@michaelthielemann/kestrel 3.0.0 → 4.0.0

package/layers/public/app/utils/page-head.ts

@@ -1,4 +1,4 @@
-import { localePath } from '../../../core/app/utils/locale-path'
+import { localePath } from '@michaelthielemann/kestrel-core/client'
 
 export interface PageHeadImage { src: string; width?: number | null; height?: number | null }
 export interface PageHeadAlternate { locale: string; path: string }

package/layers/public/modules/deploy-output/index.ts

@@ -1,10 +1,8 @@
 import { defineNuxtModule } from '@nuxt/kit'
-import { createS3Driver } from '../../../core/server/utils/storage.s3'
-import { resolveOutputCreds, deployStaticOutput, isEnvTrue, planS3Deploy, readRouteDiscovery } from './deploy-output'
-import { resolveKestrel } from '../../../core/server/utils/kestrel-config'
-import type { KestrelConfig } from '../../../core/server/utils/kestrel-config'
-
-
+import { createS3Driver } from '@michaelthielemann/kestrel-core'
+import { resolveOutputCreds, deployStaticOutput, isEnvTrue, planS3Deploy, readRouteDiscovery } from '@michaelthielemann/kestrel-delivery-static'
+import { resolveKestrel } from '@michaelthielemann/kestrel-core'
+import type { KestrelConfig } from '@michaelthielemann/kestrel-core'
 /**
  * Ships `nuxt generate`'s static output (`.output/public`) to an S3 bucket when `kestrel.output.driver`
  * is `s3` — the deploy half of FEATURES "Output target: local directory or S3 bucket". Runs on Nitro's

package/layers/public/modules/prerender-routes/index.ts

@@ -3,10 +3,10 @@ import { existsSync } from 'node:fs'
 import { defineNuxtModule } from '@nuxt/kit'
 import Database from 'better-sqlite3'
 import { collectPageRoutes, pageLikeTables } from './discover'
-import { localePath } from '../../../core/app/utils/locale-path'
-import { recordRouteDiscovery, META_KEYS, type RouteDiscovery } from '../deploy-output/deploy-output'
-import { resolveKestrel, type KestrelConfig } from '../../../core/server/utils/kestrel-config'
-
+import { localePath, resolveKestrel } from '@michaelthielemann/kestrel-core'
+import type { KestrelConfig } from '@michaelthielemann/kestrel-core'
+import { META_KEYS } from '@michaelthielemann/kestrel-core'
+import { recordRouteDiscovery, type RouteDiscovery } from '@michaelthielemann/kestrel-delivery-static'
 // Read published paths from EVERY page-like collection straight from the DB at build time so
 // `nuxt generate` prerenders one HTML file per page (see `collectPageRoutes` for how pageLike tables
 // are identified). The server's migrate-on-boot hasn't run yet at this point, so a DB that isn't there

package/layers/public/modules/prerender-routes/routes.ts

@@ -1,4 +1,4 @@
-import { localePath } from '../../../core/app/utils/locale-path'
+import { localePath } from '@michaelthielemann/kestrel-core'
 
 export interface PageRouteRow {
   path: string | null

package/layers/public/modules/prune-media/index.ts

@@ -1,7 +1,7 @@
 import { defineNuxtModule } from '@nuxt/kit'
 import Database from 'better-sqlite3'
-import { resolveKestrel, type KestrelConfig } from '../../../core/server/utils/kestrel-config'
-import { isEnvTrue } from '../deploy-output/deploy-output'
+import { resolveKestrel, type KestrelConfig } from '@michaelthielemann/kestrel-core'
+import { isEnvTrue } from '@michaelthielemann/kestrel-delivery-static'
 import { pruneUnreferencedMedia, mediaOwnedKeys } from './prune-media'
 
 // The set of storage keys the media library owns (originals + derivatives), read straight from the DB at

package/layers/public/server/delivery-live/serve.ts

@@ -0,0 +1,111 @@
+import { getMethod, getRequestHeader, sendRedirect, send, setHeader, setResponseStatus, type H3Event } from 'h3'
+import { isRendererContext } from '@michaelthielemann/kestrel-access'
+import { cacheControlFor, isDeliveryExemptPath, isDeliveryLive } from '@michaelthielemann/kestrel-core'
+import { usePublishingDb, currentSnapshot, htmlKeyForRoute } from '@michaelthielemann/kestrel-publishing'
+import { liveRedirectFor } from '@michaelthielemann/kestrel-delivery-live'
+
+// Requests this adapter must never answer, whatever `currentSnapshot` says: the admin app, the pipeline
+// API, Nitro's own internals (tasks — e.g. the manual `publish:run` trigger), built assets, and the
+// editor's preview ticket flow. `META_ROUTES` mirrors `@michaelthielemann/kestrel-core`'s own `META_KEYS`
+// (sitemap/robots/llms/redirects) — those are rendered by their own routes, not snapshots. Every prefix
+// is slash-terminated (`normalizeExemptPrefix`'s own rule): a bare `/admin` would also match `/admin-guide`
+// — a DIFFERENT, publishable route this adapter must still serve from its own snapshot.
+const EXEMPT_PREFIXES = ['/api/', '/admin/', '/_nuxt/', '/_nitro/', '/__kestrel/']
+const META_ROUTES = new Set(['/sitemap.xml', '/robots.txt', '/llms.txt', '/llms-full.txt', '/redirects.json'])
+
+// EXEMPT_PREFIXES is slash-terminated the same way (see the const's own comment), so the bare form gets
+// the same exact-path treatment `isDeliveryExemptPath` applies to the configured entries — matching only
+// `startsWith(prefix)` left it unmatched, contrary to `deliveryExempt`'s own documented examples
+// (`/health`, `/feed.xml`).
+function isExempt(path: string): boolean {
+  if (META_ROUTES.has(path)) return true
+  if (path === '/admin') return true // the bare admin root has no trailing segment to anchor a '/admin/' prefix match
+  if (EXEMPT_PREFIXES.some((prefix) => path === prefix.slice(0, -1) || path.startsWith(prefix))) return true
+  return isDeliveryExemptPath(path)
+}
+
+// A route's own trailing slash is not a distinct route: '/route/' must resolve the same snapshot as
+// '/route'. Only the FINAL slash is stripped (one normalization pass), so a prefix match like '/admin/'
+// against '/admin/foo/' still sees '/admin/foo' and still starts with '/admin/'. The root path is its
+// own fixed point and is never touched.
+function normalizeTrailingSlash(path: string): string {
+  return path !== '/' && path.endsWith('/') ? path.slice(0, -1) : path
+}
+
+// RFC 7232 §3.2: If-None-Match may carry a comma-separated list of ETags, and a bare `*` matches any
+// current representation (always a match, as long as the resource exists — checked by the caller).
+// This route's ETag is always strong (`"<fingerprint>"`), so a weak validator (`W/"..."`) never matches
+// under strong comparison, per the same section.
+function ifNoneMatchHits(header: string | undefined, etag: string): boolean {
+  if (!header) return false
+  const trimmed = header.trim()
+  if (trimmed === '*') return true
+  return trimmed.split(',').some((candidate) => candidate.trim() === etag)
+}
+
+/**
+ * The delivery-live catch-all: under `delivery: 'live'`, answers public content traffic exclusively from
+ * `published_snapshots` — a configured redirect, 200 with the snapshot's own html, or 404. Wired as a
+ * Nitro MIDDLEWARE (see `middleware/delivery-live-catchall.ts`) rather than a route, since a middleware
+ * runs ahead of Nuxt's page router; middleware return values are ignored by h3, so this writes the
+ * response itself and returns whether it did.
+ *
+ * Returns `false` (unhandled — the caller falls through to ordinary page rendering) for everything the
+ * adapter must not touch: `delivery: 'static'` (the default), a response already sent, a non-GET/HEAD
+ * request, a non-content path (admin/api/assets/meta/consumer-exempted routes), or the producer's OWN
+ * internal render fetch. That last one is `isRendererContext()`/`import.meta.prerender` — the SAME
+ * unforgeable AsyncLocalStorage marker `pipelines/route.ts` and `00.ip-allowlist.ts` already trust for
+ * exactly this "is this our own in-process render, not an external request" question (`render-live.ts`'s
+ * `renderRouteLive` runs its `localFetch` inside `runAsRenderer`, which sets it) — NOT a request header,
+ * which any external client could forge. Without this bypass, a publish's own render would loop back
+ * into this catch-all and get served its route's CURRENT (about-to-be-superseded) snapshot instead of
+ * ever reaching a real page render, so a
+ * publish under `'live'` could never record a fresh one.
+ */
+export async function serveLiveRoute(event: H3Event): Promise<boolean> {
+  if (event.node?.res?.writableEnded) return false
+  if (!isDeliveryLive()) return false
+  if (import.meta.prerender === true || isRendererContext()) return false
+  const method = getMethod(event)
+  if (method !== 'GET' && method !== 'HEAD') return false
+  const path = normalizeTrailingSlash(event.path.split('?')[0] || '/')
+  if (isExempt(path)) return false
+
+  // Live mode is the app's own edge — there is no separate njs/edge script in front of it the way the
+  // static topology has, so a configured redirect has to be honoured here too, before the 404.
+  const redirect = liveRedirectFor(path)
+  if (redirect) {
+    await sendRedirect(event, redirect.target, redirect.status)
+    return true
+  }
+
+  const snapshot = currentSnapshot(usePublishingDb().db, path)
+  if (!snapshot) {
+    setResponseStatus(event, 404)
+    await send(event, 'Not Found', 'text/plain')
+    return true
+  }
+
+  // The fingerprint is a sha256 of the exact rendered bytes (publisher.ts), so a STRONG ETag is exact:
+  // any two responses sharing it are byte-identical, never merely semantically equivalent. Cache-Control
+  // mirrors delivery-static's own policy for an html key (`cacheControlFor`/`REVALIDATE_CACHE`) so the
+  // two adapters agree on cacheability for the same snapshot. NOTE: this ETag/304 state lives only in
+  // `published_snapshots`, read fresh per request — there is no separate in-process cache to invalidate,
+  // so this is safe across multiple server processes sharing the DB.
+  const etag = `"${snapshot.fingerprint}"`
+  const cacheControl = cacheControlFor(htmlKeyForRoute(path))
+  setHeader(event, 'etag', etag)
+  if (cacheControl) setHeader(event, 'cache-control', cacheControl)
+
+  if (ifNoneMatchHits(getRequestHeader(event, 'if-none-match'), etag)) {
+    setResponseStatus(event, 304)
+    await send(event, undefined)
+    return true
+  }
+
+  const body = Buffer.from(snapshot.html, 'utf8')
+  setHeader(event, 'content-length', body.byteLength)
+  setResponseStatus(event, 200)
+  await send(event, method === 'HEAD' ? undefined : snapshot.html, 'text/html; charset=utf-8')
+  return true
+}

package/layers/public/server/middleware/delivery-live-catchall.ts

@@ -0,0 +1,7 @@
+import { serveLiveRoute } from '../delivery-live/serve'
+
+// Runs on every request; only intercepts when serveLiveRoute's own gate says so (delivery-live/ stays
+// the single owner of when/how this adapter answers — see its TSDoc).
+export default defineEventHandler(async (event) => {
+  await serveLiveRoute(event)
+})

package/layers/public/server/pipelines/index.ts

@@ -0,0 +1,23 @@
+import type { PipelineDef } from '@michaelthielemann/kestrel-core'
+import {
+  buildPublishPipelines,
+  buildPublishRunsPipelines,
+  buildLinkPipelines,
+  buildPreviewPipelines,
+  buildRoutePipelines,
+} from '@michaelthielemann/kestrel-publishing'
+import { buildDeliveryLivePipelines } from '@michaelthielemann/kestrel-delivery-live'
+
+/** The public layer's own API surface: the render entry, the preview ticket pair, the publish action and
+ *  its status read, the orchestrator's admin progress read, the editor's link resolver, and the
+ *  delivery-live read API. All collection-less, so each lives at `/api/<name>`. */
+export function buildPublicPipelines(): PipelineDef[] {
+  return [
+    ...buildRoutePipelines(),
+    ...buildPreviewPipelines(),
+    ...buildPublishPipelines(),
+    ...buildPublishRunsPipelines(),
+    ...buildLinkPipelines(),
+    ...buildDeliveryLivePipelines(),
+  ]
+}

package/layers/public/server/plugins/00.ensure-snapshot-triggers.ts

@@ -0,0 +1,14 @@
+import type Database from 'better-sqlite3'
+import { useDb } from '@michaelthielemann/kestrel-core'
+import { ensureSnapshotTriggers } from '@michaelthielemann/kestrel-publishing'
+
+// Layer order puts every core-layer plugin (00.migrate, 02.schema-sync) before this layer's, so
+// `published_snapshots` already exists here for either provisioning path (a committed migration inside
+// Kestrel's own repo, or the schema engine for a consumer layer) — except a boot before EITHER has run,
+// which `ensureSnapshotTriggers` itself tolerates (warns, does not crash). Skipped during prerender, same
+// as `02.schema-sync`: no DDL runs in that phase.
+export default defineNitroPlugin(() => {
+  if (import.meta.prerender) return
+  const client = (useDb() as unknown as { $client: Database.Database }).$client
+  ensureSnapshotTriggers(client)
+})

package/layers/public/server/plugins/01.register-public-pipelines.ts

@@ -0,0 +1,7 @@
+import { registerPipeline } from '@michaelthielemann/kestrel-core'
+import { buildPublicPipelines } from '../pipelines'
+
+// Registration only — nothing resolves a pipeline here; the registry is read on the first request.
+export default defineNitroPlugin(() => {
+  for (const def of buildPublicPipelines()) registerPipeline(def)
+})

package/layers/public/server/plugins/02.register-links.ts

@@ -1,6 +1,5 @@
-import { registerFieldPopulator } from '../../../core/server/utils/populate'
-import { buildLinkFieldPopulators } from '../utils/populate-links'
-import { resolveInternalHref } from '../utils/link-resolve'
+import { registerFieldPopulator } from '@michaelthielemann/kestrel-core'
+import { buildLinkFieldPopulators, resolveInternalHref } from '@michaelthielemann/kestrel-publishing'
 
 // Resolve internal links to the target record's localized public path at read time (page-like targets;
 // external/email/tel pass through). The resolver IS status-gated: a link to a DRAFT resolves to nothing and

package/layers/public/server/plugins/03.redirects.ts

@@ -1,37 +1,55 @@
-import { registerWriteEffect } from '../../../core/server/utils/write-effects'
-import { outputDriver } from '../utils/publish/publisher'
-import { REDIRECTS_COLLECTION, REDIRECTS_FIELD, writeRedirectsArtifact } from '../utils/publish/redirects-artifact'
+import { Effect } from 'effect'
+import { collectionOf, registerAfterStep } from '@michaelthielemann/kestrel-core'
+import type { StepDef } from '@michaelthielemann/kestrel-core'
+import { outputDriver, REDIRECTS_COLLECTION, REDIRECTS_FIELD, writeRedirectsArtifact } from '@michaelthielemann/kestrel-publishing'
+import { invalidateLiveRedirects } from '@michaelthielemann/kestrel-delivery-live'
 
 /**
  * Publish `redirects.json` on every save of the redirects singleton — deliberately decoupled from the
  * publish cycle, so a redirect goes live without a full republish (and without an editor pressing
  * Publish, which after ADR-0008 they otherwise would have to).
  *
- * A write EFFECT, not a write listener: the bus swallows throws, and a save that reports success while
- * the edge still serves the old rules is exactly the failure this feature cannot have. Registered in
- * every environment, unlike the publish plugin — that one is dev-gated because a dev publish would write
- * Vite-dev HTML with no hashed `_nuxt`, a CONTENT problem this artifact does not have (it is
+ * A CRITICAL after-step, not a non-critical one: a save that reports success while the edge still serves
+ * the old rules is exactly the failure this feature cannot have — its failure becomes the save's response.
+ * Registered in every environment, unlike the publish plugin — that one is dev-gated because a dev publish
+ * would write Vite-dev HTML with no hashed `_nuxt`, a CONTENT problem this artifact does not have (it is
  * `JSON.stringify` of DB rows, byte-identical either way).
  *
  * Where it lands is `output.dir` / the S3 prefix — the same target the publisher uses. With the classic
  * `output.auto: false` + `driver: 'local'` build model that is NOT the deployed tree, so there a
  * redirect goes live with the next `nuxt generate` instead; documented under Redirects in
- * `docs/static-output.md`.
+ * `docs/guide/redirects.md`.
  */
 export default defineNitroPlugin(() => {
-  registerWriteEffect(async ({ def, row }) => {
-    if (def.name !== REDIRECTS_COLLECTION) return
-    try {
-      await writeRedirectsArtifact(row[REDIRECTS_FIELD], outputDriver())
-    } catch (error) {
-      // The row is already committed (CRUD holds no transaction), so the only honest message is
-      // "saved, but not live". Short and ASCII on purpose: h3 truncates nothing but the reason phrase is
-      // the wire's, and the cause goes in `data` where nothing can strip it.
-      throw createError({
-        statusCode: 500,
-        statusMessage: 'Redirects saved, but publishing redirects.json failed. Save again to retry.',
-        data: { cause: (error as Error)?.message ?? String(error) },
-      })
-    }
-  })
+  const writeRedirectsStep: StepDef = {
+    name: 'writeRedirects',
+    when: (ctx) => collectionOf(ctx).def.name === REDIRECTS_COLLECTION,
+    whenLabel: `collection is "${REDIRECTS_COLLECTION}"`,
+    fn: (ctx) => Effect.gen(function* () {
+      const row = ctx.output as Record<string, unknown>
+      // The row is already committed regardless of what the static artifact write below does (see its
+      // own comment) — the live catch-all reads straight from the row, so its cache drops unconditionally,
+      // in lockstep with every save.
+      invalidateLiveRedirects()
+      // A JS try/catch does NOT observe an Effect failure crossing a `yield*` — only Effect's own
+      // combinators do — so the survivor rewrap has to be Effect.catchAll, not a wrapping try/catch.
+      yield* Effect.tryPromise({ try: () => writeRedirectsArtifact(row[REDIRECTS_FIELD], outputDriver()), catch: (error) => error }).pipe(
+        Effect.catchAll((error) => Effect.sync(() => {
+          // The row is already committed (CRUD holds no transaction), so the only honest message is
+          // "saved, but not live". Short and ASCII on purpose: h3 truncates nothing but the reason phrase is
+          // the wire's, and the cause goes in `data` where nothing can strip it. `savedUpdatedAt` lets the
+          // editor rebaseline on this failure the same way it would on success — it only rebaselines then.
+          throw createError({
+            statusCode: 500,
+            statusMessage: 'Redirects saved, but publishing redirects.json failed. Save again to retry.',
+            data: {
+              cause: (error as Error)?.message ?? String(error),
+              savedUpdatedAt: new Date(row.updatedAt as string | number).getTime(),
+            },
+          })
+        })),
+      )
+    }),
+  }
+  registerAfterStep({ step: writeRedirectsStep, critical: true, ops: ['updateOne'] })
 })

package/layers/public/server/plugins/05.plan-publish.ts

@@ -0,0 +1,5 @@
+import { registerPlanPublish } from '@michaelthielemann/kestrel-publishing'
+
+export default defineNitroPlugin(() => {
+  registerPlanPublish()
+})

package/layers/public/server/plugins/zz.publish.ts

@@ -1,28 +1,57 @@
-import { createPublishQueue } from '../utils/publish/queue'
-import { setPublishRuntime } from '../utils/publish/publish-runtime'
-import { DepsStore } from '../utils/publish/deps'
-import { createSqlitePersistence } from '../utils/publish/deps-persistence'
-import { outputDriver, publishInvalidation } from '../utils/publish/publisher'
-import { classifyWrite, planWrite } from '../utils/publish/invalidation'
-import { registerWriteListener } from '../../../core/server/utils/write-events'
+import { renderRouteLive } from '../utils/publish/render-live'
+import {
+  createPublishQueue,
+  setPublishRuntime,
+  DepsStore,
+  createSqlitePersistence,
+  usePublishingDb,
+  outputDriver,
+  publishInvalidation,
+  resumePublishRuns,
+  startPublishRun,
+  setRenderRouteLive,
+  type PublishDelivery,
+} from '@michaelthielemann/kestrel-publishing'
 
 /**
- * The in-server publish runtime (the production operation model). Wires three things, gated on
- * `output.auto` and skipped in dev (a dev publish would write Vite-dev HTML without hashed `_nuxt`):
+ * The in-server publish runtime (the production operation model). Wires the queue + deps index and gates
+ * whether they exist at all, on `output.auto`, skipped in dev (a dev publish would write Vite-dev HTML
+ * without hashed `_nuxt`):
  *
- *  1. AUTO-TRIGGER — every content write classifies into an invalidation and enqueues an incremental
- *     republish (a debounced/coalesced/single-flight queue; precise routes via the captured deps index).
+ *  1. THE RUNTIME ITSELF — `setPublishRuntime` publishes the queue + deps index via `usePublishRuntime()`.
+ *     The `planPublish` outbox handler (`handlers/plan-publish.ts`, registered independently by
+ *     `05.plan-publish.ts`) is the actual AUTO-TRIGGER: it classifies every content/media write into an
+ *     invalidation and enqueues it, but only when this plugin has actually set a runtime — a no-op
+ *     otherwise (dev, or `output.auto` off), so the gate lives here even though the trigger does not.
  *  2. BOOT PUBLISH — a full publish on startup resyncs this build's `_nuxt` + records every route's deps.
  *     DETACHED (`runNitroPlugins` is synchronous + unawaited; `localFetch` is already wired before plugins
- *     run + before the server listens), so it never blocks boot.
+ *     run + before the server listens), so it never blocks boot. A FULL run (boot's own, and the
+ *     reconciler's below) goes through `startPublishRun`, so its command -> snapshot -> delivery ->
+ *     done sequence is persisted to `publish_runs` and survives a crash — an incremental (tag) run a
+ *     content/media write triggers stays a direct `publishInvalidation` call, since it is not part of
+ *     the owned sequence.
  *  3. RECONCILER — an optional periodic full publish (`output.reconcileMinutes`) self-heals any missed
- *     invalidation.
+ *     invalidation, also tracked as an owned run. The self-heal is real, not just "re-render everything
+ *     and hope": every full/reconcile publish live-renders each published route and compares its
+ *     fingerprint against the currently recorded snapshot (`publisher.ts`'s `PublishMode: 'reconcile'`,
+ *     ADR-0013's amendment) — a mismatch (a missed invalidation, a template/component deploy) records +
+ *     delivers the fresh render; a match costs nothing beyond the render itself.
+ *
+ * Crash-resume (ADR-0025): `resumePublishRuns` marks any run a crash left `running` as `failed` — it does
+ * NOT redeliver — and runs BEFORE the boot enqueue below, which fires unconditionally regardless of what
+ * resume found. The queue remains the ONLY caller that ever invokes a delivery; resume never bypasses its
+ * single-flight guard.
  */
 export default defineNitroPlugin(() => {
   if (import.meta.dev) return
   const output = (useRuntimeConfig().kestrel as { output?: { auto?: boolean; publishOnSave?: boolean; reconcileMinutes?: number; verbose?: boolean } }).output
   if (!output?.auto) return
 
+  // Wired explicitly here (not a module-load side effect) — see tasks/publish/run.ts's own comment for
+  // why: it removes any dependency on import-order/instance-identity between this plugin's own
+  // `@michaelthielemann/kestrel-publishing` import and the one `publisher.ts`'s internals resolve. Idempotent.
+  setRenderRouteLive(renderRouteLive)
+
   // `output.verbose`: on top of the one-line summary, itemise each incremental republish with a
   // timestamped per-route line (rendered / pruned) for traceability. Off by default. (A queued FULL run
   // — boot / reconciler — is a bulk resync and stays a summary; publishInvalidation returns no per-route
@@ -33,9 +62,35 @@ export default defineNitroPlugin(() => {
   const driver = outputDriver()
   // Durable deps: rehydrate `route → tags` from SQLite so the boot full-publish below can prune routes
   // that were unpublished/deleted while the server was down (staleRoutes over a non-empty tracked set).
-  const deps = new DepsStore(createSqlitePersistence(useDb()))
+  const deps = new DepsStore(createSqlitePersistence(usePublishingDb().db))
+
+  // The delivery port for a FULL run: the real renderer, driven the same way a queued full invalidation
+  // always was. `startPublishRun` persists the command -> snapshot -> delivery -> done sequence around
+  // this call; this closure is only the "delivery" step itself.
+  const fullDelivery: PublishDelivery = {
+    deliver: async () => {
+      const { rendered, pruned, counts } = await publishInvalidation({ type: 'full' }, driver, deps)
+      if (counts.rendered === 0 && counts.pruned === 0) return
+      console.info(`[kestrel] published ${counts.rendered} route(s) (pruned ${counts.pruned})`)
+      if (verbose) {
+        for (const route of rendered) console.info(`[kestrel] ${stamp()} rendered ${route}`)
+        for (const route of pruned) console.info(`[kestrel] ${stamp()} pruned ${route}`)
+      }
+    },
+  }
+
   const queue = createPublishQueue({
     run: async (inv) => {
+      if (inv.type === 'full') {
+        const result = await startPublishRun(fullDelivery)
+        // Rethrow on a recorded failure so the queue's own retry-on-failure fires (its `.catch()` calls
+        // `onError` below and re-queues the batch) — `startPublishRun` itself never throws for a delivery
+        // failure (it resolves with the outcome as data), so restoring that retry has to happen here.
+        // `id: 0` is the synthetic placeholder `startPublishRun`'s missing-table fallback returns (no real
+        // row backs it) — label it distinctly rather than a misleading "#0".
+        if (result.status === 'failed') throw new Error(`publish run #${result.id === 0 ? 'untracked' : result.id} failed: ${result.error}`)
+        return
+      }
       const { rendered, pruned, counts } = await publishInvalidation(inv, driver, deps)
       if (counts.rendered === 0 && counts.pruned === 0) return
       // Incremental runs name the routes; a queued full run (the reconciler) prints counts only.
@@ -53,19 +108,19 @@ export default defineNitroPlugin(() => {
   // a write-driven prune are serialized by one single-flight run rather than racing each other.
   setPublishRuntime({ queue, deps })
 
-  // A save writes the DB, not the site: by default only what a save must still REMOVE from the output (an
-  // unpublished or deleted record's page) passes through, and everything renderable waits for an explicit
-  // publish — see ADR-0008. `output.publishOnSave` restores the pre-2.0 model, where every write republished.
-  const publishOnSave = output.publishOnSave ?? false
-  registerWriteListener(({ def, before, after }) => {
-    queue.enqueue(planWrite(classifyWrite(def, before, after, primaryLocale(), prefixPrimaryLocale()), publishOnSave))
-  })
-
   // Boot publish goes THROUGH the queue (not a direct publishFull) so it shares the single-flight guard:
   // otherwise a boot full-publish could overlap a write-triggered incremental or the reconciler, and both
   // runs share the module-level variant accumulator (corrupting the registry) and can interleave
-  // render/prune (leaving an unpublished page live). The queue serializes them.
-  queue.enqueue({ type: 'full' })
+  // render/prune (leaving an unpublished page live). The queue serializes them, and it is the ONLY
+  // AUTOMATIC caller that ever invokes a delivery — `resumePublishRuns` below just updates rows, so there
+  // is nothing left to race it. (The `publish:run` Nitro task — `tasks/publish/run.ts` — is a documented
+  // exception: an operator-triggered manual run that calls `publishFull` directly, outside this queue.)
+  //
+  // Resume runs first, awaited: it is a plain DB update (never invokes delivery, so it cannot itself
+  // crash the process the way a redelivered render could), which is what guarantees the boot enqueue below
+  // always fires — a resume that instead redelivered and crashed again the same way would leave the row
+  // `running` forever and never reach this line, an infinite boot loop that never makes progress.
+  void resumePublishRuns().finally(() => queue.enqueue({ type: 'full' }))
 
   const mins = output.reconcileMinutes ?? 0
   if (mins > 0) setInterval(() => queue.enqueue({ type: 'full' }), mins * 60_000).unref?.()

package/layers/public/server/routes/llms-full.txt.get.ts

@@ -1,9 +1,9 @@
 import { getTableColumns } from 'drizzle-orm'
-import { localePath } from '../../../core/app/utils/locale-path'
-import { LLMS_FULL_HEADING_OFFSET } from '../utils/llms-full'
-import type { LlmsFullSection, LlmsFullPage } from '../utils/llms-full'
-import type { BuiltCollection } from '../../../core/server/utils/collection-types'
-
+import { localePath, useDb, primaryLocale, prefixPrimaryLocale, allCollections } from '@michaelthielemann/kestrel-core'
+import type { BuiltCollection } from '@michaelthielemann/kestrel-core'
+import { isPubliclyReadable, publicReadableResources } from '@michaelthielemann/kestrel-access'
+import { LLMS_FULL_HEADING_OFFSET, buildLlmsFullTxt, recordMarkdown, collectionHeading, siteBaseUrl, siteName, siteDescription, llmsFullEnabled } from '@michaelthielemann/kestrel-publishing'
+import type { LlmsFullSection, LlmsFullPage } from '@michaelthielemann/kestrel-publishing'
 // The long form of llms.txt: every published, indexable page's full Markdown body in one document, so an
 // answer engine can ground on the site without crawling it. Same registry-driven public set and the same
 // status/noindex filters as `llms.txt` and the sitemap (single source: the auth policy).

package/layers/public/server/routes/llms.txt.get.ts

@@ -1,6 +1,8 @@
 import { getTableColumns } from 'drizzle-orm'
-import { localePath } from '../../../core/app/utils/locale-path'
-import type { LlmsSection, LlmsEntry } from '../utils/llms'
+import { localePath, useDb, primaryLocale, prefixPrimaryLocale, allCollections } from '@michaelthielemann/kestrel-core'
+import { isPubliclyReadable, publicReadableResources } from '@michaelthielemann/kestrel-access'
+import { collectionHeading, buildLlmsTxt, siteBaseUrl, siteName, siteDescription } from '@michaelthielemann/kestrel-publishing'
+import type { LlmsSection, LlmsEntry } from '@michaelthielemann/kestrel-publishing'
 
 // Generates an `llms.txt` (llmstxt.org): the site name + description, then one section per pageLike
 // collection listing its published, indexable records — the SAME registry-driven public set the sitemap

package/layers/public/server/routes/redirects.json.get.ts

@@ -1,6 +1,6 @@
 import { eq } from 'drizzle-orm'
-import { compilePublishableRedirects, serializeRedirects } from '../utils/publish/redirect-rules'
-import { REDIRECTS_COLLECTION, REDIRECTS_FIELD } from '../utils/publish/redirects-artifact'
+import { getCollection, useDb } from '@michaelthielemann/kestrel-core'
+import { compilePublishableRedirects, serializeRedirects, REDIRECTS_COLLECTION, REDIRECTS_FIELD } from '@michaelthielemann/kestrel-publishing'
 
 /**
  * The redirect artifact the edge polls. A save publishes it directly (see `plugins/03.redirects.ts`);

package/layers/public/server/routes/robots.txt.get.ts

@@ -1,3 +1,5 @@
+import { siteBaseUrl, buildRobots, llmsFullEnabled } from '@michaelthielemann/kestrel-publishing'
+
 export default defineEventHandler((event) => {
   const base = siteBaseUrl()
   setHeader(event, 'content-type', 'text/plain; charset=utf-8')

package/layers/public/server/routes/sitemap.xml.get.ts

@@ -1,8 +1,15 @@
 import { getTableColumns } from 'drizzle-orm'
-import { localePath } from '../../../core/app/utils/locale-path'
+import { localePath, useDb, primaryLocale, prefixPrimaryLocale, allCollections, isDeliveryLive } from '@michaelthielemann/kestrel-core'
+import { isPubliclyReadable, publicReadableResources } from '@michaelthielemann/kestrel-access'
+import { currentRoutes, usePublishingDb, buildSitemap, withHreflang, siteBaseUrl } from '@michaelthielemann/kestrel-publishing'
+import type { SitemapCandidate } from '@michaelthielemann/kestrel-publishing'
 
 // Lists every published, indexable page-like record (across all pageLike collections) as a
-// sitemap. Filters status/noindex itself, so it is safe to serve publicly and to prerender.
+// sitemap. Filters status/noindex itself, so it is safe to serve publicly and to prerender. Under
+// `delivery: 'live'`, a route must ALSO have a current, non-retracted snapshot — the row's own
+// status/noindex fields and the snapshot store are two independent "is this reachable" facts (a direct
+// snapshot retraction leaves the row untouched, see `@michaelthielemann/kestrel-publishing`'s `server/db/snapshots.ts`), and this route is what a crawler
+// actually finds, so both must agree before a route is listed.
 export default defineEventHandler((event) => {
   const db = useDb()
   const base = siteBaseUrl()
@@ -17,10 +24,11 @@ export default defineEventHandler((event) => {
   const primary = primaryLocale()
   const prefixPrimary = prefixPrimaryLocale()
   const candidates: SitemapCandidate[] = []
+  // One set lookup for the whole candidate list instead of one currentSnapshot query per candidate.
+  const liveRoutes = isDeliveryLive() ? new Set(currentRoutes(usePublishingDb().db)) : null
 
-  // A sitemap must only advertise publicly-reachable URLs. The public render path (anonymous access
-  // policy, prerender seed, catch-all) now renders every pageLike collection, so the sitemap tracks the
-  // SAME registry-driven public set (single source: the auth policy) rather than diverging from it.
+  // A sitemap must only advertise publicly-reachable URLs, so it tracks the SAME registry-driven
+  // public set the public render path uses (single source: the auth policy).
   const pub = publicReadableResources()
   for (const c of allCollections()) {
     if (!c.def.pageLike) continue
@@ -52,8 +60,10 @@ export default defineEventHandler((event) => {
       const seo = (row.seo ?? {}) as { noindex?: boolean }
       if (seo.noindex) continue
       const locale = (row.locale as string | undefined) ?? primary
+      const route = localePath(path, locale, primary, prefixPrimary)
+      if (liveRoutes && !liveRoutes.has(route)) continue
       candidates.push({
-        loc: base + localePath(path, locale, primary, prefixPrimary),
+        loc: base + route,
         lastmod: row.updatedAt instanceof Date ? row.updatedAt.toISOString() : undefined,
         locale,
         group: (row.translationGroup as string | undefined) ?? null,

package/layers/public/server/tasks/publish/run.ts

@@ -1,6 +1,5 @@
-import { publishFull, outputDriver } from '../../utils/publish/publisher'
-import { DepsStore } from '../../utils/publish/deps'
-import { createSqlitePersistence } from '../../utils/publish/deps-persistence'
+import { renderRouteLive } from '../../utils/publish/render-live'
+import { publishFull, outputDriver, DepsStore, createSqlitePersistence, usePublishingDb, setRenderRouteLive } from '@michaelthielemann/kestrel-publishing'
 
 /**
  * The shared publish engine, exposed as a Nitro task. Renders every published page (+ sitemap/robots)
@@ -17,9 +16,15 @@ import { createSqlitePersistence } from '../../utils/publish/deps-persistence'
 export default defineTask({
   meta: { name: 'publish:run', description: 'Render all published pages to the configured static output (HTML + _nuxt + assets)' },
   async run() {
+    // Wired explicitly here (not a module-load side effect): Nitro dev re-evaluates a task's module graph
+    // per invocation for hot-reload, which can give this call and `publisher.ts`'s a differently-scoped
+    // `@michaelthielemann/kestrel-publishing` instance if the wiring only ran once, earlier, at a boot-time import — calling
+    // the setter fresh, synchronously, right before the only call that needs it removes that dependency on
+    // import-order/instance-identity entirely. Idempotent: safe to call before every run.
+    setRenderRouteLive(renderRouteLive)
     // The same durable store the boot-publish plugin uses, so a manually-triggered run also prunes
     // routes that left the published set and records deps for later incremental publishes.
-    const deps = new DepsStore(createSqlitePersistence(useDb()))
+    const deps = new DepsStore(createSqlitePersistence(usePublishingDb().db))
     const result = await publishFull(outputDriver(), deps)
     console.info(`[kestrel] publish:run rendered ${result.rendered} route(s), pruned ${result.pruned}`)
     return { result }

package/layers/public/server/utils/publish/render-live.ts

@@ -0,0 +1,26 @@
+import { runAsRenderer } from '@michaelthielemann/kestrel-access'
+
+/** Render a public route via the in-process server, returning its HTML buffer (200) or a null body with the
+ *  HTTP status, so the caller can tell a broken page (5xx — a server-error RESPONSE, not a throw) from an
+ *  expected non-200 (a draft / unpublish race → 404 / redirect). The PRODUCER's own render primitive — the
+ *  delivery-static side never calls this; see `@michaelthielemann/kestrel-delivery-static`'s `render-route.ts`. `@michaelthielemann/kestrel-publishing`
+ *  never imports this directly (a package cannot reach `useNitroApp`) — each real
+ *  entry point (`zz.publish.ts`, `tasks/publish/run.ts`) instead calls `setRenderRouteLive(renderRouteLive)`
+ *  itself, right before the call that needs it (see either file's own comment for why NOT a module-load
+ *  side effect: Nitro dev can re-evaluate a task's module graph per invocation). */
+export async function renderRouteLive(route: string): Promise<{ body: Buffer | null; status: number }> {
+  // Run as the renderer principal so the nested $fetch('/api/route') passes the access guard (it is not a
+  // public endpoint). The ALS context propagates through localFetch → the page render → the nested fetch.
+  // useNitroApp is imported LAZILY (not via the Nitro auto-import) on purpose: a static import gives this
+  // module an edge to nitropack's app.mjs, which both defines useNitroApp AND loads the plugin registry
+  // that reaches this file (via zz.publish) — a build-time circular dependency. A dynamic import is a chunk
+  // boundary, so that cycle disappears from the build graph; it's the same nitroApp singleton either way
+  // (Rollup bundles the literal specifier; useNitroApp is only CALLED here at publish time, long after boot).
+  const { useNitroApp } = await import('nitropack/runtime')
+  // Every consumer that needs to know "is this OUR OWN in-process render" (delivery-live's catch-all,
+  // media's variant-capture scan) reads `isRendererContext()`/`import.meta.prerender` instead of a header —
+  // both are set by `runAsRenderer` below and an external request can't forge either.
+  const res = await runAsRenderer(() => useNitroApp().localFetch(route, { method: 'GET' }))
+  if (res.status !== 200) return { body: null, status: res.status }
+  return { body: Buffer.from(await res.arrayBuffer()), status: res.status }
+}