@michaelthielemann/kestrel 3.0.0 → 4.0.0

package/templates/starter/app/blocks/Prose.vue

@@ -8,6 +8,6 @@ defineBlock({ label: { en: 'Prose' }, icon: 'file-text' })
 
 <template>
   <!-- richtext is sanitized server-side on write -->
-  <!-- eslint-disable-next-line vue/no-v-html -- sanitized via sanitizeRichtext (sanitize-html allowlist) in layers/fields/server/field-registry/index.ts -->
+  <!-- eslint-disable-next-line vue/no-v-html -- sanitized via sanitizeRichtext (sanitize-html allowlist) in packages/kestrel-fields/src/server/field-registry/index.ts -->
   <div class="block-prose" v-html="body" />
 </template>

package/layers/access/server/utils/csrf.ts

@@ -1,39 +0,0 @@
-export interface CsrfHeaders {
-  secFetchSite?: string | null
-  origin?: string | null
-  referer?: string | null
-  host?: string | null
-}
-
-function hostOf(url: string | null | undefined): string | null {
-  if (!url) return null
-  try {
-    return new URL(url).host
-  } catch {
-    return null
-  }
-}
-
-export function isCrossSiteWrite(h: CsrfHeaders): boolean {
-  if (h.secFetchSite) {
-    return !(h.secFetchSite === 'same-origin' || h.secFetchSite === 'none')
-  }
-  // hostOf() lowercases per the URL spec; the raw Host header does not, so normalize both
-  // sides — host comparison is case-insensitive (RFC 3986).
-  const host = (h.host ?? '').toLowerCase()
-  // The literal opaque origin `null` (a browser signal from a sandboxed iframe, a data: URL, or some
-  // redirect chains) is unparseable by new URL, so it must NOT fall through to the all-absent "allow"
-  // path — per spec it is cross-origin. Treat it as cross-site.
-  if (h.origin === 'null') return true
-  const originHost = hostOf(h.origin)
-  if (originHost !== null) return originHost !== host
-  const refererHost = hostOf(h.referer)
-  if (refererHost !== null) return refererHost !== host
-  // A write carrying NONE of Sec-Fetch-Site / Origin / Referer is treated as same-site (allowed). A
-  // browser ALWAYS attaches Origin and/or Sec-Fetch-Site to a cross-origin state-changing request, so
-  // the all-absent case can only come from a NON-browser client (the test harness, a server-to-server
-  // import, automation) — which carries no ambient cookies and therefore cannot mount CSRF. The real
-  // defenses are SameSite=Strict on the session cookie + the Origin/Referer checks above; failing closed
-  // here adds no protection and breaks legitimate authenticated API clients.
-  return false
-}

package/layers/access/server/utils/grant-registry.ts

@@ -1,36 +0,0 @@
-import type { Grant, Role } from './policy'
-
-// A process-singleton registry of EXTRA authorization grants, contributed by layers/extensions at boot
-// (server plugin) on top of the hardcoded `POLICY`. This is the seam that lets an opt-in layer deliberately
-// open a narrow hole in the default-deny guard — e.g. the proofing extension granting `anonymous → write →
-// proofing` for its public back-channel. Inert until something registers: with an empty registry the guard
-// behaves exactly as the hardcoded policy. The map is INJECTED into the (pure) guard, not read from inside
-// it (symmetric with `publicResources`), so the policy stays deterministically node-testable. Foundation
-// for a future configurable Users & Roles system.
-const registered: Partial<Record<Role, Grant[]>> = {}
-
-/** Add an extra grant for a role. Deliberate + explicit — it widens what that role may do. */
-export function registerAccessGrant(role: Role, grant: Grant): void {
-  // Defense-in-depth: the public (anonymous) must never be handed a wildcard or draft-read through this
-  // seam — a legitimate public back-channel always names ONE specific resource and reads published-only.
-  // CRUCIAL: the evaluator (`resolveAccess`) defaults an OMITTED read scope to 'all' via `(scope ?? 'all')`,
-  // so an unscoped anonymous read would silently resolve to draft-read. The validator must use the SAME
-  // default, or a "safe"-looking `{action:'read', resource:'x'}` grant leaks drafts to anonymous visitors.
-  // (Write grants carry no read scope — `resolveAccess` only upgrades readScope for read grants — so an
-  // omitted scope on a write is fine, e.g. the proofing back-channel's anonymous write.)
-  const anonymousDraftRead = role === 'anonymous' && grant.action === 'read' && (grant.scope ?? 'all') === 'all'
-  if (role === 'anonymous' && (grant.resource === '*' || anonymousDraftRead)) {
-    throw new Error(`refusing an over-broad anonymous grant (${grant.action} ${grant.resource}${grant.scope ? ` scope=${grant.scope}` : ''}): name a specific resource and grant read with an explicit scope: 'published' (never draft-read)`)
-  }
-  (registered[role] ??= []).push(grant)
-}
-
-/** The full role → extra-grants map, for the guard to consult alongside `POLICY`. */
-export function registeredGrants(): Readonly<Partial<Record<Role, Grant[]>>> {
-  return registered
-}
-
-/** Test helper: drop all registered grants (the registry is a module singleton). */
-export function clearAccessGrants(): void {
-  for (const role of Object.keys(registered) as Role[]) Reflect.deleteProperty(registered, role)
-}

package/layers/access/server/utils/guard.ts

@@ -1,44 +0,0 @@
-import { isCrossSiteWrite, type CsrfHeaders } from './csrf'
-import { verifySession } from '../../../auth/server/utils/session'
-import { resolveAccess, actionForMethod, resourceForPath, isBootstrapPath, isPublicRenderPath, type Principal, type Grant, type Role } from './policy'
-
-export interface AccessInput {
-  method: string
-  path: string
-  csrf: CsrfHeaders
-  cookie: string | undefined
-  secret: string
-  nowMs: number
-  isPrerender: boolean
-}
-
-export type AccessDecision =
-  | { allow: true; principal: Principal; readScope: 'published' | 'all' }
-  | { allow: false; status: number; message: string }
-
-export function derivePrincipal(input: AccessInput): Principal {
-  if (input.isPrerender) return { userId: 'renderer', role: 'renderer' }
-  if (verifySession(input.secret, input.cookie, input.nowMs).valid) return { userId: 'admin', role: 'admin' }
-  return { userId: null, role: 'anonymous' }
-}
-
-export function evaluateAccess(input: AccessInput, publicResources: readonly string[] = [], registeredGrants: Readonly<Partial<Record<Role, Grant[]>>> = {}): AccessDecision {
-  // CSRF first: every unsafe method (incl. login) must be same-site.
-  if (actionForMethod(input.method) === 'write' && isCrossSiteWrite(input.csrf)) {
-    return { allow: false, status: 403, message: 'Cross-origin write rejected' }
-  }
-  const principal = derivePrincipal(input)
-  // Auth bootstrap (login/session) is always permitted so the SPA can authenticate. Scope still follows
-  // the principal (mirrors isPublicRenderPath below) — an anonymous caller never gets draft-read scope.
-  if (isBootstrapPath(input.method, input.path)) {
-    return { allow: true, principal, readScope: principal.role === 'anonymous' ? 'published' : 'all' }
-  }
-  // The public render entry is readable by everyone; the scope follows the principal so an admin can
-  // preview drafts while anonymous (and the static render) stay published-only.
-  if (isPublicRenderPath(input.method, input.path)) {
-    return { allow: true, principal, readScope: principal.role === 'anonymous' ? 'published' : 'all' }
-  }
-  const { allowed, readScope } = resolveAccess(principal, actionForMethod(input.method), resourceForPath(input.path), publicResources, registeredGrants[principal.role] ?? [])
-  if (!allowed) return { allow: false, status: 401, message: 'Authentication required' }
-  return { allow: true, principal, readScope }
-}

package/layers/access/server/utils/ip-allowlist.ts

@@ -1,79 +0,0 @@
-export type AllowlistMode = 'enforce' | 'log' | 'off'
-
-/** A parsed IPv4 CIDR as `network base & mask`, both uint32. */
-export interface Cidr {
-  base: number
-  mask: number
-}
-
-/**
- * Resolve the gate mode from `KESTREL_IP_ALLOWLIST_MODE` given the raw list.
- *
- * An empty list means there is nothing to enforce → `off`. When a list IS present, an unset/unknown mode
- * defaults to `enforce`: a configured allow-list that silently let everyone through is the exact legacy
- * footgun we are replacing. `log` is the opt-in calibration mode (observe, never block) used to confirm the
- * resolved client IP + `KESTREL_TRUST_PROXY` depth before enforcing.
- */
-export function allowlistMode(modeRaw: string | undefined, listRaw: string | undefined): AllowlistMode {
-  if (!listRaw || !listRaw.trim()) return 'off'
-  const m = (modeRaw ?? '').trim().toLowerCase()
-  if (m === 'off' || m === 'disabled' || m === 'false') return 'off'
-  if (m === 'log' || m === 'log-only' || m === 'dry-run') return 'log'
-  return 'enforce'
-}
-
-/** `1.2.3.4` / `::ffff:1.2.3.4` → uint32; `null` for out-of-range, real IPv6, or non-IPv4 input. */
-export function ipv4ToInt(ip: string): number | null {
-  let s = ip.trim()
-  const mapped = /^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i.exec(s)
-  if (mapped) s = mapped[1]!
-  const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(s)
-  if (!m) return null
-  let n = 0
-  for (let i = 1; i <= 4; i++) {
-    const octet = Number(m[i])
-    if (octet > 255) return null
-    n = n * 256 + octet
-  }
-  return n >>> 0
-}
-
-function parseCidr(token: string): Cidr | null {
-  const slash = token.indexOf('/')
-  const base = ipv4ToInt(slash === -1 ? token : token.slice(0, slash))
-  if (base === null) return null
-  // `Number()` alone would widen a malformed prefix into a mask: '' → 0 → 0.0.0.0/0, and '0x10'/'1e1' → 16/10.
-  const bitsRaw = slash === -1 ? '32' : token.slice(slash + 1).trim()
-  if (!/^\d+$/.test(bitsRaw)) return null
-  const bits = Number(bitsRaw)
-  if (!Number.isInteger(bits) || bits < 0 || bits > 32) return null
-  const mask = bits === 0 ? 0 : (0xffffffff << (32 - bits)) >>> 0
-  return { base: (base & mask) >>> 0, mask }
-}
-
-/**
- * Parse the allow-list env into CIDRs, tolerant of the legacy nginx block so it can be pasted verbatim:
- * newline/comma/semicolon separated, `# comments` and a leading `allow`/`set_real_ip_from` keyword stripped.
- * Invalid tokens are dropped, not thrown — one bad line must not disable the whole gate. `onReject`, when
- * given, is called with each dropped token (this parser is IPv4-only, so an IPv6 CIDR pasted into an
- * otherwise-valid list is silently a no-op unless the caller surfaces it).
- */
-export function parseAllowlist(raw: string | undefined, onReject?: (token: string) => void): Cidr[] {
-  if (!raw) return []
-  const out: Cidr[] = []
-  for (const part of raw.split(/[\n,;]+/)) {
-    const token = part.replace(/#.*$/, '').trim().replace(/^(?:allow|set_real_ip_from)\s+/i, '').trim()
-    if (!token) continue
-    const cidr = parseCidr(token)
-    if (cidr) out.push(cidr)
-    else onReject?.(token)
-  }
-  return out
-}
-
-/** True when `ip` falls in any CIDR. Fails closed: a non-IPv4 address or empty list never matches. */
-export function ipAllowed(ip: string, cidrs: Cidr[]): boolean {
-  const n = ipv4ToInt(ip)
-  if (n === null) return false
-  return cidrs.some((c) => ((n & c.mask) >>> 0) === c.base)
-}

package/layers/access/server/utils/policy.ts

@@ -1,98 +0,0 @@
-export type Role = 'admin' | 'renderer' | 'anonymous'
-export type Action = 'read' | 'write'
-export interface Principal { userId: string | null; role: Role }
-export interface Grant { action: Action; resource: string; scope?: 'published' | 'all' }
-export interface AccessResult { allowed: boolean; readScope: 'published' | 'all' }
-
-/** Hardcoded authorization policy. Role -> grants. `resource: '*'` matches any. */
-export const POLICY: Record<Role, Grant[]> = {
-  admin: [{ action: 'write', resource: '*' }, { action: 'read', resource: '*' }],
-  // The renderer is ONLY ever the build-time prerender or the runtime publisher; both produce the
-  // public static site, which is published-only by definition. Scope its read to 'published' so the
-  // generic /api/<collection> reads never leak drafts into the generated HTML (admin live preview is
-  // unaffected — it renders under the admin principal, scope 'all').
-  renderer: [{ action: 'read', resource: '*', scope: 'published' }],
-  // Anonymous published-read is data-driven from the registry (every page-like collection), not a
-  // literal allow-list — see the `publicResources` branch in `resolveAccess`.
-  anonymous: [],
-}
-
-export function resolveAccess(principal: Principal, action: Action, resource: string, publicResources: readonly string[] = [], extraGrants: readonly Grant[] = []): AccessResult {
-  let allowed = false
-  // readScope reflects the principal's READ permission for this resource, INDEPENDENT of the requested
-  // action, and is fail-closed to 'published': a granted WRITE must never silently confer draft-read
-  // ('all'). Only an explicit read grant with scope 'all' (i.e. admin) upgrades it.
-  let readScope: 'published' | 'all' = 'published'
-  // Hardcoded policy first, then any registry-contributed grants for this role (the opt-in seam). Extra
-  // grants only ever ADD permissions for the role they were registered under — they can't revoke.
-  for (const g of [...(POLICY[principal.role] ?? []), ...extraGrants]) {
-    if (g.resource !== '*' && g.resource !== resource) continue
-    if (g.action === action) allowed = true
-    if (g.action === 'read' && (g.scope ?? 'all') === 'all') readScope = 'all' // a draft-read grant wins
-  }
-  // An anonymous visitor gets published read on every page-like collection (the registry-driven public
-  // set), so a consumer's own pageLike collection is reachable without editing a literal allow-list.
-  // Published-only and gated to the public set — never widens to drafts or non-pageLike collections.
-  if (!allowed && principal.role === 'anonymous' && action === 'read' && publicResources.includes(resource)) {
-    allowed = true
-    readScope = 'published'
-  }
-  return { allowed, readScope }
-}
-
-/**
- * Whether an anonymous visitor may read a collection — i.e. whether its pages are publicly reachable.
- * The single source of truth for "what belongs in a public sitemap": a sitemap must list only URLs an
- * unauthenticated crawler can actually fetch, so the sitemap filters pageLike collections through this.
- */
-export function isPubliclyReadable(resource: string, publicResources: readonly string[] = []): boolean {
-  return resolveAccess({ userId: null, role: 'anonymous' }, 'read', resource, publicResources).allowed
-}
-
-/**
- * Whether a read at this `readScope` must be limited to published rows. Fail-CLOSED: only the explicit
- * `'all'` scope (admin / live preview) sees drafts; anything else — `'published'`, an unexpected value,
- * or a missing scope (a guard regression) — stays published-only. Mirrors the public render path so the
- * two read entry points can't drift to opposite defaults.
- */
-export function publishedOnlyForScope(readScope: string | undefined): boolean {
-  return readScope !== 'all'
-}
-
-const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS'])
-export function actionForMethod(method: string): Action {
-  return SAFE_METHODS.has(method.toUpperCase()) ? 'read' : 'write'
-}
-
-/**
- * Resource for an /api path: the collection segment, except the tooling sub-routes
- * (`/options`, `/translations`, `/:id/translations`, `/:id/dead-refs`) map to a distinct
- * `<collection>/<tool>` resource so the public content grant (read on the bare collection) never covers
- * admin-only tooling — a pageLike collection's `translations` / `dead-refs` maps must NOT be readable by
- * anonymous visitors. The group-keyed and per-record translations routes share one resource: they expose
- * the same sibling ids (drafts included), so they must be gated identically.
- */
-export function resourceForPath(path: string): string {
-  const segs = (path.split('?')[0] ?? '').split('/').filter(Boolean)
-  if (segs[0] !== 'api' || !segs[1]) return ''
-  if (segs[2] === 'options' || segs[2] === 'translations') return `${segs[1]}/${segs[2]}`
-  if (segs[3] === 'translations' || segs[3] === 'dead-refs') return `${segs[1]}/${segs[3]}`
-  return segs[1]
-}
-
-/** Auth bootstrap endpoints, always permitted so the SPA can authenticate under default-deny. */
-export function isBootstrapPath(method: string, path: string): boolean {
-  const clean = path.split('?')[0]
-  const m = method.toUpperCase()
-  return (m === 'POST' && clean === '/api/auth/login') || (m === 'GET' && clean === '/api/auth/session')
-}
-
-/**
- * The public render entry (`GET /api/route`) the live page resolver calls. Readable by everyone — it is
- * the runtime equivalent of serving a static page — but the read SCOPE follows the principal: anonymous
- * gets published-only, an authenticated admin gets 'all' so the handler can surface a draft preview.
- * The handler itself re-forces published-only for any static-generation render (prerender / publisher).
- */
-export function isPublicRenderPath(method: string, path: string): boolean {
-  return method.toUpperCase() === 'GET' && path.split('?')[0] === '/api/route'
-}

package/layers/access/server/utils/public-resources.ts

@@ -1,11 +0,0 @@
-import { allCollections } from '../../../core/server/utils/registry'
-
-/**
- * Collections an anonymous visitor may read (published only): every page-like collection. The single,
- * registry-driven source for public reachability — consumed by the access guard (runtime serving) and
- * the sitemap (which URLs to advertise), so a consumer's own pageLike collection is public without
- * editing a literal allow-list. Page-like ⟺ has a `path`, i.e. it is routable to a static URL.
- */
-export function publicReadableResources(): string[] {
-  return allCollections().filter((c) => c.def.pageLike).map((c) => c.def.name)
-}

package/layers/access/server/utils/render-context.ts

@@ -1,41 +0,0 @@
-import { AsyncLocalStorage } from 'node:async_hooks'
-
-/**
- * Marks an in-process request chain as the runtime publisher's render, so the access guard grants it the
- * same `renderer` principal that build-time prerender gets. The publisher's render does a nested
- * `$fetch('/api/route')`, which is NOT a public endpoint; without this it would 401 at runtime. Set via
- * AsyncLocalStorage — never a header — so an external HTTP request can't forge renderer access (and
- * resolvePage still enforces published-only, so drafts never reach the output regardless).
- */
-const ctx = new AsyncLocalStorage<true>()
-
-/** Run a publish render (and its nested API fetches) as the renderer principal. */
-export function runAsRenderer<T>(fn: () => T): T {
-  return ctx.run(true, fn)
-}
-
-/** True when executing inside a publisher render, so the access guard grants the renderer principal. */
-export function isRendererContext(): boolean {
-  return ctx.getStore() === true
-}
-
-const stageGate = new AsyncLocalStorage<true>()
-
-/**
- * Marks the current request's async context as classified by the stage IP gate, so the in-process
- * sub-requests it spawns (the SSR page's own `$fetch`, the editor preview) are not gated again — they
- * reach the middleware stack on a mocked socket with no peer address and could never match a CIDR.
- *
- * `enterWith` rather than `run` because a middleware has no handle on the rest of its own request; the
- * mark is therefore reachable only from work descending from a request the gate already admitted, which
- * is what makes it unforgeable — unlike "this request has no socket peer", a property whole listeners
- * (unix domain sockets) have for every external client.
- */
-export function markStageGatePassed(): void {
-  stageGate.enterWith(true)
-}
-
-/** True inside a request whose originating request was already classified by the stage IP gate. */
-export function isStageGatePassedContext(): boolean {
-  return stageGate.getStore() === true
-}

package/layers/access/server/utils/require-admin.ts

@@ -1,15 +0,0 @@
-import { createError, type H3Event } from 'h3'
-
-/**
- * Per-handler write-authorization backstop. The access-guard middleware is the PRIMARY enforcement, but
- * it is gated on an `/api/` path-prefix string and is the only check — a future mutating route mounted
- * outside `/api/` (a `server/routes/*` action, a webhook), or any guard-vs-router path divergence, would
- * otherwise run unauthenticated. Every mutating handler calls this so authorization never depends solely
- * on that prefix heuristic. Throws 401 unless the resolved principal is the admin (the only role with
- * write grants — `renderer` is read-only, `anonymous` has no grants).
- */
-export function requireAdmin(event: H3Event): void {
-  if (event.context.principal?.role !== 'admin') {
-    throw createError({ statusCode: 401, statusMessage: 'Unauthorized' })
-  }
-}

package/layers/admin/app/pages/admin/[collection]/[id].nuxt.test.ts

@@ -1,200 +0,0 @@
-import { describe, it, expect, beforeEach, vi } from 'vitest'
-import { useState } from '#imports'
-import { flushPromises } from '@vue/test-utils'
-import { readBody } from 'h3'
-import { mountSuspended, registerEndpoint, mockNuxtImport } from '@nuxt/test-utils/runtime'
-import RecordPage from './[id].vue'
-
-const thingsSchema = {
-  name: 'things', mode: 'multi', translatable: false, pageLike: false, seo: false, status: false,
-  blocks: { enabled: false }, label: { singular: 'Thing', plural: 'Things' },
-  fields: { title: { type: 'text', required: true, unique: false } },
-}
-// Carries an explicit `label.new` — the create heading must use it verbatim, not the generic template.
-const articlesSchema = {
-  name: 'articles', mode: 'multi', translatable: false, pageLike: false, seo: false, status: false,
-  blocks: { enabled: false }, label: { singular: 'Article', plural: 'Articles', new: 'Compose article' },
-  fields: { title: { type: 'text', required: true, unique: false } },
-}
-registerEndpoint('/api/collections', () => ({ data: [thingsSchema, articlesSchema] }))
-registerEndpoint('/api/articles', () => ({ data: [], total: 0, page: 1, perPage: 25 }))
-
-let patched: Record<string, unknown> | null = null
-let posted: Record<string, unknown> | null = null
-registerEndpoint('/api/things/1', async (event) => {
-  if (event.method === 'PATCH') { patched = await readBody(event); return { id: 1, ...patched } }
-  return { id: 1, title: 'Existing' }
-})
-// A record whose title field is blank — the heading must fall back to the generic "#id" phrase.
-registerEndpoint('/api/things/2', () => ({ id: 2, title: '   ' }))
-registerEndpoint('/api/things', async (event) => {
-  if (event.method === 'POST') { posted = await readBody(event); return { id: 7, ...posted } }
-  return { data: [], total: 0, page: 1, perPage: 25 }
-})
-
-// The editor's Delete flows through the shared batch endpoint + the referrer-aggregate preview.
-let bulkBody: Record<string, unknown> | null = null
-registerEndpoint('/api/things/bulk', async (event) => {
-  bulkBody = await readBody(event)
-  return { action: bulkBody!.action, count: 1, ids: bulkBody!.ids }
-})
-registerEndpoint('/api/references/referrers', () => ({ counts: {} }))
-
-// Route + navigation are mocked so the page reads collection/id from `h.params` and navigations are captured.
-const h = vi.hoisted(() => ({ params: { collection: 'things', id: '1' }, nav: [] as unknown[] }))
-mockNuxtImport('useRoute', () => () => ({ params: h.params, query: {}, fullPath: `/admin/${h.params.collection}/${h.params.id}` }))
-mockNuxtImport('navigateTo', () => (to: unknown) => { h.nav.push(to); return Promise.resolve() })
-
-beforeEach(() => {
-  h.params = { collection: 'things', id: '1' }
-  h.nav.length = 0
-  patched = null
-  posted = null
-  bulkBody = null
-  useState('kestrel-collections').value = null
-  useState('kestrel-blocks').value = null
-})
-
-const settle = async () => {
-  await new Promise((r) => setTimeout(r, 20))
-  await flushPromises()
-}
-
-describe('record editor page header', () => {
-  it('merges Save, Cancel and Delete into the record head, each with an icon', async () => {
-    const w = await mountSuspended(RecordPage)
-    await flushPromises()
-
-    const head = w.find('.record__head')
-    expect(head.exists()).toBe(true)
-    const buttons = head.findAll('.ui-button')
-    expect(buttons.map((b) => b.text())).toEqual(expect.arrayContaining(['Save', 'Cancel', 'Delete']))
-    for (const b of buttons) expect(b.find('.ui-icon').exists()).toBe(true)
-    expect(w.find('.editor__actions').exists()).toBe(false)
-
-    // Cancel carries real button chrome — it sits beside the solid Delete/Save, not as bare text…
-    expect(buttons.find((b) => b.text() === 'Cancel')!.classes()).toContain('ui-button--secondary')
-    // …while the icon-only tools (undo/redo/open) stay quiet ghosts.
-    const iconOnly = buttons.filter((b) => b.text() === '')
-    expect(iconOnly.length).toBeGreaterThan(0)
-    for (const b of iconOnly) expect(b.classes()).toContain('ui-button--ghost')
-  })
-
-  it('titles the header with the singular label, not the raw (plural) route param', async () => {
-    h.params = { collection: 'things', id: 'new' }
-    const wNew = await mountSuspended(RecordPage)
-    await flushPromises()
-    expect(wNew.find('.record__title').text()).toBe('New Thing')
-    expect(wNew.find('.record__back').text()).toContain('Things')
-    // The generic phrase is title-cased; a real record title would not be.
-    expect(wNew.find('.record__title').classes()).toContain('record__title--generic')
-  })
-
-  it('keeps the back link on the heading row (one line, so the panes keep the vertical space)', async () => {
-    const w = await mountSuspended(RecordPage)
-    await flushPromises()
-    expect(w.find('.record__head .record__back').exists()).toBe(true)
-  })
-
-  it('titles a saved record with its own title — an id means nothing to an editor', async () => {
-    h.params = { collection: 'things', id: '1' }
-    const wEdit = await mountSuspended(RecordPage)
-    await settle()
-    expect(wEdit.find('.record__title').text()).toBe('Existing')
-    expect(wEdit.find('.record__title').classes()).not.toContain('record__title--generic')
-  })
-
-  it('falls back to "Edit {collection} #{id}" when the record has no usable title', async () => {
-    h.params = { collection: 'things', id: '2' }
-    const wEdit = await mountSuspended(RecordPage)
-    await settle()
-    expect(wEdit.find('.record__title').text()).toBe('Edit Thing #2')
-    expect(wEdit.find('.record__title').classes()).toContain('record__title--generic')
-  })
-
-  it('uses the collection\'s explicit label.new for the create heading (no generic "New X")', async () => {
-    h.params = { collection: 'articles', id: 'new' }
-    const w = await mountSuspended(RecordPage)
-    await flushPromises()
-    expect(w.find('.record__title').text()).toBe('Compose article')
-  })
-
-  it('wires the header Save button to submit the editor form', async () => {
-    const w = await mountSuspended(RecordPage)
-    await flushPromises()
-    const save = w.findAll('.record__head .ui-button').find((b) => b.text() === 'Save')!
-    expect(save.attributes('type')).toBe('submit')
-    expect(save.attributes('form')).toBe('record-editor')
-    expect(w.find('form.editor').attributes('id')).toBe('record-editor')
-  })
-
-  it('shows the back link with a centered SVG arrow (no text arrow glyph)', async () => {
-    const w = await mountSuspended(RecordPage)
-    await flushPromises()
-    const back = w.find('.record__back')
-    expect(back.exists()).toBe(true)
-    expect(back.find('.ui-icon').exists()).toBe(true)
-    expect(back.text()).not.toContain('←')
-  })
-
-  it('saving an existing record stays on the page — Save only saves', async () => {
-    const w = await mountSuspended(RecordPage)
-    await flushPromises()
-    await w.find('form.editor').trigger('submit')
-    await settle()
-    expect(patched).toMatchObject({ title: 'Existing' })
-    expect(h.nav).toEqual([])
-  })
-
-  it('saving a NEW record moves to its own editor, not back to the list', async () => {
-    h.params = { collection: 'things', id: 'new' }
-    const w = await mountSuspended(RecordPage)
-    await flushPromises()
-    await w.findAll('input')[0]!.setValue('Fresh')
-    await w.find('form.editor').trigger('submit')
-    await settle()
-    expect(posted).toMatchObject({ title: 'Fresh' })
-    // navigates to the created record's editor (id 7), never to the list path
-    expect(h.nav).toContain('/admin/things/7')
-    expect(h.nav).not.toContain('/admin/things')
-  })
-
-  it('deletes through the confirm dialog (shared batch op) and navigates back to the list', async () => {
-    const w = await mountSuspended(RecordPage)
-    await settle()
-    // the header Delete opens the dialog rather than window.confirm
-    const del = w.findAll('.record__head .ui-button').find((b) => b.text() === 'Delete')!
-    await del.trigger('click')
-    await settle()
-    expect(w.find('.ui-dialog__content').exists()).toBe(true)
-    // confirming posts the bulk delete for this one id and then navigates to the list
-    const confirm = w.findAll('.ui-dialog__content .ui-button').find((b) => /^delete$/i.test(b.text().trim()))!
-    await confirm.trigger('click')
-    await settle()
-    expect(bulkBody).toEqual({ action: 'delete', ids: [1] })
-    expect(h.nav).toContain('/admin/things')
-  })
-
-  it('a native beforeunload (tab close / reload) is blocked only while there are unsaved changes', async () => {
-    const w = await mountSuspended(RecordPage)
-    await flushPromises()
-
-    // pristine → unload is NOT blocked
-    const clean = new Event('beforeunload', { cancelable: true })
-    window.dispatchEvent(clean)
-    expect(clean.defaultPrevented).toBe(false)
-
-    // edit a field → dirty → unload IS blocked (browser shows its native prompt)
-    await w.findAll('input')[0]!.setValue('Changed')
-    await settle()
-    const dirty = new Event('beforeunload', { cancelable: true })
-    window.dispatchEvent(dirty)
-    expect(dirty.defaultPrevented).toBe(true)
-
-    // unmounting removes the listener (no leak across pages)
-    w.unmount()
-    const afterUnmount = new Event('beforeunload', { cancelable: true })
-    window.dispatchEvent(afterUnmount)
-    expect(afterUnmount.defaultPrevented).toBe(false)
-  })
-})