@michaelthielemann/kestrel 2.0.0 → 2.1.0

package/README.md

@@ -23,7 +23,8 @@ static host. It is deliberately **not**:
 - **SQLite only** — one database, single instance. (A Postgres `Dialect` seam exists; no impl is active.)
 - **No public data API** — only published *page-like* records have a read surface (mirroring the static
   output); everything else stays behind the admin guard. No per-request rate limiting / live API.
-- **No runtime redirect engine** — handle redirects at the edge (NGINX / CDN).
+- **No runtime redirect engine** — redirects are *authored* in the CMS and published as a `redirects.json`
+  artifact, but Kestrel never answers a 30x itself; an edge (NGINX / njs / CloudFront) has to read it.
 - **No per-file access control on uploads.** The admin guard protects the media *library* — listing,
   editing, deleting — but not the bytes. With `media.driver: 'local'` the files are served from the app
   origin by Nitro's static handler, which runs ahead of every middleware, so anyone who knows a URL can
@@ -49,13 +50,18 @@ static host. It is deliberately **not**:
 - **Block page-builder** — a 3-pane editor (tree · live preview · fields) with nestable block slots; each
   block is a single `app/blocks/*.vue` SFC (schema via field-factory `defineProps` + the display template).
 - **Media library** — upload (magic-byte sniff + SVG sanitize), local or S3 storage, responsive WebP
-  derivatives + thumbhash, folders, and a full-screen asset viewer.
+  derivatives + thumbhash, folders, and a full-screen asset viewer. Optional **EU AI Act (Art. 50)
+  disclosure** fields per asset, with an upload-time scan for AI-origin signals (off by default).
 - **Multilingual content** — optional per-record translations, an editor locale flow, locale-prefixed
   routing, hreflang alternates in the sitemap.
 - **Static output** — `nuxt generate` (full rebuild) or a runtime **incremental publisher** (re-renders
-  only the pages a write affects), to a local dir or S3; emits `sitemap.xml`, `robots.txt`, and
-  **`llms.txt`** (an [llmstxt.org](https://llmstxt.org) site map so AI agents grasp the site). A live
-  in-dashboard preview renders straight from the origin.
+  only the pages a write affects), to a local dir or S3; emits `sitemap.xml`, `robots.txt`,
+  **`llms.txt`** (an [llmstxt.org](https://llmstxt.org) site map so AI agents grasp the site) and
+  `redirects.json`. A live in-dashboard preview renders straight from the origin.
+- **Search + answer engines** — canonical / Open Graph / hreflang tags and a schema.org JSON-LD graph
+  (`WebSite` + `WebPage`/`Article` + `BreadcrumbList`) on every page, no wiring. Two opt-in extras publish
+  more than the page already showed: `seo.articleMeta` (author / publication date / keywords) and
+  `seo.llmsFull` (`/llms-full.txt`, every published page's body in one document).
 - **Reference integrity** — writes invalidate exactly the affected static pages; dead-reference warnings;
   required + globally-unique page slugs per locale.
 
@@ -126,9 +132,9 @@ where to start reading, the cross-layer seams, the gotchas). Then the per-topic
 | [consuming-kestrel.md](docs/consuming-kestrel.md) | Using Kestrel in your own app: defining collections/fields/blocks, auto-discovery, the schema lifecycle |
 | [configuration.md](docs/configuration.md) | The single config source (`kestrel.config.ts`), every `KESTREL_*` env var, the auth/session env split |
 | [block-editing.md](docs/block-editing.md) | The block content model + the 3-pane block editor (tree · preview · fields) |
-| [media-uploads.md](docs/media-uploads.md) | Ingest security, storage drivers (local/S3), responsive-image derivation |
+| [media-uploads.md](docs/media-uploads.md) | Ingest security, storage drivers (local/S3), responsive-image derivation, EU AI Act disclosure |
 | [multilingual.md](docs/multilingual.md) | Content locales, the editor locale flow, locale-prefixed routing |
-| [static-output.md](docs/static-output.md) | `nuxt generate` + the runtime incremental publisher, the live editor preview, `sitemap.xml` / `robots.txt` / `llms.txt`, the optional S3 deploy |
+| [static-output.md](docs/static-output.md) | `nuxt generate` + the runtime incremental publisher, the live editor preview, `sitemap.xml` / `robots.txt` / `llms.txt` / `llms-full.txt`, the JSON-LD structured data, CMS-managed redirects, the optional S3 deploy |
 | [reference-integrity.md](docs/reference-integrity.md) | How writes invalidate the static site precisely, dead-reference warnings (a dead link renders `#`, and the editor is warned), and required/unique page slugs |
 | [architecture-decisions.md](docs/architecture-decisions.md) | ADRs (the collection-derived schema engine, reference integrity, the auth/password choice) |
 
@@ -147,7 +153,8 @@ The CMS is split into Nuxt layers under `layers/`:
   lives in the repo root, dev-only, and is **not** shipped in the package.)
 - **`media`** — uploads, pluggable storage, image derivation, the media library + asset viewer.
 - **`admin`** — the editor SPA: collection list, record editor, the 3-pane block editor.
-- **`public`** — the SSG render path: the catch-all page, `BlockRenderer`, sitemap / robots / llms.txt, deploy.
+- **`public`** — the SSG render path: the catch-all page, `BlockRenderer`, the JSON-LD head, the literal-key
+  artifacts (sitemap / robots / llms.txt / llms-full.txt / redirects.json), deploy.
 
 `playground/` is a small consuming example. `templates/starter/` is what the scaffolder writes out;
 `scripts/kestrel.mjs` is the engine's CLI and `packages/create-kestrel/` the standalone

package/layers/admin/app/components/CollectionList.vue

@@ -1,5 +1,6 @@
 <script setup lang="ts">
 import type { SerializedCollection } from '../../../core/server/utils/serialize-collection'
+import type { Localized } from '../../../core/server/utils/defineCollection'
 import { sortDirection, type FilterCell } from '../utils/list-query'
 import type { ListColumn } from '../utils/list-columns'
 import { PER_PAGE_OPTIONS } from '../../../core/app/utils/list-limits'
@@ -74,7 +75,10 @@ function enumOptions(c: ListColumn): { label: string; value: string }[] {
     { value: 'draft', label: t('pageSettings.statusDraft') },
     { value: 'published', label: t('pageSettings.statusPublished') },
   ]
-  return ((c.field?.options?.choices ?? []) as { label: string; value: string }[])
+  // A choice label is `Localized`, so resolve it here as the editor widget does — `{{ o.label }}` would
+  // stringify a `{ en, de }` map into the filter dropdown.
+  return ((c.field?.options?.choices ?? []) as { label: Localized; value: string }[])
+    .map((o) => ({ value: o.value, label: resolveLocalized(o.label, lang.value) ?? o.value }))
 }
 function displayValue(kind: FilterKind, value: string): string {
   if (kind === 'boolean') return value === 'true' ? t('filter.bool.true') : value === 'false' ? t('filter.bool.false') : value

package/layers/admin/app/components/PageFields.vue

@@ -30,6 +30,10 @@ const { t } = useT()
 const layoutOptions = computed(() => layoutSelectOptions(useOfferableLayouts(), t('pageSettings.layoutDefault')))
 const showLayout = computed(() => !!props.pageLike && layoutOptions.value.length > 1)
 
+// Article metadata is an installation-wide policy (`kestrel.seo.articleMeta`), not a per-collection one,
+// so it comes from runtimeConfig rather than the serialized collection schema.
+const articleMeta = computed(() => (useRuntimeConfig().public as { seoArticleMeta?: boolean }).seoArticleMeta === true)
+
 // Live preview of the slug the server will auto-generate from the title while the field is left blank
 // (the server slugifies the title on save). Falls back to '/' when there is no title yet.
 const slugPlaceholder = computed(() => {
@@ -121,6 +125,7 @@ const slugPlaceholder = computed(() => {
     :path="(values.path as string) ?? ''"
     :locale="locale"
     :disabled="disabled"
+    :article-meta="articleMeta"
     @update="(v) => emit('update', 'seo', v)"
   />
 </template>

package/layers/admin/app/components/SeoFields.vue

@@ -12,6 +12,10 @@ const props = defineProps<{
   path?: string
   locale: string
   disabled?: boolean
+  /** `kestrel.seo.articleMeta`. Off (the default) hides author/date/keywords entirely: an installation
+   *  that must not attribute content should never be offered the fields, not merely stop publishing
+   *  them. Stored values are hidden, never cleared — turning the flag back on restores them. */
+  articleMeta?: boolean
 }>()
 const emit = defineEmits<{ update: [seo: SeoMeta] }>()
 const { t } = useT()
@@ -90,6 +94,44 @@ const socialImageField = { type: 'media', options: { accept: 'image' } } as Fiel
       </template>
     </UiField>
 
+    <!-- Article metadata (schema.org author / datePublished / keywords). Opt-in per installation. -->
+    <template v-if="articleMeta">
+      <UiField class="seo-fields__author" :label="t('seo.author')" :hint="t('seo.authorHint')">
+        <template #default="f">
+          <UiTextInput
+            :model-value="value.author ?? ''"
+            :disabled="disabled"
+            v-bind="f"
+            @update:model-value="(v) => patch({ author: v ?? '' })"
+          />
+        </template>
+      </UiField>
+
+      <UiField class="seo-fields__published" :label="t('seo.publishedDate')" :hint="t('seo.publishedDateHint')">
+        <template #default="f">
+          <UiDatePicker
+            :model-value="value.publishedDate || null"
+            precision="date"
+            :disabled="disabled"
+            :aria-label="t('seo.publishedDate')"
+            :describedby="f['aria-describedby']"
+            @update:model-value="(v) => patch({ publishedDate: v ?? '' })"
+          />
+        </template>
+      </UiField>
+
+      <UiField class="seo-fields__keywords" :label="t('seo.keywords')" :hint="t('seo.keywordsHint')">
+        <template #default="f">
+          <UiTextInput
+            :model-value="value.keywords ?? ''"
+            :disabled="disabled"
+            v-bind="f"
+            @update:model-value="(v) => patch({ keywords: v ?? '' })"
+          />
+        </template>
+      </UiField>
+    </template>
+
     <!-- eslint-disable-next-line vuejs-accessibility/label-has-for -- native wrapping label around a custom UiCheckbox; no `for`/`id` pair needed, invisible to static analysis -->
     <label class="seo-fields__noindex">
       <UiCheckbox

package/layers/admin/app/composables/useEditForm.ts

@@ -278,7 +278,11 @@ export function useEditForm(opts: UseEditFormOptions) {
   }
 
   function handleError(e: unknown) {
-    const { statusCode, statusMessage, issues } = readFetchError(e)
+    const { statusCode, statusMessage, issues, data } = readFetchError(e)
+    // The row WAS written and a follow-up step failed (a write effect — see write-effects.ts), so the
+    // server hands back the new `updatedAt`. Take it as the baseline: the client only rebaselines on
+    // success, and without this the "save again" those errors ask for would 409 on a stale precondition.
+    if (typeof data?.savedUpdatedAt === 'number') baseUpdatedAt.value = data.savedUpdatedAt
     if (statusCode === 400) {
       const mapped = mapServerErrors(issues)
       for (const [k, msg] of Object.entries(mapped.fields)) errors[k] = msg
@@ -292,9 +296,11 @@ export function useEditForm(opts: UseEditFormOptions) {
           ? t('editor.fixBlockContent')
           : Object.keys(mapped.fields).length ? t('editor.fixPageFields') : '')
     } else if (statusCode === 409) {
-      formError.value = statusMessage ?? t('editor.saveConflict')
+      // `||`, not `??`: an absent reason phrase arrives as '' rather than undefined, and an empty banner
+      // is a silent failure — the Save button simply stops spinning.
+      formError.value = statusMessage || t('editor.saveConflict')
     } else {
-      formError.value = statusMessage ?? t('editor.saveFailed')
+      formError.value = statusMessage || t('editor.saveFailed')
     }
   }
 

package/layers/admin/app/utils/edit-form.ts

@@ -17,6 +17,8 @@ export interface FetchErrorInfo {
   statusCode?: number
   statusMessage?: string
   issues: ServerIssue[]
+  /** The error body when it is NOT a Zod-issue array — e.g. `{ savedUpdatedAt }` from a failed write effect. */
+  data?: Record<string, unknown>
 }
 
 // The wire `SerializedField` is structurally what every Field* widget and `validateField` read
@@ -26,13 +28,18 @@ export function asFieldDef(field: SerializedField): FieldDef {
 }
 
 // Read an ofetch/H3 error envelope: top-level statusCode/statusMessage, Zod issues nested at err.data.data.
+// The BODY's statusMessage wins over the response's: ofetch maps `statusMessage` from `response.statusText`,
+// and HTTP/2 has no reason phrase — behind any h2 proxy that arrives as '' and the real message is only in
+// the JSON. Anything else under `data` (not an issue array) is handed back for the caller to act on.
 export function readFetchError(e: unknown): FetchErrorInfo {
   const err = e as { statusCode?: number; statusMessage?: string; data?: { data?: ServerIssue[] } & Record<string, unknown> }
-  const raw = err.data?.data ?? err.data
+  const body = Array.isArray(err.data) ? undefined : err.data
+  const raw = body?.data ?? err.data
   return {
     statusCode: err.statusCode,
-    statusMessage: err.statusMessage,
+    statusMessage: (body?.statusMessage as string | undefined) || err.statusMessage,
     issues: Array.isArray(raw) ? (raw as ServerIssue[]) : [],
+    ...(body && !Array.isArray(body.data) ? { data: body } : {}),
   }
 }
 

package/layers/core/modules/kestrel/index.ts

@@ -56,6 +56,13 @@ export default defineNuxtModule<KestrelConfig>({
     pub.siteName = c.siteName ?? ''
     // Reference desktop width (px) for the admin page-builder preset; the editor's scale-to-fit shrinks it.
     pub.previewDesktopWidth = c.preview.desktopWidth
+    // Whether the admin shows the EU AI Act disclosure controls on a media asset; the data itself is
+    // always resolved server-side, so flipping this off only hides the editor.
+    pub.aiDisclosureEnabled = c.aiDisclosure.enabled
+    // Article metadata is an APP-side concern on both ends — the admin SEO panel decides whether to offer
+    // the fields, the public page decides whether to publish them as JSON-LD — so the flag has to be
+    // client-visible. It gates a disclosure, not a secret.
+    pub.seoArticleMeta = c.seo.articleMeta
 
     // Server-only resolved settings, so server utils read the CONSUMER's `kestrel: {}` (via this module)
     // rather than importing Kestrel's own `kestrel.config.ts` file. Essential when Kestrel is consumed as
@@ -67,6 +74,10 @@ export default defineNuxtModule<KestrelConfig>({
     srv.siteDescription = c.siteDescription
     // Built-in collection toggles (pages/media) — read by the register plugin to gate built-ins.
     srv.collections = c.collections
+    // Read by the upload route to decide whether to run the AI-signal scan at all.
+    srv.aiDisclosure = c.aiDisclosure
+    // Answer-engine toggles; `llmsFull` is server-only (it gates a Nitro route and what the publisher writes).
+    srv.seo = c.seo
     // Static-publish target for the runtime publisher (server-only). S3 creds are env-only; prefer the
     // output-specific creds, fall back to the shared media creds so a single S3 account "just works".
     srv.output = {

package/layers/core/server/api/[collection]/index.put.test.ts

@@ -0,0 +1,76 @@
+import { describe, it, expect, beforeEach } from 'vitest'
+import { createError } from 'h3'
+import Database from 'better-sqlite3'
+import { drizzle } from 'drizzle-orm/better-sqlite3'
+import { buildCollection } from '../../../../fields/server/utils/buildCollection'
+import { defineCollection } from '../../utils/defineCollection'
+import { putSingleton } from '../../utils/crud'
+import { requireCollection } from '../../utils/http'
+import { clearRegistry, registerCollection } from '../../utils/registry'
+import { clearWriteListeners } from '../../utils/write-events'
+import { registerWriteEffect, clearWriteEffects, runWriteEffects } from '../../utils/write-effects'
+import { desiredSchema } from '../../schema/desired'
+import { diffSchema } from '../../schema/diff'
+import { renderSqlite } from '../../schema/render-sqlite'
+
+const settings = buildCollection(defineCollection({
+  name: 'settings', mode: 'single',
+  fields: { title: { type: 'text', required: true } },
+}))
+
+interface FakeEvent { query: Record<string, unknown>; body: unknown; context: { params: Record<string, string> } }
+
+let db: ReturnType<typeof drizzle>
+
+// Bind the auto-imported helpers to the REAL implementations, so this proves the actual wiring rather
+// than a stub (same rationale as options.get.test.ts).
+Object.assign(globalThis, {
+  defineEventHandler: (handler: unknown) => handler,
+  createError,
+  getQuery: (event: FakeEvent) => event.query,
+  readBody: (event: FakeEvent) => Promise.resolve(event.body),
+  useDb: () => db,
+  requireAdmin: () => {},
+  requireCollection,
+  readIfUnmodifiedSince: () => undefined,
+  putSingleton,
+  runWriteEffects,
+})
+
+const handler = (await import('./index.put')).default as unknown as (event: FakeEvent) => Promise<Record<string, unknown>>
+const put = (collection: string, body: unknown) => handler({ query: {}, body, context: { params: { collection } } })
+
+beforeEach(() => {
+  const sqlite = new Database(':memory:')
+  for (const stmt of renderSqlite(diffSchema(desiredSchema([settings.table]), {}))) sqlite.exec(stmt)
+  db = drizzle(sqlite)
+  clearRegistry()
+  registerCollection(settings)
+  clearWriteListeners()
+  clearWriteEffects()
+})
+
+describe('PUT /api/[collection] — singleton save', () => {
+  it('writes the row and returns it', async () => {
+    await expect(put('settings', { title: 'Hello' })).resolves.toMatchObject({ title: 'Hello' })
+  })
+
+  it('runs post-write effects with the saved row', async () => {
+    const seen: unknown[] = []
+    registerWriteEffect((e) => { seen.push([e.def.name, e.row.title]) })
+    await put('settings', { title: 'Hello' })
+    expect(seen).toEqual([['settings', 'Hello']])
+  })
+
+  it('fails the save when an effect rejects — a stale side effect must not report success', async () => {
+    registerWriteEffect(() => { throw createError({ statusCode: 500, statusMessage: 'artifact is stale' }) })
+    await expect(put('settings', { title: 'Hello' })).rejects.toMatchObject({ statusCode: 500, statusMessage: 'artifact is stale' })
+  })
+
+  it('does not run effects when validation rejects the body', async () => {
+    let ran = false
+    registerWriteEffect(() => { ran = true })
+    await expect(put('settings', { title: '' })).rejects.toMatchObject({ statusCode: 400 })
+    expect(ran).toBe(false)
+  })
+})

package/layers/core/server/api/[collection]/index.put.ts

@@ -3,5 +3,22 @@ export default defineEventHandler(async (event) => {
   const collection = requireCollection(event)
   const query = getQuery(event)
   const body = await readBody(event)
-  return putSingleton(useDb(), collection, query.locale as string | undefined, body, { expectedUpdatedAt: readIfUnmodifiedSince(event) })
+  const saved = putSingleton(useDb(), collection, query.locale as string | undefined, body, { expectedUpdatedAt: readIfUnmodifiedSince(event) })
+  // Awaited, and a rejection is the save's response: a singleton whose write has an external side effect
+  // (the redirects artifact the edge serves) is not really saved until that side effect landed, and the
+  // write-event bus swallows throws by design. See write-effects.ts.
+  try {
+    await runWriteEffects(collection.def, saved)
+  } catch (error) {
+    // The row IS committed and its `updatedAt` bumped, but the client only rebaselines on success — so
+    // hand the new baseline back with the error, or the retry these failures ask for would 409 on a
+    // precondition that is stale by construction.
+    const err = error as { statusCode?: number; statusMessage?: string; data?: Record<string, unknown> }
+    throw createError({
+      statusCode: err.statusCode ?? 500,
+      statusMessage: err.statusMessage ?? 'The record was saved but a follow-up step failed',
+      data: { ...(err.data ?? {}), savedUpdatedAt: new Date(saved.updatedAt as string | number).getTime() },
+    })
+  }
+  return saved
 })

package/layers/core/server/utils/collection-types.ts

@@ -20,8 +20,9 @@ export interface BuiltCollection {
   insert: CollectionSchema
   update: CollectionSchema
   select: CollectionSchema
-  /** Re-enforce `required` for conditional fields whose condition is met against the whole record
-   *  (the per-field schema can't see siblings). Returns Zod-shaped issues keyed by the field's def
-   *  name. Present only when the collection has conditional required fields. */
+  /** Every pre-write check the per-field schema can't do because it sees one field at a time: `required`
+   *  re-enforced for conditional fields whose condition is met against the whole record, plus the
+   *  collection's own `def.validate`. Returns Zod-shaped issues keyed by the field's def name. Present
+   *  only when the collection has conditional required fields or a `validate`. */
   applyConditions?: (record: Record<string, unknown>) => { issues: ConditionIssue[] }
 }

package/layers/core/server/utils/defineCollection.ts

@@ -97,7 +97,7 @@ export type FieldDef =
   | (BaseFieldDef & { type: 'number'; options?: { min?: number; max?: number; integer?: boolean; decimals?: number; unit?: string; units?: string[] } })
   | (BaseFieldDef & { type: 'boolean' })
   | (BaseFieldDef & { type: 'datetime'; options?: { precision?: 'date' | 'datetime' | 'time'; range?: boolean } })
-  | (BaseFieldDef & { type: 'choice'; options: { choices: { label: string; value: string }[]; multiple?: boolean; display?: 'select' | 'buttons' | 'checkboxes' } })
+  | (BaseFieldDef & { type: 'choice'; options: { choices: { label: Localized; value: string }[]; multiple?: boolean; display?: 'select' | 'buttons' | 'checkboxes' } })
   | (BaseFieldDef & { type: 'link'; options?: { types?: LinkType[]; collections?: string[] } })
   | (BaseFieldDef & { type: 'media'; options?: { multiple?: boolean; accept?: 'image' | 'any' } })
   | (BaseFieldDef & { type: 'relation'; relation: { collection: string; many?: boolean; labelField?: string } })
@@ -158,6 +158,13 @@ export interface CollectionDef {
    *  so adding a field never hides it. Absent → today's one-field-per-row. (Deviates from Pruvious, which
    *  nests this under a `dashboard` wrapper — Kestrel keeps its flat CollectionDef idiom.) */
   fieldLayout?: FieldLayoutDSL
+  /** Whole-record validation the per-field Zod schema cannot express, because a field validator only ever
+   *  sees its own value — e.g. a rule set whose rows have to compile as a unit. Runs server-side BEFORE
+   *  the write, next to the conditional-required check, and its issues become the same field-scoped 400
+   *  the editor already renders. Server-only: a function, never serialized.
+   *  Note the asymmetry: `record` is keyed by COLUMN name (`authorId` for a single relation/media field —
+   *  see `resolveColumnName`), while an issue's `path[0]` is the FIELD key the editor renders against. */
+  validate?: (record: Record<string, unknown>) => Array<{ path: (string | number)[]; message: string }>
   /** Display labels. `new` is the complete, per-locale "create" phrase (e.g. de `'Neue Seite'` /
    *  `'Neuer Beitrag'`) — supplying the whole phrase sidesteps German gender agreement, which no
    *  `'Neu {x}'` template can get right. Falls back to a generic phrase from `singular` when absent. */

package/layers/core/server/utils/kestrel-config.ts

@@ -138,10 +138,32 @@ export interface KestrelConfig {
   /** Disable Kestrel's built-in collections (default on). Set in `kestrel: {}` (consumer nuxt.config) or
    *  `kestrel.config.ts`; per-setting env `KESTREL_COLLECTIONS_PAGES` / `_MEDIA` overrides. */
   collections?: { pages?: boolean; media?: boolean }
+  /** Search / answer-engine surface. Both flags default to **false** and stay off until a consumer turns
+   *  them on: each one publishes something the site did not publish before, and an upgrade must never
+   *  start disclosing it. Everything else on this surface (canonical, OG, hreflang, sitemap, robots,
+   *  llms.txt, the WebSite/WebPage JSON-LD graph) is unconditional — it only restates what the page head
+   *  already says. */
+  seo?: {
+    /** Offer editors `author` / `publishedDate` / `keywords` on the SEO panel and publish them as
+     *  schema.org `author` / `datePublished` / `keywords` (which also promotes the page's JSON-LD node
+     *  from `WebPage` to `Article`). Some consumers must not attribute content at all — internal
+     *  authorship, confidentiality — so nothing is emitted and the fields are not even shown unless this
+     *  is on. Env `KESTREL_SEO_ARTICLE_META`. */
+    articleMeta?: boolean
+    /** Serve and publish `/llms-full.txt`: the full Markdown body of every published, indexable page in
+     *  one file (the llmstxt.org long form). Off by default — it aggregates the whole site into a single
+     *  scrapeable artifact, and it reads every page's block content on every publish, which the link-only
+     *  `llms.txt` deliberately avoids. Env `KESTREL_SEO_LLMS_FULL`. */
+    llmsFull?: boolean
+  }
   /** Admin page-builder live preview. `desktopWidth` is the reference viewport width (px) the "Desktop"
    *  preset renders at before the editor's scale-to-fit shrinks it to the pane; default 1440. Env:
    *  `KESTREL_PREVIEW_DESKTOP_WIDTH`. */
   preview?: { desktopWidth?: number }
+  /** EU AI Act Art. 50 disclosure fields on media assets — OFF by default. Kestrel only stores/manages
+   *  this metadata; it never burns a label/watermark into an image and never auto-emits it into public
+   *  output — see docs/media-uploads.md. Env: `KESTREL_AI_DISCLOSURE`. */
+  aiDisclosure?: { enabled?: boolean }
 }
 
 export interface ResolvedKestrel {
@@ -170,8 +192,13 @@ export interface ResolvedKestrel {
   }
   /** Resolved built-in-collection toggles (default on). The register plugin skips a built-in whose flag is false. */
   collections: { pages: boolean; media: boolean }
+  /** Resolved answer-engine toggles, both default-off (see `KestrelConfig.seo`). */
+  seo: { articleMeta: boolean; llmsFull: boolean }
   /** Resolved admin-preview settings (surfaced to the client via `runtimeConfig.public`). */
   preview: { desktopWidth: number }
+  /** Gates the media-disclosure UI in the admin ONLY. `ResolvedMedia.aiDisclosure` is always resolved from
+   *  the columns, so turning this off hides the editor controls without touching existing data. */
+  aiDisclosure: { enabled: boolean }
 }
 
 type Env = Record<string, string | undefined>
@@ -411,7 +438,14 @@ export function resolveKestrel(config: KestrelConfig | undefined, env: Env, root
     media: envBool(env.KESTREL_COLLECTIONS_MEDIA, c.collections?.media ?? true),
   }
 
+  const seo = {
+    articleMeta: envBool(env.KESTREL_SEO_ARTICLE_META, c.seo?.articleMeta ?? false),
+    llmsFull: envBool(env.KESTREL_SEO_LLMS_FULL, c.seo?.llmsFull ?? false),
+  }
+
   const preview = { desktopWidth: resolvePosInt(c.preview?.desktopWidth, env.KESTREL_PREVIEW_DESKTOP_WIDTH, 1440) }
 
-  return { dbPath, siteUrl, siteName, siteDescription, supportedLocales, primaryLocale, prefixPrimary, media, output, collections, preview }
+  const aiDisclosure = { enabled: envBool(env.KESTREL_AI_DISCLOSURE, c.aiDisclosure?.enabled ?? false) }
+
+  return { dbPath, siteUrl, siteName, siteDescription, supportedLocales, primaryLocale, prefixPrimary, media, output, collections, seo, preview, aiDisclosure }
 }

package/layers/core/server/utils/seo.ts

@@ -7,13 +7,31 @@ export interface SeoMeta {
   noindex?: boolean
   /** Media id of the social-share image (og:image / twitter card); resolved under `seo.$media.image`. */
   image?: number | null
+  /** Article metadata — schema.org `author` / `datePublished` / `keywords` on the page's JSON-LD node.
+   *  Only offered and only published when `kestrel.seo.articleMeta` is on; the column always ROUND-TRIPS
+   *  them, so turning the flag off hides and unpublishes existing values instead of destroying them. */
+  author?: string
+  /** ISO date (`YYYY-MM-DD`) or ISO datetime; `''` is the editor's cleared state. */
+  publishedDate?: string
+  /** Free-form comma-separated list (the spelling schema.org accepts verbatim). */
+  keywords?: string
 }
 
+// A date is validated here rather than at emission time so a mistyped value surfaces in the editor,
+// where it can be fixed — not silently as a missing `datePublished` in an artifact nobody looks at.
+const isoDateish = z.string().refine(
+  (v) => v === '' || /^\d{4}-\d{2}-\d{2}([T ]\d{2}:\d{2}(:\d{2})?(\.\d+)?(Z|[+-]\d{2}:?\d{2})?)?$/.test(v),
+  { message: 'Expected a date (YYYY-MM-DD)' },
+)
+
 export const seoSchema = z.object({
   title: z.string().optional(),
   description: z.string().optional(),
   noindex: z.boolean().optional(),
   image: z.number().int().positive().nullish(),
+  author: z.string().optional(),
+  publishedDate: isoDateish.optional(),
+  keywords: z.string().optional(),
 })
 
 // The synthetic field set the row populator walks over the `seo` system column (PROPS key-mode), so the

package/layers/core/server/utils/write-effects.ts

@@ -0,0 +1,40 @@
+import type { CollectionDef } from './defineCollection'
+
+/**
+ * Post-write EFFECTS — the fail-able sibling of the write-event bus (`write-events.ts`).
+ *
+ * A write LISTENER is fire-and-forget on purpose: a publish failure must never break a content write, so
+ * `emitWrite` swallows throws. That is exactly wrong for a write whose external side effect is part of
+ * the contract — a redirects artifact the edge serves is stale the moment it fails, and an editor who saw
+ * a green save has no way to know. An EFFECT is awaited by the route and its rejection becomes the save's
+ * error response.
+ *
+ * Deliberately narrow: only the singleton PUT runs effects. Widening it to create/update/delete would make
+ * every content write fail-able, which is the invariant the listener bus exists to protect.
+ *
+ * The DB row is already committed when effects run (better-sqlite3 writes are synchronous and CRUD holds
+ * no transaction), so a failing effect means "saved, but the side effect is stale" — never a rollback.
+ * The message an effect throws has to say so.
+ */
+export interface WriteEffectEvent {
+  def: CollectionDef
+  /** The row as saved. */
+  row: Record<string, unknown>
+}
+
+type WriteEffect = (event: WriteEffectEvent) => Promise<void> | void
+
+const effects: WriteEffect[] = []
+
+export function registerWriteEffect(fn: WriteEffect): void {
+  effects.push(fn)
+}
+
+export function clearWriteEffects(): void {
+  effects.length = 0
+}
+
+/** Run the registered effects in order. Rejects on the first failure, leaving the rest unrun. */
+export async function runWriteEffects(def: CollectionDef, row: Record<string, unknown>): Promise<void> {
+  for (const fn of effects) await fn({ def, row })
+}

package/layers/fields/server/utils/buildCollection.ts

@@ -51,22 +51,24 @@ export function ensureBuilt(c: CollectionDef | BuiltCollection): BuiltCollection
 }
 
 /**
- * Build the `applyConditions` hook for a collection with conditional required fields, or `undefined`
- * when it has none (so CRUD skips it). The per-field schema relaxed every conditional field to optional
- * (it can't see siblings); this re-enforces `required` for the ones whose condition is met against the
- * whole record. Issues are keyed by the field's def name (so they map to the editor's per-field errors),
- * resolving each value at its column key (`<name>Id` for single relation/media).
+ * Build the `applyConditions` hook — every pre-write check the per-field schema can't do — or `undefined`
+ * when the collection needs none (so CRUD skips it). Two sources, both of which need the whole record:
+ * the per-field schema relaxed every conditional field to optional (it can't see siblings), so `required`
+ * is re-enforced here for the ones whose condition is met; and the collection's own `def.validate`, for a
+ * rule spanning fields. Issues are keyed by the field's def name (so they map to the editor's per-field
+ * errors), resolving each value at its column key (`<name>Id` for single relation/media).
  */
 function buildApplyConditions(def: CollectionDef): BuiltCollection['applyConditions'] {
   const required = Object.entries(def.fields).filter(([, f]) => f.condition && f.required)
-  if (!required.length) return undefined
+  if (!required.length && !def.validate) return undefined
+  if (!required.length) return (record) => ({ issues: def.validate!(record) })
   return (record) => {
     const scope: Record<string, unknown> = {}
     for (const [key, field] of Object.entries(def.fields)) scope[key] = record[resolveColumnName(key, field).jsKey]
     const issues = required
       .filter(([key, field]) => evaluateCondition(field.condition!, scope) && isEmptyValue(record[resolveColumnName(key, field).jsKey]))
       .map(([key]) => ({ path: [key], message: 'This field is required.' }))
-    return { issues }
+    return { issues: [...issues, ...(def.validate?.(record) ?? [])] }
   }
 }
 

package/layers/media/app/components/KestrelImg.vue

@@ -1,6 +1,7 @@
 <script setup lang="ts">
 import { useBlurUp } from '../composables/useBlurUp'
 import { useMediaVariant } from '../composables/useMediaVariant'
+import { aiSourceTypeLabel } from '../utils/ai-disclosure'
 import type { ResolvedMedia } from '../../server/utils/resolve'
 import type { VariantFit, VariantFormat } from '../../../core/server/utils/kestrel-config'
 
@@ -17,6 +18,11 @@ const props = defineProps<{
   formats?: VariantFormat[]
   sizes?: string
   priority?: boolean
+  /** Opt into a structurally-present but UNSTYLED EU AI Act disclosure badge (`.kestrel-img__ai-badge`),
+   *  rendered only when `media.aiDisclosure` is set. Off by default: Kestrel must never publish a claim
+   *  the consumer did not ask for, in a place/language/style it cannot know. The alternative escape hatch
+   *  is to read `media.aiDisclosure` and render your own element — see docs/media-uploads.md. */
+  aiBadge?: boolean
 }>()
 
 const { model } = useMediaVariant(
@@ -44,6 +50,11 @@ const { imgEl, animate, placeholderStyle, onLoad } = useBlurUp(() => props.media
       decoding="async"
       @load="onLoad"
     >
+    <span
+      v-if="aiBadge && media?.aiDisclosure"
+      class="kestrel-img__ai-badge"
+      :data-ai-source-type="media.aiDisclosure.sourceType"
+    >{{ media.aiDisclosure.note ?? aiSourceTypeLabel(media.aiDisclosure.sourceType) }}</span>
   </picture>
 </template>
 
@@ -63,3 +74,21 @@ const { imgEl, animate, placeholderStyle, onLoad } = useBlurUp(() => props.media
   }
 }
 </style>
+
+<!-- Deliberately UNSCOPED: a scoped rule carries the `[data-v-*]` attribute selector, which out-specifies
+     a consumer stylesheet targeting `.kestrel-img__ai-badge` and would make the badge un-restylable.
+     Layout only — no color, background, border, radius or font — so nothing is visible as a "badge" until
+     the consumer's own CSS says so. Scoped to pictures that actually contain one, so a consumer who never
+     sets `ai-badge` gets no rule at all. -->
+<style>
+picture:has(> .kestrel-img__ai-badge) {
+  position: relative;
+  display: inline-block;
+}
+.kestrel-img__ai-badge {
+  position: absolute;
+  inset-block-end: 0;
+  inset-inline-start: 0;
+  pointer-events: none;
+}
+</style>