@michaelthielemann/kestrel 3.0.1 → 4.0.0

package/layers/auth/server/utils/client-ip.ts

@@ -1,88 +0,0 @@
-import { getRequestIP, getRequestHeader } from 'h3'
-import type { H3Event } from 'h3'
-
-type Env = Record<string, string | undefined>
-
-/**
- * How many reverse-proxy hops to trust in front of the app, parsed from `KESTREL_TRUST_PROXY`.
- *
- * Default **0** == trust nothing == ignore `X-Forwarded-For` entirely (without a proxy in front, XFF is
- * fully attacker-controlled). `true`/`on`/`yes`/`1` == one trusted proxy; a positive integer == that many
- * chained trusted proxies (e.g. CDN → load balancer). Anything else (`false`/`0`/blank/garbage) == 0.
- */
-export function trustProxyDepth(env: Env = process.env): number {
-  const raw = (env.KESTREL_TRUST_PROXY ?? '').trim().toLowerCase()
-  if (!raw) return 0
-  if (raw === 'true' || raw === 'on' || raw === 'yes') return 1
-  const n = Number(raw)
-  return Number.isInteger(n) && n > 0 ? n : 0
-}
-
-/**
- * Pick the client address from an `X-Forwarded-For` chain, counting `depth` hops from the RIGHT.
- *
- * XFF is appended left-to-right (`client, proxy1, proxy2`), so the entries a client can forge sit on the
- * LEFT and the right-most entry is the address our nearest trusted proxy actually observed. With one
- * trusted proxy (depth 1) we take the right-most entry; with N chained trusted proxies we skip the N-1
- * proxy hops and take the Nth-from-right. (h3's own `getRequestIP({ xForwardedFor: true })` takes the
- * LEFT-most — spoofable — value, which is exactly why we don't use it.)
- *
- * If the chain is shorter than the trusted depth, it didn't traverse the expected proxies → untrustworthy,
- * so we return `undefined` and let the caller fall back to the socket peer rather than honour a forged value.
- */
-export function forwardedForHop(header: string | undefined, depth: number): string | undefined {
-  if (depth < 1) return undefined
-  const parts = (header ?? '').split(',').map((s) => s.trim()).filter(Boolean)
-  const idx = parts.length - depth
-  return idx >= 0 ? parts[idx] : undefined
-}
-
-/**
- * The client IP used to key the login throttle.
- *
- * Trusting `X-Forwarded-For` unconditionally lets a direct client rotate the header to dodge the per-IP
- * limit, so by default we key on the socket peer address and ignore XFF. Only when `KESTREL_TRUST_PROXY`
- * declares a trusted proxy depth do we honour the correct (right-most) XFF hop; a missing/too-short chain
- * still falls back to the peer.
- */
-export function clientIp(event: H3Event, env: Env = process.env): string {
-  const depth = trustProxyDepth(env)
-  if (depth > 0) {
-    const forwarded = forwardedForHop(getRequestHeader(event, 'x-forwarded-for'), depth)
-    if (forwarded) return forwarded
-  }
-  return getRequestIP(event) ?? 'unknown'
-}
-
-/** Expand a syntactically valid IPv6 address (optionally `::`-compressed) into its 8 hextets, or `null`. */
-function ipv6Hextets(ip: string): string[] | null {
-  const compressAt = ip.indexOf('::')
-  if (compressAt === -1) {
-    const groups = ip.split(':')
-    return groups.length === 8 ? groups : null
-  }
-  if (ip.indexOf('::', compressAt + 1) !== -1) return null // more than one '::' is not valid IPv6
-  const left = ip.slice(0, compressAt)
-  const right = ip.slice(compressAt + 2)
-  const leftGroups = left === '' ? [] : left.split(':')
-  const rightGroups = right === '' ? [] : right.split(':')
-  const missing = 8 - leftGroups.length - rightGroups.length
-  if (missing < 0) return null
-  return [...leftGroups, ...Array(missing).fill('0'), ...rightGroups]
-}
-
-/**
- * The key used to bucket the login throttle: an IPv4 (and IPv4-mapped `::ffff:a.b.c.d`) address stays a
- * full /32 — NAT already shares those legitimately, so widening the bucket there would throttle unrelated
- * users behind the same NAT. A real IPv6 address is coarsened to its first four hextets (a /64), the block
- * an ISP typically routes to a single customer — otherwise an attacker on a routed /64 binds a fresh source
- * address per request and `recentFails` never sees the same key twice, so the throttle bounds nothing.
- * Anything that isn't well-formed IPv4 or IPv6 (including the `unknown` fallback) is returned unchanged,
- * which is only ever as permissive as the pre-existing full-address key.
- */
-export function throttleKey(ip: string): string {
-  if (ip.includes('.') || !ip.includes(':')) return ip
-  const hextets = ipv6Hextets(ip)
-  if (!hextets) return ip
-  return hextets.slice(0, 4).join(':') + '::/64'
-}

package/layers/auth/server/utils/login-throttle.ts

@@ -1,126 +0,0 @@
-import { createError } from 'h3'
-
-export const MAX_LOGIN_BODY = 4096
-export const MAX_INFLIGHT_HASHES = 4
-
-export function assertBodyLimit(contentLength: string | undefined, maxBytes = MAX_LOGIN_BODY): void {
-  const len = Number(contentLength)
-  // A missing/garbage Content-Length means a chunked transfer, which readBody would buffer with no
-  // ceiling — refuse it. The only legitimate login body is a tiny JSON object with a known length.
-  if (contentLength === undefined || !Number.isFinite(len) || len < 0) {
-    throw createError({ statusCode: 411, statusMessage: 'Length required' })
-  }
-  if (len > maxBytes) {
-    throw createError({ statusCode: 413, statusMessage: 'Payload too large' })
-  }
-}
-
-export const MAX_LOGIN_FAILS = 10
-export const LOGIN_WINDOW_MS = 15 * 60 * 1000
-// Hard ceiling on the number of distinct IPs tracked at once. A login POST is anonymously reachable and
-// seeds an entry BEFORE the expensive scrypt runs, so without a bound a spray from many distinct source
-// addresses (e.g. a routed IPv6 /64 or a botnet) could grow this map without limit and OOM the process.
-// Generous vs any real login volume for a single-admin CMS; eviction (below) keeps memory bounded.
-export const MAX_TRACKED_IPS = 10_000
-
-// Per-IP failed-attempt timestamps (in-memory, per-process: resets on restart, fine for a
-// single-instance private CMS). Bounds online brute-force; the admin password entropy is the
-// primary defense. The keying IP comes from `clientIp` (socket peer by default; trusted
-// X-Forwarded-For hop only when KESTREL_TRUST_PROXY is set). Bounded by MAX_TRACKED_IPS + eviction.
-const loginFails = new Map<string, number[]>()
-
-function recentFails(ip: string, nowMs: number): number[] {
-  const fresh = (loginFails.get(ip) ?? []).filter((t) => nowMs - t < LOGIN_WINDOW_MS)
-  // DELETE rather than persist an empty array: an IP whose failures have all aged out (or that only ever
-  // hit the read-path lockout check) must not leave a permanent entry — otherwise a distinct-IP flood of
-  // one-shot addresses grows the map forever (every key would be reclaimed only by a *successful* login).
-  if (fresh.length === 0) loginFails.delete(ip)
-  else loginFails.set(ip, fresh)
-  return fresh
-}
-
-/** Reclaim every entry whose newest failure has aged past the window (a cheap sweep run under pressure). */
-function evictExpired(nowMs: number): void {
-  for (const [ip, times] of loginFails) {
-    const newest = times[times.length - 1]
-    if (newest === undefined || nowMs - newest >= LOGIN_WINDOW_MS) loginFails.delete(ip)
-  }
-}
-
-export function assertNotLockedOut(ip: string, nowMs: number): void {
-  if (recentFails(ip, nowMs).length >= MAX_LOGIN_FAILS) {
-    throw createError({ statusCode: 429, statusMessage: 'Too many attempts, try again later' })
-  }
-}
-
-export function recordFailedLogin(ip: string, nowMs: number): void {
-  const fails = recentFails(ip, nowMs)
-  fails.push(nowMs)
-  loginFails.set(ip, fails)
-  // Enforce the ceiling: first reclaim anything already expired, then, if still over budget, evict the
-  // oldest-inserted entries (Map preserves insertion order → FIFO). Evicting a live entry merely resets that
-  // IP's throttle — acceptable under memory pressure; the primary brute-force defense is password entropy.
-  if (loginFails.size > MAX_TRACKED_IPS) {
-    evictExpired(nowMs)
-    while (loginFails.size > MAX_TRACKED_IPS) {
-      const oldest = loginFails.keys().next().value
-      if (oldest === undefined) break
-      loginFails.delete(oldest)
-    }
-  }
-}
-
-export function clearLoginFailures(ip: string): void {
-  loginFails.delete(ip)
-}
-
-/** Test/introspection helpers: current tracked-IP count and a full reset (the store is a module singleton). */
-export function loginFailIpCount(): number {
-  return loginFails.size
-}
-export function clearAllLoginFailures(): void {
-  loginFails.clear()
-}
-
-/**
- * Atomically reserve a login attempt: assert the IP isn't locked out AND record the attempt in one
- * synchronous step (no await between the check and the record). This makes the throttle a true
- * reservation — concurrent in-flight guesses, each awaiting a slow scrypt verify, all count toward the
- * cap up front, instead of every one passing the gate on the same pre-increment count. The handler
- * clears the reservation on a successful login; a failed login leaves it recorded.
- */
-export function reserveLoginAttempt(ip: string, nowMs: number): void {
-  assertNotLockedOut(ip, nowMs)
-  recordFailedLogin(ip, nowMs)
-}
-
-/**
- * Undo a `reserveLoginAttempt` reservation for an outage no caller could have caused or guessed past (no
- * admin hash configured) — otherwise a misconfigured deployment leaves the admin throttled once they fix
- * it. Deliberately NOT used for attacker-triggerable rejections: charging those is what makes a flood run
- * into the lockout. Removes one entry equal to `nowMs` (there is at most one per call, recorded
- * synchronously by the reservation this undoes; entries are interchangeable by value, so it doesn't
- * matter which one a concurrent same-millisecond request added).
- */
-export function releaseLoginAttempt(ip: string, nowMs: number): void {
-  const fails = loginFails.get(ip)
-  if (!fails) return
-  const idx = fails.lastIndexOf(nowMs)
-  if (idx === -1) return
-  fails.splice(idx, 1)
-  if (fails.length === 0) loginFails.delete(ip)
-  else loginFails.set(ip, fails)
-}
-
-let inFlight = 0
-
-export function acquireHashSlot(): void {
-  if (inFlight >= MAX_INFLIGHT_HASHES) {
-    throw createError({ statusCode: 503, statusMessage: 'Busy, try again' })
-  }
-  inFlight++
-}
-
-export function releaseHashSlot(): void {
-  if (inFlight > 0) inFlight--
-}

package/layers/auth/server/utils/password.ts

@@ -1,52 +0,0 @@
-import { scrypt, randomBytes, timingSafeEqual } from 'node:crypto'
-import { promisify } from 'node:util'
-
-const scryptAsync = promisify(scrypt) as (
-  password: string | Buffer,
-  salt: string | Buffer,
-  keylen: number,
-  options: { N: number; r: number; p: number; maxmem: number },
-) => Promise<Buffer>
-
-const N = 2 ** 17
-const R = 8
-const P = 1
-const KEYLEN = 64
-const MAXMEM = 256 * 1024 * 1024
-
-export async function hashPassword(password: string): Promise<string> {
-  const salt = randomBytes(16)
-  const hash = await scryptAsync(password, salt, KEYLEN, { N, r: R, p: P, maxmem: MAXMEM })
-  return `scrypt$${N}$${R}$${P}$${salt.toString('base64url')}$${hash.toString('base64url')}`
-}
-
-export async function verifyPassword(password: string, stored: string): Promise<boolean> {
-  const parts = stored.split('$')
-  if (parts.length !== 6 || parts[0] !== 'scrypt') return false
-  const n = Number(parts[1])
-  const r = Number(parts[2])
-  const p = Number(parts[3])
-  if (!Number.isInteger(n) || !Number.isInteger(r) || !Number.isInteger(p)) return false
-
-  let salt: Buffer
-  let expected: Buffer
-  try {
-    salt = Buffer.from(parts[4], 'base64url')
-    expected = Buffer.from(parts[5], 'base64url')
-  } catch {
-    return false
-  }
-  if (expected.length === 0) return false
-
-  let actual: Buffer
-  try {
-    actual = await scryptAsync(password, salt, expected.length, { N: n, r, p, maxmem: MAXMEM })
-  } catch {
-    return false
-  }
-  if (actual.length !== expected.length) {
-    timingSafeEqual(actual, actual)
-    return false
-  }
-  return timingSafeEqual(actual, expected)
-}

package/layers/auth/server/utils/session-cookie.ts

@@ -1,44 +0,0 @@
-import { getCookie, setCookie, type H3Event } from 'h3'
-import { signSession, verifySession, sessionSettings, shouldRefreshSession } from './session'
-
-/** Shared session-cookie attributes; only `maxAge` differs between set and clear. */
-const baseCookieOptions = (secure: boolean) => ({
-  httpOnly: true,
-  secure,
-  sameSite: 'strict' as const,
-  path: '/',
-})
-
-export function setAuthSession(event: H3Event): number {
-  const { secret, maxAge, secureCookies, cookieName } = sessionSettings()
-  const exp = Date.now() + maxAge * 1000
-  setCookie(event, cookieName, signSession(secret, exp), { ...baseCookieOptions(secureCookies), maxAge })
-  return exp
-}
-
-export function clearAuthSession(event: H3Event): void {
-  const { secureCookies, cookieName } = sessionSettings()
-  setCookie(event, cookieName, '', { ...baseCookieOptions(secureCookies), maxAge: 0 })
-}
-
-export function getAuthSession(event: H3Event): { authenticated: boolean; exp?: number } {
-  const { secret, cookieName } = sessionSettings()
-  const result = verifySession(secret, getCookie(event, cookieName), Date.now())
-  return result.valid ? { authenticated: true, exp: result.exp } : { authenticated: false }
-}
-
-/**
- * Sliding-expiry: on an authenticated request whose session has passed the halfway point of the idle
- * window, re-issue the cookie with a fresh exp — so activity keeps the admin logged in and inactivity
- * longer than `maxAge` auto-logs-out (the cookie AND the embedded exp lapse). No-op when there is no valid
- * session cookie (anonymous / public requests), so it is safe to call unconditionally on every request.
- */
-export function refreshAuthSession(event: H3Event): void {
-  const { secret, maxAge, secureCookies, cookieName } = sessionSettings()
-  const now = Date.now()
-  const current = verifySession(secret, getCookie(event, cookieName), now)
-  if (!current.valid || current.exp === undefined) return
-  if (!shouldRefreshSession(current.exp, now, maxAge * 1000)) return
-  const exp = now + maxAge * 1000
-  setCookie(event, cookieName, signSession(secret, exp), { ...baseCookieOptions(secureCookies), maxAge })
-}

package/layers/auth/server/utils/session-epoch.ts

@@ -1,96 +0,0 @@
-import { readFileSync, writeFileSync, mkdirSync, statSync } from 'node:fs'
-import { dirname, join } from 'node:path'
-import { resolveServerKestrel, serverRuntimeConfig } from '../../../core/server/utils/server-config'
-
-// The session REVOCATION epoch: a monotonic counter folded into the signing key (see deriveSigningKey), so
-// bumping it invalidates every outstanding token at once — the stateless model's server-side "hard logout".
-// Persisted to a file in the data dir so it survives a restart. Cached in-process, but the cache is
-// mtime-validated on read, so a bump by a SIBLING process (a `db:migrate` task, a second worker, a CLI
-// force-logout) is observed on the next request instead of only after a restart.
-
-let cached: number | undefined
-let cachedMtimeMs = -1
-
-/** Where the epoch persists: `KESTREL_SESSION_EPOCH_FILE`, else next to the DB. Null for a `:memory:` DB
- *  (tests) → the epoch still works in-process, it just doesn't survive a restart. */
-function epochPath(): string | null {
-  const override = process.env.KESTREL_SESSION_EPOCH_FILE?.trim()
-  if (override) return override
-  // Resolve the DB the same way useDb() does — the consumer's `kestrel: { db }` via runtimeConfig first,
-  // Kestrel's own config + env only as the non-Nitro fallback. Landing anywhere else would put revocation
-  // state outside the volume the operator persists, so a restart would resurrect revoked sessions.
-  const fromRc = serverRuntimeConfig()?.kestrel as { dbPath?: string } | undefined
-  const dbPath = fromRc?.dbPath || resolveServerKestrel().dbPath
-  if (!dbPath || dbPath === ':memory:') return null
-  return join(dirname(dbPath), '.kestrel-session-epoch')
-}
-
-/** `null` means "couldn't tell" (unreadable, or present but not a valid epoch) — distinct from the genuine
- *  ENOENT baseline of 0, so a caller never mistakes "the file is broken" for "never revoked". */
-function readEpoch(path: string): number | null {
-  let raw: string
-  try {
-    raw = readFileSync(path, 'utf8')
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException)?.code === 'ENOENT') return 0
-    console.error('[kestrel auth] could not read the session epoch file (keeping the last known epoch):', (error as Error)?.message ?? error)
-    return null
-  }
-  const n = parseInt(raw.trim(), 10)
-  if (Number.isFinite(n) && n >= 0) return n
-  console.error(`[kestrel auth] session epoch file has unreadable content, ignoring it (keeping the last known epoch): ${JSON.stringify(raw.slice(0, 40))}`)
-  return null
-}
-
-/** The file's mtime in ms, or -1 when absent/unreadable (a stable sentinel distinct from any real mtime). */
-function epochMtime(path: string): number {
-  try {
-    return statSync(path).mtimeMs
-  } catch {
-    return -1
-  }
-}
-
-/** The current epoch. Cached in-process, but re-read from the file whenever its mtime moved — so a
- *  cross-process bump takes effect on the next call, not only after a restart. The stat is one cheap
- *  syscall per request (no content read on the common unchanged path). */
-export function currentSessionEpoch(): number {
-  const path = epochPath()
-  if (!path) {
-    // No persistence (`:memory:`): the in-process bump is the only source of truth.
-    if (cached === undefined) cached = 0
-    return cached
-  }
-  const mtime = epochMtime(path)
-  if (cached === undefined || mtime !== cachedMtimeMs) {
-    // A `null` read (broken file) must never regress an already-higher in-process value — take the max
-    // rather than adopting it outright, the same guard bumpSessionEpoch already applies to its own re-read.
-    cached = Math.max(cached ?? 0, readEpoch(path) ?? 0)
-    cachedMtimeMs = mtime
-  }
-  return cached
-}
-
-/** Revoke every currently-issued session (logout / force-logout): increment + persist the epoch so the
- *  derived signing key changes and all outstanding tokens fail verification immediately. Best-effort
- *  persistence — a failed write still revokes for this process's lifetime (the in-process bump). */
-export function bumpSessionEpoch(): void {
-  const next = currentSessionEpoch() + 1
-  cached = next
-  const path = epochPath()
-  if (!path) return
-  try {
-    mkdirSync(dirname(path), { recursive: true })
-    writeFileSync(path, String(next), 'utf8')
-    // Re-read AFTER writing and take the max: a sibling process may have written a HIGHER epoch between our
-    // write and this read. The epoch is monotonic, so max is correct — and it closes the write→stat TOCTOU
-    // where adopting only our own mtime+value could permanently mask a concurrent revocation.
-    cached = Math.max(next, readEpoch(path) ?? 0)
-    cachedMtimeMs = epochMtime(path)
-  } catch (error) {
-    console.error('[kestrel auth] could not persist session epoch (revocation holds for this process only):', (error as Error)?.message ?? error)
-  }
-}
-
-/** Test hook: drop the in-process cache so a test controls the epoch via its file/env. */
-export function _resetSessionEpochCache(): void { cached = undefined; cachedMtimeMs = -1 }

package/layers/auth/server/utils/session.ts

@@ -1,88 +0,0 @@
-import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto'
-import { currentSessionEpoch } from './session-epoch'
-
-export function deriveSigningKey(rawSecret: string, passwordHash?: string, epoch = 0): string {
-  // The `epoch` is a server-side revocation counter: bumping it (on logout / force-logout) changes the key
-  // so every previously-issued token fails verification immediately — the stateless model's "hard logout".
-  return createHmac('sha256', rawSecret).update('kestrel-session-v1').update(passwordHash ?? '').update(`e${epoch}`).digest('base64url')
-}
-
-export function signSession(secret: string, expMs: number): string {
-  const payload = Buffer.from(JSON.stringify({ exp: expMs })).toString('base64url')
-  const sig = createHmac('sha256', secret).update(payload).digest('base64url')
-  return `${payload}.${sig}`
-}
-
-export function verifySession(secret: string, value: string | undefined, nowMs: number): { valid: boolean; exp?: number } {
-  if (!value || typeof value !== 'string') return { valid: false }
-  const dot = value.indexOf('.')
-  if (dot <= 0 || dot === value.length - 1) return { valid: false }
-  const payload = value.slice(0, dot)
-  const sig = value.slice(dot + 1)
-  const expected = createHmac('sha256', secret).update(payload).digest('base64url')
-  const sigBuf = Buffer.from(sig)
-  const expBuf = Buffer.from(expected)
-  if (sigBuf.length !== expBuf.length || !timingSafeEqual(sigBuf, expBuf)) return { valid: false }
-  let exp: unknown
-  try {
-    exp = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8')).exp
-  } catch {
-    return { valid: false }
-  }
-  if (typeof exp !== 'number' || exp <= nowMs) return { valid: false }
-  return { valid: true, exp }
-}
-
-/**
- * Sliding-expiry decision: refresh the session cookie once its remaining lifetime drops below HALF the
- * idle window. Activity within the window keeps the session alive (each refresh resets exp to now+maxAge);
- * inactivity longer than the window lets it expire → the admin must log in again. The halfway threshold
- * bounds Set-Cookie churn to at most once per half-window instead of on every request.
- */
-export function shouldRefreshSession(exp: number, nowMs: number, maxAgeMs: number): boolean {
-  return exp - nowMs < maxAgeMs / 2
-}
-
-let devSecret: string | undefined
-
-export interface SessionSettings {
-  secret: string
-  maxAge: number
-  secureCookies: boolean
-  cookieName: string
-}
-
-export function sessionSettings({ prerender = import.meta.prerender === true } = {}): SessionSettings {
-  // Treat anything that isn't an EXPLICIT dev signal as production for these safeguards, so a deployment
-  // that simply omits NODE_ENV (a common slip when launching `.output/server/index.mjs`) is hardened —
-  // not silently downgraded to dev, which would tolerate a missing secret + non-Secure cookies. Vitest
-  // sets NODE_ENV=test; KESTREL_DEV=1 is an explicit escape hatch for other dev contexts.
-  const explicitDev = process.env.NODE_ENV === 'development' || process.env.NODE_ENV === 'test' || process.env.KESTREL_DEV === '1'
-  const isProd = !explicitDev
-  const secureCookies = process.env.KESTREL_SECURE_COOKIES !== 'false'
-  // `nuxt generate` prerenders every page through `/api/route`, which passes the access guard and lands
-  // here with NODE_ENV=production. A prerender request never issues a cookie, so enforcing the flag there
-  // only means a dev `.env` silently drops pages from the static output.
-  if (isProd && !secureCookies && !prerender) {
-    throw new Error('KESTREL_SECURE_COOKIES=false is not allowed in production')
-  }
-  const rawMaxAge = Number(process.env.KESTREL_SESSION_MAX_AGE)
-  const maxAge = Number.isFinite(rawMaxAge) && rawMaxAge > 0 ? rawMaxAge : 604800
-  let secret = process.env.KESTREL_SESSION_SECRET
-  if (!secret) {
-    if (isProd) throw new Error('KESTREL_SESSION_SECRET is required in production')
-    if (!devSecret) {
-      devSecret = randomBytes(32).toString('base64url')
-      console.warn('[kestrel auth] KESTREL_SESSION_SECRET not set — using a random per-process dev secret; sessions reset on restart')
-    }
-    secret = devSecret
-  } else if (isProd && Buffer.byteLength(secret) < 32) {
-    throw new Error('KESTREL_SESSION_SECRET must be at least 32 bytes in production')
-  }
-  return {
-    secret: deriveSigningKey(secret, process.env.KESTREL_ADMIN_PASSWORD_HASH, currentSessionEpoch()),
-    maxAge,
-    secureCookies,
-    cookieName: secureCookies ? '__Host-kestrel_session' : 'kestrel_session',
-  }
-}

package/layers/collections/server/collections/pages.ts

@@ -1,19 +0,0 @@
-import { buildCollection } from '../../../fields/server/utils/buildCollection'
-import { defineCollection } from '../../../core/server/utils/defineCollection'
-
-const built = buildCollection(defineCollection({
-  name: 'pages',
-  mode: 'multi',
-  translatable: true,
-  pageLike: true,
-  seo: true,
-  blocks: { enabled: true },
-  status: true,
-  builtin: true,
-  label: { singular: { en: 'Page', de: 'Seite' }, plural: { en: 'Pages', de: 'Seiten' }, new: { en: 'New Page', de: 'Neue Seite' } },
-  icon: 'file-text',
-  fields: { title: { type: 'text', required: true } },
-}))
-
-export const pages = built.table
-export default built

package/layers/collections/server/utils/populate-relations.ts

@@ -1,79 +0,0 @@
-import { fieldIs } from '../../../core/server/utils/defineCollection'
-import type { FieldPopulator } from '../../../core/server/utils/populate'
-import { memoDuringPrerender } from '../../../core/server/utils/prerender-memo'
-import { memoResolver } from '../../../core/server/utils/resolve-scope'
-
-/** Fetches a related record FULLY populated (its own media / links / nested relations resolved), or null
- *  when the id is stale / deleted / draft. Injected so the populator stays pure + unit-testable; the plugin
- *  wires the real `getOne`. `depth` is the ALREADY-decremented depth for the related read (the cycle guard). */
-export type ResolveRecord = (
-  collection: string,
-  id: number,
-  depth: number,
-  locale: string,
-  publicOnly: boolean,
-) => Record<string, unknown> | null
-
-/**
- * Run a related-record fetch, mapping `getOne`'s 404 (a stale / deleted / draft target — the intended
- * "skip this reference" signal) to `null`, but letting ANY OTHER error propagate. Swallowing every error
- * here would drop a relation on a real fault (a DB error, a downstream populator throwing on malformed
- * stored data) while the page still renders + records `success` — violating fail-loud. Pure + testable.
- */
-export function skipMissing(fetch: () => Record<string, unknown>): Record<string, unknown> | null {
-  try {
-    return fetch()
-  } catch (e) {
-    if ((e as { statusCode?: number })?.statusCode === 404) return null
-    throw e
-  }
-}
-
-/**
- * The `relation` field populator: expands a relation id (single, `${name}Id` in columns / bare in props)
- * or id array (many, always bare) into the fully-populated related record(s) under a `$<name>` sibling,
- * leaving the raw id column intact — so write round-trips and the admin relation-picker keep working.
- * Stale / deleted / draft ids are skipped (single → null, many → filtered out) so one bad reference never
- * fails the whole read. The related read passes `ctx.depth - 1`; `populateRow` bails at depth 0, so a
- * relation cycle terminates. Registered per-type via `registerFieldPopulator('relation', …)`; the shared
- * field-tree walker drives it over top-level fields, block props, slots, and repeater entries.
- *
- * Under `ctx.publicOnly` a relation into a collection `isPublicCollection` rejects is left unexpanded
- * (raw id only, NO `$<name>` sibling at all — a relation field targets exactly one collection, so a
- * `many` relation is all-or-nothing): expansion must not reach a record the caller could not have
- * requested directly. The check runs BEFORE `resolve`, so a withheld target never enters the memo.
- */
-export function buildRelationFieldPopulator(
-  resolveRecord: ResolveRecord,
-  isPublicCollection: (collection: string) => boolean,
-): FieldPopulator {
-  // The same target (collection+id+depth+locale+scope) is resolved once — build-wide during a generate run
-  // (memoDuringPrerender), request-/publish-run-wide via the resolve scope (which also budgets the
-  // distinct fan-out of one live request and replays read-tags on hits, so publish deps stay complete).
-  // memoResolver OUTERMOST: the per-scope budget verdict must stay scope-local. If memoDuringPrerender
-  // wrapped memoResolver, a build-wide memoize would cache a budget-skip `null` and poison every later
-  // page of a `nuxt generate`. With this order the build-wide memo only ever caches REAL resolver results.
-  // `publicOnly` is part of the key because the same record populates DIFFERENTLY under it (its own
-  // non-public relations are withheld) — sharing one entry would serve one scope's record to the other.
-  const key = (collection: string, id: number, depth: number, locale: string, publicOnly: boolean) => `rel:${collection}:${id}:${depth}:${locale}:${publicOnly}`
-  const resolve = memoResolver(memoDuringPrerender(resolveRecord, key), key)
-  return (bag, key, field, ctx, keyMode) => {
-    if (!fieldIs(field, 'relation')) return
-    const collection = field.relation.collection
-    const publicOnly = ctx.publicOnly === true
-    if (publicOnly && !isPublicCollection(collection)) return
-    const depth = ctx.depth - 1
-    if (field.relation.many) {
-      const ids = bag[key]
-      if (Array.isArray(ids)) {
-        bag['$' + key] = ids
-          .filter((n): n is number => typeof n === 'number')
-          .map((id) => resolve(collection, id, depth, ctx.locale, publicOnly))
-          .filter((r): r is Record<string, unknown> => r != null)
-      }
-    } else {
-      const id = bag[keyMode === 'columns' ? `${key}Id` : key]
-      if (typeof id === 'number') bag['$' + key] = resolve(collection, id, depth, ctx.locale, publicOnly)
-    }
-  }
-}

package/layers/core/app/utils/bulk-actions.ts

@@ -1,9 +0,0 @@
-// The batch operations the bulk endpoint accepts — the single source of truth shared by the server
-// handler (`bulk.post.ts`) and any client that builds a bulk request. Pure, so the allow-list is
-// unit-testable without a Nitro context.
-export const BULK_ACTIONS = ['delete', 'publish', 'unpublish', 'duplicate'] as const
-export type BulkAction = typeof BULK_ACTIONS[number]
-
-export function isBulkAction(value: unknown): value is BulkAction {
-  return typeof value === 'string' && (BULK_ACTIONS as readonly string[]).includes(value)
-}