Where the next publish would go, and whether one happens here at all: in dev (or with `output.auto`
+  // off) there is no runtime publisher, and saying so is more useful than a queued run that never runs.
+  const output = (useRuntimeConfig().kestrel as { output?: { auto?: boolean } }).output
+  const runtime = usePublishRuntime()
+  const generates = !import.meta.dev && !!output?.auto && !!runtime
+
+  // The live route set answers "is this tracked route still somebody's page?" — the question a rename
+  // leaves open. `failed` means the enumeration was incomplete, and an incomplete read must never drive a
+  // delete (the standing rule from the 2026-07-25 audit), so the prune is skipped wholesale.
+  const liveNow = runtime ? allPublishedRoutes() : { routes: [], failed: ['*'] }
+  const prunable = liveNow.failed.length === 0
+
+  const primary = primaryLocale()
+  const prefixPrimary = prefixPrimaryLocale()
+  const routes: string[] = []
+  const pruned: string[] = []
+  const drafts: number[] = []
+  let queued = false
+
+  for (const row of rows) {
+    // before === after: nothing about the record is changing, this is a re-render of its current state.
+    // A draft classifies as not-published, so `planInvalidation` returns a noop for it — reported below.
+    const ev = classifyWrite(c.def, row, row, primary, prefixPrimary)
+    const inv = planInvalidation(ev)
+    if (inv.type !== 'tags') {
+      drafts.push(row.id as number)
+      continue
+    }
+    // Abandoned URLs: routes the publisher baked FROM this record (tagged with its id) that no live page
+    // claims any more — in practice the old file a published rename left behind. Same rule a full publish
+    // applies globally, scoped to this record's tag; a referrer or listing carrying the tag is a live route
+    // and therefore never in this set.
+    const tagged = ev.id != null ? (runtime?.deps.routesForTags([`${c.def.name}:${ev.id}`]) ?? []) : []
+    const stale = prunable ? staleRoutes(tagged, liveNow.routes) : []
+    routes.push(...inv.render)
+    pruned.push(...stale)
+    if (runtime) {
+      runtime.queue.enqueue({ ...inv, prune: [...inv.prune, ...stale] })
+      queued = true
+    }
+  }
+
+  return { queued, generates, routes, pruned, drafts }
+})

package/layers/public/server/api/route.get.ts

@@ -42,5 +42,13 @@ export default defineEventHandler((event) => {
   if (siteUnreadable || (failed.length && !resolved)) {
     throw createError({ statusCode: 503, statusMessage: 'Route lookup incomplete' })
   }
-  return { collection: resolved?.collection ?? null, page: resolved?.page ?? null, alternates: resolved?.alternates ?? [], site }
+  return {
+    collection: resolved?.collection ?? null,
+    page: resolved?.page ?? null,
+    alternates: resolved?.alternates ?? [],
+    // The breadcrumb trail rides the same fetch as the hreflang set, for the same reason: it is resolved
+    // from the DB, and the publish-dep capture only works on a path the renderer actually awaits.
+    ancestors: resolved?.ancestors ?? [],
+    site,
+  }
 })

package/layers/public/server/collections/redirects.ts

@@ -0,0 +1,75 @@
+import { buildCollection } from '../../../fields/server/utils/buildCollection'
+import { defineCollection } from '../../../core/server/utils/defineCollection'
+import { compileRedirects } from '../utils/publish/redirect-rules'
+
+// Editorial SEO redirects, kept in the DB rather than in config because they outlive a deployment and are
+// the editors' to change. Saving compiles them into the `redirects.json` artifact the edge serves — Kestrel
+// itself never redirects at runtime (there is no live public SSR to redirect in).
+const built = buildCollection(defineCollection({
+  name: 'redirects',
+  mode: 'single',
+  builtin: true,
+  label: { singular: { en: 'Redirects', de: 'Weiterleitungen' }, plural: { en: 'Redirects', de: 'Weiterleitungen' } },
+  icon: 'external-link',
+  fields: {
+    rules: {
+      type: 'repeater',
+      // Row order is priority and there is no per-field help text in the editor, so the rule and the
+      // wildcard syntax have to ride along in the labels — this is the only place an editor sees them.
+      label: {
+        en: 'Rules — the first matching rule wins, so put the most specific one first',
+        de: 'Regeln — die erste passende Regel gewinnt, spezifische zuerst',
+      },
+      options: {
+        fields: {
+          from: {
+            type: 'text',
+            required: true,
+            label: {
+              en: 'From — old path, * = one segment, ** = several',
+              de: 'Von — alter Pfad, * = ein Segment, ** = mehrere',
+            },
+          },
+          to: {
+            type: 'text',
+            required: true,
+            label: {
+              en: 'To — new path or full URL, $1/$2 = the wildcards',
+              de: 'Nach — neuer Pfad oder vollständige URL, $1/$2 = die Platzhalter',
+            },
+          },
+          status: {
+            type: 'choice',
+            label: { en: 'Status', de: 'Status' },
+            options: {
+              choices: [
+                { label: { en: '301 — permanent', de: '301 — dauerhaft' }, value: '301' },
+                { label: { en: '302 — temporary', de: '302 — vorübergehend' }, value: '302' },
+                { label: { en: '307 — temporary, keeps the method', de: '307 — vorübergehend, Methode bleibt' }, value: '307' },
+                { label: { en: '308 — permanent, keeps the method', de: '308 — dauerhaft, Methode bleibt' }, value: '308' },
+              ],
+              display: 'select',
+            },
+            default: '301',
+          },
+        },
+        fieldLayout: [['from|2', 'to|2', 'status|1']],
+      },
+    },
+  },
+  // A row that cannot compile must never reach the DB: it would leave the artifact stale on every
+  // subsequent save and fail the prerender of `/redirects.json`. Zod validates one field at a time and
+  // cannot see that `to: '/x/$2'` needs a second wildcard in `from`, so the check lands here — before the
+  // write, as a field-scoped 400 the editor renders on the repeater.
+  validate: (record) => {
+    try {
+      compileRedirects(record.rules)
+      return []
+    } catch (error) {
+      return [{ path: ['rules'], message: (error as Error).message }]
+    }
+  },
+}))
+
+export const redirects = built.table
+export default built

package/layers/public/server/plugins/03.redirects.ts

@@ -0,0 +1,37 @@
+import { registerWriteEffect } from '../../../core/server/utils/write-effects'
+import { outputDriver } from '../utils/publish/publisher'
+import { REDIRECTS_COLLECTION, REDIRECTS_FIELD, writeRedirectsArtifact } from '../utils/publish/redirects-artifact'
+
+/**
+ * Publish `redirects.json` on every save of the redirects singleton — deliberately decoupled from the
+ * publish cycle, so a redirect goes live without a full republish (and without an editor pressing
+ * Publish, which after ADR-0008 they otherwise would have to).
+ *
+ * A write EFFECT, not a write listener: the bus swallows throws, and a save that reports success while
+ * the edge still serves the old rules is exactly the failure this feature cannot have. Registered in
+ * every environment, unlike the publish plugin — that one is dev-gated because a dev publish would write
+ * Vite-dev HTML with no hashed `_nuxt`, a CONTENT problem this artifact does not have (it is
+ * `JSON.stringify` of DB rows, byte-identical either way).
+ *
+ * Where it lands is `output.dir` / the S3 prefix — the same target the publisher uses. With the classic
+ * `output.auto: false` + `driver: 'local'` build model that is NOT the deployed tree, so there a
+ * redirect goes live with the next `nuxt generate` instead; documented under Redirects in
+ * `docs/static-output.md`.
+ */
+export default defineNitroPlugin(() => {
+  registerWriteEffect(async ({ def, row }) => {
+    if (def.name !== REDIRECTS_COLLECTION) return
+    try {
+      await writeRedirectsArtifact(row[REDIRECTS_FIELD], outputDriver())
+    } catch (error) {
+      // The row is already committed (CRUD holds no transaction), so the only honest message is
+      // "saved, but not live". Short and ASCII on purpose: h3 truncates nothing but the reason phrase is
+      // the wire's, and the cause goes in `data` where nothing can strip it.
+      throw createError({
+        statusCode: 500,
+        statusMessage: 'Redirects saved, but publishing redirects.json failed. Save again to retry.',
+        data: { cause: (error as Error)?.message ?? String(error) },
+      })
+    }
+  })
+})

package/layers/public/server/plugins/zz.publish.ts

@@ -1,8 +1,9 @@
 import { createPublishQueue } from '../utils/publish/queue'
+import { setPublishRuntime } from '../utils/publish/publish-runtime'
 import { DepsStore } from '../utils/publish/deps'
 import { createSqlitePersistence } from '../utils/publish/deps-persistence'
 import { outputDriver, publishInvalidation } from '../utils/publish/publisher'
-import { classifyWrite, planInvalidation } from '../utils/publish/invalidation'
+import { classifyWrite, planWrite } from '../utils/publish/invalidation'
 import { registerWriteListener } from '../../../core/server/utils/write-events'
 
 /**
@@ -19,7 +20,7 @@ import { registerWriteListener } from '../../../core/server/utils/write-events'
  */
 export default defineNitroPlugin(() => {
   if (import.meta.dev) return
-  const output = (useRuntimeConfig().kestrel as { output?: { auto?: boolean; reconcileMinutes?: number; verbose?: boolean } }).output
+  const output = (useRuntimeConfig().kestrel as { output?: { auto?: boolean; publishOnSave?: boolean; reconcileMinutes?: number; verbose?: boolean } }).output
   if (!output?.auto) return
 
   // `output.verbose`: on top of the one-line summary, itemise each incremental republish with a
@@ -48,8 +49,16 @@ export default defineNitroPlugin(() => {
     onError: (error) => console.error('[kestrel] publish run failed:', error),
   })
 
+  // The explicit publish action (`POST /api/publish`) enqueues through this same queue, so a publish and
+  // a write-driven prune are serialized by one single-flight run rather than racing each other.
+  setPublishRuntime({ queue, deps })
+
+  // A save writes the DB, not the site: by default only what a save must still REMOVE from the output (an
+  // unpublished or deleted record's page) passes through, and everything renderable waits for an explicit
+  // publish — see ADR-0008. `output.publishOnSave` restores the pre-2.0 model, where every write republished.
+  const publishOnSave = output.publishOnSave ?? false
   registerWriteListener(({ def, before, after }) => {
-    queue.enqueue(planInvalidation(classifyWrite(def, before, after, primaryLocale(), prefixPrimaryLocale())))
+    queue.enqueue(planWrite(classifyWrite(def, before, after, primaryLocale(), prefixPrimaryLocale()), publishOnSave))
   })
 
   // Boot publish goes THROUGH the queue (not a direct publishFull) so it shares the single-flight guard:

package/layers/public/server/routes/llms-full.txt.get.ts

@@ -0,0 +1,99 @@
+import { getTableColumns } from 'drizzle-orm'
+import { localePath } from '../../../core/app/utils/locale-path'
+import { LLMS_FULL_HEADING_OFFSET } from '../utils/llms-full'
+import type { LlmsFullSection, LlmsFullPage } from '../utils/llms-full'
+import type { BuiltCollection } from '../../../core/server/utils/collection-types'
+
+// The long form of llms.txt: every published, indexable page's full Markdown body in one document, so an
+// answer engine can ground on the site without crawling it. Same registry-driven public set and the same
+// status/noindex filters as `llms.txt` and the sitemap (single source: the auth policy).
+//
+// OPT-IN (`kestrel.seo.llmsFull`, default off), for two reasons that both matter: it aggregates the whole
+// site into one scrapeable artifact — a disclosure decision that belongs to the consumer, not to an
+// upgrade — and unlike `llms.txt` it must read every row's block content, which the publisher would
+// re-render on every incremental publish.
+export default defineEventHandler((event) => {
+  if (!llmsFullEnabled()) throw createError({ statusCode: 404, statusMessage: 'Not Found' })
+  const db = useDb()
+  const base = siteBaseUrl()
+  const primary = primaryLocale()
+  const prefixPrimary = prefixPrimaryLocale()
+
+  setHeader(event, 'content-type', 'text/plain; charset=utf-8')
+  // Without an absolute origin every `Source:` line would be a relative path resolving against whatever
+  // host fetched the file — the same rule `llms.txt` applies to its link list.
+  if (!base) {
+    console.warn('[kestrel] llms-full.txt: siteUrl is unset — omitting page bodies (their URLs would be relative)')
+    return buildLlmsFullTxt({ siteName: siteName(), siteDescription: siteDescription() || undefined, sections: [] })
+  }
+
+  interface Loaded { c: BuiltCollection; rows: Record<string, unknown>[] }
+  const pub = publicReadableResources()
+  const loaded: Loaded[] = []
+  for (const c of allCollections()) {
+    if (!c.def.pageLike) continue
+    if (!isPubliclyReadable(c.def.name, pub)) continue
+    // Project the listing columns plus ONLY the prose-bearing fields — this route does have to read block
+    // content, but a media/relation/json column still has no business being loaded to render text.
+    const cols = getTableColumns(c.table) as Record<string, never>
+    const proj: Record<string, unknown> = { id: cols.id, path: cols.path }
+    if (c.def.translatable) proj.locale = cols.locale
+    if (c.def.status) proj.status = cols.status
+    if (c.def.seo) proj.seo = cols.seo
+    if (c.def.blocks?.enabled) proj.content = cols.content
+    for (const [key, field] of Object.entries(c.def.fields)) {
+      if (field.type === 'text' || field.type === 'richtext' || field.type === 'repeater') proj[key] = cols[key]
+    }
+    try {
+      loaded.push({ c, rows: db.select(proj as never).from(c.table).all() as Record<string, unknown>[] })
+    } catch (error) {
+      // Skipping keeps a bare prerender DB publishable, but a drifted table drops the whole section — a
+      // silent gap the publisher would write straight over the live artifact.
+      console.error(`[kestrel] llms-full.txt: skipped collection ${c.def.name}:`, (error as Error)?.message ?? error)
+    }
+  }
+
+  const advertisable = (c: BuiltCollection, row: Record<string, unknown>): string | null => {
+    if (c.def.status && row.status !== 'published') return null
+    const path = row.path as string | null
+    if (!path) return null
+    if ((row.seo as { noindex?: boolean } | null)?.noindex) return null
+    return base + localePath(path, (row.locale as string | undefined) ?? primary, primary, prefixPrimary)
+  }
+
+  // Internal richtext links are stored as `kestrel:<collection>:<id>` markers. Resolve them from the rows
+  // already loaded — the same status/noindex gate, so a marker pointing at a draft or a noindexed page
+  // declines and the link degrades to its own text instead of leaking an unpublished URL.
+  const linkTargets = new Map<string, string>()
+  for (const { c, rows } of loaded) {
+    for (const row of rows) {
+      const url = advertisable(c, row)
+      if (url) linkTargets.set(`${c.def.name}:${row.id as number}`, url)
+    }
+  }
+  const resolveLink = (collection: string, id: number): string | null => linkTargets.get(`${collection}:${id}`) ?? null
+
+  const sections: LlmsFullSection[] = []
+  for (const { c, rows } of loaded) {
+    const pages: LlmsFullPage[] = []
+    for (const row of rows) {
+      const url = advertisable(c, row)
+      if (!url) continue
+      const seo = (row.seo ?? {}) as { title?: string; description?: string }
+      pages.push({
+        title: seo.title || (row.title as string | undefined) || (row.path as string),
+        url,
+        description: seo.description || undefined,
+        // `title` already IS this page's heading — emitting it again as body text would repeat every
+        // page title twice in the document.
+        body: recordMarkdown(c.def, row, { headingOffset: LLMS_FULL_HEADING_OFFSET, skipFields: ['title'], resolveLink }),
+      })
+    }
+    if (pages.length) {
+      pages.sort((a, b) => a.url.localeCompare(b.url))
+      sections.push({ heading: collectionHeading(c.def, primary), pages })
+    }
+  }
+
+  return buildLlmsFullTxt({ siteName: siteName(), siteDescription: siteDescription() || undefined, sections })
+})

package/layers/public/server/routes/llms.txt.get.ts

@@ -11,17 +11,6 @@ export default defineEventHandler((event) => {
   const primary = primaryLocale()
   const prefixPrimary = prefixPrimaryLocale()
 
-  const cap = (s: string) => (s ? s[0].toUpperCase() + s.slice(1) : s)
-  const headingFor = (def: { name: string; label?: { plural?: unknown } }): string => {
-    const pl = def.label?.plural
-    if (typeof pl === 'string') return pl
-    if (pl && typeof pl === 'object') {
-      const m = pl as Record<string, string>
-      return m[primary] ?? Object.values(m)[0] ?? cap(def.name)
-    }
-    return cap(def.name)
-  }
-
   const pub = publicReadableResources()
   const sections: LlmsSection[] = []
   // Without an absolute origin, every resource URL would be a relative path — omit the page sections (keep
@@ -66,7 +55,7 @@ export default defineEventHandler((event) => {
     }
     if (entries.length) {
       entries.sort((a, b) => a.url.localeCompare(b.url))
-      sections.push({ heading: headingFor(c.def), entries })
+      sections.push({ heading: collectionHeading(c.def, primary), entries })
     }
   }
 

package/layers/public/server/routes/redirects.json.get.ts

@@ -0,0 +1,58 @@
+import { eq } from 'drizzle-orm'
+import { compilePublishableRedirects, serializeRedirects } from '../utils/publish/redirect-rules'
+import { REDIRECTS_COLLECTION, REDIRECTS_FIELD } from '../utils/publish/redirects-artifact'
+
+/**
+ * The redirect artifact the edge polls. A save publishes it directly (see `plugins/03.redirects.ts`);
+ * this route is what makes it survive everything else — it is prerendered into `.output/public`, so the
+ * build-time deploy's reconcile keeps it instead of pruning a key it cannot account for, and a full
+ * publish re-renders it from the live DB. Public and cheap: one row, no user input.
+ *
+ * Zero redirects is a supported state, and so is a collection a consumer toggled off — both serve `[]`,
+ * never a 404, because an edge that cannot fetch the file has to keep its last good state and would
+ * otherwise burn its cold-start budget retrying.
+ */
+
+/** A table that does not exist yet — the release adds one, so a consumer can generate before their
+ *  `db:migrate`. `[]` is the truth there, not a degrade. */
+function tableIsAbsent(error: unknown): boolean {
+  return /no such table/i.test((error as Error)?.message ?? '')
+}
+
+/**
+ * Render the artifact, or fail loudly. The distinction is deliberate and narrow: only a missing table
+ * yields `[]`, because only then is "no redirects" a FACT. Any other read failure (a drifted column, an
+ * I/O error) throws — at build time an errored route costs the deploy its reconcile, which is the
+ * conservative direction, and at runtime `publishMeta` writes nothing on a non-200, where an empty body
+ * would instead overwrite a good live artifact with "no redirects". A failed read must never be an
+ * authoritative empty result.
+ */
+export function renderRedirects(readRows: () => unknown): string {
+  let rows: unknown
+  try {
+    rows = readRows()
+  } catch (error) {
+    if (!tableIsAbsent(error)) throw error
+    console.warn('[kestrel] redirects.json: the redirects table does not exist yet — serving an empty list. Run `db:migrate`.')
+    return serializeRedirects([])
+  }
+  const { rules, skipped } = compilePublishableRedirects(rows)
+  for (const message of skipped) {
+    console.error(`[kestrel] redirects.json: skipped an unpublishable rule — ${message}`)
+  }
+  return serializeRedirects(rules)
+}
+
+export default defineEventHandler((event) => {
+  setHeader(event, 'content-type', 'application/json; charset=utf-8')
+  const collection = getCollection(REDIRECTS_COLLECTION)
+  if (!collection) return serializeRedirects([])
+
+  const cols = collection.table as unknown as Record<string, never>
+  return renderRedirects(() => {
+    const row = useDb().select().from(collection.table).where(eq(cols.singletonKey, REDIRECTS_COLLECTION)).get() as
+      | Record<string, unknown>
+      | undefined
+    return row?.[REDIRECTS_FIELD]
+  })
+})

package/layers/public/server/routes/robots.txt.get.ts

@@ -4,5 +4,6 @@ export default defineEventHandler((event) => {
   return buildRobots({
     sitemapUrl: base ? `${base}/sitemap.xml` : undefined,
     llmsUrl: base ? `${base}/llms.txt` : undefined,
+    llmsFullUrl: base && llmsFullEnabled() ? `${base}/llms-full.txt` : undefined,
   })
 })

package/layers/public/server/tasks/publish/run.ts

@@ -5,7 +5,8 @@ import { createSqlitePersistence } from '../../utils/publish/deps-persistence'
 /**
  * The shared publish engine, exposed as a Nitro task. Renders every published page (+ sitemap/robots)
  * via the live server, mirrors `_nuxt`/assets, and always prunes the routes that left the published set
- * (output ≡ DB).
+ * (output ≡ DB). Like every full publish it HOLDS BACK routes with unpublished changes (ADR-0008) — a
+ * resync must not push work in progress live; those pages go out when they are published.
  *
  * Triggering (Nuxt 4.4 / Nitro 2.13 — there is NO `nuxi task run`):
  *   - dev:  GET http://localhost:3000/_nitro/tasks/publish:run   (the dev-only task route; plumbing smoke test)