@michaelthielemann/kestrel 2.0.0 → 2.1.0

package/layers/public/server/utils/publish/redirects-artifact.ts

@@ -0,0 +1,20 @@
+import type { StorageDriver } from '../../../../core/server/utils/storage'
+import { contentTypeFor, cacheControlFor } from '../../../modules/deploy-output/deploy-output'
+import { compileRedirects, serializeRedirects } from './redirect-rules'
+
+/** The collection and the repeater field the artifact is compiled from, named once. */
+export const REDIRECTS_COLLECTION = 'redirects'
+export const REDIRECTS_FIELD = 'rules'
+
+/** Literal key at the output root — a sibling of `index.html`, not a child of it. The driver's root IS
+ *  the output root (local `output.dir`, or the S3 prefix), so a key can never sit *beside* that tree. */
+export const REDIRECTS_KEY = 'redirects.json'
+
+/**
+ * Compile the editor's rows and publish them. Compilation runs first so an unpublishable rule fails
+ * before the driver is touched, and the writer never swallows: a rejection is the caller's to surface.
+ */
+export async function writeRedirectsArtifact(rows: unknown, driver: StorageDriver): Promise<void> {
+  const body = Buffer.from(serializeRedirects(compileRedirects(rows)))
+  await driver.put(REDIRECTS_KEY, body, contentTypeFor(REDIRECTS_KEY), { cacheControl: cacheControlFor(REDIRECTS_KEY) })
+}

package/layers/public/server/utils/richtext-markdown.ts

@@ -0,0 +1,260 @@
+/**
+ * Richtext HTML → Markdown, for the agent-facing `llms-full.txt`. Answer engines consume Markdown, not
+ * markup, and a stripped-tags dump would lose exactly the structure they retrieve on (headings, lists,
+ * links).
+ *
+ * A hand-rolled parser rather than a DOM library because the input dialect is CLOSED and already
+ * well-formed: every stored richtext value passed `sanitizeRichtext` on write, so it is sanitize-html's
+ * own re-serialization of a parsed tree, restricted to `RICHTEXT_ALLOWLIST`. That keeps this pure — no
+ * DOM, no Nuxt, no new dependency in the public layer's server bundle — so it unit-tests hard.
+ *
+ * Deliberately minimal escaping: only link text (whose brackets would break the link syntax) and a
+ * leading block marker (which would silently turn a paragraph into a list item or heading). Escaping
+ * every markdown metacharacter would make the output markedly harder to read for the model that reads it.
+ */
+
+export interface RichtextMarkdownOptions {
+  /** Push every heading down by this many levels (clamped at h6), so a body nests under the document
+   *  headings the caller already emitted. */
+  headingOffset?: number
+}
+
+type MdNode =
+  | { kind: 'text'; value: string }
+  | { kind: 'el'; tag: string; attrs: Record<string, string>; children: MdNode[] }
+
+const VOID_TAGS = new Set(['br', 'hr', 'img', 'input', 'meta', 'link'])
+const HEADINGS: Record<string, number> = { h1: 1, h2: 2, h3: 3, h4: 4, h5: 5, h6: 6 }
+const BLOCK_TAGS = new Set(['p', 'blockquote', 'pre', 'ul', 'ol', 'hr', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6'])
+
+const TAG = /<(\/)?([a-zA-Z][a-zA-Z0-9]*)((?:\s+[^\s"'>/=]+(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s"'=<>`]+))?)*)\s*(\/)?>/g
+const ATTR = /([^\s"'>/=]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+)))?/g
+
+const NAMED_ENTITIES: Record<string, string> = {
+  amp: '&', lt: '<', gt: '>', quot: '"', apos: "'", nbsp: ' ',
+}
+
+/** Decode the entity set sanitize-html emits, plus numeric references. `&nbsp;` becomes an ordinary
+ *  space on purpose: a U+00A0 survives whitespace collapsing and shows up as a stray gap. */
+function decodeEntities(raw: string): string {
+  return raw.replace(/&(#x[0-9a-fA-F]+|#\d+|[a-zA-Z]+);/g, (match, body: string) => {
+    if (body[0] === '#') {
+      const code = body[1] === 'x' || body[1] === 'X' ? Number.parseInt(body.slice(2), 16) : Number(body.slice(1))
+      return Number.isFinite(code) && code > 0 && code <= 0x10ffff ? String.fromCodePoint(code) : match
+    }
+    return NAMED_ENTITIES[body.toLowerCase()] ?? match
+  })
+}
+
+function parseAttrs(raw: string): Record<string, string> {
+  const attrs: Record<string, string> = {}
+  if (!raw.trim()) return attrs
+  ATTR.lastIndex = 0
+  let m: RegExpExecArray | null
+  while ((m = ATTR.exec(raw))) {
+    attrs[m[1]!.toLowerCase()] = decodeEntities(m[2] ?? m[3] ?? m[4] ?? '')
+  }
+  return attrs
+}
+
+/** Tag soup → a node tree. A stray close tag with no matching open is dropped; anything still open at
+ *  the end is closed implicitly, so a truncated value degrades to the content it did carry. */
+function parse(html: string): MdNode[] {
+  const root: MdNode[] = []
+  const stack: Array<{ tag: string; children: MdNode[] }> = []
+  const top = (): MdNode[] => (stack.length ? stack[stack.length - 1]!.children : root)
+  const pushText = (raw: string): void => {
+    if (raw) top().push({ kind: 'text', value: decodeEntities(raw) })
+  }
+
+  TAG.lastIndex = 0
+  let cursor = 0
+  let m: RegExpExecArray | null
+  while ((m = TAG.exec(html))) {
+    pushText(html.slice(cursor, m.index))
+    cursor = TAG.lastIndex
+    const tag = m[2]!.toLowerCase()
+    if (m[1]) {
+      // Close the innermost matching element; an unmatched close tag is ignored rather than unwinding
+      // the whole stack, which would drop every sibling that followed it.
+      const at = stack.map((s) => s.tag).lastIndexOf(tag)
+      if (at >= 0) stack.length = at
+      continue
+    }
+    const node: MdNode = { kind: 'el', tag, attrs: parseAttrs(m[3] ?? ''), children: [] }
+    top().push(node)
+    if (!m[4] && !VOID_TAGS.has(tag)) stack.push({ tag, children: node.children })
+  }
+  pushText(html.slice(cursor))
+  return root
+}
+
+/** Raw text of a subtree, entities already decoded and whitespace untouched (code blocks). */
+function rawText(nodes: MdNode[]): string {
+  return nodes.map((n) => (n.kind === 'text' ? n.value : rawText(n.children))).join('')
+}
+
+const escapeLinkText = (s: string): string => s.replace(/[[\]]/g, '\\$&')
+
+const INLINE_WRAP: Record<string, string> = { strong: '**', b: '**', em: '*', i: '*', s: '~~' }
+
+/** The longest run of `char` anywhere in `text` — the width a fence/delimiter has to beat to contain it. */
+function longestRun(text: string, char: string): number {
+  let longest = 0
+  let run = 0
+  for (const c of text) {
+    run = c === char ? run + 1 : 0
+    if (run > longest) longest = run
+  }
+  return longest
+}
+
+/** `` `code` `` with a delimiter wider than any backtick run inside it (CommonMark's own escape hatch),
+ *  padded with a space when the content would otherwise fuse with the delimiter. */
+function inlineCode(text: string): string {
+  const delimiter = '`'.repeat(longestRun(text, '`') + 1)
+  const pad = text.startsWith('`') || text.endsWith('`') ? ' ' : ''
+  return `${delimiter}${pad}${text}${pad}${delimiter}`
+}
+
+function renderInline(nodes: MdNode[]): string {
+  let out = ''
+  for (const node of nodes) {
+    if (node.kind === 'text') { out += node.value.replace(/\s+/g, ' '); continue }
+    if (node.tag === 'br') { out += '\n'; continue }
+    if (node.tag === 'a') {
+      const text = renderInline(node.children).trim()
+      const href = node.attrs.href
+      // `#` is what the internal-link resolver writes for a target it declined (missing or unpublished) —
+      // a dead anchor is worth less than the words it wraps, so keep the words and drop the link.
+      out += !href || href === '#' ? text : `[${escapeLinkText(text)}](${href})`
+      continue
+    }
+    const inner = renderInline(node.children)
+    if (node.tag === 'code') { out += inner.trim() ? inlineCode(inner.trim()) : inner; continue }
+    const wrap = INLINE_WRAP[node.tag]
+    if (!wrap || !inner.trim()) { out += inner; continue }
+    // CommonMark will not open emphasis on `** bold **` — whitespace immediately inside the delimiter
+    // makes it literal asterisks. Editors leave it there routinely (selecting a word plus its space), so
+    // move it outside rather than emitting markup that does not parse.
+    const [, lead = '', body = '', trail = ''] = /^(\s*)([\s\S]*?)(\s*)$/.exec(inner) ?? []
+    out += `${lead}${wrap}${body}${wrap}${trail}`
+  }
+  return out
+}
+
+const prefixLines = (text: string, first: string, rest: string): string =>
+  text.split('\n').map((line, i) => (i === 0 ? first + line : (line ? rest + line : rest.trimEnd()))).join('\n')
+
+/** Escape a line that would otherwise open a Markdown block: a heading, a list item, a quote, a code
+ *  fence or a thematic break. One backslash on the first marker character defuses all of them (every one
+ *  is ASCII punctuation, so the escape is valid CommonMark and renders as the literal character). */
+function escapeMarkerLine(line: string): string {
+  // CommonMark allows a block marker up to three spaces in; deeper is an indented code block, which no
+  // backslash can defuse — and which whitespace collapsing has already removed from converted text.
+  const [, indent = '', rest = ''] = /^(\s{0,3})([\s\S]*)$/.exec(line) ?? []
+  const ordered = /^(\d{1,9})[.)](\s|$)/.exec(rest)
+  if (ordered) return `${indent}${ordered[1]}\\${rest.slice(ordered[1]!.length)}`
+  const opensBlock = /^#{1,6}(\s|$)/.test(rest)          // heading, any level
+    || /^[-+*](\s|$)/.test(rest)                          // bullet list
+    || rest.startsWith('>')                               // block quote
+    || /^(`{3,}|~{3,})/.test(rest)                        // fenced code
+    || /^([-*_])[\s]*(\1[\s]*){2,}$/.test(rest)           // thematic break (and the setext h2 underline)
+    || /^=+\s*$/.test(rest)                               // setext h1 underline
+  return opensBlock ? `${indent}\\${rest}` : line
+}
+
+/**
+ * Escape every line of a text block that would open a Markdown construct. Applied per LINE, not once per
+ * block: a `<br>` becomes a real newline, so an anchored first-line-only check guards nothing after it.
+ *
+ * This is the whole defence between editor-authored prose and the structure of `llms-full.txt`, whose own
+ * document uses `##` for collection sections and `###` for pages — an unescaped `## …` in a body would
+ * not merely add a heading, it would forge a sibling of the generator's own and re-parent every page
+ * after it.
+ */
+export function escapeMarkdownBlock(text: string): string {
+  return text.split('\n').map(escapeMarkerLine).join('\n')
+}
+
+function renderList(node: MdNode & { kind: 'el' }, opts: RichtextMarkdownOptions): string {
+  const ordered = node.tag === 'ol'
+  const items = node.children.filter((c): c is MdNode & { kind: 'el' } => c.kind === 'el' && c.tag === 'li')
+  const lines: string[] = []
+  let n = 0
+  for (const item of items) {
+    const blocks = renderBlocks(item.children, opts)
+    n += 1
+    const marker = ordered ? `${n}. ` : '- '
+    const indent = ' '.repeat(marker.length)
+    // The first block is the item's own text; anything after it (a nested list, a second paragraph)
+    // continues the item and must be indented to the marker's width to stay inside it.
+    const [head = '', ...rest] = blocks
+    lines.push(prefixLines(head, marker, indent))
+    for (const block of rest) lines.push(prefixLines(block, indent, indent))
+  }
+  return lines.join('\n')
+}
+
+/** Render a node list as block-level markdown: an array of blocks, joined by a blank line by the caller. */
+function renderBlocks(nodes: MdNode[], opts: RichtextMarkdownOptions): string[] {
+  const blocks: string[] = []
+  let run: MdNode[] = []
+  const flushRun = (): void => {
+    if (!run.length) return
+    const text = renderInline(run).trim()
+    run = []
+    if (text) blocks.push(escapeMarkdownBlock(text))
+  }
+
+  for (const node of nodes) {
+    // An unrecognised wrapper is transparent: splice its children into this level rather than dropping
+    // the content or forcing it inline, so a consumer's stray <div>/<section> keeps its structure.
+    if (node.kind === 'el' && !BLOCK_TAGS.has(node.tag) && !VOID_TAGS.has(node.tag) && !INLINE_WRAP[node.tag]
+      && node.tag !== 'a' && node.tag !== 'li' && node.children.some(isBlockNode)) {
+      flushRun()
+      blocks.push(...renderBlocks(node.children, opts))
+      continue
+    }
+    if (node.kind !== 'el' || !BLOCK_TAGS.has(node.tag)) { run.push(node); continue }
+    flushRun()
+
+    const level = HEADINGS[node.tag]
+    if (level !== undefined) {
+      // A heading is one line by definition: a `<br>` inside it would end the heading and leave the rest
+      // as a bare paragraph, silently splitting the text an editor wrote as one title.
+      const text = renderInline(node.children).replace(/\s+/g, ' ').trim()
+      if (text) blocks.push(`${'#'.repeat(Math.min(6, level + (opts.headingOffset ?? 0)))} ${text}`)
+    } else if (node.tag === 'hr') {
+      blocks.push('---')
+    } else if (node.tag === 'pre') {
+      const code = rawText(node.children).replace(/^\n+|\n+$/g, '')
+      // Fence wider than any backtick run in the code, or the code closes the fence it sits in and
+      // everything after it — the rest of the page, and the pages after that — reparses as prose.
+      const fence = '`'.repeat(Math.max(3, longestRun(code, '`') + 1))
+      if (code) blocks.push(`${fence}\n${code}\n${fence}`)
+    } else if (node.tag === 'blockquote') {
+      const inner = renderBlocks(node.children, opts).join('\n\n')
+      if (inner) blocks.push(prefixLines(inner, '> ', '> '))
+    } else if (node.tag === 'ul' || node.tag === 'ol') {
+      const list = renderList(node, opts)
+      if (list) blocks.push(list)
+    } else {
+      const text = renderInline(node.children).trim()
+      if (text) blocks.push(escapeMarkdownBlock(text))
+    }
+  }
+  flushRun()
+  return blocks
+}
+
+function isBlockNode(node: MdNode): boolean {
+  return node.kind === 'el' && (BLOCK_TAGS.has(node.tag) || node.tag === 'li')
+}
+
+/** Sanitized richtext HTML → Markdown. Non-string / empty input, and markup that carries no words at
+ *  all, both yield `''` so a caller can drop the field without a second emptiness test. */
+export function richtextToMarkdown(html: string | null | undefined, opts: RichtextMarkdownOptions = {}): string {
+  if (typeof html !== 'string' || !html.trim()) return ''
+  return renderBlocks(parse(html), opts).join('\n\n')
+}

package/layers/public/server/utils/site-url.ts

@@ -30,3 +30,11 @@ export function siteDescription(): string {
   const fromRc = serverRuntimeConfig()?.kestrel as { siteDescription?: string } | undefined
   return (fromRc?.siteDescription ?? resolveServerKestrel().siteDescription ?? '').trim()
 }
+
+/** Whether `/llms-full.txt` is served, prerendered and published (`kestrel.seo.llmsFull`, default off).
+ *  Read the same two-tier way as every other server setting, so a consumed layer sees the CONSUMER's
+ *  config rather than Kestrel's own. */
+export function llmsFullEnabled(): boolean {
+  const fromRc = serverRuntimeConfig()?.kestrel as { seo?: { llmsFull?: boolean } } | undefined
+  return (fromRc?.seo?.llmsFull ?? resolveServerKestrel().seo.llmsFull) === true
+}

package/layers/public/server/utils/sitemap.ts

@@ -87,11 +87,13 @@ export function buildSitemap(entries: SitemapEntry[]): string {
   return `<?xml version="1.0" encoding="UTF-8"?><urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"${xhtmlNs}>${urls}</urlset>`
 }
 
-export function buildRobots(opts: { sitemapUrl?: string; llmsUrl?: string } = {}): string {
+export function buildRobots(opts: { sitemapUrl?: string; llmsUrl?: string; llmsFullUrl?: string } = {}): string {
   const lines = ['User-agent: *', 'Allow: /']
-  // A comment (robots.txt has no standard llms directive) so crawlers that read robots also find the
-  // agent-oriented site map at /llms.txt. Kept above the blank-line-separated Sitemap directive.
+  // Comments (robots.txt has no standard llms directive) so crawlers that read robots also find the
+  // agent-oriented site map at /llms.txt — and its full-text long form when that is switched on.
+  // Kept above the blank-line-separated Sitemap directive.
   if (opts.llmsUrl) lines.push(`# llms.txt: ${opts.llmsUrl}`)
+  if (opts.llmsFullUrl) lines.push(`# llms-full.txt: ${opts.llmsFullUrl}`)
   if (opts.sitemapUrl) lines.push('', `Sitemap: ${opts.sitemapUrl}`)
   return `${lines.join('\n')}\n`
 }

package/layers/ui/app/components/field/Choice.vue

@@ -5,17 +5,22 @@ import UiFieldset from '../ui/Fieldset.vue'
 import UiSelect from '../ui/Select.vue'
 import UiButtonGroup from '../ui/ButtonGroup.vue'
 import UiCheckboxGroup from '../ui/CheckboxGroup.vue'
+import { resolveLocalized } from '../../utils/localized'
 import type { FieldComponentProps } from '../../utils/field-component'
 import type { FieldOf } from '../../../../core/server/utils/defineCollection'
 
 const props = defineProps<FieldComponentProps>()
 const model = defineModel<string | string[] | null>()
 
+const { lang } = useT()
+
 const cfg = computed(() => {
   if (props.field.type !== 'choice') return { choices: [] as { label: string; value: string }[], multiple: false, buttons: false }
   const o = (props.field as FieldOf<'choice'>).options
   return {
-    choices: o.choices,
+    // A choice label is `Localized` like every other author-supplied label. Resolving it HERE (not in the
+    // controls) is what keeps it out of the markup as a JSON blob — `{{ o.label }}` would stringify the map.
+    choices: o.choices.map((c) => ({ ...c, label: resolveLocalized(c.label, lang.value) ?? c.value })),
     multiple: !!o.multiple,
     buttons: o.display === 'buttons',
   }

package/layers/ui/app/i18n/de.ts

@@ -188,6 +188,12 @@ export const de: Catalog = {
   'editor.unsupported': 'Für den Typ „{type}“ ist kein Editor registriert.',
   'seo.socialImage': 'Social-Share-Bild',
   'seo.socialImageHint': 'Wird als Vorschaubild beim Teilen der Seite angezeigt (og:image).',
+  'seo.author': 'Autor/in',
+  'seo.authorHint': 'Wird in den strukturierten Daten der Seite als Verfasser/in veröffentlicht.',
+  'seo.publishedDate': 'Veröffentlichungsdatum',
+  'seo.publishedDateHint': 'Zeigt Such- und Antwortmaschinen, wie aktuell diese Seite ist.',
+  'seo.keywords': 'Schlagwörter',
+  'seo.keywordsHint': 'Themen dieser Seite, durch Kommas getrennt.',
 
   'localeBar.fieldLabel': 'Sprache',
   'localeBar.groupLabel': 'Inhaltssprache',
@@ -313,6 +319,13 @@ export const de: Catalog = {
   'mediaViewer.alt': 'Alt-Text',
   'mediaViewer.altHint': 'Beschreibt das Bild für Screenreader und SEO.',
   'mediaViewer.saveFailed': 'Alt-Text konnte nicht gespeichert werden.',
+  'mediaViewer.aiSourceTypeLabel': 'KI-Kennzeichnung',
+  'mediaViewer.aiSourceTypeHint': 'Wie diese Datei entstanden ist (EU-KI-Verordnung Art. 50). Leer lassen, wenn nichts zu kennzeichnen ist.',
+  'mediaViewer.aiSourceType.trainedAlgorithmicMedia': 'Vollständig KI-generiert',
+  'mediaViewer.aiSourceType.compositeWithTrainedAlgorithmicMedia': 'KI-Inhalt in echtes Material montiert',
+  'mediaViewer.aiSourceType.algorithmicallyEnhanced': 'KI-bearbeitet / algorithmisch verändert',
+  'mediaViewer.aiNote': 'Hinweis zur Kennzeichnung',
+  'mediaViewer.aiNoteHint': 'Freitext, z. B. das verwendete Werkzeug. Beim Upload gefundene KI-Signale werden vorausgefüllt — nur Indizien, kein geprüfter Nachweis.',
 
   // richtext toolbar
   'richtext.bold': 'Fett',

package/layers/ui/app/i18n/en.ts

@@ -201,6 +201,12 @@ export const en: Catalog = {
   'editor.unsupported': 'No editor is registered for type “{type}”.',
   'seo.socialImage': 'Social share image',
   'seo.socialImageHint': 'Shown as the preview image when the page is shared (og:image).',
+  'seo.author': 'Author',
+  'seo.authorHint': 'Published as the article author in the page’s structured data.',
+  'seo.publishedDate': 'Publication date',
+  'seo.publishedDateHint': 'Tells search and answer engines how current this page is.',
+  'seo.keywords': 'Keywords',
+  'seo.keywordsHint': 'Comma-separated topics for this page.',
 
   // locale bar (translations)
   'localeBar.fieldLabel': 'Locale',
@@ -337,6 +343,13 @@ export const en: Catalog = {
   'mediaViewer.alt': 'Alt text',
   'mediaViewer.altHint': 'Describes the image for screen readers and SEO.',
   'mediaViewer.saveFailed': "Couldn't save the alt text.",
+  'mediaViewer.aiSourceTypeLabel': 'AI disclosure',
+  'mediaViewer.aiSourceTypeHint': 'How this asset was produced (EU AI Act Art. 50). Leave empty when nothing needs disclosing.',
+  'mediaViewer.aiSourceType.trainedAlgorithmicMedia': 'Fully AI-generated',
+  'mediaViewer.aiSourceType.compositeWithTrainedAlgorithmicMedia': 'AI content composited into real media',
+  'mediaViewer.aiSourceType.algorithmicallyEnhanced': 'AI-enhanced / algorithmically edited',
+  'mediaViewer.aiNote': 'Disclosure note',
+  'mediaViewer.aiNoteHint': 'Free text, e.g. the tool used. Pre-filled with any AI signals found in the file at upload — evidence only, not a verified claim.',
 
   // richtext toolbar
   'richtext.bold': 'Bold',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@michaelthielemann/kestrel",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "A slim, collection-driven Nuxt 4 CMS meta-layer with a runtime schema engine. Add `extends: ['@michaelthielemann/kestrel']`, define collections, and the database migrates itself.",
   "license": "Apache-2.0",
   "author": "Michael Thielemann <283621694+MichaelThielemann@users.noreply.github.com>",
@@ -78,6 +78,7 @@
     "dompurify": "^3.4.13",
     "drizzle-orm": "^0.45.2",
     "drizzle-zod": "^0.8.3",
+    "exifr": "^7.1.3",
     "file-type": "^22.0.1",
     "jsdom": "^29.1.1",
     "nanoid": "^5.1.16",

package/templates/starter/nuxt.config.ts

@@ -16,5 +16,8 @@ export default defineNuxtConfig({
     media: { uploadDir: '.data/uploads' },
     // locales: ['en', 'de'],
     // collections: { pages: false },
+    // Answer-engine extras, both off until you opt in: articleMeta publishes author/date/keywords,
+    // llmsFull serves /llms-full.txt (every published page's full body in one file).
+    // seo: { articleMeta: true, llmsFull: true },
   },
 })