@michaelthielemann/kestrel 3.0.0 → 4.0.0

package/layers/ui/app/i18n/en.ts

@@ -4,7 +4,6 @@ import type { Catalog } from '../composables/useT'
 // carry `{name}` placeholders interpolated by `useT().t`. Content (collection data) is NOT translated
 // here — only the dashboard chrome. Keep `en` the complete set; other catalogs may be partial.
 export const en: Catalog = {
-  // common / shared
   'common.new': 'New {label}',
   'common.save': 'Save',
   'common.publish': 'Publish',
@@ -14,7 +13,6 @@ export const en: Catalog = {
   'common.close': 'Close',
   'common.retry': 'Retry',
 
-  // navigation rail + shell
   'nav.dashboard': 'Dashboard',
   'nav.signOut': 'Sign out',
   'theme.dark': 'Dark mode',
@@ -27,21 +25,17 @@ export const en: Catalog = {
   'a11y.rowActions': 'Actions',
   'lang.label': 'Language',
 
-  // account menu (rail foot)
   'account.label': 'Account',
   'account.name': 'Admin',
 
-  // text input (password reveal)
   'input.showPassword': 'Show password',
   'input.hidePassword': 'Hide password',
 
-  // login
   'login.signIn': 'Sign in',
   'login.password': 'Password',
   'login.invalid': 'Invalid credentials',
   'login.error': 'Something went wrong — please try again',
 
-  // dashboard
   'dash.title': 'Dashboard',
   'dash.lede': 'Choose a collection to manage its content.',
   'dash.empty.title': 'No collections yet',
@@ -49,10 +43,8 @@ export const en: Catalog = {
   'dash.mode.singleton': 'Singleton',
   'dash.mode.collection': 'Collection',
 
-  // collection (list page wrapper)
   'collection.unknown': 'Unknown collection: {name}',
 
-  // record editor page + toasts
   'editor.back': '{collection}',
   'editor.newRecord': 'New {collection}',
   'editor.editRecord': 'Edit {collection} #{id}',
@@ -61,6 +53,8 @@ export const en: Catalog = {
   'editor.fixBlockContent': 'Some block content is invalid. Check the highlighted block fields.',
   'editor.saveConflict': 'This conflicts with an existing record.',
   'editor.saveFailed': 'Save failed.',
+  'editor.quarantined.title': 'Record quarantined',
+  'editor.quarantined.desc': 'This record no longer matches its collection’s schema and is shown read-only. It cannot be edited or saved until the underlying data is fixed.',
   'toast.saved': 'Saved',
   'toast.deleted': 'Deleted',
   'toast.duplicated': 'Duplicated',
@@ -69,7 +63,6 @@ export const en: Catalog = {
   'toast.region': 'Notifications',
   'toast.dismiss': 'Dismiss',
 
-  // collection list
   'list.translations': 'Translations',
   'list.deadRefs': 'Refs',
   'list.filter': 'Filter',
@@ -113,7 +106,9 @@ export const en: Catalog = {
   'list.result': '{total} result',
   'list.results': '{total} results',
   'list.loadError': "Couldn't load this collection.",
-  // row selection + bulk actions
+  'list.quarantined': 'Quarantined',
+  'list.quarantinedOne': '{n} quarantined record',
+  'list.quarantinedCount': '{n} quarantined records',
   'list.selectAll': 'Select all rows on this page',
   'list.selectRow': 'Select {name}',
   'list.selected': '{n} selected',
@@ -129,8 +124,9 @@ export const en: Catalog = {
   'list.deleteRefsUnverified': 'References could not be verified — some records may be left with a broken link. Proceed with caution.',
   'list.opFailed': 'The action could not be completed.',
   'list.refCheckFailed': 'References could not be checked.',
+  'list.actionConfirm': 'Run "{name}" on {n} record(s)?',
+  'list.actionDone': '{name} done',
 
-  // editor preview pane
   'preview.ariaLabel': 'Live preview',
   'preview.label': 'Preview',
   'preview.deviceLabel': 'Preview size',
@@ -142,7 +138,6 @@ export const en: Catalog = {
   'preview.width': 'Width',
   'preview.height': 'Height',
 
-  // page settings (system fields on pageLike collections)
   'pageSettings.slugLabel': 'Slug',
   'pageSettings.slugHint': 'URL path, e.g. /about (blank = auto-generated from the title)',
   'pageSettings.layoutLabel': 'Layout',
@@ -153,7 +148,6 @@ export const en: Catalog = {
   'pageSettings.statusDraft': 'Draft',
   'pageSettings.statusPublished': 'Published',
 
-  // editor action bar — live preview + status "Ampel"
   'editor.openInNewTab': 'Open in new tab',
   'editor.previewUnsaved': 'Preview unsaved changes in a new tab',
   'editor.previewFailed': 'Could not open the preview.',
@@ -189,7 +183,6 @@ export const en: Catalog = {
   'editorStatus.live.draft': 'Draft — not generated. It stays off the live site until published.',
   'editorStatus.live.updatedAt': 'Last published {time}',
 
-  // SEO section + Google preview
   'seo.sectionLabel': 'SEO',
   'seo.metaTitle': 'Meta title',
   'seo.metaDescription': 'Meta description',
@@ -208,7 +201,6 @@ export const en: Catalog = {
   'seo.keywords': 'Keywords',
   'seo.keywordsHint': 'Comma-separated topics for this page.',
 
-  // locale bar (translations)
   'localeBar.fieldLabel': 'Locale',
   'localeBar.groupLabel': 'Content locale',
   'localeBar.editLocale': 'Edit {loc}',
@@ -216,12 +208,10 @@ export const en: Catalog = {
   'localeBar.createTranslation': 'Create {loc} translation',
   'localeBar.copyFailed': "Couldn't copy from {locale}.",
 
-  // editor history (undo/redo)
   'history.label': 'Edit history',
   'history.undo': 'Undo',
   'history.redo': 'Redo',
 
-  // block editor
   'blocks.empty': 'No blocks yet.',
   'blocks.moveUp': 'Move block {n} up',
   'blocks.moveDown': 'Move block {n} down',
@@ -238,7 +228,6 @@ export const en: Catalog = {
   'blocks.fieldsLabel': 'Block fields',
   'blocks.treeLabel': 'Block structure',
 
-  // dead references (derived stale-reference warnings)
   'deadRefs.listWarning': 'Links to a deleted or unpublished record',
   'deadRefs.blockBadge': 'Broken reference',
   'deadRefs.fieldNote': 'Points at a deleted or unpublished record.',
@@ -256,16 +245,13 @@ export const en: Catalog = {
   'refs.reason.unpublished': 'Unpublished',
   'refs.dashAlert': '{n} broken reference(s) — review',
 
-  // field gallery
   'gallery.title': 'Field gallery',
   'gallery.lede.before': 'Every implemented field widget, live. The relation and internal-link pickers query ',
   'gallery.lede.after': ' — create a post or two to see results.',
 
-  // media library
   'media.title': 'Media',
   'media.picker.titleSingle': 'Select a file',
   'media.picker.titleMultiple': 'Select media',
-  // media — right-click context menu
   'media.menu.cut': 'Cut',
   'media.menu.copy': 'Copy',
   'media.menu.paste': 'Paste',
@@ -295,7 +281,6 @@ export const en: Catalog = {
   'media.selected': 'selected',
   'media.useSelected': 'Use selected',
   'media.dropToUpload': 'Drop files to upload',
-  // media — upload conflict resolution
   'media.conflicts.title': 'Resolve upload conflicts',
   'media.conflicts.desc': '{count} file(s) already exist. Choose how to resolve each.',
   'media.conflicts.applyAll': 'Apply to all:',
@@ -306,20 +291,17 @@ export const en: Catalog = {
   'media.conflicts.overwrite': 'Overwrite',
   'media.conflicts.rename': 'Rename',
   'media.conflicts.skip': 'Skip',
-  // media — new folder / rename dialogs
   'media.newFolder': 'New folder',
   'media.folderName': 'Folder name',
   'media.folderNamePlaceholder': 'e.g. holiday',
   'media.rename': 'Rename',
   'media.newName': 'New name',
-  // media — delete dialog
   'media.deleteSummary': 'Delete {files} {filesUnit} and {folders} {foldersUnit} — {size}.',
   'media.file': 'file',
   'media.files': 'files',
   'media.folder': 'folder',
   'media.folders': 'folders',
   'media.usageWarning': 'These files are used by published content and links will break:',
-  // media — move/copy conflict dialog
   'media.conflictTitleMove': 'Move — conflicts',
   'media.conflictTitleCopy': 'Copy — conflicts',
   'media.conflictItems': '{count} item(s) already exist in "{dest}":',
@@ -329,7 +311,6 @@ export const en: Catalog = {
   'media.skip': 'Skip',
   'media.replace': 'Replace',
   'media.keepBoth': 'Keep both',
-  // media — table view
   'media.colName': 'Name',
   'media.colType': 'Type',
   'media.colSize': 'Size',
@@ -337,7 +318,6 @@ export const en: Catalog = {
   'media.typeFolder': 'Folder',
   'media.parentFolder': 'Go to the parent folder',
 
-  // media — viewer
   'mediaViewer.folder': 'Folder',
   'mediaViewer.uploaded': 'Uploaded',
   'mediaViewer.alt': 'Alt text',
@@ -351,7 +331,6 @@ export const en: Catalog = {
   'mediaViewer.aiNote': 'Disclosure note',
   'mediaViewer.aiNoteHint': 'Free text, e.g. the tool used. Pre-filled with any AI signals found in the file at upload — evidence only, not a verified claim.',
 
-  // richtext toolbar
   'richtext.bold': 'Bold',
   'richtext.italic': 'Italic',
   'richtext.underline': 'Underline',
@@ -386,7 +365,6 @@ export const en: Catalog = {
   'richtext.linkUrl': 'Link URL',
   'richtext.apply': 'Apply',
 
-  // media toolbar
   'mediaToolbar.searchPlaceholder': 'Search…',
   'mediaToolbar.searchAriaLabel': 'Search media',
   'mediaToolbar.viewGrid': 'Grid',
@@ -395,18 +373,14 @@ export const en: Catalog = {
   'mediaToolbar.upload': 'Upload',
   'mediaToolbar.newFolder': 'New folder',
 
-  // media path bar
   'mediaPath.navAriaLabel': 'Path',
   'mediaPath.editAriaLabel': 'Edit path',
   'mediaPath.inputAriaLabel': 'Enter path',
 
-  // collections nav
   'nav.collections': 'Collections',
 
-  // field widgets — datetime
   'field.datetime.range_start': 'Start',
   'field.datetime.range_end': 'End',
-  // field widgets — link
   'field.link.type_internal': 'Internal',
   'field.link.type_url': 'URL',
   'field.link.type_email': 'Email',
@@ -415,14 +389,11 @@ export const en: Catalog = {
   'field.link.url_placeholder': 'https://…',
   'field.link.label_placeholder': 'Link text (optional)',
   'field.link.hash_placeholder': 'Anchor (optional, e.g. section-id)',
-  // field widgets — relation
   'field.relation.placeholder': 'Search…',
-  // field widgets — internal-link picker
   'field.linkPicker.loadError': 'Could not load collections.',
   'field.linkPicker.chooseCollection': 'Choose a collection…',
   'field.linkPicker.collectionLabel': 'Collection',
   'field.linkPicker.searchRecords': 'Search records…',
-  // field widgets — repeater
   'field.repeater.moved': 'Moved item to position {n} of {total}',
   'field.repeater.removed': 'Item {n} removed, {remaining} remaining',
   'field.repeater.duplicated': 'Duplicated item {n}',
@@ -435,7 +406,6 @@ export const en: Catalog = {
   'field.repeater.remove_label': 'Remove item {n}',
   'field.repeater.empty': 'No items yet.',
   'field.repeater.add': 'Add item',
-  // field widgets — media
   'field.media.empty': 'No media selected.',
   'field.media.add': 'Add media',
   'field.media.replace': 'Replace',
@@ -446,7 +416,6 @@ export const en: Catalog = {
   'field.media.move_later': 'Move {name} later',
   'field.media.moved': 'Moved {name} to position {pos} of {total}',
 
-  // combobox
   'combobox.moved': 'Moved {label} to position {pos} of {total}',
   'combobox.move_earlier': 'Move {label} earlier',
   'combobox.move_later': 'Move {label} later',
@@ -456,7 +425,6 @@ export const en: Catalog = {
   'combobox.loading': 'Loading…',
   'combobox.no_results': 'No results',
 
-  // date pickers
   'datePicker.openCalendar': 'Open calendar',
   'datePicker.previousMonth': 'Previous month',
   'datePicker.nextMonth': 'Next month',

package/layers/ui/app/utils/field-component.ts

@@ -1,4 +1,4 @@
-import type { FieldDef } from '../../../core/server/utils/defineCollection'
+import type { FieldDef } from '@michaelthielemann/kestrel-core'
 
 /** A record reference: its id plus a human label. Shared by UiCombobox and FieldRelation. */
 export interface FieldOption { value: number; label: string }

package/layers/ui/app/utils/field-registry.ts

@@ -1,5 +1,5 @@
 import { defineAsyncComponent, type Component } from 'vue'
-import type { FieldType } from '../../../core/server/utils/defineCollection'
+import type { FieldType } from '@michaelthielemann/kestrel-core'
 import FieldText from '../components/field/Text.vue'
 import FieldNumber from '../components/field/Number.vue'
 import FieldBoolean from '../components/field/Boolean.vue'

package/layers/ui/app/utils/icons.ts

@@ -3,19 +3,14 @@ export type IconName =
   | 'copy' | 'trash' | 'x' | 'plus' | 'pencil' | 'check'
   | 'home' | 'file-text' | 'folder' | 'folder-plus' | 'panel-left-close' | 'panel-left-open' | 'log-out'
   | 'sun' | 'moon' | 'calendar' | 'upload' | 'layout-grid' | 'table'
-  // collection icons + list toolbar
   | 'settings' | 'image' | 'newspaper' | 'columns' | 'filter' | 'search' | 'sliders'
-  // richtext toolbar
   | 'bold' | 'italic' | 'underline' | 'strikethrough' | 'code' | 'square-code' | 'highlighter'
   | 'subscript' | 'superscript' | 'list' | 'list-ordered' | 'quote' | 'minus' | 'message-square'
   | 'align-left' | 'align-center' | 'align-right' | 'align-justify'
   | 'eraser' | 'undo' | 'redo' | 'link' | 'link-2'
-  | 'external-link' | 'triangle-alert'
-  // password reveal
+  | 'external-link' | 'triangle-alert' | 'globe'
   | 'eye' | 'eye-off'
-  // preview device widths + reload
   | 'monitor' | 'tablet' | 'smartphone' | 'rotate-cw'
-  // block-type tiles
   | 'clock' | 'user'
 
 export const icons: Record<IconName, string> = {
@@ -74,6 +69,7 @@ export const icons: Record<IconName, string> = {
   'link': '<path d="M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71"/><path d="M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71"/>',
   'link-2': '<path d="M9 17H7A5 5 0 0 1 7 7h2"/><path d="M15 7h2a5 5 0 1 1 0 10h-2"/><line x1="8" x2="16" y1="12" y2="12"/>',
   'external-link': '<path d="M15 3h6v6"/><path d="M10 14 21 3"/><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h6"/>',
+  'globe': '<circle cx="12" cy="12" r="10"/><path d="M12 2a14.5 14.5 0 0 0 0 20 14.5 14.5 0 0 0 0-20"/><path d="M2 12h20"/>',
   'triangle-alert': '<path d="m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3"/><path d="M12 9v4"/><path d="M12 17h.01"/>',
   'settings': '<path d="M12.22 2h-.44a2 2 0 0 0-2 2v.18a2 2 0 0 1-1 1.73l-.43.25a2 2 0 0 1-2 0l-.15-.08a2 2 0 0 0-2.73.73l-.22.38a2 2 0 0 0 .73 2.73l.15.1a2 2 0 0 1 1 1.72v.51a2 2 0 0 1-1 1.74l-.15.09a2 2 0 0 0-.73 2.73l.22.38a2 2 0 0 0 2.73.73l.15-.08a2 2 0 0 1 2 0l.43.25a2 2 0 0 1 1 1.73V20a2 2 0 0 0 2 2h.44a2 2 0 0 0 2-2v-.18a2 2 0 0 1 1-1.73l.43-.25a2 2 0 0 1 2 0l.15.08a2 2 0 0 0 2.73-.73l.22-.39a2 2 0 0 0-.73-2.73l-.15-.08a2 2 0 0 1-1-1.74v-.5a2 2 0 0 1 1-1.74l.15-.09a2 2 0 0 0 .73-2.73l-.22-.38a2 2 0 0 0-2.73-.73l-.15.08a2 2 0 0 1-2 0l-.43-.25a2 2 0 0 1-1-1.73V4a2 2 0 0 0-2-2z"/><circle cx="12" cy="12" r="3"/>',
   'image': '<rect width="18" height="18" x="3" y="3" rx="2" ry="2"/><circle cx="9" cy="9" r="2"/><path d="m21 15-3.086-3.086a2 2 0 0 0-2.828 0L6 21"/>',

package/layers/ui/app/utils/localized.ts

@@ -1,4 +1,4 @@
-import type { Localized } from '../../../core/server/utils/defineCollection'
+import type { Localized } from '@michaelthielemann/kestrel-core'
 
 /**
  * Resolve a (possibly localized) label for the active admin language. A plain string is returned as-is

package/nuxt.config.ts

@@ -1,5 +1,5 @@
 import kestrel from './kestrel.config'
-import { layerKestrelOption } from './layers/core/server/utils/kestrel-config'
+import { layerKestrelOption } from '@michaelthielemann/kestrel-core'
 
 // Silence known-harmless, un-actionable THIRD-PARTY build noise (output unaffected — applied to both the
 // Vite client and the Nitro server Rollup passes). Everything else still surfaces — crucially, any

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@michaelthielemann/kestrel",
-  "version": "3.0.0",
+  "version": "4.0.0",
   "description": "A slim, collection-driven Nuxt 4 CMS meta-layer with a runtime schema engine. Add `extends: ['@michaelthielemann/kestrel']`, define collections, and the database migrates itself.",
   "license": "Apache-2.0",
   "author": "Michael Thielemann <283621694+MichaelThielemann@users.noreply.github.com>",
@@ -24,7 +24,6 @@
   "bin": {
     "kestrel": "./scripts/kestrel.mjs"
   },
-  "packageManager": "pnpm@11.9.0",
   "publishConfig": {
     "access": "public",
     "provenance": true
@@ -45,21 +44,6 @@
     "node": ">=22.12.0"
   },
   "//lint": "The root eslint.config.mjs imports the generated playground/.nuxt/eslint.config.mjs (Nuxt-aware: auto-import globals for every layer + extension) — `nuxt prepare` must run first or that import 404s on a fresh checkout. Cheap on a warm .nuxt cache, so it's chained rather than a separate step.",
-  "scripts": {
-    "dev": "nuxt dev",
-    "build": "nuxt build",
-    "preview": "nuxt preview",
-    "generate": "nuxt generate",
-    "db:generate": "drizzle-kit generate",
-    "db:migrate": "drizzle-kit migrate",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "test:e2e": "vitest run --config vitest.e2e.config.ts",
-    "test:nuxt": "vitest run --config vitest.nuxt.config.ts",
-    "typecheck": "node scripts/typecheck.mjs",
-    "lint": "nuxt prepare playground && eslint .",
-    "hash-password": "node scripts/hash-password.mjs"
-  },
   "dependencies": {
     "@babel/parser": "^7.29.8",
     "@internationalized/date": "^3.12.3",
@@ -78,10 +62,12 @@
     "dompurify": "^3.4.13",
     "drizzle-orm": "^0.45.2",
     "drizzle-zod": "^0.8.3",
+    "effect": "~3.22.1",
     "exifr": "^7.1.3",
     "file-type": "^22.0.1",
     "jsdom": "^29.1.1",
     "nanoid": "^5.1.16",
+    "nitropack": "^2.13.4",
     "nuxt": "^4.5.2",
     "reka-ui": "^2.10.1",
     "sanitize-html": "^2.17.6",
@@ -89,7 +75,17 @@
     "sharp": "^0.35.3",
     "thumbhash": "^0.1.1",
     "typescript": "^6.0.3",
-    "zod": "^4.4.3"
+    "zod": "^4.4.3",
+    "@michaelthielemann/kestrel-access": "0.1.0",
+    "@michaelthielemann/kestrel-auth": "0.1.0",
+    "@michaelthielemann/kestrel-core": "0.1.0",
+    "@michaelthielemann/kestrel-contracts": "0.1.0",
+    "@michaelthielemann/kestrel-collections": "0.1.0",
+    "@michaelthielemann/kestrel-delivery-live": "0.1.0",
+    "@michaelthielemann/kestrel-delivery-static": "0.1.0",
+    "@michaelthielemann/kestrel-fields": "0.1.0",
+    "@michaelthielemann/kestrel-media": "0.1.0",
+    "@michaelthielemann/kestrel-publishing": "0.1.0"
   },
   "//peers": "Framework singletons the layer sources import by bare specifier. Peers, not dependencies: a second copy breaks identity (two Vue instances; an h3 v1 `createError` handed to an h3 v2 error handler, which surfaces our 400/404/409 as bare 500s). All optional, because kestrel's own `nuxt` dependency already supplies them transitively — the entry pins identity where a copy exists rather than demanding one, and a required peer would ERESOLVE-fail npm installs on any Nuxt whose bundled range we did not anticipate. Each is also a devDependency so this repo resolves it without auto-install-peers writing a phantom root dependency into the lockfile.",
   "peerDependencies": {
@@ -113,20 +109,58 @@
     }
   },
   "devDependencies": {
+    "@arethetypeswrong/cli": "^0.18.5",
+    "@fast-check/vitest": "^0.4.1",
+    "@microsoft/api-extractor": "^7.58.13",
     "@nuxt/eslint": "^1.9.0",
     "@nuxt/kit": "^4.5.2",
     "@nuxt/test-utils": "^4.1.0",
+    "@stryker-mutator/core": "^10.0.0",
+    "@stryker-mutator/vitest-runner": "^10.0.0",
     "@vitejs/plugin-vue": "^6.0.8",
+    "@vitest/coverage-v8": "4.1.10",
     "@vue/test-utils": "^2.4.11",
     "drizzle-kit": "^0.31.10",
     "eslint": "^9.39.1",
+    "eslint-plugin-boundaries": "^7.2.0",
+    "eslint-plugin-jsdoc": "^64.2.1",
+    "eslint-plugin-tsdoc": "^0.5.2",
     "eslint-plugin-vuejs-accessibility": "^2.4.1",
+    "fast-check": "^4.9.0",
     "h3": "^1.15.11",
     "happy-dom": "^20.11.2",
     "playwright-core": "^1.62.1",
+    "publint": "^0.3.24",
+    "typedoc": "^0.28.20",
     "vitest": "^4.1.10",
+    "vitest-openapi": "^1.0.3",
     "vue": "3.5.35",
     "vue-router": "^5.2.0",
     "vue-tsc": "^3.3.9"
+  },
+  "scripts": {
+    "dev": "nuxt dev",
+    "build": "nuxt build",
+    "build:packages": "pnpm -F @michaelthielemann/kestrel-contracts build && pnpm -F @michaelthielemann/kestrel-core build && pnpm -F @michaelthielemann/kestrel-fields build && pnpm -F @michaelthielemann/kestrel-auth build && pnpm -F @michaelthielemann/kestrel-access build && pnpm -F @michaelthielemann/kestrel-media build && pnpm -F @michaelthielemann/kestrel-collections build && pnpm -F @michaelthielemann/kestrel-publishing build && pnpm -F @michaelthielemann/kestrel-delivery-live build && pnpm -F @michaelthielemann/kestrel-delivery-static build",
+    "preview": "nuxt preview",
+    "generate": "nuxt generate",
+    "db:generate": "drizzle-kit generate",
+    "db:migrate": "drizzle-kit migrate",
+    "test": "vitest run",
+    "test:coverage": "node scripts/coverage-all.mjs",
+    "test:watch": "vitest",
+    "test:e2e": "vitest run --config vitest.e2e.config.ts",
+    "test:nuxt": "vitest run --config vitest.nuxt.config.ts",
+    "test:packages": "pnpm --filter \"@michaelthielemann/kestrel-*\" -r test",
+    "typecheck": "node scripts/typecheck.mjs",
+    "typecheck:packages": "pnpm --filter \"@michaelthielemann/kestrel-*\" -r typecheck",
+    "lint": "nuxt prepare playground && eslint .",
+    "docs:api": "nuxt prepare playground && typedoc",
+    "api:check": "pnpm -F @michaelthielemann/kestrel-contracts build && api-extractor run -c packages/kestrel-contracts/api-extractor.json && pnpm -F @michaelthielemann/kestrel-core build && api-extractor run -c packages/kestrel-core/api-extractor.json && api-extractor run -c packages/kestrel-core/api-extractor.client.json && pnpm -F @michaelthielemann/kestrel-fields build && api-extractor run -c packages/kestrel-fields/api-extractor.json && api-extractor run -c packages/kestrel-fields/api-extractor.client.json && pnpm -F @michaelthielemann/kestrel-auth build && api-extractor run -c packages/kestrel-auth/api-extractor.json && pnpm -F @michaelthielemann/kestrel-access build && api-extractor run -c packages/kestrel-access/api-extractor.json && pnpm -F @michaelthielemann/kestrel-media build && api-extractor run -c packages/kestrel-media/api-extractor.json && pnpm -F @michaelthielemann/kestrel-collections build && api-extractor run -c packages/kestrel-collections/api-extractor.json && pnpm -F @michaelthielemann/kestrel-publishing build && api-extractor run -c packages/kestrel-publishing/api-extractor.json && pnpm -F @michaelthielemann/kestrel-delivery-live build && api-extractor run -c packages/kestrel-delivery-live/api-extractor.json && pnpm -F @michaelthielemann/kestrel-delivery-static build && api-extractor run -c packages/kestrel-delivery-static/api-extractor.json",
+    "api:update": "pnpm -F @michaelthielemann/kestrel-contracts build && api-extractor run --local -c packages/kestrel-contracts/api-extractor.json && pnpm -F @michaelthielemann/kestrel-core build && api-extractor run --local -c packages/kestrel-core/api-extractor.json && api-extractor run --local -c packages/kestrel-core/api-extractor.client.json && pnpm -F @michaelthielemann/kestrel-fields build && api-extractor run --local -c packages/kestrel-fields/api-extractor.json && api-extractor run --local -c packages/kestrel-fields/api-extractor.client.json && pnpm -F @michaelthielemann/kestrel-auth build && api-extractor run --local -c packages/kestrel-auth/api-extractor.json && pnpm -F @michaelthielemann/kestrel-access build && api-extractor run --local -c packages/kestrel-access/api-extractor.json && pnpm -F @michaelthielemann/kestrel-media build && api-extractor run --local -c packages/kestrel-media/api-extractor.json && pnpm -F @michaelthielemann/kestrel-collections build && api-extractor run --local -c packages/kestrel-collections/api-extractor.json && pnpm -F @michaelthielemann/kestrel-publishing build && api-extractor run --local -c packages/kestrel-publishing/api-extractor.json && pnpm -F @michaelthielemann/kestrel-delivery-live build && api-extractor run --local -c packages/kestrel-delivery-live/api-extractor.json && pnpm -F @michaelthielemann/kestrel-delivery-static build && api-extractor run --local -c packages/kestrel-delivery-static/api-extractor.json",
+    "pkg:lint": "publint . && pnpm -F @michaelthielemann/kestrel-contracts build && publint packages/kestrel-contracts && attw --pack packages/kestrel-contracts --profile esm-only && pnpm -F @michaelthielemann/kestrel-core build && publint packages/kestrel-core && attw --pack packages/kestrel-core --profile esm-only && pnpm -F @michaelthielemann/kestrel-fields build && publint packages/kestrel-fields && attw --pack packages/kestrel-fields --profile esm-only && pnpm -F @michaelthielemann/kestrel-auth build && publint packages/kestrel-auth && attw --pack packages/kestrel-auth --profile esm-only && pnpm -F @michaelthielemann/kestrel-access build && publint packages/kestrel-access && attw --pack packages/kestrel-access --profile esm-only && pnpm -F @michaelthielemann/kestrel-media build && publint packages/kestrel-media && attw --pack packages/kestrel-media --profile esm-only && pnpm -F @michaelthielemann/kestrel-collections build && publint packages/kestrel-collections && attw --pack packages/kestrel-collections --profile esm-only && pnpm -F @michaelthielemann/kestrel-publishing build && publint packages/kestrel-publishing && attw --pack packages/kestrel-publishing --profile esm-only && pnpm -F @michaelthielemann/kestrel-delivery-live build && publint packages/kestrel-delivery-live && attw --pack packages/kestrel-delivery-live --profile esm-only && pnpm -F @michaelthielemann/kestrel-delivery-static build && publint packages/kestrel-delivery-static && attw --pack packages/kestrel-delivery-static --profile esm-only",
+    "ci:consumer-template": "node scripts/consumer-template-ci.mjs",
+    "dashboard": "npx tsx scripts/dashboard.mjs",
+    "hash-password": "node scripts/hash-password.mjs"
   }
-}
+}

package/scripts/consumer-template-ci.mjs

@@ -0,0 +1,157 @@
+// The ONLY real package-consumption test. Every earlier gate (api:check, pkg:lint) inspects one
+// package's own tarball in isolation; this script is the one that scaffolds an actual consumer from
+// templates/starter (via create-kestrel's real CLI), packs the engine + every @michaelthielemann/kestrel-* package the way
+// `npm publish` would, installs them into that consumer with a real `npm install` (no workspace protocol,
+// no symlinks back into this repo), builds it, boots the production server, and hits it over real HTTP.
+//
+// Local: `pnpm ci:consumer-template`. CI: the `consumer-template` job in .github/workflows/ci.yml.
+import { execFileSync, spawn } from 'node:child_process'
+import { mkdtempSync, mkdirSync, readFileSync, writeFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { setTimeout as sleep } from 'node:timers/promises'
+
+const root = process.cwd()
+const log = (msg) => console.log(`[consumer-template-ci] ${msg}`)
+const run = (cmd, args, opts = {}) => execFileSync(cmd, args, { stdio: 'inherit', ...opts })
+
+// @michaelthielemann/kestrel-* in the order `pnpm --filter "@michaelthielemann/kestrel-*" -r exec` resolves them (a real topological walk of
+// the workspace graph, not a hand guess) — mirrors the publish order in .github/workflows/release.yml.
+const PACKAGES = ['contracts', 'core', 'auth', 'access', 'fields', 'collections', 'media', 'publishing', 'delivery-live', 'delivery-static']
+
+const work = mkdtempSync(join(tmpdir(), 'kestrel-consumer-ci-'))
+const tarballDir = join(work, 'tarballs')
+const consumerDir = join(work, 'site')
+mkdirSync(tarballDir, { recursive: true })
+log(`work dir: ${work}`)
+
+let server
+try {
+  log('building @michaelthielemann/kestrel-* packages (dist/ must exist before pnpm pack)')
+  run('pnpm', ['--filter', '@michaelthielemann/kestrel-*', '-r', 'build'], { cwd: root })
+
+  log('packing the engine + every @michaelthielemann/kestrel-* package as npm publish would')
+  const tarball = {}
+  for (const dir of ['.', ...PACKAGES.map((n) => `packages/kestrel-${n}`)]) {
+    const out = execFileSync('pnpm', ['pack', '--pack-destination', tarballDir], { cwd: join(root, dir) }).toString().trim()
+    const file = out.split('\n').pop().trim()
+    const name = JSON.parse(readFileSync(join(root, dir, 'package.json'), 'utf8')).name
+    tarball[name] = file
+    log(`  ${name} -> ${file}`)
+  }
+
+  log('scaffolding a consumer from templates/starter via the real create-kestrel CLI')
+  const password = 'consumer-ci-password'
+  run('node', [join(root, 'packages/create-kestrel/index.mjs'), consumerDir, '--yes', '--password', password], { cwd: work })
+
+  log('pointing the scaffolded package.json at the packed tarballs (no registry, no workspace protocol)')
+  const pkgPath = join(consumerDir, 'package.json')
+  const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
+  pkg.dependencies['@michaelthielemann/kestrel'] = `file:${tarball['@michaelthielemann/kestrel']}`
+  // npm's `overrides` redirects a dependency AT ANY DEPTH — the engine tarball's own manifest declares
+  // "@michaelthielemann/kestrel-core": "0.1.0" etc. (pnpm pack already rewrote the workspace:* protocol to that real
+  // version), which would otherwise 404 against the real registry since these packages are not published
+  // yet in this checkout's tag. This is what actually forces npm's resolver to read each package's real
+  // `exports` map / `main` / `types` from a standalone tarball, the same way a real end user's install
+  // would — not a symlink into this repo's own packages/*/src.
+  pkg.overrides = Object.fromEntries(PACKAGES.map((n) => [`@michaelthielemann/kestrel-${n}`, `file:${tarball[`@michaelthielemann/kestrel-${n}`]}`]))
+  writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`)
+
+  // The runner's ambient npm (10.9.8 as of this writing) hits a real npm/arborist bug resolving nuxt's
+  // large optional-peer set (`TypeError: Cannot read properties of null (reading 'edgesOut')`, inside
+  // `#loadPeerSet`) — reproduced directly, unrelated to anything this script does. npm >= 11 does not
+  // have it. `npx --yes npm@11` sidesteps needing a global npm upgrade (which needs root the runner may
+  // not have) while still using real npm, not pnpm.
+  log('npm install (real npm 11 via npx — the most representative simulation of an actual end user)')
+  run('npx', ['--yes', 'npm@11', 'install'], { cwd: consumerDir })
+
+  log('verifying no @michaelthielemann/kestrel-* dependency resolved back into this repo (would prove nothing)')
+  for (const n of PACKAGES) {
+    let resolved = ''
+    try {
+      resolved = execFileSync('npm', ['ls', `@michaelthielemann/kestrel-${n}`, '--json'], { cwd: consumerDir }).toString()
+    } catch (err) {
+      // `npm ls` exits non-zero on a peer-dep mismatch warning even when the tree itself resolved fine;
+      // its stdout (on the error object) still carries the real tree, which is what matters here.
+      resolved = err.stdout?.toString() ?? ''
+    }
+    if (resolved.includes(root)) throw new Error(`@michaelthielemann/kestrel-${n} resolved into ${root} — the override did not take effect`)
+  }
+
+  log('reading the .env create-kestrel wrote (session secret + admin password hash)')
+  const env = Object.fromEntries(
+    readFileSync(join(consumerDir, '.env'), 'utf8')
+      .split('\n')
+      .map((l) => /^([A-Z][A-Z0-9_]*)=(.*)$/.exec(l))
+      .filter(Boolean)
+      .map((m) => [m[1], m[2]]),
+  )
+  // KESTREL_SECURE_COOKIES=false is what create-kestrel writes for a brand-new site (local http dev) —
+  // the app itself refuses it under a production boot ("KESTREL_SECURE_COOKIES=false is not allowed in
+  // production"), which is the correct, secure-by-default behavior, not a bug this script should route
+  // around by keeping the flag. Unset it; the production default is secure.
+  delete env.KESTREL_SECURE_COOKIES
+
+  const devPort = 41822
+  log('nuxt dev (brief boot, then kill) — schema auto-syncs additively at dev boot; a production boot never touches it (by design), so this is what a real `pnpm dev` first run also does')
+  const dev = spawn('npx', ['nuxt', 'dev', '--port', String(devPort)], {
+    cwd: consumerDir,
+    env: { ...process.env, ...env },
+    stdio: 'inherit',
+  })
+  try {
+    await waitForServer(`http://localhost:${devPort}/robots.txt`, 60000)
+  } finally {
+    dev.kill()
+    await sleep(1000) // let the dev Nitro process release the sqlite file before the production build reopens it
+  }
+
+  log('nuxt build (production) — the real exports-map/deps resolution surface, not a dev-mode shortcut')
+  run('npx', ['nuxt', 'build'], { cwd: consumerDir, env: { ...process.env, ...env } })
+
+  log('booting the built server and hitting it over real HTTP')
+  const port = 41823
+  server = spawn('node', [join(consumerDir, '.output/server/index.mjs')], {
+    cwd: consumerDir,
+    env: { ...process.env, ...env, PORT: String(port), NITRO_PORT: String(port) },
+    stdio: 'inherit',
+  })
+  await waitForServer(`http://localhost:${port}/robots.txt`, 30000)
+
+  const checks = [
+    ['GET /robots.txt', `http://localhost:${port}/robots.txt`, 200],
+    ['GET /sitemap.xml', `http://localhost:${port}/sitemap.xml`, 200],
+    ['GET /admin (login page, SPA shell)', `http://localhost:${port}/admin`, 200],
+  ]
+  for (const [label, url, wantStatus] of checks) {
+    const res = await fetch(url)
+    if (res.status !== wantStatus) throw new Error(`${label} -> ${res.status}, expected ${wantStatus}`)
+    log(`  ${label} -> ${res.status} OK`)
+  }
+
+  const loginRes = await fetch(`http://localhost:${port}/api/login`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ password }),
+  })
+  if (loginRes.status !== 200) throw new Error(`POST /api/login -> ${loginRes.status}, expected 200 (the packed admin auth stack did not resolve)`)
+  log('  POST /api/login -> 200 OK (the packed @michaelthielemann/kestrel-auth + @michaelthielemann/kestrel-access stack authenticates for real)')
+
+  log('PASS — a real npm install of the packed engine + packages boots and serves under production, and login round-trips through the packed auth stack.')
+} finally {
+  server?.kill()
+  if (!process.env.KEEP_CONSUMER_TEMPLATE_CI_WORKDIR) rmSync(work, { recursive: true, force: true })
+  else log(`KEEP_CONSUMER_TEMPLATE_CI_WORKDIR set — leaving ${work} in place`)
+}
+
+async function waitForServer(url, timeoutMs) {
+  const deadline = Date.now() + timeoutMs
+  for (;;) {
+    try {
+      const res = await fetch(url)
+      if (res.status) return
+    } catch { /* not up yet */ }
+    if (Date.now() > deadline) throw new Error(`server did not come up at ${url} within ${timeoutMs}ms`)
+    await sleep(250)
+  }
+}