@michaelthielemann/kestrel 3.0.0 → 4.0.0

package/layers/public/modules/deploy-output/deploy-output.ts

@@ -1,384 +0,0 @@
-import { readdirSync, readFileSync } from 'node:fs'
-import { join, relative, sep, extname } from 'node:path'
-import { setTimeout as sleepFor } from 'node:timers/promises'
-import { resolveS3Settings } from '../../../core/server/utils/kestrel-config'
-import type { StorageDriver } from '../../../core/server/utils/storage'
-
-const MIME: Record<string, string> = {
-  // markup / scripts / data
-  '.html': 'text/html; charset=utf-8',
-  '.css': 'text/css; charset=utf-8',
-  '.js': 'text/javascript; charset=utf-8',
-  '.mjs': 'text/javascript; charset=utf-8',
-  '.json': 'application/json; charset=utf-8',
-  '.map': 'application/json; charset=utf-8',
-  '.xml': 'application/xml; charset=utf-8',
-  '.txt': 'text/plain; charset=utf-8',
-  '.csv': 'text/csv; charset=utf-8',
-  '.md': 'text/markdown; charset=utf-8',
-  '.wasm': 'application/wasm',
-  '.pdf': 'application/pdf',
-  '.webmanifest': 'application/manifest+json',
-  // images
-  '.svg': 'image/svg+xml',
-  '.ico': 'image/x-icon',
-  '.png': 'image/png',
-  '.jpg': 'image/jpeg',
-  '.jpeg': 'image/jpeg',
-  '.gif': 'image/gif',
-  '.webp': 'image/webp',
-  '.avif': 'image/avif',
-  '.apng': 'image/apng',
-  '.bmp': 'image/bmp',
-  // fonts
-  '.woff': 'font/woff',
-  '.woff2': 'font/woff2',
-  '.ttf': 'font/ttf',
-  '.otf': 'font/otf',
-  '.eot': 'application/vnd.ms-fontobject',
-  // audio / video
-  '.mp3': 'audio/mpeg',
-  '.ogg': 'audio/ogg',
-  '.wav': 'audio/wav',
-  '.m4a': 'audio/mp4',
-  '.mp4': 'video/mp4',
-  '.webm': 'video/webm',
-  '.mov': 'video/quicktime',
-}
-
-/** MIME type for a static output file, inferred from its extension; octet-stream when unknown. A
- *  pre-compressed sibling (`app.js.br`) carries the encoding in `Content-Encoding`, so its type is the
- *  underlying asset's — strip a trailing `.br`/`.gz` before the lookup. Only strip it when a
- *  `Content-Encoding` will actually be sent (`hasEncoding`, default true for existing callers): a
- *  standalone archive with no such header must keep its own extension, or it ships mislabelled as the
- *  underlying (uncompressed) type — e.g. a browser trying to parse raw gzip bytes as JSON. */
-export function contentTypeFor(filename: string, hasEncoding = true): string {
-  const base = hasEncoding ? filename.replace(/\.(?:br|gz)$/i, '') : filename
-  return MIME[extname(base).toLowerCase()] ?? 'application/octet-stream'
-}
-
-/** The `Content-Encoding` for a precompressed sidecar (`app.js.br` beside `app.js`), or undefined for a
- *  standalone archive with no uncompressed base — tagging that would make a browser transparently decode
- *  genuine content and corrupt it. `siblingNames` are the file names in the same directory. */
-export function precompressedEncoding(filename: string, siblingNames: string[]): 'br' | 'gzip' | undefined {
-  const m = /\.(br|gz)$/.exec(filename)
-  if (!m || !siblingNames.includes(filename.slice(0, m.index))) return undefined
-  return m[1] === 'br' ? 'br' : 'gzip'
-}
-
-const IMMUTABLE_CACHE = 'public, max-age=31536000, immutable'
-const REVALIDATE_CACHE = 'public, max-age=0, must-revalidate'
-
-/** Artifacts served at a LITERAL key (not `<path>/index.html`) and rendered from the live DB rather than
- *  copied from the build. One list, because each of them has to be handled the same way in four places:
- *  re-rendered on every publish, excluded from the build-asset mirror (a stale copy must never overwrite
- *  a fresh one), seeded into the prerender routes, and cached as revalidate-always below.
- *  `llms-full.txt` is opt-in (`kestrel.seo.llmsFull`) and simply renders to a 404 when off — it stays in
- *  this list either way, so the rules that are about the FILENAME hold regardless of the flag; only the
- *  prerender seeding, which asks for the ROUTE, has to consult it. */
-export const META_KEYS = ['sitemap.xml', 'robots.txt', 'llms.txt', 'llms-full.txt', 'redirects.json'] as const
-
-export function isMetaKey(key: string): boolean {
-  return (META_KEYS as readonly string[]).includes(key)
-}
-
-/**
- * `Cache-Control` for a static-output key, or `undefined` for no explicit policy. Content-hashed
- * `_nuxt/` assets get a year + `immutable` (the hash is the cache key — new content ⇒ new URL). HTML and
- * the `META_KEYS` artifacts live at *stable* URLs whose content changes on any deploy, so they get
- * `max-age=0, must-revalidate` (cacheable but always revalidated) — `redirects.json` especially, since a
- * cached copy keeps serving withdrawn redirects. Everything else (favicons, fonts, un-hashed media) is
- * left to the host default.
- */
-export function cacheControlFor(key: string): string | undefined {
-  // Nuxt's app manifest lives at a STABLE _nuxt URL but its content (the buildId) changes every build, so it
-  // must revalidate — else the immutable rule below pins it and clients never detect a new deploy.
-  if (key === '_nuxt/builds/latest.json') return REVALIDATE_CACHE
-  if (key === '_nuxt' || key.startsWith('_nuxt/')) return IMMUTABLE_CACHE
-  const base = key.split('/').pop() ?? key
-  if (base.endsWith('.html') || isMetaKey(base)) return REVALIDATE_CACHE
-  return undefined
-}
-
-/** A boolean env flag is on for any of the common truthy spellings (case-insensitive, trimmed). */
-export function isEnvTrue(value: string | undefined): boolean {
-  const t = value?.trim().toLowerCase()
-  return t === 'true' || t === '1' || t === 'yes' || t === 'on'
-}
-
-/**
- * Decide what the deploy hook should do, kept pure so the trigger guard is unit-testable. Returns
- * `'skip'` when this isn't a static `nuxt generate` — a plain `nuxt build` (or dev) must never deploy,
- * even with `driver: s3` configured — and when `output.auto` hands publishing to the running server
- * (see `autoPublish`). For a real (non-dry-run) static generate it throws when the
- * bucket or `KESTREL_S3_*` credentials are missing, so a misconfigured deploy fails the generate
- * loudly instead of warning and exiting 0 with a stale live bucket. A dry-run needs neither.
- */
-/** Strip leading/trailing slashes so prefixes compare on bare path segments. */
-const normPrefix = (p: string): string => p.replace(/^\/+|\/+$/g, '')
-
-/**
- * Do two S3 key prefixes share keyspace on a path-segment boundary — i.e. is one equal to, or nested
- * under, the other? Catches both nesting directions: a prune of `a` reaches everything under `a/b`, and
- * a prune of `a/b` reaches the `a/b/…` slice of media stored under `a`. A pure-string collision like
- * `site` vs `siteother` is *not* an overlap. Empty prefixes never overlap (handled by their own guards).
- */
-function prefixesOverlap(a: string, b: string): boolean {
-  const x = normPrefix(a)
-  const y = normPrefix(b)
-  if (!x || !y) return false
-  return x === y || x.startsWith(`${y}/`) || y.startsWith(`${x}/`)
-}
-
-export function planS3Deploy(opts: {
-  isStaticGenerate: boolean
-  dryRun: boolean
-  bucket: string
-  accessKeyId: string
-  secretAccessKey: string
-  prefix?: string
-  /**
-   * `output.auto` — the running server publishes to this bucket/prefix itself. Build-time route seeding is
-   * then disabled (a prerendered file would shadow the live route), so `.output/public` holds only what
-   * Nitro's crawler reached: shipping it would reconcile the server's live pages, sitemap and robots away.
-   */
-  autoPublish?: boolean
-  /** Bucket the S3 media driver writes live uploads to (empty when media isn't on S3 — then irrelevant). */
-  mediaBucket?: string
-  /** Key prefix of those live media objects, to keep the reconcile from deleting them. */
-  mediaPrefix?: string
-}): 'skip' | 'deploy' {
-  if (!opts.isStaticGenerate) return 'skip'
-  if (opts.autoPublish) return 'skip'
-  if (!opts.dryRun) {
-    const missing: string[] = []
-    if (!opts.bucket) missing.push('bucket (KESTREL_OUTPUT_S3_BUCKET)')
-    if (!opts.accessKeyId) missing.push('KESTREL_OUTPUT_S3_ACCESS_KEY_ID / KESTREL_S3_ACCESS_KEY_ID')
-    if (!opts.secretAccessKey) missing.push('KESTREL_OUTPUT_S3_SECRET_ACCESS_KEY / KESTREL_S3_SECRET_ACCESS_KEY')
-    if (missing.length) {
-      throw new Error(
-        `[kestrel] output.driver=s3 but ${missing.join(', ')} ${missing.length > 1 ? 'are' : 'is'} missing`
-        + ' — refusing to finish `nuxt generate` with a broken S3 deploy.',
-      )
-    }
-    // The deploy always reconciles (deletes every remote object under the prefix not in this generate —
-    // output ≡ DB). With an empty prefix that's the whole bucket root, which may hold the media bucket's
-    // objects too. Refuse rather than risk wiping it: an S3 deploy must target a dedicated prefix.
-    if (!opts.prefix) {
-      throw new Error(
-        '[kestrel] output.s3.prefix is empty — refusing to deploy (the always-on reconcile would delete the'
-        + ' whole bucket root, and a shared/media bucket could be wiped). Set KESTREL_OUTPUT_S3_PREFIX to a'
-        + ' prefix dedicated to the generated site.',
-      )
-    }
-    // Same bucket as the S3 media driver AND overlapping prefixes → the reconcile would delete live uploads.
-    if (opts.mediaBucket && opts.mediaBucket === opts.bucket
-      && opts.mediaPrefix && prefixesOverlap(opts.prefix, opts.mediaPrefix)) {
-      throw new Error(
-        `[kestrel] the output reconcile would delete live media: output prefix "${opts.prefix}" overlaps the`
-        + ` S3 media prefix "${opts.mediaPrefix}" in the same bucket "${opts.bucket}". Give the generated`
-        + ' site its own bucket or a non-overlapping KESTREL_OUTPUT_S3_PREFIX.',
-      )
-    }
-  }
-  return 'deploy'
-}
-
-export interface OutputTarget {
-  driver: 'local' | 's3'
-  /** Non-secret S3 settings; credentials are resolved separately by `resolveOutputCreds`. */
-  s3: { bucket: string; region: string; endpoint: string; prefix: string }
-}
-
-type OutputConfig = { driver?: string; s3?: { bucket?: string; region?: string; endpoint?: string; prefix?: string } }
-const clean = (v: unknown): string | undefined => (typeof v === 'string' && v.trim() ? v.trim() : undefined)
-
-/**
- * Resolve where `nuxt generate`'s static output is shipped: a local directory (default) or an S3
- * bucket. Precedence per setting: `KESTREL_OUTPUT_*` env → config → default (the documented Kestrel
- * order, same as the runtime publisher). Pure, so the precedence is unit-testable; secrets are resolved
- * by `resolveOutputCreds`, never here.
- */
-export function resolveOutputTarget(out: OutputConfig = {}, env: Record<string, string | undefined> = {}): OutputTarget {
-  const driver = (clean(env.KESTREL_OUTPUT_DRIVER) ?? clean(out.driver))?.toLowerCase() === 's3' ? 's3' : 'local'
-  // Same non-secret resolver media uses, under the KESTREL_OUTPUT_S3_* prefix (own bucket, own creds).
-  return { driver, s3: resolveS3Settings(out.s3, env, 'KESTREL_OUTPUT_S3') }
-}
-
-/**
- * S3 credentials for the output deploy: the output-specific `KESTREL_OUTPUT_S3_*`, falling back to the
- * shared media `KESTREL_S3_*` so a single S3 account "just works" — identical to the runtime publisher's
- * resolution. Required keys default to '' (not undefined) so `planS3Deploy` detects a missing credential.
- */
-export function resolveOutputCreds(env: Record<string, string | undefined> = {}): { accessKeyId: string; secretAccessKey: string; sessionToken?: string } {
-  return {
-    accessKeyId: clean(env.KESTREL_OUTPUT_S3_ACCESS_KEY_ID) ?? clean(env.KESTREL_S3_ACCESS_KEY_ID) ?? '',
-    secretAccessKey: clean(env.KESTREL_OUTPUT_S3_SECRET_ACCESS_KEY) ?? clean(env.KESTREL_S3_SECRET_ACCESS_KEY) ?? '',
-    sessionToken: clean(env.KESTREL_OUTPUT_S3_SESSION_TOKEN) ?? clean(env.KESTREL_S3_SESSION_TOKEN),
-  }
-}
-
-/** Every file under `dir` as `{ abs, key }`, the key being its POSIX-relative path (stable order). */
-function listFiles(dir: string): Array<{ abs: string; key: string }> {
-  return readdirSync(dir, { recursive: true, withFileTypes: true })
-    .filter((e) => e.isFile())
-    .map((e) => {
-      const abs = join(e.parentPath, e.name)
-      return { abs, key: relative(dir, abs).split(sep).join('/') }
-    })
-}
-
-/**
- * A `*.gz`/`*.br` file is a pre-compressed sidecar (from `nitro.compressPublicAssets`) when its
- * uncompressed base is also in the output. On a plain static S3 host these are dead weight — the host
- * does no `Accept-Encoding` negotiation, so nobody fetches `index.html.gz`, and storing it *as*
- * `index.html` with `Content-Encoding` would collide with the real file — so the deploy skips them.
- * A standalone `*.gz` archive (no base file) is genuine content and is kept.
- */
-export function isCompressedSidecar(key: string, all: Set<string>): boolean {
-  const m = /\.(?:gz|br)$/.exec(key)
-  return m ? all.has(key.slice(0, m.index)) : false
-}
-
-export interface DeployResult { pruned: number; keys: string[] }
-
-/**
- * What build-time route discovery enumerated for this generate, plus WHY that enumeration is known to be
- * short of the site's pages (`incomplete` unset ⇒ it is complete). The runtime publisher's
- * `{ routes, failed }` is the same contract: an enumeration that came up short must never be the
- * authority for what gets deleted.
- */
-export interface RouteDiscovery { routes: string[]; incomplete?: string }
-
-interface DiscoveryHost { _kestrelRouteDiscovery?: RouteDiscovery }
-
-/** The prerender and deploy modules are loaded separately and share no module scope — but they are handed
- *  the same Nuxt instance, so that object is what carries the signal from the one to the other. */
-export function recordRouteDiscovery(nuxt: object, discovery: RouteDiscovery): void {
-  (nuxt as DiscoveryHost)._kestrelRouteDiscovery = discovery
-}
-
-/** `undefined` ⇒ discovery never reported anything, which is not itself evidence of a degraded build. */
-export function readRouteDiscovery(nuxt: object): RouteDiscovery | undefined {
-  return (nuxt as DiscoveryHost)._kestrelRouteDiscovery
-}
-
-/** The deploy needs `put` always, and `list`+`delete` for the reconcile; both are optional on the driver. */
-type DeployDriver = Pick<StorageDriver, 'put'> & Partial<Pick<StorageDriver, 'list' | 'delete'>>
-
-export interface DeployOptions {
-  dryRun?: boolean
-  log?: (msg: string) => void
-  /** Max operations in flight at once (default 8). Bounded so a large tree never opens thousands of sockets. */
-  concurrency?: number
-  /** Total attempts per operation before giving up (default 3); retries ride out transient S3 errors. */
-  retries?: number
-  /** Sleep between retries (exponential backoff); injectable so tests run without real delay. */
-  sleep?: (ms: number) => Promise<void>
-  /**
-   * Why a build step REPORTED that this output tree is short of pages (routes that failed to prerender,
-   * route discovery that could not read the DB). Set ⇒ upload but never reconcile: pages missing from the
-   * input are indistinguishable from pages removed from the CMS, so the prune would delete live ones.
-   * Only a step's own failure report belongs here: the SHAPE of the output cannot tell a degraded build
-   * from a small site, so inferring it would strand the pages an editor deleted.
-   */
-  incomplete?: string
-}
-
-/** Run `task` over `items` with at most `concurrency` in flight at once. */
-async function runPool<T>(items: T[], concurrency: number, task: (item: T) => Promise<void>): Promise<void> {
-  let next = 0
-  const worker = async (): Promise<void> => {
-    while (next < items.length) {
-      const i = next++
-      await task(items[i])
-    }
-  }
-  await Promise.all(Array.from({ length: Math.min(concurrency, items.length) }, worker))
-}
-
-/** HTTP statuses the S3 driver surfaces in its error message (e.g. `S3 put failed (403) for x`). */
-function statusFromError(err: unknown): number | undefined {
-  const m = /\((\d{3})\)/.exec((err as Error)?.message ?? '')
-  return m ? Number(m[1]) : undefined
-}
-
-/**
- * A permanent client error — bad/forbidden credentials, missing bucket, denied access (400/401/403/404).
- * These never become successful on a later attempt, so retrying only delays the inevitable loud failure.
- */
-export function isPermanentError(err: unknown): boolean {
-  const s = statusFromError(err)
-  return s === 400 || s === 401 || s === 403 || s === 404
-}
-
-/** Retry `fn` with exponential backoff up to `retries` total attempts, surfacing the last error. */
-async function withRetry(fn: () => Promise<void>, label: string, retries: number, sleep: (ms: number) => Promise<void>, log?: (msg: string) => void): Promise<void> {
-  for (let attempt = 1; ; attempt++) {
-    try {
-      await fn()
-      return
-    } catch (err) {
-      // A permanent 4xx can't be ridden out — re-throw at once so the deploy fails loudly, not slowly.
-      if (isPermanentError(err) || attempt >= retries) throw err
-      log?.(`retry ${attempt}/${retries - 1} for ${label}: ${(err as Error).message}`)
-      await sleep(100 * 2 ** (attempt - 1))
-    }
-  }
-}
-
-/**
- * Upload every file under `dir` to `driver`, keyed by its POSIX-relative path, with a content type
- * inferred from the extension — the S3 equivalent of `aws s3 sync` (overwrites). Then reconciles: deletes
- * remote objects under the prefix that this generate didn't produce (`--delete`), so pages removed from
- * the CMS stop being served (output ≡ DB, no toggle). The reconcile is skipped when the driver can't
- * list+delete and when the caller flagged the tree `incomplete` — a build step reported it is short of
- * pages, so their absence says nothing about the CMS. Uploads still run then: shipping the pages that did
- * render is safe, deleting on their absence is not.
- * Uploads and deletes run with bounded concurrency and each is retried with
- * backoff, so a transient 5xx/throttle/dropped-connection no longer aborts the deploy mid-way and
- * half-updates the bucket; only an operation that fails every attempt rejects (true rollback isn't
- * possible on S3). With `dryRun`, walks/lists and reports without writing.
- */
-export async function deployStaticOutput(
-  dir: string,
-  driver: DeployDriver,
-  opts: DeployOptions = {},
-): Promise<DeployResult> {
-  const concurrency = Math.max(1, opts.concurrency ?? 8)
-  const retries = Math.max(1, opts.retries ?? 3)
-  const sleep = opts.sleep ?? ((ms: number) => sleepFor(ms))
-  const all = listFiles(dir)
-  const allKeys = new Set(all.map((f) => f.key))
-  const files = all.filter((f) => !isCompressedSidecar(f.key, allKeys))
-  const skipped = all.length - files.length
-  if (skipped) opts.log?.(`skipping ${skipped} pre-compressed sidecar(s) (.gz/.br)`)
-  const keys = files.map((f) => f.key)
-
-  if (!opts.dryRun) {
-    // `files` already excludes pre-compressed sidecars (above), so anything ending `.gz`/`.br` here is a
-    // standalone archive shipped with no `Content-Encoding` — keep its own extension in the type lookup.
-    await runPool(files, concurrency, (f) =>
-      withRetry(() => driver.put(f.key, readFileSync(f.abs), contentTypeFor(f.key, false), { cacheControl: cacheControlFor(f.key) }), f.key, retries, sleep, opts.log))
-  }
-  opts.log?.(`${opts.dryRun ? 'Would deploy' : 'Deployed'} ${keys.length} file(s)`)
-
-  // Reconcile (output ≡ DB) — skipped when the driver lacks list/delete (e.g. a put-only target) and when
-  // a build step reported that this generate is short of pages.
-  let pruned = 0
-  if (!driver.list || !driver.delete) {
-    opts.log?.('driver cannot list/delete — skipping reconcile')
-  } else if (opts.incomplete) {
-    opts.log?.(`skipping reconcile — ${opts.incomplete}; the missing pages would read as stale and be deleted`)
-  } else {
-    const keep = new Set(keys)
-    const stale = (await driver.list()).filter((k) => !keep.has(k))
-    if (!opts.dryRun) {
-      const del = driver.delete
-      await runPool(stale, concurrency, (k) => withRetry(() => del(k), `delete ${k}`, retries, sleep, opts.log))
-      pruned = stale.length
-    }
-    opts.log?.(`${opts.dryRun ? 'Would prune' : 'Pruned'} ${stale.length} stale object(s)`)
-  }
-  return { pruned, keys }
-}

package/layers/public/server/api/links/resolve.get.ts

@@ -1,19 +0,0 @@
-import { resolveInternalHref } from '../../utils/link-resolve'
-
-// Batch-resolve internal link refs (`?refs=collection:id,collection:id`) to public hrefs for the admin
-// block preview. Mirrors the read-path populator, status gate included; only resolved refs are returned,
-// so the client renders '#' for a target that is missing or still a draft — same as the generated site.
-export default defineEventHandler((event) => {
-  const refs = String(getQuery(event).refs ?? '').split(',').map((s) => s.trim()).filter(Boolean)
-  const data: { collection: string; id: number; href: string }[] = []
-  for (const ref of refs) {
-    const sep = ref.lastIndexOf(':')
-    if (sep <= 0) continue
-    const collection = ref.slice(0, sep)
-    const id = Number(ref.slice(sep + 1))
-    if (!Number.isInteger(id) || id <= 0) continue
-    const href = resolveInternalHref(collection, id)
-    if (href != null) data.push({ collection, id, href })
-  }
-  return { data }
-})

package/layers/public/server/api/preview.get.ts

@@ -1,28 +0,0 @@
-import { usePreviewStore, previewOwner } from '../utils/preview-token'
-
-/**
- * Read back a preview ticket (ADR-0008) — the public page fetches it during SSR when the URL carries
- * `?kestrel-preview-token=…` and renders the editor's unsaved state instead of the stored record. Admin-
- * only and session-bound; an expired, foreign or unknown token is `null`, which the page treats as
- * "nothing to preview" and falls back to the saved content rather than failing the render.
- */
-export default defineEventHandler((event) => {
-  requireAdmin(event) // write-authorization backstop (defense-in-depth; see require-admin.ts)
-  const token = getQuery(event).token
-  if (typeof token !== 'string' || !token) return null
-  const payload = usePreviewStore().read(token, previewOwner(event))
-  if (!payload) return null
-
-  // The editor sends what a SAVE would send — raw ids for media and relations — so the ticket goes through
-  // the same read population a stored record does. Without it the preview would render a page with the
-  // images and internal links stripped, which is worse than useless for judging a layout.
-  const c = getCollection(payload.collection)
-  if (!c) return { payload }
-  const locale = payload.locale || primaryLocale()
-  const values = withResolveScope(
-    () => populateRow({ ...payload.values }, { depth: 1, locale, def: c.def }),
-    resolveBudgetFor(1),
-    `preview ${payload.collection}`,
-  )
-  return { payload: { ...payload, values } }
-})

package/layers/public/server/api/preview.post.ts

@@ -1,93 +0,0 @@
-import { usePreviewStore, previewOwner, type PreviewPayload } from '../utils/preview-token'
-import type { BuiltCollection } from '../../../core/server/utils/collection-types'
-import { fieldIs, type FieldDef } from '../../../core/server/utils/defineCollection'
-import { resolveColumnName } from '../../../fields/server/field-registry/naming'
-import { sanitizeRichtext } from '../../../fields/server/field-registry/sanitize'
-import { getBlock } from '../../../fields/server/utils/defineBlock'
-
-/** Editor payloads are form state, not uploads — a block tree with populated media is far below this. */
-const MAX_PAYLOAD_BYTES = 2_000_000
-
-/**
- * Sanitize every richtext leaf reachable from `scope` (top-level fields + nested repeater entries), in
- * place. Mirrors the WALK shape of crud.ts's `applyFieldTransforms`/`transformNested`, but not the
- * mechanism: richtext's sanitizer is wired into the Zod validator (`z.string().transform(sanitizeRichtext)`
- * in field-registry/index.ts), not the field-type's `transform` hook that walk calls — and running the
- * collection's Zod schema here isn't an option anyway, see `sanitizePreviewValues` below. So this calls
- * `sanitizeRichtext` directly wherever a `richtext` field is present, and only there; every other field
- * passes through untouched.
- */
-function sanitizeRichtextFields(fields: Record<string, FieldDef>, scope: Record<string, unknown>): void {
-  for (const [key, fieldDef] of Object.entries(fields)) {
-    const { jsKey } = resolveColumnName(key, fieldDef)
-    if (!Object.hasOwn(scope, jsKey)) continue
-    if (fieldIs(fieldDef, 'richtext')) {
-      if (typeof scope[jsKey] === 'string') scope[jsKey] = sanitizeRichtext(scope[jsKey] as string)
-    } else if (fieldIs(fieldDef, 'repeater')) {
-      const entries = scope[jsKey]
-      if (Array.isArray(entries)) {
-        for (const entry of entries) if (entry && typeof entry === 'object') sanitizeRichtextFields(fieldDef.options.fields, entry as Record<string, unknown>)
-      }
-    }
-  }
-}
-
-/** Same walk as `transformBlocks` in crud.ts: each block's props (by its registered field defs) + its
- *  slots' nested blocks, recursively. An unregistered block type is left as-is (matches crud.ts). */
-function sanitizeRichtextInBlocks(blocks: unknown): void {
-  if (!Array.isArray(blocks)) return
-  for (const block of blocks) {
-    if (!block || typeof block !== 'object') continue
-    const b = block as { type?: string; props?: unknown; slots?: unknown }
-    const def = typeof b.type === 'string' ? getBlock(b.type) : undefined
-    if (def && b.props && typeof b.props === 'object') sanitizeRichtextFields(def.fields, b.props as Record<string, unknown>)
-    if (b.slots && typeof b.slots === 'object') for (const sub of Object.values(b.slots as Record<string, unknown>)) sanitizeRichtextInBlocks(sub)
-  }
-}
-
-/**
- * Apply the richtext sanitizer to a preview ticket's `values` — the fix for the ticket bypassing it
- * entirely (it normally runs as a Zod `.transform()` on WRITE, `create`/`update`/`putSingleton` in
- * crud.ts; a ticket never reaches those). Deliberately NOT a schema parse: `values` is the editor's
- * in-progress, possibly-invalid draft (a missing required field, an out-of-range number, …), and a preview
- * exists precisely so a draft can be inspected BEFORE it would pass a save — a strict or even a `.partial()`
- * parse would legitimately reject some of what it must accept. Sanitizing is not a validity constraint
- * though (it only narrows stored bytes, the same way a save would), so a direct field-tree walk gets the
- * safety without the rejection risk. Walks top-level fields, repeater entries, and (when the collection
- * uses the block editor) block props + nested slots — everywhere a richtext leaf can live.
- */
-function sanitizePreviewValues(collection: BuiltCollection, values: Record<string, unknown>): void {
-  sanitizeRichtextFields(collection.def.fields, values)
-  if (collection.def.blocks?.enabled && Object.hasOwn(values, 'content')) sanitizeRichtextInBlocks(values.content)
-}
-
-/**
- * Mint a preview ticket for the editor's UNSAVED state (ADR-0008). The editor posts what it currently
- * holds and opens the page at `?kestrel-preview-token=<token>` in a new tab; nothing is written to the DB,
- * so previewing never doubles as an unasked-for save. Admin-only (default-deny API guard + the backstop),
- * and the ticket is bound to this session.
- *
- *   body: { collection, id: number | null, locale?, values }
- *   200:  { token, expiresAt }
- */
-export default defineEventHandler(async (event) => {
-  requireAdmin(event) // write-authorization backstop (defense-in-depth; see require-admin.ts)
-  const body = (await readBody(event)) as Partial<PreviewPayload> | null
-
-  const name = typeof body?.collection === 'string' ? body.collection : ''
-  const collection = getCollection(name) as BuiltCollection | undefined
-  if (!collection) throw createError({ statusCode: 404, statusMessage: `Unknown collection: ${name}` })
-
-  const values = body?.values
-  if (!values || typeof values !== 'object' || Array.isArray(values)) {
-    throw createError({ statusCode: 400, statusMessage: 'preview requires a `values` object' })
-  }
-  if (JSON.stringify(values).length > MAX_PAYLOAD_BYTES) {
-    throw createError({ statusCode: 413, statusMessage: 'Preview payload too large' })
-  }
-  sanitizePreviewValues(collection, values as Record<string, unknown>)
-
-  const id = typeof body?.id === 'number' && Number.isInteger(body.id) ? body.id : null
-  const locale = typeof body?.locale === 'string' ? body.locale : undefined
-  return usePreviewStore().mint(previewOwner(event), { collection: name, id, locale, values })
-})

package/layers/public/server/api/publish-status.get.ts

@@ -1,58 +0,0 @@
-import { eq, getTableColumns } from 'drizzle-orm'
-import type { AnySQLiteTable } from 'drizzle-orm/sqlite-core'
-import { publishStatus } from '../database/publish-status'
-import { routeForRecord } from '../utils/publish/route-for-record'
-import { hasPendingChanges } from '../utils/publish/pending'
-
-/**
- * Admin-only read of the LIVE publish state of a record's static page (`?collection=&id=`). Admin-only by
- * construction: `/api/*` is default-deny for anonymous and `publish-status` is not a public pageLike
- * resource, so the access guard rejects an unauthenticated request before this runs. Resolves the record's
- * route, then looks up its `publish_status` row. Returns `{ route, status }` (+ error/updatedAt on a row),
- * or `{ route: null, status: null }` when the record has no route (non-pageLike / blank slug / missing),
- * or `{ route, status: null }` when there is no status row yet (never published — dev, a draft, or a
- * republish still in flight). The editor's live-ampel reads this and refetches after each save.
- */
-export default defineEventHandler((event) => {
-  // Environment-level facts the right lamp needs beyond the per-route row: where the NEXT publish would go
-  // (`driver`) and whether the runtime publisher actually produces files HERE (prod + `output.auto`). In dev
-  // (or with auto off) nothing is ever generated, so the lamp shows a calm "Not built" instead of a stuck
-  // "Generating". Read straight from runtimeConfig — no need to pull in the whole publisher module.
-  const output = (useRuntimeConfig().kestrel as { output?: { driver?: 'local' | 's3'; auto?: boolean; publishOnSave?: boolean } }).output
-  // `publishOnSave` also tells the editor whether to offer a Publish button at all: with the split turned
-  // off there is nothing left for it to do.
-  const publishOnSave = !!output?.publishOnSave
-  const env = { driver: (output?.driver ?? 'local') as 'local' | 's3', generates: !import.meta.dev && !!output?.auto, publishOnSave }
-
-  const q = getQuery(event)
-  const name = typeof q.collection === 'string' ? q.collection : ''
-  const id = Number(typeof q.id === 'string' ? q.id : NaN)
-  const c = getCollection(name)
-  if (!c || !c.def.pageLike || !Number.isInteger(id) || id <= 0) return { route: null, status: null, pending: false, neverPublished: false, ...env }
-
-  const db = useDb()
-  const table = c.table as AnySQLiteTable
-  const cols = getTableColumns(table) as Record<string, never>
-  const row = db.select().from(table).where(eq(cols.id, id)).get() as { path?: unknown; locale?: unknown; updatedAt?: unknown } | undefined
-  const route = routeForRecord(row, true, primaryLocale(), prefixPrimaryLocale())
-  if (!route) return { route: null, status: null, pending: false, neverPublished: false, ...env }
-
-  // Saved after it was last published: with publishing deferred to an explicit action, that is the normal
-  // working state of a page being edited — the live file is the previous version until someone publishes.
-  const savedAt = row?.updatedAt instanceof Date ? row.updatedAt.getTime() : null
-  try {
-    const st = db.select().from(publishStatus).where(eq(publishStatus.route, route)).get()
-    // A routable page with no row was never published. Before the split that was indistinguishable from
-    // "a publish is running" — a save always enqueued one — but now nothing is in flight and nothing will be
-    // until someone presses Publish, so the lamp must not claim progress that is not happening.
-    if (!st) return { route, status: null, pending: false, neverPublished: true, ...env }
-    // With the split off, a save republishes on its own, so a newer save means a republish is in flight —
-    // reporting that as "unpublished changes" would ask the user to act on something already happening.
-    const pending = !publishOnSave && hasPendingChanges(savedAt, st.updatedAt instanceof Date ? st.updatedAt.getTime() : null)
-    return { route, status: st.status, error: st.error, updatedAt: st.updatedAt, target: st.target, pending, neverPublished: false, ...env }
-  } catch {
-    // publish_status not migrated yet → treat as "no status" rather than a 500. Not "never published"
-    // either: the table is unreadable, so the page's real state is unknown, not known to be absent.
-    return { route, status: null, pending: false, neverPublished: false, ...env }
-  }
-})