@michaelthielemann/kestrel 3.0.0 → 4.0.0

package/layers/media/server/api/media/[id].delete.ts

@@ -1,18 +0,0 @@
-import { eq, getTableColumns } from 'drizzle-orm'
-import { media } from '../../collections/media'
-import { useStorageDriver } from '../../../../core/server/utils/storage'
-import { deleteAffected } from '../../utils/media-ops'
-import { requireMediaCollection } from '../../utils/media-enabled'
-
-export default defineEventHandler(async (event) => {
-  requireAdmin(event) // write-authorization backstop (defense-in-depth; see require-admin.ts)
-  requireMediaCollection()
-  const id = requireId(event)
-  const cols = getTableColumns(media) as Record<string, never>
-  const db = useDb()
-  // deleteAffected silently no-ops on a missing row, so keep an explicit 404 guard.
-  const row = db.select({ id: cols.id }).from(media).where(eq(cols.id, id)).get() as { id: number } | undefined
-  if (!row) throw createError({ statusCode: 404, statusMessage: `media ${id} not found` })
-  await deleteAffected(db, useStorageDriver(), [{ type: 'file', id }], false)
-  return { deleted: true, id }
-})

package/layers/media/server/api/media/[id].get.ts

@@ -1,10 +0,0 @@
-import media from '../../collections/media'
-import { requireMediaCollection } from '../../utils/media-enabled'
-
-export default defineEventHandler((event) => {
-  requireMediaCollection()
-  const query = getQuery(event)
-  const depth = Number(query.depth ?? 0)
-  const locale = query.locale as string | undefined
-  return getOne(useDb(), media, requireId(event), depth, locale)
-})

package/layers/media/server/api/media/[id].patch.test.ts

@@ -1,66 +0,0 @@
-import { describe, it, expect, beforeEach } from 'vitest'
-import { eq, getTableColumns } from 'drizzle-orm'
-import { createError } from 'h3'
-import { createTestDb } from '../../../../../test/helpers/db'
-import { create } from '../../../../core/server/utils/crud'
-import builtMedia, { media } from '../../collections/media'
-
-interface FakeEvent { body: Record<string, unknown> }
-
-let db: ReturnType<typeof createTestDb>
-let id: number
-
-// The handler is a Nitro route: its auto-imported helpers are plain globals in a node test.
-Object.assign(globalThis, {
-  defineEventHandler: (handler: unknown) => handler,
-  requireAdmin: () => {},
-  createError,
-  requireId: () => id,
-  readIfUnmodifiedSince: () => undefined,
-  readBody: async (event: FakeEvent) => event.body,
-  useDb: () => db,
-  useRuntimeConfig: () => ({ kestrel: {} }),
-})
-
-const handler = (await import('./[id].patch')).default as unknown as (event: FakeEvent) => Promise<Record<string, unknown>>
-const patch = (body: Record<string, unknown>) => handler({ body })
-
-const cols = getTableColumns(media) as Record<string, never>
-const row = () => db.select().from(media).where(eq(cols.id, id)).get() as Record<string, unknown>
-
-beforeEach(() => {
-  db = createTestDb()
-  const created = create(db, builtMedia, { storageKey: 'a/one.png', folder: 'a', filename: 'one.png', mime: 'image/png', ext: 'png', size: 1 }) as { id: number }
-  id = created.id
-})
-
-describe('PATCH /api/media/:id — EU AI Act disclosure', () => {
-  it('persists both disclosure columns', async () => {
-    await patch({ aiSourceType: 'algorithmicallyEnhanced', aiNote: 'upscaled' })
-    expect(row()).toMatchObject({ aiSourceType: 'algorithmicallyEnhanced', aiNote: 'upscaled' })
-  })
-
-  it('clears the classification with an explicit null', async () => {
-    await patch({ aiSourceType: 'trainedAlgorithmicMedia', aiNote: 'Midjourney v7' })
-    await patch({ aiSourceType: null })
-    expect(row().aiSourceType).toBeNull()
-    expect(row().aiNote).toBe('Midjourney v7') // untouched — only the sent keys are written
-  })
-
-  it('rejects an unknown source type with a 400 instead of writing it', async () => {
-    await expect(patch({ aiSourceType: 'nonsense' })).rejects.toThrowError(expect.objectContaining({ statusCode: 400 }))
-    expect(row().aiSourceType).toBeNull()
-  })
-
-  it('stores a blanked note as null rather than an empty string a badge would render', async () => {
-    await patch({ aiSourceType: 'trainedAlgorithmicMedia', aiNote: 'Midjourney v7' })
-    await patch({ aiNote: '   ' })
-    expect(row().aiNote).toBeNull()
-  })
-
-  it('leaves the columns alone when the body does not mention them', async () => {
-    await patch({ aiSourceType: 'trainedAlgorithmicMedia', aiNote: 'note' })
-    await patch({ translations: { en: { alt: 'a kitten' } } })
-    expect(row()).toMatchObject({ aiSourceType: 'trainedAlgorithmicMedia', aiNote: 'note' })
-  })
-})

package/layers/media/server/api/media/[id].patch.ts

@@ -1,65 +0,0 @@
-import { eq, getTableColumns } from 'drizzle-orm'
-import builtMedia, { media } from '../../collections/media'
-import { mergeTranslations, type Translations } from '../../utils/translations'
-import { emitMediaWrite } from '../../utils/media-write'
-import { requireMediaCollection } from '../../utils/media-enabled'
-
-const AI_KEYS = ['aiSourceType', 'aiNote'] as const
-
-/**
- * The EU AI Act disclosure columns are top-level (not per-locale), so they are patched as plain siblings of
- * `translations`. Only the keys the body actually sent are written — omitting one must not clear it. The
- * allow-list of source types is NOT duplicated here: the collection's own update schema (built from the
- * `choice` field's `choices`) is the single source of truth, so an unknown value 400s instead of storing.
- */
-function readAiDisclosure(body: Record<string, unknown> | undefined | null): Record<string, unknown> {
-  const sent = AI_KEYS.filter((k) => Object.hasOwn(body ?? {}, k))
-  if (!sent.length) return {}
-  const parsed = builtMedia.update.safeParse(Object.fromEntries(sent.map((k) => [k, body![k]])))
-  if (!parsed.success) {
-    throw createError({ statusCode: 400, statusMessage: `Invalid AI disclosure: ${parsed.error.issues[0]?.message ?? 'unknown value'}` })
-  }
-  const value = parsed.data as Record<string, unknown>
-  const patch: Record<string, unknown> = {}
-  for (const k of sent) patch[k] = value[k] ?? null
-  // A blanked note must round-trip as "no note", not as an empty string a badge would render as blank text.
-  if (patch.aiNote === '') patch.aiNote = null
-  return patch
-}
-
-export default defineEventHandler(async (event) => {
-  requireAdmin(event) // write-authorization backstop (defense-in-depth; see require-admin.ts)
-  requireMediaCollection()
-  const id = requireId(event)
-  const body = await readBody(event)
-  const cols = getTableColumns(media) as Record<string, never>
-  const db = useDb()
-  const expectedUpdatedAt = readIfUnmodifiedSince(event)
-  const patch: Record<string, unknown> = { updatedAt: new Date() }
-  // `folder` is immutable via PATCH: relocating a file means moving its storage object and every
-  // derivative, which belongs to the media-library slice. Writing only the column would desync it
-  // from the folder baked into storageKey, which is what the public URL is built from.
-  const needsCurrent = expectedUpdatedAt !== undefined
-    || (body?.translations && typeof body.translations === 'object' && !Array.isArray(body.translations))
-  const current = needsCurrent
-    ? db.select().from(media).where(eq(cols.id, id)).get() as { translations?: Translations; updatedAt?: Date } | undefined
-    : undefined
-  // Optimistic concurrency: honor the same X-Kestrel-If-Unmodified-Since precondition the collection CRUD
-  // does, so two media-viewer tabs editing the same asset's alt text can't silently overwrite each other.
-  if (expectedUpdatedAt !== undefined && current) {
-    const cur = current.updatedAt instanceof Date ? current.updatedAt.getTime() : new Date(current.updatedAt as never).getTime()
-    if (cur !== expectedUpdatedAt) {
-      throw createError({ statusCode: 409, statusMessage: 'This media item changed since you opened it. Reload before saving.' })
-    }
-  }
-  if (body?.translations && typeof body.translations === 'object' && !Array.isArray(body.translations)) {
-    // Media keeps all locales in one JSON column. Deep-merge per locale so a partial PATCH (e.g. just
-    // `en.alt` from the media viewer) keeps the other locales AND the locale's other fields intact.
-    patch.translations = mergeTranslations(current?.translations, body.translations as Translations)
-  }
-  Object.assign(patch, readAiDisclosure(body))
-  const row = db.update(media).set(patch).where(eq(cols.id, id)).returning().get() as Record<string, unknown> | undefined
-  if (!row) throw createError({ statusCode: 404, statusMessage: `media ${id} not found` })
-  emitMediaWrite({ id }, row) // alt/title/description changed → re-render embedding pages (fresh alt text)
-  return row
-})

package/layers/media/server/api/media/backfill.post.ts

@@ -1,18 +0,0 @@
-import { runBackfill } from '../../utils/backfill'
-import { useStorageDriver, mediaRuntimeConfig } from '../../../../core/server/utils/storage'
-import { DEFAULT_IMAGE_POLICY } from '../../../../core/server/utils/kestrel-config'
-import { requireMediaCollection } from '../../utils/media-enabled'
-
-/**
- * Admin-triggered variant backfill/prune (the Mediathek "Regenerate/Prune" action). `{ check: true }` is a
- * dry-run reporting the plan (rows / would-generate / would-prune) — the UI shows it before applying.
- * Synchronous: fine for a dry-run and moderate libraries; a very large library should run the
- * `media:backfill` task on a schedule instead (a full-original GET + sharp per row).
- */
-export default defineEventHandler(async (event) => {
-  requireAdmin(event)
-  requireMediaCollection()
-  const body = (await readBody(event).catch(() => ({}))) as { check?: boolean }
-  const policy = mediaRuntimeConfig().imagePolicy ?? DEFAULT_IMAGE_POLICY
-  return runBackfill(useDb(), useStorageDriver(), policy, { check: !!body?.check })
-})

package/layers/media/server/api/media/copy.post.ts

@@ -1,7 +0,0 @@
-import { runRelocation } from '../../utils/relocate-ops'
-import { requireMediaCollection } from '../../utils/media-enabled'
-
-export default defineEventHandler((event) => {
-  requireMediaCollection()
-  return runRelocation(event, (items, body) => ({ type: 'copy', items, dest: typeof body.dest === 'string' ? body.dest : '' }))
-})

package/layers/media/server/api/media/delete.post.ts

@@ -1,13 +0,0 @@
-import { deleteAffected } from '../../utils/media-ops'
-import { coerceOpItems } from '../../utils/relocate-ops'
-import { useStorageDriver } from '../../../../core/server/utils/storage'
-import { requireMediaCollection } from '../../utils/media-enabled'
-
-export default defineEventHandler(async (event) => {
-  requireAdmin(event) // write-authorization backstop (defense-in-depth; see require-admin.ts)
-  requireMediaCollection()
-  const body = await readBody(event)
-  const items = coerceOpItems(body?.items)
-  if (!items.length) throw createError({ statusCode: 400, statusMessage: 'No items to delete' })
-  return deleteAffected(useDb(), useStorageDriver(), items, body?.dryRun === true)
-})

package/layers/media/server/api/media/folders.post.ts

@@ -1,18 +0,0 @@
-import { ensureFolder } from '../../utils/folders'
-import { sanitizeFolder } from '../../utils/naming'
-import { useStorageDriver } from '../../../../core/server/utils/storage'
-import { requireMediaCollection } from '../../utils/media-enabled'
-
-export default defineEventHandler(async (event) => {
-  requireAdmin(event) // write-authorization backstop (defense-in-depth; see require-admin.ts)
-  requireMediaCollection()
-  const body = await readBody(event)
-  const path = sanitizeFolder(typeof body?.path === 'string' ? body.path : '')
-  if (!path) throw createError({ statusCode: 400, statusMessage: 'A non-empty folder path is required' })
-  // ensureDir (mkdir, can throw ENAMETOOLONG/ENOTDIR/etc.) runs BEFORE the row commit — a folder row
-  // with no backing directory would list forever with every upload/retry into it failing the same way.
-  await useStorageDriver().ensureDir?.(path)
-  const db = useDb()
-  ensureFolder(db, path)
-  return { path }
-})

package/layers/media/server/api/media/index.get.ts

@@ -1,15 +0,0 @@
-import media from '../../collections/media'
-import { requireMediaCollection } from '../../utils/media-enabled'
-
-export default defineEventHandler((event) => {
-  requireMediaCollection()
-  const query = getQuery(event)
-  return list(useDb(), media, {
-    locale: query.locale as string | undefined,
-    sort: query.sort as string | undefined,
-    page: query.page ? Number(query.page) : undefined,
-    perPage: query.perPage ? Number(query.perPage) : undefined,
-    filter: parseFilter(query as Record<string, unknown>),
-    depth: query.depth ? Number(query.depth) : 0,
-  })
-})

package/layers/media/server/api/media/index.post.ts

@@ -1,173 +0,0 @@
-import { createHash } from 'node:crypto'
-import { eq, inArray, getTableColumns, isNull } from 'drizzle-orm'
-import builtMedia, { media } from '../../collections/media'
-import { useStorageDriver, mediaRuntimeConfig } from '../../../../core/server/utils/storage'
-import { sniffMime, extForMime, resolveAllowedMimes } from '../../utils/sniff'
-import { sanitizeFolder, buildKey, suggestFreeName, withExtension } from '../../utils/naming'
-import { sanitizeSvg } from '../../utils/sanitize-svg'
-import { deriveImage, RASTER, type DerivedImage } from '../../utils/derive'
-import { DEFAULT_IMAGE_POLICY } from '../../../../core/server/utils/kestrel-config'
-import { buildMediaValues, derivativeKey, type DerivativeManifest } from '../../utils/record'
-import { persistUpload } from '../../utils/persist-upload'
-import type { Translations } from '../../utils/translations'
-import { activeVariants } from '../../utils/variants'
-import { ensureFolder } from '../../utils/folders'
-import { primaryLocale } from '../../../../core/server/utils/locale'
-import { isUniqueViolation } from '../../../../core/server/utils/crud'
-import { withLock, mediaLockKey } from '../../../../core/server/utils/key-lock'
-import { requireMediaCollection } from '../../utils/media-enabled'
-import { emitMediaWrite } from '../../utils/media-write'
-import { detectAiSignal, aiSignalNote } from '../../utils/ai-signal-detect'
-import { aiDisclosureEnabled } from '../../utils/ai-disclosure-enabled'
-
-export default defineEventHandler(async (event) => {
-  requireAdmin(event) // write-authorization backstop (defense-in-depth; see require-admin.ts)
-  requireMediaCollection()
-  const cfg = mediaRuntimeConfig()
-  const len = Number(getRequestHeader(event, 'content-length'))
-  // A missing/garbage Content-Length means a chunked transfer, which readMultipartFormData would
-  // buffer with no ceiling — refuse it up front. The declared length is then a cheap pre-check; the
-  // real cap is re-asserted on the parsed bytes below (a client can under-declare Content-Length).
-  if (!Number.isFinite(len) || len < 0) {
-    throw createError({ statusCode: 411, statusMessage: 'Length required' })
-  }
-  if (len > cfg.maxUploadBytes) {
-    throw createError({ statusCode: 413, statusMessage: 'Payload too large' })
-  }
-
-  const parts = await readMultipartFormData(event)
-  if (!parts) throw createError({ statusCode: 400, statusMessage: 'Expected multipart/form-data' })
-  const filePart = parts.find((p) => p.name === 'file' && p.filename)
-  if (!filePart || !filePart.data?.length) throw createError({ statusCode: 400, statusMessage: 'Missing file' })
-  if (filePart.data.length > cfg.maxUploadBytes) throw createError({ statusCode: 413, statusMessage: 'Payload too large' })
-  const text = (n: string) => parts.find((p) => p.name === n && !p.filename)?.data.toString('utf8')
-
-  let bytes = filePart.data as Buffer
-  const allowed = resolveAllowedMimes(cfg.allowedMimes)
-  const mime = await sniffMime(bytes)
-  if (!mime || !allowed.has(mime)) {
-    throw createError({ statusCode: 415, statusMessage: `Unsupported media type${mime ? `: ${mime}` : ''}` })
-  }
-  const ext = extForMime(mime)
-
-  if (mime === 'image/svg+xml') bytes = Buffer.from(sanitizeSvg(bytes.toString('utf8')))
-
-  // server-controlled key only (folder + filename are both sanitized → no path traversal)
-  const folder = sanitizeFolder(text('folder') ?? '')
-  const overwrite = text('overwrite') === 'true'
-  // The stored extension follows the sniffed type, never the client filename (content-type confusion).
-  const filename = withExtension(text('filename') ?? filePart.filename ?? 'file', ext)
-  const storageKey = buildKey(folder, filename)
-
-  const db = useDb()
-  const cols = getTableColumns(media) as Record<string, never>
-  const driver = useStorageDriver()
-
-  const checksum = createHash('sha256').update(bytes).digest('hex')
-  // Narrow generation: derive exactly the currently-registered variant set (the media_settings registry),
-  // falling back to the config policy's variants when the registry is empty (fresh project / no scan yet).
-  // Done BEFORE the per-key lock so uploads of different files derive in parallel (sharp is the hot path).
-  const policy = cfg.imagePolicy ?? DEFAULT_IMAGE_POLICY
-  // A raster that sniffs fine but is truncated/corrupt (or a misconfigured crop position slipping past
-  // validation) makes sharp reject mid-pipeline — a bare unwrapped throw here would 500 with an internal
-  // vips error string. Surface it as a real, unprocessable-upload 4xx instead.
-  let derived: DerivedImage | undefined
-  if (RASTER.has(mime)) {
-    try {
-      derived = await deriveImage(bytes, { ...policy, variants: activeVariants(db, policy.variants, policy.presets) })
-    } catch (error) {
-      throw createError({ statusCode: 422, statusMessage: 'Could not process this image', data: { reason: (error as Error)?.message } })
-    }
-  }
-
-  const alt = text('alt')
-  const title = text('title')
-  const description = text('description')
-  const translations = alt || title || description ? { [primaryLocale()]: { alt, title, description } } : {}
-
-  // EU AI Act Art. 50 disclosure. The classification is validated against the collection's own choice
-  // schema so the allow-list has a single source of truth (same as the PATCH route).
-  const aiSourceType = text('aiSourceType')?.trim() || undefined
-  if (aiSourceType && !builtMedia.update.safeParse({ aiSourceType }).success) {
-    throw createError({ statusCode: 400, statusMessage: `Invalid AI disclosure: unknown source type "${aiSourceType}"` })
-  }
-  const uploadedAiNote = text('aiNote')?.trim() || undefined
-  // Only parse when the feature is on: consumers who leave it off pay nothing for it. What the scan finds
-  // is EVIDENCE for the free-text note — it never asserts `aiSourceType`, which stays a human decision.
-  const signal = aiDisclosureEnabled() && !uploadedAiNote ? await detectAiSignal(bytes, mime).catch(() => null) : null
-
-  // Serialize the collision-check → put → insert per storageKey: two concurrent uploads to the SAME key
-  // (or a backfill re-deriving it) must not interleave, or last-writer-wins would leave the winning row
-  // describing the loser's bytes. Different keys never share a lock, so throughput is unaffected.
-  const { row, created } = await withLock(mediaLockKey(storageKey), async (): Promise<{ row: Record<string, unknown>; created: boolean }> => {
-    const existing = db.select().from(media).where(eq(cols.storageKey, storageKey)).get() as
-      | { id: number; derivatives?: DerivativeManifest; translations?: Translations; aiNote?: string | null }
-      | undefined
-
-    // An object on disk with no media row (another media's derivative, or an orphan) must never be
-    // clobbered — not even under overwrite, which only replaces a managed media row.
-    const blockedByDisk = !existing && (await driver.exists?.(storageKey))
-    if ((existing && !overwrite) || blockedByDisk) {
-      // One query: the filenames already taken in this folder, used to suggest a free name in memory.
-      const takenNames = new Set(
-        db.select({ f: cols.filename }).from(media)
-          .where(folder ? eq(cols.folder, folder) : isNull(cols.folder))
-          .all().map((r) => (r as { f: string }).f),
-      )
-      if (blockedByDisk) takenNames.add(filename)
-      throw createError({
-        statusCode: 409,
-        statusMessage: 'A file with this name already exists',
-        data: { storageKey, existingId: existing?.id, suggestion: suggestFreeName(filename, (n) => !takenNames.has(n)) },
-      })
-    }
-
-    // Reserve the derivative namespace: `derivativeKey` mints a syntactically valid ORIGINAL key
-    // (`<key>-<name>.<format>`), so a same-named upload elsewhere (or a coincidentally matching filename)
-    // can already own the exact key this derive is about to `driver.put` over. The create-path write below
-    // has no per-key collision check of its own, so refuse up front rather than silently overwrite another
-    // row's blob out from under it.
-    const derivKeys = (derived?.variants ?? []).map((v) => derivativeKey(storageKey, v.name, v.format))
-    if (derivKeys.length) {
-      const clash = db.select({ storageKey: cols.storageKey }).from(media).where(inArray(cols.storageKey, derivKeys)).all() as { storageKey: string }[]
-      if (clash.length) {
-        // Not a 409: the uploader reads that status as the rename/overwrite/skip name-conflict contract,
-        // and neither branch resolves this — the requested name is free, and overwriting it re-derives the
-        // very same blocked keys. The message names the file the user actually dropped, plus the existing
-        // one standing in its way, so the remedy (rename either) is visible from the upload dialog.
-        throw createError({
-          statusCode: 422,
-          statusMessage: `Cannot store "${filename}": the existing file "${clash[0]!.storageKey}" already uses a name reserved for one of its generated image sizes. Rename either file, then upload again.`,
-          data: { storageKey, clashKeys: clash.map((c) => c.storageKey) },
-        })
-      }
-    }
-
-    if (folder) ensureFolder(db, folder)
-    // The scan only ever fills a note that would otherwise be empty — it must not talk over an uploader's
-    // own text, nor over one an editor already curated on the row this upload is replacing.
-    const aiNote = uploadedAiNote ?? (existing?.aiNote ? undefined : signal && aiSignalNote(signal))
-    const values = buildMediaValues({ storageKey, folder, filename, mime, ext, size: bytes.length, checksum, derived, translations, aiSourceType, aiNote })
-    try {
-      // persistUpload writes the objects then the row; on a create-path failure it removes the freshly-written
-      // blobs so a partial upload never strands orphans that permanently 409-block the filename.
-      const saved = await persistUpload(db, driver, { storageKey, bytes, mime, derived, values, existing, overwrite })
-      return { row: saved, created: !(existing && overwrite) }
-    } catch (error) {
-      // A double-submit that slips through the check surfaces as a UNIQUE violation → 409, not a raw 500.
-      if (isUniqueViolation(error)) {
-        throw createError({ statusCode: 409, statusMessage: 'A file with this name already exists', data: { storageKey } })
-      }
-      throw error
-    }
-  })
-
-  // Only an overwrite can invalidate published output: it rewrites the bytes, dimensions, thumbhash and
-  // derivative manifest under an unchanged id, so every page embedding it holds srcset candidates that no
-  // longer exist. Gate on `created`, not the requested `overwrite` flag — an overwrite request that finds
-  // no row inserts a fresh one, which nothing published can reference yet.
-  if (!created) emitMediaWrite({ id: row.id as number }, row)
-
-  setResponseStatus(event, created ? 201 : 200)
-  return { ...row, url: driver.publicUrl(storageKey) }
-})

package/layers/media/server/api/media/library.get.ts

@@ -1,17 +0,0 @@
-import { listLibrary } from '../../utils/library'
-import { useStorageDriver } from '../../../../core/server/utils/storage'
-import { requireMediaCollection } from '../../utils/media-enabled'
-
-export default defineEventHandler((event) => {
-  requireMediaCollection()
-  const query = getQuery(event)
-  const driver = useStorageDriver()
-  return listLibrary(useDb(), {
-    folder: typeof query.folder === 'string' ? query.folder : '',
-    search: typeof query.search === 'string' ? query.search : undefined,
-    type: query.type === 'image' ? 'image' : 'all',
-    page: query.page ? Number(query.page) : undefined,
-    perPage: query.perPage ? Number(query.perPage) : undefined,
-    sort: typeof query.sort === 'string' ? query.sort : undefined,
-  }, (key) => driver.publicUrl(key))
-})

package/layers/media/server/api/media/move.post.ts

@@ -1,7 +0,0 @@
-import { runRelocation } from '../../utils/relocate-ops'
-import { requireMediaCollection } from '../../utils/media-enabled'
-
-export default defineEventHandler((event) => {
-  requireMediaCollection()
-  return runRelocation(event, (items, body) => ({ type: 'move', items, dest: typeof body.dest === 'string' ? body.dest : '' }))
-})

package/layers/media/server/api/media/rename.post.ts

@@ -1,7 +0,0 @@
-import { runRelocation } from '../../utils/relocate-ops'
-import { requireMediaCollection } from '../../utils/media-enabled'
-
-export default defineEventHandler((event) => {
-  requireMediaCollection()
-  return runRelocation(event, (items, body) => ({ type: 'rename', items, name: typeof body.name === 'string' ? body.name : '' }))
-})

package/layers/media/server/api/media/resolve.get.ts

@@ -1,13 +0,0 @@
-import { resolveManyByIds } from '../../utils/resolve'
-import { useStorageDriver } from '../../../../core/server/utils/storage'
-import { primaryLocale } from '../../../../core/server/utils/locale'
-import { requireMediaCollection } from '../../utils/media-enabled'
-
-export default defineEventHandler((event) => {
-  requireMediaCollection()
-  const q = getQuery(event)
-  const ids = String(q.ids ?? '').split(',').map((s) => Number(s.trim())).filter((n) => Number.isInteger(n) && n > 0)
-  const locale = typeof q.locale === 'string' ? q.locale : primaryLocale()
-  const driver = useStorageDriver()
-  return { data: resolveManyByIds(useDb(), ids, locale, (k) => driver.publicUrl(k)) }
-})

package/layers/media/server/collections/media-settings.ts

@@ -1,25 +0,0 @@
-import { buildCollection } from '../../../fields/server/utils/buildCollection'
-import { defineCollection } from '../../../core/server/utils/defineCollection'
-
-// The usage-driven variant REGISTRY: a single-row store of the active image-variant set (name × size ×
-// format presets) that the upload path derives and the generate-time scan reconciles. A singleton so it
-// reuses the schema engine + (later) the singleton editor, but `nav: false` — it is a system/config store,
-// not content, and must not appear as a flat top-level rail item beside the media library. It is surfaced
-// (if at all) through a Media sub-menu once the rail supports nested navigation.
-const built = buildCollection(defineCollection({
-  name: 'media_settings',
-  mode: 'single',
-  translatable: false,
-  builtin: true,
-  nav: false,
-  label: { singular: 'Media settings', plural: 'Media settings' },
-  icon: 'sliders',
-  fields: {
-    // The resolved variant set (`StoredVariant[]`): each entry carries its provenance (`source`/`pinned`)
-    // so the scan reconcile can replace discovered entries while preserving hand-authored ones.
-    variants: { type: 'json' },
-  },
-}))
-
-export const mediaSettings = built.table
-export default built

package/layers/media/server/collections/media.ts

@@ -1,43 +0,0 @@
-import { buildCollection } from '../../../fields/server/utils/buildCollection'
-import { defineCollection } from '../../../core/server/utils/defineCollection'
-
-const built = buildCollection(defineCollection({
-  name: 'media',
-  mode: 'multi',
-  translatable: false,
-  builtin: true,
-  label: { singular: 'Media', plural: 'Media' },
-  icon: 'image',
-  fields: {
-    storageKey: { type: 'text', required: true, unique: true },
-    // Indexed: the library lists/filters/rolls-up recursive sizes by folder on every request.
-    folder: { type: 'text', index: true },
-    filename: { type: 'text', required: true },
-    mime: { type: 'text', required: true },
-    ext: { type: 'text', required: true },
-    size: { type: 'number', required: true },
-    width: { type: 'number' },
-    height: { type: 'number' },
-    checksum: { type: 'text' },
-    thumbhash: { type: 'text' },
-    derivatives: { type: 'json' },
-    translations: { type: 'json' },
-    // EU AI Act Art. 50 disclosure. Top-level, NOT per-locale (`translations`): how an asset was produced
-    // does not change per translation. The vocabulary mirrors the disclosure-relevant subset of IPTC's
-    // Digital Source Type, so a later metadata-embedding slice can map 1:1.
-    aiSourceType: {
-      type: 'choice',
-      options: {
-        choices: [
-          { label: 'Fully AI-generated', value: 'trainedAlgorithmicMedia' },
-          { label: 'AI content composited into real media', value: 'compositeWithTrainedAlgorithmicMedia' },
-          { label: 'AI-enhanced / algorithmically edited', value: 'algorithmicallyEnhanced' },
-        ],
-      },
-    },
-    aiNote: { type: 'text' },
-  },
-}))
-
-export const media = built.table
-export default built

package/layers/media/server/database/folders.ts

@@ -1,10 +0,0 @@
-import { sqliteTable, integer, text } from 'drizzle-orm/sqlite-core'
-
-// Path-based folder registry: persists folders (incl. empty ones) and is the authoritative
-// tree for media navigation. `path` is the normalized folder path (root '' is never a row).
-export const folders = sqliteTable('folders', {
-  id: integer('id').primaryKey({ autoIncrement: true }),
-  path: text('path').notNull().unique(),
-  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
-  updatedAt: integer('updated_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
-})

package/layers/media/server/plugins/03.media-cleanup.ts

@@ -1,20 +0,0 @@
-import { registerWriteListener } from '../../../core/server/utils/write-events'
-import { planMediaDeletion } from '../utils/media-cleanup'
-import { useStorageDriver } from '../../../core/server/utils/storage'
-
-/**
- * Storage GC for media-record deletes. The media library's own `deleteAffected` deletes storage inline
- * (and bypasses the write bus); this covers EVERY OTHER delete path — the generic CRUD `remove()`, which
- * emits a delete event — by removing the row's original + all derivatives from storage. So a media record
- * is never removed while leaving orphaned files: principle 4 (output ≡ DB) for media, on every path.
- * Fire-and-forget (best-effort, like the publisher); the driver's delete is idempotent, errors are logged.
- */
-export default defineNitroPlugin(() => {
-  registerWriteListener((event) => {
-    const keys = planMediaDeletion(event)
-    if (!keys.length) return
-    const driver = useStorageDriver()
-    void Promise.all(keys.map((key) => driver.delete(key)))
-      .catch((error) => console.error('[kestrel] media storage cleanup failed:', error))
-  })
-})

package/layers/media/server/schema-tables/folders.ts

@@ -1,4 +0,0 @@
-import { folders } from '../database/folders'
-
-// Registers the standalone folders table with the schema engine (the `#kestrel/schema-tables` virtual).
-export default folders

package/layers/media/server/utils/ai-disclosure-enabled.ts

@@ -1,16 +0,0 @@
-import { resolveServerKestrel, serverRuntimeConfig } from '../../../core/server/utils/server-config'
-
-/**
- * Whether the EU AI Act disclosure feature is switched on for this consumer (`aiDisclosure.enabled`).
- *
- * It gates the ADMIN UI and the upload-time signal scan — never the data: `ResolvedMedia.aiDisclosure` is
- * always resolved from whatever the columns hold, so turning the flag off hides the editor without
- * touching (or hiding) a disclosure already recorded. Same runtimeConfig-then-own-config fallback as
- * `mediaCollectionEnabled`, so non-Nitro callers (scripts, build) resolve it too.
- */
-export function aiDisclosureEnabled(): boolean {
-  const cfg = (serverRuntimeConfig()?.kestrel?.aiDisclosure ?? resolveServerKestrel().aiDisclosure) as
-    | { enabled?: boolean }
-    | undefined
-  return cfg?.enabled === true
-}