@michaelthielemann/kestrel 3.0.0 → 4.0.0

package/layers/admin/app/components/CollectionListBulkBar.vue

@@ -3,10 +3,14 @@
 // than overlaying it. Publish/Unpublish are schema-driven (only when the collection has a status).
 // NOT a live region: the selection count is announced through the list's permanent .list__sr-status
 // region; a v-if-toggled role="status" here would double up and stay silent on first show.
-defineProps<{ count: number; hasStatus: boolean; busy: boolean }>()
-const emit = defineEmits<{ setStatus: [status: 'published' | 'draft']; delete: []; clear: [] }>()
+import { resolveLocalized } from '../../../ui/app/utils/localized'
+import type { SerializedAction } from '@michaelthielemann/kestrel-core'
 
-const { t } = useT()
+const props = defineProps<{ count: number; hasStatus: boolean; busy: boolean; actions?: SerializedAction[] }>()
+const emit = defineEmits<{ setStatus: [status: 'published' | 'draft']; delete: []; runAction: [action: SerializedAction]; clear: [] }>()
+
+const { t, lang } = useT()
+const actionLabel = (action: SerializedAction) => resolveLocalized(action.label, lang.value) ?? action.name
 </script>
 
 <template>
@@ -17,6 +21,16 @@ const { t } = useT()
         <KestrelUiButton type="button" size="sm" variant="secondary" :disabled="busy" @click="emit('setStatus', 'published')">{{ t('list.bulkPublish') }}</KestrelUiButton>
         <KestrelUiButton type="button" size="sm" variant="secondary" :disabled="busy" @click="emit('setStatus', 'draft')">{{ t('list.bulkUnpublish') }}</KestrelUiButton>
       </template>
+      <KestrelUiButton
+        v-for="action in props.actions"
+        :key="action.name"
+        type="button"
+        size="sm"
+        variant="secondary"
+        :disabled="busy"
+        :data-action="action.name"
+        @click="emit('runAction', action)"
+      >{{ actionLabel(action) }}</KestrelUiButton>
       <KestrelUiButton type="button" size="sm" variant="danger" :disabled="busy" @click="emit('delete')">{{ t('list.bulkDelete') }}</KestrelUiButton>
       <KestrelUiButton type="button" size="sm" variant="ghost" @click="emit('clear')">{{ t('list.clearSelection') }}</KestrelUiButton>
     </div>

package/layers/admin/app/components/CollectionListFilterPanel.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import type { FilterOp } from '../../../core/app/utils/filter-ops'
+import type { FilterOp } from '@michaelthielemann/kestrel-core'
 import type { ListFilterDraft } from '../composables/useListFilterDraft'
 import { columnLabel } from '../utils/list-cell'
 import type { ListColumn } from '../utils/list-columns'

package/layers/admin/app/components/CollectionListPager.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { PER_PAGE_OPTIONS } from '../../../core/app/utils/list-limits'
+import { PER_PAGE_OPTIONS } from '@michaelthielemann/kestrel-core/client'
 
 const props = defineProps<{ page: number; totalPages: number; total: number; perPage: number }>()
 const emit = defineEmits<{ 'update:page': [page: number]; 'update:perPage': [perPage: number] }>()

package/layers/admin/app/components/CollectionListTable.vue

@@ -2,6 +2,8 @@
 import { sortDirection } from '../utils/list-query'
 import { cellDisplay, columnLabel, rowLabel as labelForRow } from '../utils/list-cell'
 import type { ListColumn } from '../utils/list-columns'
+import { resolveLocalized } from '../../../ui/app/utils/localized'
+import type { SerializedAction } from '@michaelthielemann/kestrel-core'
 
 const props = defineProps<{
   rows: Record<string, unknown>[]
@@ -13,6 +15,8 @@ const props = defineProps<{
   selected: Set<number>
   allSelected: boolean
   headerIndeterminate: boolean
+  /** Schema-driven row actions beyond the built-in edit/duplicate/delete. */
+  actions?: SerializedAction[]
 }>()
 const emit = defineEmits<{
   sort: [key: string]
@@ -20,13 +24,15 @@ const emit = defineEmits<{
   toggleAll: [on: boolean]
   duplicate: [id: number]
   delete: [ids: number[]]
+  runAction: [action: SerializedAction, id: number]
 }>()
 
-const { t } = useT()
+const { t, lang } = useT()
 const { locales } = useContentLocales()
 
 const colLabel = (col: ListColumn) => columnLabel(col, t)
 const rowLabel = (row: Record<string, unknown>) => labelForRow(props.columns, row)
+const actionLabel = (action: SerializedAction) => resolveLocalized(action.label, lang.value) ?? action.name
 
 function arrow(field: string) {
   const dir = sortDirection(props.sort, field)
@@ -99,12 +105,32 @@ function rowTranslations(row: Record<string, unknown>) {
             <button type="button" class="list__action-btn" :disabled="busy" :aria-label="t('list.rowDuplicate', { name: rowLabel(row) })" @click="emit('duplicate', Number(row.id))">
               <KestrelUiIcon name="copy" :size="15" />
             </button>
+            <button
+              v-for="action in actions"
+              :key="action.name"
+              type="button"
+              class="list__action-btn"
+              :disabled="busy"
+              :data-action="action.name"
+              :aria-label="`${actionLabel(action)}: ${rowLabel(row)}`"
+              @click="emit('runAction', action, Number(row.id))"
+            >
+              <KestrelUiIcon :name="action.icon ?? 'zap'" :size="15" />
+            </button>
             <button type="button" class="list__action-btn list__action-btn--danger" :disabled="busy" :aria-label="t('list.rowDelete', { name: rowLabel(row) })" @click="emit('delete', [Number(row.id)])">
               <KestrelUiIcon name="trash" :size="15" />
             </button>
           </div>
         </td>
-        <td v-for="c in columns" :key="c.key" :class="{ 'list__narrow-cell': c.type === 'translations' || c.type === 'deadRefs' }">
+        <!-- A quarantined row carries none of its normal fields — a single spanning cell replaces
+             the per-column cells rather than rendering blanks for data that doesn't exist. -->
+        <td v-if="row.$quarantined === true" :colspan="columns.length">
+          <span class="list__quarantine-badge">
+            <KestrelUiIcon name="triangle-alert" :size="14" role="img" :aria-label="t('list.quarantined')" />
+            {{ t('list.quarantined') }}
+          </span>
+        </td>
+        <td v-else v-for="c in columns" :key="c.key" :class="{ 'list__narrow-cell': c.type === 'translations' || c.type === 'deadRefs' }">
           <span v-if="c.type === 'deadRefs'" class="list__deadrefs">
             <KestrelUiIcon
               v-if="row.$hasDeadRefs"
@@ -196,6 +222,19 @@ function rowTranslations(row: Record<string, unknown>) {
     white-space: nowrap;
   }
 
+  // Quarantine badge — icon + text (not color alone, WCAG 1.4.1), replacing a row's normal data cells.
+  &__quarantine-badge {
+    display: inline-flex;
+    align-items: center;
+    gap: var(--space-1);
+    padding: 2px var(--space-2);
+    border: 1px solid var(--color-danger);
+    border-radius: var(--radius-sm);
+    color: var(--color-danger);
+    font-size: var(--text-xs);
+    font-weight: var(--weight-medium);
+  }
+
   // Dead-reference warning: an amber triangle, shown only on rows holding a stale reference.
   &__deadrefs {
     display: inline-flex;

package/layers/admin/app/components/EditorStatus.vue

@@ -5,7 +5,7 @@
 //             blue   — saved but a Draft, so it is intentionally NOT on the live/static site
 //             green  — saved and (for status collections) published, or just saved (no status field)
 //   RIGHT — the GENERATED state of this record's static page (pageLike collections only), read from
-//           `publish_status` via `/api/publish-status`:
+//           `publish_status` via `/api/publishStatus`:
 //             green   — the route's last publish succeeded (the file is live; the tooltip names local vs S3)
 //             amber   — published but no success row yet — a republish is in flight ("Generating…")
 //             neutral — this environment never produces the file (dev / static output off) → "Not built"
@@ -24,7 +24,7 @@ const props = defineProps<{
   savedStatus?: string
   /** Only pageLike collections produce a static page → only they get the right (live) lamp. */
   pageLike?: boolean
-  /** The record's last publish outcome (from `/api/publish-status`); null/absent while unknown. */
+  /** The record's last publish outcome (from `/api/publishStatus`); null/absent while unknown. */
   live?: PublishStatusData | null
 }>()
 const { t, lang } = useT()
@@ -62,6 +62,11 @@ const live = computed<{ tone: 'green' | 'red' | 'amber' | 'blue' | 'neutral'; wo
   const s = props.live?.status ?? null
   if (s === 'error')
     return { tone: 'red', word: t('editorStatus.word.error'), detail: t('editorStatus.live.error'), when: updatedAtLabel.value, error: props.live?.error ?? '' }
+  // An environment that never generates (dev / static output off) cannot resolve any pending state, so an
+  // alarming "Outdated" would point at a problem no action here can fix — calm neutral, even when an old
+  // success row (e.g. a prod run against the same DB) exists.
+  if (props.live?.generates === false)
+    return { tone: 'neutral', word: t('editorStatus.word.notBuilt'), detail: t('editorStatus.live.notBuilt') }
   if (s === 'success') {
     // Saved after the last publish: the file IS live, but it is an older version of this record. Saving no
     // longer republishes (ADR-0008), so this is the normal state of a page being worked on — amber, not red.
@@ -72,11 +77,7 @@ const live = computed<{ tone: 'green' | 'red' | 'amber' | 'blue' | 'neutral'; wo
     const onS3 = (props.live?.target ?? props.live?.driver) === 's3'
     return { tone: 'green', word: t('editorStatus.word.live'), detail: t(onS3 ? 'editorStatus.live.liveS3' : 'editorStatus.live.liveLocal'), when: updatedAtLabel.value }
   }
-  // No success row yet. Only an explicit generates:false means "this environment produces nothing" (dev /
-  // static output off) → a calm neutral "Not built". Unknown (undefined) → assume a publish is in flight.
-  if (props.live?.generates === false)
-    return { tone: 'neutral', word: t('editorStatus.word.notBuilt'), detail: t('editorStatus.live.notBuilt') }
-  // Never published, and a save no longer enqueues anything (ADR-0008) — so nothing is in flight and
+  // Never published, and a save does not enqueue anything (ADR-0008) — so nothing is in flight and
   // nothing will be until someone presses Publish. Reporting progress here would point the user at a
   // spinner instead of at the one action that changes it. With `publishOnSave` a save DOES republish, so
   // there the in-flight reading is the right one.

package/layers/admin/app/components/LocaleBar.vue

@@ -41,7 +41,9 @@ const { t } = useT()
       >{{ up(loc) }}<KestrelUiIcon name="pencil" :size="14" /></NuxtLink>
 
       <span v-else-if="existingId(loc) !== null" class="locale-bar__item">
-        <NuxtLink class="locale-bar__btn" :to="`/admin/${collection}/${existingId(loc)}?locale=${loc}`" :aria-label="t('localeBar.editLocale', { loc: up(loc) })">{{ up(loc) }}<KestrelUiIcon name="pencil" :size="14" /></NuxtLink>
+        <!-- No `?locale=` here: the target id already IS a specific locale's row (useEditForm reads the
+             active locale off the loaded record, not the query, once an id is known). -->
+        <NuxtLink class="locale-bar__btn" :to="`/admin/${collection}/${existingId(loc)}`" :aria-label="t('localeBar.editLocale', { loc: up(loc) })">{{ up(loc) }}<KestrelUiIcon name="pencil" :size="14" /></NuxtLink>
         <button type="button" class="locale-bar__btn locale-bar__btn--copy" :aria-label="t('localeBar.copyInto', { loc: up(loc), current: up(current) })" @click="emit('copyFrom', loc)"><KestrelUiIcon name="copy" :size="14" /></button>
       </span>
 

package/layers/admin/app/components/PageFields.vue

@@ -1,8 +1,6 @@
 <script setup lang="ts">
-import type { FieldDef } from '../../../core/server/utils/defineCollection'
-import type { LayoutNode } from '../../../core/server/utils/field-layout'
-import type { SeoMeta } from '../../../core/server/utils/seo'
-
+import type { FieldDef, LayoutNode, SeoMeta } from '@michaelthielemann/kestrel-core'
+import { slugify } from '@michaelthielemann/kestrel-core/client'
 // The collection (page) field list — delegates to the shared <KestrelFieldLayout> renderer (rows / groups /
 // widths, or one field per row when the collection declares no layout), shared by the flat-collection
 // form and the 3-pane editor's root-selected pane so the wiring lives in exactly one place. pageLike

package/layers/admin/app/components/SeoFields.vue

@@ -1,9 +1,7 @@
 <script setup lang="ts">
 import { computed } from 'vue'
-import type { SeoMeta } from '../../../core/server/utils/seo'
-import type { FieldDef } from '../../../core/server/utils/defineCollection'
-import { localePath } from '../../../core/app/utils/locale-path'
-
+import { localePath } from '@michaelthielemann/kestrel-core/client'
+import type { FieldDef, SeoMeta } from '@michaelthielemann/kestrel-core'
 // The page-level SEO section: edit the meta title/description/noindex (the `seo` system column) with a
 // live Google-result preview. Emits the whole merged SeoMeta so the parent routes it through setField.
 const props = defineProps<{

package/layers/admin/app/components/SingletonEditor.vue

@@ -34,9 +34,10 @@ useUnsavedGuard(() => editorRef.value?.dirty ?? false, () => t('editor.discardCo
         <KestrelUiButton type="button" variant="ghost" size="sm" icon="undo" :disabled="saving || !editorRef?.canUndo" :title="t('history.undo')" :aria-label="t('history.undo')" @click="editorRef?.undo()" />
         <KestrelUiButton type="button" variant="ghost" size="sm" icon="redo" :disabled="saving || !editorRef?.canRedo" :title="t('history.redo')" :aria-label="t('history.redo')" @click="editorRef?.redo()" />
         <KestrelUiButton type="button" variant="ghost" size="sm" icon="external-link" :title="previewTitle" :aria-label="previewTitle" :loading="editorRef?.previewOpening" @click="editorRef?.openPreview()" />
-        <KestrelUiButton type="submit" :form="EDITOR_FORM_ID" variant="primary" size="sm" icon="check" :loading="saving">{{ t('common.save') }}</KestrelUiButton>
+        <!-- A quarantined record is read-only: no Save, no Publish — there is nothing valid to write. -->
+        <KestrelUiButton v-if="!editorRef?.quarantined" type="submit" :form="EDITOR_FORM_ID" variant="primary" size="sm" icon="check" :loading="saving">{{ t('common.save') }}</KestrelUiButton>
         <!-- Publishing is its own decision: Save persists, Publish writes the static page (ADR-0008). -->
-        <KestrelUiButton v-if="editorRef?.canPublish !== false" type="button" variant="secondary" size="sm" icon="upload" :loading="editorRef?.publishing" :disabled="saving" @click="editorRef?.publish()">{{ t('common.publish') }}</KestrelUiButton>
+        <KestrelUiButton v-if="editorRef?.canPublish !== false && !editorRef?.quarantined" type="button" variant="secondary" size="sm" icon="upload" :loading="editorRef?.publishing" :disabled="saving" @click="editorRef?.publish()">{{ t('common.publish') }}</KestrelUiButton>
         <KestrelEditorStatus class="singleton__ampel" :dirty="editorRef?.dirty ?? false" :saving="saving" :has-status="editorRef?.hasStatus ?? false" :status="editorRef?.status" :saved-status="editorRef?.savedStatus" :page-like="editorRef?.pageLike ?? false" :live="editorRef?.live" />
       </div>
     </div>

package/layers/admin/app/composables/useAuth.ts

@@ -17,7 +17,7 @@ export function useAuth() {
     // Fail closed: a transient session-endpoint failure (5xx, offline) must read as
     // "not authenticated" so the route guard redirects to login instead of throwing an error page.
     try {
-      const r = await $fetch<{ authenticated: boolean; exp?: number }>('/api/auth/session')
+      const r = await $fetch<{ authenticated: boolean; exp?: number }>('/api/session')
       state.value = { authenticated: r.authenticated, exp: r.exp ?? null, checked: true }
     } catch {
       state.value = { authenticated: false, exp: null, checked: true }
@@ -31,7 +31,7 @@ export function useAuth() {
   }
 
   async function login(password: string) {
-    const r = await $fetch<{ ok: true; exp: number }>('/api/auth/login', {
+    const r = await $fetch<{ ok: true; exp: number }>('/api/login', {
       method: 'POST',
       body: { password },
     })
@@ -48,7 +48,7 @@ export function useAuth() {
     // The desired end state is "logged out" regardless of the response: an expired/rotated
     // session makes the guarded logout endpoint 401, but the local session is still cleared.
     try {
-      await $fetch('/api/auth/logout', { method: 'POST' })
+      await $fetch('/api/logout', { method: 'POST' })
     } catch {
       // already invalid server-side — nothing to clear there
     }

package/layers/admin/app/composables/useBlockTree.ts

@@ -1,7 +1,7 @@
 import { ref, computed } from 'vue'
 import type { Ref } from 'vue'
 import { useEchoGuard } from '../../../ui/app/composables/useEchoGuard'
-import type { SerializedBlock } from '../../../core/server/utils/serialize-collection'
+import type { SerializedBlock } from '@michaelthielemann/kestrel-core'
 import {
   type BlockRow,
   findInTree,

package/layers/admin/app/composables/useBlocks.ts

@@ -1,4 +1,4 @@
-import type { SerializedBlock } from '../../../core/server/utils/serialize-collection'
+import type { SerializedBlock } from '@michaelthielemann/kestrel-core'
 
 // Thin wrapper over the shared cached-resource loader; keeps the named `blocks` return.
 export function useBlocks() {

package/layers/admin/app/composables/useCollectionOps.ts

@@ -1,10 +1,20 @@
 import { ref, toValue, type MaybeRefOrGetter } from 'vue'
-import { buildDeleteReport, type BatchAction, type BatchDeleteReport, type BulkResult, type ReferrerCounts } from '../utils/collection-ops'
+import { buildDeleteReport, type BatchAction, type BatchDeleteReport, type BatchPipelineResult, type BulkResult, type ReferrerCounts } from '../utils/collection-ops'
+import type { SerializedAction } from '@michaelthielemann/kestrel-core'
+
+/** Which write pipeline each batch action runs, and the body it takes. A publish/unpublish is an
+ *  `updateMany` with a status patch — the same pipeline any other field-wide edit would use. */
+const BATCH_PIPELINE: Record<BatchAction, { op: string, patch?: { status: 'published' | 'draft' } }> = {
+  delete: { op: 'deleteMany' },
+  duplicate: { op: 'duplicate' },
+  publish: { op: 'updateMany', patch: { status: 'published' } },
+  unpublish: { op: 'updateMany', patch: { status: 'draft' } },
+}
 
 /**
  * Client orchestration for the collection batch operations — ONE module, two entry points: a row action
- * passes a single id, the bulk bar passes many. Every mutating call hits the one command endpoint
- * (`POST /api/{collection}/bulk`); the server does the batching, the client never loops N requests.
+ * passes a single id, the bulk bar passes many. Every mutating call runs a batch pipeline
+ * (`POST /api/{collection}/{pipeline}`); the server does the batching, the client never loops N requests.
  * Mirrors media/useMediaOps (busy/error + an onChanged refetch hook).
  */
 export function useCollectionOps(collection: MaybeRefOrGetter<string>, onChanged?: () => void | Promise<void>) {
@@ -17,9 +27,14 @@ export function useCollectionOps(collection: MaybeRefOrGetter<string>, onChanged
     busy.value = true
     error.value = null
     try {
-      const res = await $fetch<BulkResult>(`/api/${name()}/bulk`, { method: 'POST', body: { action, ids } })
+      const { op, patch } = BATCH_PIPELINE[action]
+      const res = await $fetch<BatchPipelineResult>(`/api/${name()}/${op}`, { method: 'POST', body: { ids, ...(patch ? { patch } : {}) } })
       await onChanged?.()
-      return res
+      // `duplicate` answers with the CREATED rows, the two batch ops with a count + the ids they touched;
+      // both fold into the one shape the list UI reports.
+      return Array.isArray(res)
+        ? { action, count: res.length, ids: res.map((row) => Number(row.id)) }
+        : { action, count: res.count, ids: res.ids }
     } catch (e) {
       error.value = (e as { statusMessage?: string })?.statusMessage ?? t('list.opFailed')
       throw e
@@ -33,7 +48,7 @@ export function useCollectionOps(collection: MaybeRefOrGetter<string>, onChanged
   async function previewDelete(ids: number[]): Promise<BatchDeleteReport> {
     error.value = null
     try {
-      const res = await $fetch<ReferrerCounts>('/api/references/referrers', { query: { collection: name(), ids: ids.join(',') } })
+      const res = await $fetch<ReferrerCounts>(`/api/${name()}/referrers`, { query: { ids: ids.join(',') } })
       // The endpoint flags whether the index lookup ran; carry that through rather than inferring safety from
       // an empty `counts`. A missing body is indeterminate too — it is no evidence that nothing links here.
       return buildDeleteReport(ids, res?.counts ?? {}, res != null && res.checked !== false)
@@ -43,11 +58,33 @@ export function useCollectionOps(collection: MaybeRefOrGetter<string>, onChanged
     }
   }
 
+  /**
+   * Run a schema-driven custom action (a consumer's `definePipeline` beyond the built-in bulk set). The
+   * response shape is whatever that pipeline answers with — unlike the built-ins, generic rendering has no
+   * contract to decode, so the reported result is simply the ids the caller asked to act on.
+   */
+  async function runCustomAction(action: SerializedAction, ids: number[]): Promise<BulkResult> {
+    busy.value = true
+    error.value = null
+    try {
+      const record = action.kind === 'record'
+      const url = record ? `/api/${name()}/${action.name}/${ids[0]}` : `/api/${name()}/${action.name}`
+      await $fetch(url, { method: 'POST', body: record ? undefined : { ids } })
+      await onChanged?.()
+      return { action: action.name, count: ids.length, ids }
+    } catch (e) {
+      error.value = (e as { statusMessage?: string })?.statusMessage ?? t('list.opFailed')
+      throw e
+    } finally {
+      busy.value = false
+    }
+  }
+
   const confirmDelete = (ids: number[]) => bulk('delete', ids)
   const duplicate = (ids: number[]) => bulk('duplicate', ids)
   /**
    * Persist a new status and, for a publish, write the static output too (ADR-0008). Two calls because
-   * they are two things: the bulk endpoint owns the DB write (validation, all-or-nothing, write events),
+   * they are two things: `updateMany` owns the DB write (validation, all-or-nothing, write events),
    * `/api/publish` owns the render. Unpublishing needs no second call — the write event prunes the pages
    * on its own, since taking a page offline must never wait for a separate action.
    */
@@ -61,5 +98,5 @@ export function useCollectionOps(collection: MaybeRefOrGetter<string>, onChanged
     return res
   }
 
-  return { busy, error, previewDelete, confirmDelete, duplicate, setStatus }
+  return { busy, error, previewDelete, confirmDelete, duplicate, setStatus, runCustomAction }
 }

package/layers/admin/app/composables/useCollections.ts

@@ -1,6 +1,5 @@
-import type { SerializedCollection } from '../../../core/server/utils/serialize-collection'
+import type { SerializedCollection } from '@michaelthielemann/kestrel-core'
 
-// Thin wrapper over the shared cached-resource loader; keeps the named `collections` return.
 export function useCollections() {
   const { state: collections, load } = useCachedResource<SerializedCollection>('kestrel-collections', '/api/collections')
   return { collections, load }

package/layers/admin/app/composables/useEditForm.ts

@@ -1,8 +1,9 @@
-import type { SerializedField } from '../../../core/server/utils/serialize-collection'
-import type { LayoutNode } from '../../../core/server/utils/field-layout'
+import type { LayoutNode, SerializedField } from '@michaelthielemann/kestrel-core'
+import { isFieldVisible } from '@michaelthielemann/kestrel-core/client'
+import { validateField } from '@michaelthielemann/kestrel-fields/client'
 import type { BlockErrorMap } from '../utils/edit-form'
 import type { DeadRef } from '../utils/dead-refs'
-import { asFieldDef, initialValues, mapServerErrors, parseBlockErrors, reconcileBlockErrors, readFetchError } from '../utils/edit-form'
+import { asFieldDef, initialValues, mapServerErrors, parseBlockErrors, reconcileBlockErrors, reconcileDeadRefs, readFetchError } from '../utils/edit-form'
 
 export interface UseEditFormOptions {
   collection: string
@@ -51,6 +52,11 @@ export function useEditForm(opts: UseEditFormOptions) {
   // but fall back defensively (blocks → 'blocks', else 'fields') so an older/partial schema still works.
   const editorType = ref('fields')
 
+  // Set when the loaded row is the quarantine shape (`{ id, $quarantined: true }`) — a stored row
+  // that no longer matches its collection's select schema. The form locks read-only; nothing here can
+  // widen what a corrupted row exposes.
+  const quarantined = ref(false)
+
   const values = reactive<Record<string, unknown>>({})
   const errors = reactive<Record<string, string>>({})
   const formError = ref('')
@@ -171,16 +177,18 @@ export function useEditForm(opts: UseEditFormOptions) {
 
     let row: Record<string, unknown> | null = null
     if (mode.value === 'single') {
-      row = await $fetch<Record<string, unknown> | null>(`/api/${collection}`, translatable.value ? { query: { locale: requestedLocale } } : {})
+      row = await $fetch<Record<string, unknown> | null>(`/api/${collection}/readOne`, translatable.value ? { query: { locale: requestedLocale } } : {})
       activeLocale.value = requestedLocale
     } else if (id !== 'new') {
-      row = await $fetch<Record<string, unknown>>(`/api/${collection}/${id}`)
-      if (translatable.value) {
+      row = await $fetch<Record<string, unknown>>(`/api/${collection}/readOne/${id}`)
+      // A quarantined row carries none of its normal fields — skip the locale/translations lookups, which
+      // assume a real row, and go straight to the read-only lock.
+      if (row?.$quarantined !== true && translatable.value) {
         if (typeof row?.locale === 'string') activeLocale.value = row.locale
         if (typeof row?.translationGroup === 'string') translationGroup.value = row.translationGroup
         // Supplementary (drives the LocaleBar) — never block editing if it fails.
         try {
-          translations.value = await $fetch<Record<string, number | null>>(`/api/${collection}/${id}/translations`)
+          translations.value = await $fetch<Record<string, number | null>>(`/api/${collection}/translations/${id}`)
         } catch {
           translations.value = {}
         }
@@ -199,18 +207,19 @@ export function useEditForm(opts: UseEditFormOptions) {
         }
       }
     }
+    quarantined.value = row?.$quarantined === true
     rebaseline(row)
 
     // Supplementary dead-reference map (the editor warnings) — for any saved record, never blocks editing.
     const recordId = typeof row?.id === 'number' ? row.id : null
-    if (recordId != null) {
+    if (recordId != null && !quarantined.value) {
       try {
-        deadRefs.value = await $fetch<DeadRef[]>(`/api/${collection}/${recordId}/dead-refs`)
+        deadRefs.value = await $fetch<DeadRef[]>(`/api/${collection}/deadRefs/${recordId}`)
       } catch {
         deadRefs.value = []
       }
     } else {
-      deadRefs.value = [] // a new (unsaved) record has no references — keep it explicit, never stale
+      deadRefs.value = [] // a new (unsaved) or quarantined record has no references — keep it explicit
     }
   }
 
@@ -221,9 +230,14 @@ export function useEditForm(opts: UseEditFormOptions) {
   function setField(name: string, value: unknown, coalesceAs: string = name) {
     // Capture the pre-edit state for undo (coalesced for a same-field typing burst).
     recordHistory(coalesceAs)
-    // Reconcile before overwriting: keep block errors through a reorder, drop them on an edit.
+    // Reconcile before overwriting: keep block errors/dead-ref warnings through a reorder, drop them once
+    // the offending field itself is edited (swapping out a broken reference clears its own warning without
+    // a reload — the dead-ref map is otherwise only refetched on load).
     if (name === 'content') {
       blockErrors.value = reconcileBlockErrors(blockErrors.value, values.content as unknown[], value as unknown[])
+      deadRefs.value = reconcileDeadRefs(deadRefs.value, values.content as unknown[], value as unknown[])
+    } else if (deadRefs.value.some((r) => !r.blockId && r.field === name)) {
+      deadRefs.value = deadRefs.value.filter((r) => r.blockId || r.field !== name)
     }
     values[name] = value
     formError.value = ''
@@ -279,9 +293,9 @@ export function useEditForm(opts: UseEditFormOptions) {
 
   function handleError(e: unknown) {
     const { statusCode, statusMessage, issues, data } = readFetchError(e)
-    // The row WAS written and a follow-up step failed (a write effect — see write-effects.ts), so the
-    // server hands back the new `updatedAt`. Take it as the baseline: the client only rebaselines on
-    // success, and without this the "save again" those errors ask for would 409 on a stale precondition.
+    // The row WAS written and a critical after-step failed (e.g. `writeRedirects`), so the server hands
+    // back the new `updatedAt`. Take it as the baseline: the client only rebaselines on success, and
+    // without this the "save again" those errors ask for would 409 on a stale precondition.
     if (typeof data?.savedUpdatedAt === 'number') baseUpdatedAt.value = data.savedUpdatedAt
     if (statusCode === 400) {
       const mapped = mapServerErrors(issues)
@@ -305,6 +319,9 @@ export function useEditForm(opts: UseEditFormOptions) {
   }
 
   async function submit(): Promise<SubmitResult> {
+    // Sealed at the wire (validateOut) — a quarantined row's fields are unknown, so nothing here may
+    // send a write for it.
+    if (quarantined.value) return { ok: false }
     formError.value = ''
     blockErrors.value = {}
     // Clear the whole map, not just declared-field errors: `path`/`seo`/`status` are system columns
@@ -326,10 +343,10 @@ export function useEditForm(opts: UseEditFormOptions) {
       // `method` cast: Nuxt's typed `$fetch` over-constrains the method for this dynamic (template-literal)
       // admin route to GET; the runtime value is correct, only the static route type can't express it.
       const row = mode.value === 'single'
-        ? await $fetch(`/api/${collection}`, { method: 'PUT' as never, body, headers: ifUnmodified, ...(translatable.value ? { query: { locale: activeLocale.value } } : {}) })
+        ? await $fetch(`/api/${collection}/updateOne`, { method: 'POST' as never, body, headers: ifUnmodified, ...(translatable.value ? { query: { locale: activeLocale.value } } : {}) })
         : id === 'new'
-          ? await $fetch(`/api/${collection}`, { method: 'POST' as never, body })
-          : await $fetch(`/api/${collection}/${id}`, { method: 'PATCH', body, headers: ifUnmodified })
+          ? await $fetch(`/api/${collection}/createOne`, { method: 'POST' as never, body })
+          : await $fetch(`/api/${collection}/updateOne/${id}`, { method: 'POST' as never, body, headers: ifUnmodified })
       rebaseline(row as Record<string, unknown>)
       // `record` is the saved entity at the editor's public boundary; `row` stays the DB-layer term.
       return { ok: true, record: row }
@@ -361,6 +378,7 @@ export function useEditForm(opts: UseEditFormOptions) {
     pageLike,
     hasSeo,
     hasStatus,
+    quarantined,
     values,
     errors,
     formError,

package/layers/admin/app/composables/useLinkResolver.ts

@@ -21,7 +21,7 @@ export function useLinkResolver() {
     for (const k of keys) pending.add(k)
     try {
       const { data } = await $fetch<{ data: { collection: string; id: number; href: string }[] }>(
-        '/api/links/resolve', { query: { refs: keys.join(',') } },
+        '/api/resolveLinks', { query: { refs: keys.join(',') } },
       )
       const got = new Map(data.map((d) => [keyFor(d.collection, d.id), d.href]))
       for (const k of keys) cache.set(k, got.get(k) ?? '') // cache misses too, as '' → no re-fetch

package/layers/admin/app/composables/useListBatchActions.ts

@@ -3,12 +3,14 @@
 //
 // Destructive → confirm dialog. Reversible → run, toast, refetch (the ops composable's onChanged).
 import { ref, type ComputedRef } from 'vue'
+import { resolveLocalized } from '../../../ui/app/utils/localized'
 import type { BatchDeleteReport } from '../utils/collection-ops'
+import type { SerializedAction } from '@michaelthielemann/kestrel-core'
 
 export function useListBatchActions(collection: ComputedRef<string>, refetch: () => void | Promise<void>) {
-  const { t } = useT()
+  const { t, lang } = useT()
   const toast = useToast()
-  const { busy, error, previewDelete, confirmDelete: runDelete, duplicate: runDuplicate, setStatus: runSetStatus } =
+  const { busy, error, previewDelete, confirmDelete: runDelete, duplicate: runDuplicate, setStatus: runSetStatus, runCustomAction } =
     useCollectionOps(collection, () => refetch())
 
   const deleteOpen = ref(false)
@@ -57,5 +59,20 @@ export function useListBatchActions(collection: ComputedRef<string>, refetch: ()
     }
   }
 
-  return { busy, error, deleteOpen, deleteReport, askDelete, confirmDelete, duplicate, setStatus }
+  /** A schema-driven custom action: label falls back to the pipeline name, and an `ui.confirm` flag gates
+   *  on a plain confirm prompt (the built-ins get the richer dialog above; a generic action has no report to
+   *  preview). */
+  async function runAction(action: SerializedAction, ids: number[]) {
+    if (!ids.length) return
+    const label = resolveLocalized(action.label, lang.value) ?? action.name
+    if (action.confirm && !confirm(t('list.actionConfirm', { name: label, n: ids.length }))) return
+    try {
+      await runCustomAction(action, ids)
+      toast.success(t('list.actionDone', { name: label }))
+    } catch {
+      toast.error(error.value ?? t('list.opFailed'))
+    }
+  }
+
+  return { busy, error, deleteOpen, deleteReport, askDelete, confirmDelete, duplicate, setStatus, runAction }
 }

package/layers/admin/app/composables/useListColumns.ts

@@ -1,5 +1,5 @@
 import type { Ref } from 'vue'
-import type { SerializedCollection } from '../../../core/server/utils/serialize-collection'
+import type { SerializedCollection } from '@michaelthielemann/kestrel-core'
 import { availableColumns, defaultVisibleKeys, resolveVisibleColumns, type ListColumn } from '../utils/list-columns'
 
 /**

package/layers/admin/app/composables/useListFilterDraft.ts

@@ -3,10 +3,11 @@
 // `filter` (from the URL) is the committed state that drives the query; `draft` is what the panel shows
 // while the user is still typing. A value change debounces, an operator change commits at once.
 import { computed, onBeforeUnmount, reactive, watch, type ComputedRef } from 'vue'
-import { DEFAULT_OP, OPS_BY_KIND, type FilterKind, type FilterOp } from '../../../core/app/utils/filter-ops'
+import { DEFAULT_OP, OPS_BY_KIND } from '@michaelthielemann/kestrel-core/client'
+import type { FilterKind, FilterOp } from '@michaelthielemann/kestrel-core/client'
+import type { Localized } from '@michaelthielemann/kestrel-core'
 import { resolveLocalized } from '../../../ui/app/utils/localized'
 import { columnLabel } from '../utils/list-cell'
-import type { Localized } from '../../../core/server/utils/defineCollection'
 import type { ListColumn } from '../utils/list-columns'
 import type { FilterCell } from '../utils/list-query'