@michaelthielemann/kestrel 3.0.1 → 4.0.0

package/layers/fields/app/utils/condition.ts

@@ -1,71 +0,0 @@
-import type { Condition, ConditionOperator, ConditionRule } from '../../../core/server/utils/defineCollection'
-
-/** Empty = absent or a "no value" (null/undefined/''/[]). Shared by the evaluator (the `empty`
- *  operator + bare-rule presence) and the server's required-when-visible check. 0 and false are values. */
-export function isEmptyValue(value: unknown): boolean {
-  return value === null || value === undefined || value === '' || (Array.isArray(value) && value.length === 0)
-}
-
-// v1 path scope is SIBLING-ONLY. A bare name or `./name` resolves a sibling in the current scope;
-// cross-scope forms (`/abs`, `../parent`, dotted `a.b`) are out of v1 and resolve to undefined — so the
-// rule is simply false (the field hides), keeping the evaluator total: it never throws on a bad path.
-function resolvePath(field: string, scope: Record<string, unknown>): unknown {
-  const key = field.startsWith('./') ? field.slice(2) : field
-  if (key === '' || key.startsWith('/') || key.startsWith('..') || key.includes('/') || key.includes('.')) {
-    return undefined
-  }
-  return scope[key]
-}
-
-function compare(dep: unknown, target: number | string, op: 'gt' | 'gte' | 'lt' | 'lte'): boolean {
-  if (typeof dep !== typeof target || (typeof dep !== 'number' && typeof dep !== 'string')) return false
-  if (op === 'gt') return dep > target
-  if (op === 'gte') return dep >= target
-  if (op === 'lt') return dep < target
-  return dep <= target
-}
-
-function matchOperator(dep: unknown, op: ConditionOperator): boolean {
-  for (const [key, target] of Object.entries(op)) {
-    if (target === undefined) continue
-    let ok: boolean
-    switch (key) {
-      case 'eq': ok = dep === target; break
-      case 'ne': ok = dep !== target; break
-      case 'gt': case 'gte': case 'lt': case 'lte':
-        ok = compare(dep, target as number | string, key); break
-      case 'in': ok = Array.isArray(target) && (target as unknown[]).includes(dep); break
-      case 'notIn': ok = Array.isArray(target) && !(target as unknown[]).includes(dep); break
-      case 'regexp': {
-        if (typeof dep !== 'string' || typeof target !== 'string') { ok = false; break }
-        try { ok = new RegExp(target).test(dep) } catch { ok = false }
-        break
-      }
-      case 'empty': ok = target ? isEmptyValue(dep) : !isEmptyValue(dep); break
-      default: ok = false
-    }
-    if (!ok) return false
-  }
-  return true
-}
-
-function evaluateRule(rule: ConditionRule, scope: Record<string, unknown>): boolean {
-  const dep = resolvePath(rule.field, scope)
-  if (rule.is !== undefined) return dep === rule.is
-  if (rule.op) return matchOperator(dep, rule.op)
-  return !isEmptyValue(dep)
-}
-
-/** Pure, total (never throws) condition evaluator shared by the editor (hide widgets) and the server
- *  (required-when-visible). `scope` is the sibling-value map the condition resolves against. */
-export function evaluateCondition(condition: Condition, scope: Record<string, unknown>): boolean {
-  if ('and' in condition) return condition.and.every((c) => evaluateCondition(c, scope))
-  if ('or' in condition) return condition.or.some((c) => evaluateCondition(c, scope))
-  if ('not' in condition) return !evaluateCondition(condition.not, scope)
-  return evaluateRule(condition, scope)
-}
-
-/** Whether a field is shown given the sibling-value `scope`. No condition => always visible. */
-export function isFieldVisible(field: { condition?: Condition } | null | undefined, scope: Record<string, unknown>): boolean {
-  return !field?.condition || evaluateCondition(field.condition, scope)
-}

package/layers/fields/app/utils/define-block.ts

@@ -1,13 +0,0 @@
-/**
- * Runtime no-op for a block SFC's metadata call — `defineBlock({ label, slots, icon })`. The metadata is
- * read at BUILD time by the SFC extractor (from the same call, statically); at runtime this only exists so
- * the SFC's `<script setup>` doesn't reference an undefined `defineBlock`. Auto-imported in the app so block
- * authors call it without an import (the field factories are auto-imported the same way).
- */
-export function defineBlock(_meta?: {
-  label?: string | Record<string, string>
-  slots?: string[]
-  icon?: string
-}): void {
-  // intentionally empty — see above.
-}

package/layers/fields/app/utils/field-constraints.ts

@@ -1,17 +0,0 @@
-import type { FieldDef } from '../../../core/server/utils/defineCollection'
-
-type NumberOptions = Extract<FieldDef, { type: 'number' }>['options']
-type ChoiceOptions = Extract<FieldDef, { type: 'choice' }>['options']
-
-/**
- * Whether a number field is integer-valued — the default — i.e. neither
- * `integer: false` nor a `decimals` precision opts it into reals.
- */
-export function numberIsInteger(options: NumberOptions): boolean {
-  return options?.integer !== false && options?.decimals === undefined
-}
-
-/** The allowed values of a choice field, as a non-empty tuple (for `z.enum`). */
-export function choiceValues(options: ChoiceOptions): [string, ...string[]] {
-  return options.choices.map((c) => c.value) as [string, ...string[]]
-}

package/layers/fields/app/utils/field-meta.ts

@@ -1,33 +0,0 @@
-import type { FieldDef, FieldOf } from '../../../core/server/utils/defineCollection'
-import { numberIsInteger } from './field-constraints'
-
-export interface FieldConstraints {
-  required: boolean
-  minlength?: number
-  maxlength?: number
-  min?: number
-  max?: number
-  step?: number | 'any'
-  multiline?: boolean
-}
-
-/** Input-relevant attributes derived from a FieldDef, for the field widgets. */
-export function fieldConstraints(field: FieldDef): FieldConstraints {
-  const c: FieldConstraints = { required: !!field.required }
-  // `field as FieldOf<'x'>`: the open consumer arm makes `type` a non-discriminant, so `field.type === 'x'`
-  // doesn't narrow `field` — the cast applies the arm the guard just proved. (App-side: type-only, no
-  // runtime import of the server-side `fieldIs` guard into the client bundle.)
-  if (field.type === 'text') {
-    const f = field as FieldOf<'text'>
-    if (f.options?.minLength !== undefined) c.minlength = f.options.minLength
-    if (f.options?.maxLength !== undefined) c.maxlength = f.options.maxLength
-    if (f.options?.multiline) c.multiline = true
-  } else if (field.type === 'number') {
-    const f = field as FieldOf<'number'>
-    if (f.options?.min !== undefined) c.min = f.options.min
-    if (f.options?.max !== undefined) c.max = f.options.max
-    if (f.options?.decimals !== undefined) c.step = 1 / 10 ** f.options.decimals
-    else c.step = numberIsInteger(f.options) ? 1 : 'any'
-  }
-  return c
-}

package/layers/fields/app/utils/field-validate.ts

@@ -1,75 +0,0 @@
-import type { FieldDef, FieldOf } from '../../../core/server/utils/defineCollection'
-import { choiceValues, numberIsInteger } from './field-constraints'
-
-function isEmpty(value: unknown): boolean {
-  return value === undefined || value === null || value === ''
-}
-
-/**
- * Advisory client-side validation for instant feedback. A lightweight mirror of a
- * subset of the server rules — the server Zod schema stays the sole authority.
- */
-export function validateField(field: FieldDef, value: unknown): string | null {
-  if (isEmpty(value)) return field.required ? 'This field is required.' : null
-
-  switch (field.type) {
-    case 'text': {
-      if (typeof value !== 'string') return null
-      const { minLength, maxLength } = (field as FieldOf<'text'>).options ?? {}
-      if (minLength !== undefined && value.length < minLength) return `Must be at least ${minLength} characters.`
-      if (maxLength !== undefined && value.length > maxLength) return `Must be at most ${maxLength} characters.`
-      return null
-    }
-    case 'number': {
-      if (typeof value !== 'number' || Number.isNaN(value)) return 'Must be a number.'
-      const opts = (field as FieldOf<'number'>).options
-      const { min, max } = opts ?? {}
-      if (numberIsInteger(opts) && !Number.isInteger(value)) return 'Must be a whole number.'
-      if (min !== undefined && value < min) return `Must be at least ${min}.`
-      if (max !== undefined && value > max) return `Must be at most ${max}.`
-      return null
-    }
-    // The widget model is always already-parsed (Json.vue stores `JSON.parse(raw)`, never raw text), so a
-    // json field's value here is never source to re-parse — even when it happens to be a plain string
-    // (e.g. `default: 'dark'`). The widget owns raw-text parse errors itself via its own `localError`.
-    case 'json':
-      return null
-    case 'datetime': {
-      const dt = (field as FieldOf<'datetime'>).options
-      const p = dt?.precision ?? 'datetime'
-      const re = p === 'date'
-        ? /^\d{4}-\d{2}-\d{2}$/
-        : p === 'time'
-          ? /^\d{2}:\d{2}(:\d{2})?$/
-          : /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2})?$/
-      if (dt?.range) {
-        const v = value && typeof value === 'object' ? (value as { start?: unknown; end?: unknown }) : {}
-        const start = typeof v.start === 'string' ? v.start : ''
-        const end = typeof v.end === 'string' ? v.end : ''
-        // A picker mid-selection (one endpoint chosen, the other still blank) is invalid regardless of
-        // `required` — the server only ever accepts a fully-filled range or a fully-empty one.
-        if (!start && !end) return field.required ? 'This field is required.' : null
-        if (!start || !end) return 'Both start and end are required.'
-        if (!re.test(start)) return 'Invalid start.'
-        if (!re.test(end)) return 'Invalid end.'
-        if (start > end) return 'Start must be before or equal to end.'
-        return null
-      }
-      return typeof value === 'string' && value && !re.test(value) ? 'Invalid date or time.' : null
-    }
-    case 'choice': {
-      const opts = (field as FieldOf<'choice'>).options
-      const allowed = new Set(choiceValues(opts))
-      if (opts.multiple) {
-        const arr = Array.isArray(value) ? value : []
-        if (field.required && arr.length === 0) return 'Select at least one option.'
-        if (arr.some((v) => !allowed.has(v as string))) return 'Invalid selection.'
-        return null
-      }
-      if (typeof value === 'string' && !allowed.has(value)) return 'Invalid selection.'
-      return null
-    }
-    default:
-      return null
-  }
-}

package/layers/fields/app/utils/field-value.ts

@@ -1,7 +0,0 @@
-export function tryParseJson(text: string): { ok: true; value: unknown } | { ok: false } {
-  try {
-    return { ok: true, value: JSON.parse(text) }
-  } catch {
-    return { ok: false }
-  }
-}

package/layers/fields/app/utils/richtext-links.ts

@@ -1,48 +0,0 @@
-// Internal links inside richtext are stored as a marker href `kestrel:<collection>:<id>` (the editor
-// sets it via the normal Link mark; sanitize allows the `kestrel:` scheme). At read time the marker is
-// rewritten to the target's real localized path — the richtext counterpart of the `link` field's
-// server populator. Pure string helpers, shared by the server populate pass and the client preview.
-
-/** URL scheme that flags an internal richtext link (`kestrel:<collection>:<id>`); shared with sanitize. */
-export const RICHTEXT_LINK_SCHEME = 'kestrel'
-
-const MARKER_HREF = new RegExp(`href="${RICHTEXT_LINK_SCHEME}:([a-zA-Z0-9_-]+):(\\d+)"`, 'g')
-const MARKER_VALUE = new RegExp(`^${RICHTEXT_LINK_SCHEME}:([a-zA-Z0-9_-]+):(\\d+)$`)
-
-/** The marker href the editor stores for an internal richtext link. */
-export function richtextLinkHref(collection: string, id: number): string {
-  return `${RICHTEXT_LINK_SCHEME}:${collection}:${id}`
-}
-
-/**
- * Parse a bare `kestrel:<collection>:<id>` marker href back to its `{collection, id}` (the inverse of
- * `richtextLinkHref`); returns `null` for an ordinary/external anchor, a malformed marker, or non-string
- * input. Used by the toolbar to prefill the internal-link picker when re-editing an existing link.
- */
-export function parseRichtextLinkHref(href: string | null | undefined): { collection: string; id: number } | null {
-  if (typeof href !== 'string') return null
-  const m = href.match(MARKER_VALUE)
-  return m ? { collection: m[1]!, id: Number(m[2]) } : null
-}
-
-/** Every internal-link `{collection, id}` referenced by marker hrefs in the HTML (for batch resolve). */
-export function collectRichtextRefs(html: string | null | undefined): { collection: string; id: number }[] {
-  if (!html) return []
-  return [...html.matchAll(MARKER_HREF)].map((m) => ({ collection: m[1]!, id: Number(m[2]) }))
-}
-
-const escapeAttr = (s: string): string => s.replace(/&/g, '&amp;').replace(/"/g, '&quot;')
-
-/**
- * Rewrite every `kestrel:<collection>:<id>` marker href to whatever the injected resolver returns; a
- * target the resolver declines becomes `#`. The production resolver is status-gated, so that covers a
- * missing target AND a draft one. Ordinary anchors are left untouched. Non-string input → `''`.
- */
-export function resolveRichtextLinks(
-  html: string | null | undefined,
-  resolveHref: (collection: string, id: number) => string | null,
-): string {
-  if (typeof html !== 'string' || !html) return ''
-  return html.replace(MARKER_HREF, (_m, collection: string, idStr: string) =>
-    `href="${escapeAttr(resolveHref(collection, Number(idStr)) ?? '#')}"`)
-}

package/layers/fields/server/api/blocks/index.get.ts

@@ -1,9 +0,0 @@
-// Admin-only (default-deny applies to /api/**): the per-block field schemas the editor needs to
-// render block inputs. `?allowed=a,b` restricts to a collection's allowed block types.
-export default defineEventHandler((event) => {
-  const q = getQuery(event)
-  const allowed = typeof q.allowed === 'string' && q.allowed.length
-    ? q.allowed.split(',').map((s) => s.trim()).filter(Boolean)
-    : undefined
-  return { data: allBlocks(allowed).map(serializeBlock) }
-})

package/layers/fields/server/field-registry/index.ts

@@ -1,249 +0,0 @@
-import { integer, real, text } from 'drizzle-orm/sqlite-core'
-import type { SQLiteColumnBuilder } from 'drizzle-orm/sqlite-core'
-import { sql } from 'drizzle-orm'
-import { z } from 'zod'
-import type { FieldDef, FieldType, LinkValue } from '../../../core/server/utils/defineCollection'
-import { fieldIs } from '../../../core/server/utils/defineCollection'
-import type { FieldTypeDescriptor } from './types'
-import { sanitizeRichtext } from './sanitize'
-import { choiceValues, numberIsInteger } from '../../app/utils/field-constraints'
-import { slugify } from '../../../core/app/utils/slugify'
-import { refineConditionalRequired } from '../utils/conditional-required'
-
-// A conditional field is only `required` when its condition is met — which the per-column / per-field
-// schema can't see (no sibling access). So it is never enforced HERE: the column stays nullable and the
-// validator stays optional; the whole-record `applyConditions` hook re-enforces required-when-visible.
-export function isHardRequired(field: FieldDef): boolean {
-  return !!field.required && !field.condition
-}
-
-export function constrain<T extends SQLiteColumnBuilder>(col: T, field: FieldDef): T {
-  let c = col
-  if (isHardRequired(field)) c = c.notNull() as T
-  if (field.unique) c = c.unique() as T
-  if (field.default !== undefined) c = c.default(field.default as never) as T
-  return c
-}
-
-export const opt = (s: z.ZodType, field: FieldDef): z.ZodType => (isHardRequired(field) ? s : s.nullish())
-export const optArr = (s: z.ZodType, field?: FieldDef): z.ZodType =>
-  field && isHardRequired(field)
-    ? s.refine((v) => Array.isArray(v) && v.length > 0, { message: 'At least one value is required' })
-    // Non-required: an EXPLICIT null is a clear → the empty array [] (so a PATCH `field: null` actually
-    // resets it, consistent with the .nullish() scalar fields, rather than mapping to undefined which
-    // drizzle's .set() silently skips). An absent (undefined) value stays undefined so the column default
-    // ([]) applies on insert.
-    : z.preprocess((v) => (v === null ? [] : v), s.optional())
-
-// Array-backed column (multiple choice/media, many-relation, repeater). Honours a declared `default` (a
-// default multi-selection / seed rows), serialized as a JSON literal by the schema renderer; else '[]'.
-// (`unique` is intentionally not applied — a UNIQUE index over a JSON blob is not meaningful.)
-const jsonArray = (dbName: string, field?: FieldDef) =>
-  text(dbName, { mode: 'json' }).$type<unknown[]>().notNull()
-    .default(field?.default !== undefined ? (field.default as never) : sql`'[]'`)
-
-/** Type a built-in descriptor against its SPECIFIC arm (`FieldOf<T>`) so its body narrows correctly, then
- *  widen to the registry's general `FieldTypeDescriptor` for storage. */
-const fieldType = <T extends FieldType>(d: FieldTypeDescriptor<T>): FieldTypeDescriptor =>
-  d as unknown as FieldTypeDescriptor
-
-/** Whether `field.unique` actually reaches a DB constraint for THIS field (options-dependent, not just
- *  type-dependent — a `choice`/`media` field is only json-backed when `multiple`, a `relation` only when
- *  `many`). Mirrors the `column()` arms above exactly: the json/array-backed arms (`jsonArray`, the plain
- *  `json` type) never call `constrain()`, so `.unique()` is never invoked — `unique: true` there is a silent
- *  no-op, not a soft hint. `buildTable` uses this to fail loud at collection-build time instead. */
-export function fieldCanEnforceUnique(field: FieldDef): boolean {
-  // `fieldIs` not `switch`: the open consumer arm makes `type` a non-discriminant (no switch narrowing).
-  if (fieldIs(field, 'choice')) return !field.options.multiple
-  if (fieldIs(field, 'media')) return !field.options?.multiple
-  if (fieldIs(field, 'relation')) return !field.relation.many
-  if (fieldIs(field, 'repeater')) return false
-  if (fieldIs(field, 'json')) return false
-  return true
-}
-
-export const fieldTypes: Record<string, FieldTypeDescriptor> = {
-  text: fieldType<'text'>({
-    column: (n, f) => constrain(text(n), f),
-    // Plain text is stored verbatim (trimmed): the column is not HTML and every consumer
-    // escapes on output, so tag-stripping here would only corrupt legitimate input (e.g. "a < b").
-    validator: (f) => {
-      let s = z.string().trim()
-      if (f.type === 'text') {
-        if (f.options?.minLength !== undefined) s = s.min(f.options.minLength)
-        if (f.options?.maxLength !== undefined) s = s.max(f.options.maxLength)
-      }
-      // A hard-required string must be non-empty — '' / whitespace is "missing" to the client validator
-      // and the conditional-required check, so the server (sole authority) must agree. Only add the
-      // implicit min(1) when no explicit minLength already enforces a lower bound.
-      if (isHardRequired(f) && (f.type !== 'text' || f.options?.minLength === undefined)) s = s.min(1)
-      return opt(s, f)
-    },
-  }),
-  // A url-safe slug, stored as text. Optionality-aware like text, but typically left non-required so it can
-  // be omitted and auto-generated from another field. `transform` derives it on write: an explicit value is
-  // slugified (normalised); a blank value falls back to slugify(record[options.from]) (e.g. the title). The
-  // `options.from`/`options.prefix` are read by the client widget too (prefix is display-only). A `unique`
-  // slug collision is a HARD, field-scoped error (`assertUniqueSlugs` in crud — no silent dedup; the editor
-  // must pick a different slug), needing the DB the pure `transform` hook can't touch, so it lives in crud.
-  slug: fieldType<'slug'>({
-    column: (n, f) => constrain(text(n), f),
-    validator: (f) => opt(isHardRequired(f) ? z.string().trim().min(1) : z.string().trim(), f),
-    transform: (value, record, field) => {
-      const explicit = typeof value === 'string' ? value.trim() : ''
-      if (explicit) return slugify(explicit)
-      const from = field.options?.from
-      const source = from ? record[from] : undefined
-      return typeof source === 'string' ? (slugify(source) || value) : value
-    },
-  }),
-  richtext: {
-    column: (n, f) => constrain(text(n), f),
-    // Required richtext must carry content: sanitize first, then reject a sanitized-empty result
-    // (e.g. '' or markup that strips to nothing), mirroring the non-empty rule for plain text.
-    validator: (f) => {
-      const base = z.string().transform(sanitizeRichtext)
-      if (!isHardRequired(f)) return base.nullish()
-      return base.refine((v) => v.trim().length > 0, { message: 'This field is required' })
-    },
-  },
-  number: fieldType<'number'>({
-    column: (n, f) =>
-      constrain(!numberIsInteger(f.options) ? real(n) : integer(n), f),
-    validator: (f) => {
-      let n = z.number()
-      if (numberIsInteger(f.options)) n = n.int()
-      if (f.options?.min !== undefined) n = n.min(f.options.min)
-      if (f.options?.max !== undefined) n = n.max(f.options.max)
-      return opt(n, f)
-    },
-  }),
-  boolean: {
-    column: (n, f) => constrain(integer(n, { mode: 'boolean' }), f),
-    validator: (f) => opt(z.boolean(), f),
-  },
-  datetime: fieldType<'datetime'>({
-    column: (n, f) =>
-      f.options?.range
-        ? constrain(text(n, { mode: 'json' }).$type<{ start: string; end: string }>(), f)
-        : constrain(text(n), f),
-    validator: (f) => {
-      const p = f.options?.precision ?? 'datetime'
-      const base = p === 'date' ? z.iso.date() : p === 'time' ? z.iso.time() : z.iso.datetime({ local: true })
-      if (f.options?.range) {
-        const r = z.object({ start: base, end: base }).refine((v) => v.start <= v.end, { message: 'start must be before or equal to end' })
-        return isHardRequired(f) ? r : r.nullish()
-      }
-      return opt(base, f)
-    },
-  }),
-  choice: fieldType<'choice'>({
-    column: (n, f) => (f.options.multiple ? jsonArray(n, f) : constrain(text(n), f)),
-    validator: (f) => {
-      const values = choiceValues(f.options)
-      const e = z.enum(values)
-      return f.options.multiple ? optArr(z.array(e), f) : opt(e, f)
-    },
-  }),
-  link: {
-    column: (n, f) => constrain(text(n, { mode: 'json' }).$type<LinkValue>(), f),
-    // The validator is type-agnostic; options.types/collections only constrain the editor widget.
-    validator: (f) => {
-      const label = z.string().trim().optional()
-      // Optional URL fragment for internal links (e.g. link to a page's section). Stored WITHOUT the
-      // leading '#' (a lenient leading '#' is stripped); restricted to an id-safe charset since it ends
-      // up verbatim in a static <a href>. `linkToHref` appends it as `<path>#<hash>` at render.
-      const hash = z.string().trim().transform((s) => s.replace(/^#+/, '')).pipe(z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_-]*$/, 'Invalid anchor')).optional()
-      return opt(
-        z.discriminatedUnion('type', [
-          z.object({ type: z.literal('internal'), collection: z.string().min(1), id: z.number().int(), hash, label }),
-          z.object({
-            type: z.literal('external'),
-            // http(s) only, no control chars, no embedded credentials — the value ends up in a static <a href>.
-            url: z.string().trim().pipe(z.url({ protocol: /^https?$/ })).refine((v) => {
-              // eslint-disable-next-line no-control-regex -- deliberately rejects control characters embedded in a URL destined for a static <a href>
-              if (/[\u0000-\u001f]/.test(v)) return false
-              const u = new URL(v)
-              return !u.username && !u.password
-            }, 'URL must not contain control characters or embedded credentials'),
-            label,
-          }),
-          z.object({ type: z.literal('email'), email: z.string().trim().pipe(z.email()), label }),
-          z.object({ type: z.literal('tel'), tel: z.string().trim().min(1).regex(/^[+0-9 ()\-./]+$/).refine((v) => /[0-9]/.test(v), 'Tel must contain at least one digit'), label }),
-        ]),
-        f,
-      )
-    },
-  },
-  media: fieldType<'media'>({
-    column: (n, f) => (f.options?.multiple ? jsonArray(n, f) : constrain(integer(n), f)),
-    validator: (f) =>
-      f.options?.multiple ? optArr(z.array(z.number().int()), f) : opt(z.number().int(), f),
-  }),
-  relation: fieldType<'relation'>({
-    column: (n, f) => (f.relation.many ? jsonArray(n, f) : constrain(integer(n), f)),
-    validator: (f) =>
-      f.relation.many ? optArr(z.array(z.number().int()), f) : opt(z.number().int(), f),
-  }),
-  repeater: fieldType<'repeater'>({
-    column: (n, f) => jsonArray(n, f),
-    validator: (f) => {
-      const shape = Object.fromEntries(
-        Object.entries(f.options.fields).map(([k, sub]) => [k, getFieldType(sub.type).validator(sub)]),
-      )
-      // Re-enforce conditional-required sub-fields per entry (the entry object is where siblings are visible).
-      return optArr(z.array(refineConditionalRequired(z.object(shape), f.options.fields)), f)
-    },
-  }),
-  json: {
-    column: (n, f) => text(n, { mode: 'json' }).$type<unknown>().notNull().default(f?.default !== undefined ? (f.default as never) : sql`'{}'`),
-    // Optionality-aware like every other arm. The column is NOT NULL with a '{}' default, so a non-required
-    // null/undefined must become `undefined` (→ default applies) rather than reaching the column as null (an
-    // unmapped NOT NULL 500); a required json must be present (a clean 400, not a 500).
-    validator: (f) =>
-      isHardRequired(f)
-        ? z.unknown().refine((v) => v !== null && v !== undefined, { message: 'This field is required' })
-        // Explicit null clears to {} (a PATCH reset); undefined stays absent so the column default ({}) applies.
-        : z.preprocess((v) => (v === null ? {} : v), z.unknown().optional()),
-  },
-}
-
-/** The names Kestrel ships built-in (captured before any consumer registration). */
-const BUILTIN_FIELD_TYPES = new Set(Object.keys(fieldTypes))
-
-/** Register a consumer-defined field type (via `defineFieldType`). Later registration wins, but never
- *  silently: a bad descriptor throws a clear error at registration (not a cryptic TypeError when a table is
- *  later built), and ANY re-registration of an existing name warns — overriding a built-in, or one extension
- *  clobbering another's same-named type. */
-export function registerFieldType(name: string, descriptor: FieldTypeDescriptor): void {
-  if (typeof name !== 'string' || !name.trim()) {
-    throw new Error('[kestrel] registerFieldType: name must be a non-empty string')
-  }
-  if (typeof descriptor?.column !== 'function') {
-    throw new Error(`[kestrel] registerFieldType("${name}"): descriptor.column must be a function`)
-  }
-  if (typeof descriptor?.validator !== 'function') {
-    throw new Error(`[kestrel] registerFieldType("${name}"): descriptor.validator must be a function`)
-  }
-  if (descriptor.transform !== undefined && typeof descriptor.transform !== 'function') {
-    throw new Error(`[kestrel] registerFieldType("${name}"): descriptor.transform must be a function if provided`)
-  }
-  // Object.hasOwn, not `in`: a field type named 'constructor'/'toString'/… would otherwise match an
-  // inherited Object.prototype member (a spurious "re-registered" warning, and below a truthy lookup).
-  if (Object.hasOwn(fieldTypes, name)) {
-    console.warn(BUILTIN_FIELD_TYPES.has(name)
-      ? `[kestrel] field type "${name}" overrides a built-in`
-      : `[kestrel] field type "${name}" re-registered — the previous definition was overwritten`)
-  }
-  fieldTypes[name] = descriptor
-}
-
-/** Look up a field-type descriptor, with a clear error for an unknown / unregistered type. */
-export function getFieldType(type: string): FieldTypeDescriptor {
-  // Object.hasOwn guards the prototype chain: getFieldType('constructor') must throw the clear error, not
-  // return Object.prototype.constructor and then crash with `.column is not a function` at table build.
-  if (!Object.hasOwn(fieldTypes, type)) {
-    throw new Error(`[kestrel] unknown field type "${type}" — register it with defineFieldType in server/field-types/`)
-  }
-  return fieldTypes[type]
-}

package/layers/fields/server/field-registry/naming.ts

@@ -1,10 +0,0 @@
-import { isSingleRefColumn, type FieldDef } from '../../../core/server/utils/defineCollection'
-
-export function toSnakeCase(key: string): string {
-  return key.replace(/[A-Z]/g, (m) => `_${m.toLowerCase()}`)
-}
-
-export function resolveColumnName(key: string, field: FieldDef): { jsKey: string; dbName: string } {
-  if (isSingleRefColumn(field)) return { jsKey: `${key}Id`, dbName: `${toSnakeCase(key)}_id` }
-  return { jsKey: key, dbName: toSnakeCase(key) }
-}

package/layers/fields/server/field-registry/sanitize.ts

@@ -1,43 +0,0 @@
-import sanitizeHtml from 'sanitize-html'
-import { RICHTEXT_LINK_SCHEME } from '../../app/utils/richtext-links'
-
-// Kept deliberately in step with the editor's schema (`ui/Richtext.vue`): a tag allowed here that no
-// extension can parse is not "supported", it is a delayed deletion — the editor drops it on load and the
-// next save persists the loss. `richtext.dom.test.ts` asserts the two lists agree, so widening this one
-// means teaching the editor the tag in the same change. Images belong in a media field or an image
-// block, not in flow text; tables await an editor that can hold them.
-export const RICHTEXT_ALLOWLIST: sanitizeHtml.IOptions = {
-  allowedTags: [
-    'p', 'br', 'span', 'strong', 'b', 'em', 'i', 'u', 's', 'sub', 'sup', 'mark',
-    'blockquote', 'pre', 'code', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6',
-    'ul', 'ol', 'li', 'a', 'hr',
-  ],
-  allowedAttributes: {
-    a: ['href', 'title', 'target', 'rel'],
-    '*': ['class', 'style'],
-  },
-  allowedStyles: {
-    '*': { 'text-align': [/^(left|right|center|justify)$/] },
-  },
-  // `kestrel:` is the internal-link marker (`kestrel:<collection>:<id>`), resolved to a real localized
-  // path at read time; it must survive sanitisation so the resolver can rewrite it.
-  allowedSchemes: ['http', 'https', 'mailto', 'tel', RICHTEXT_LINK_SCHEME],
-  allowedSchemesAppliedToAttributes: ['href', 'src'],
-  disallowedTagsMode: 'discard',
-  transformTags: {
-    // Only absolute http(s) (incl. protocol-relative) links are "external" → open in a new isolated
-    // tab + nofollow. Internal/relative/mailto/tel/kestrel: links keep no target/rel (a same-site link
-    // must not open a new tab or be nofollowed); any author-supplied target/rel on them is dropped.
-    a: (tagName, attribs) => {
-      if (/^(https?:)?\/\//i.test(attribs.href ?? '')) {
-        return { tagName, attribs: { ...attribs, target: '_blank', rel: 'noopener noreferrer nofollow' } }
-      }
-      const { target: _t, rel: _r, ...rest } = attribs
-      return { tagName, attribs: rest }
-    },
-  },
-}
-
-export function sanitizeRichtext(html: string): string {
-  return sanitizeHtml(html, RICHTEXT_ALLOWLIST)
-}

package/layers/fields/server/field-registry/types.ts

@@ -1,19 +0,0 @@
-import type { SQLiteColumnBuilderBase } from 'drizzle-orm/sqlite-core'
-import type { ZodType } from 'zod'
-import type { FieldOf, FieldType } from '../../../core/server/utils/defineCollection'
-
-/** Descriptor for a field `type`. Generic over the type name so a built-in descriptor's body receives its
- *  SPECIFIC `FieldDef` arm (`FieldOf<'text'>` etc.) — the registry can't discriminate the union itself
- *  (the open consumer arm makes `type` a non-discriminant). The default `T = FieldType` widens `field` back
- *  to the full union for the registry's storage type + consumer-registered descriptors. */
-export interface FieldTypeDescriptor<T extends FieldType = FieldType> {
-  /** The ONLY place a Drizzle column type is decided. Pure; no Nitro/DB. */
-  column(dbName: string, field: FieldOf<T>): SQLiteColumnBuilderBase
-  /** Complete, optionality-aware Zod for the field value (drop-in replacement schema). */
-  validator(field: FieldOf<T>): ZodType
-  /** Optional write-time derivation: given this field's (validated) value, the whole record, and the field
-   *  def, return the value to persist — e.g. a slug auto-generated from another field when left blank. Runs
-   *  on create/update AFTER validation, BEFORE insert. Pure (no DB/Nitro); cross-field reads come from
-   *  `record`. */
-  transform?(value: unknown, record: Record<string, unknown>, field: FieldOf<T>): unknown
-}

package/layers/fields/server/utils/block-ids.ts

@@ -1,43 +0,0 @@
-import { randomUUID } from 'node:crypto'
-
-// Server-side twin of the admin's `cloneBlockTree` (layers/admin/app/utils/block-tree.ts): re-mint every
-// block id at every slot depth, preserving type / props / structure. This is a DELIBERATE crossing-free
-// duplication, NOT a reshape: `cloneBlockTree` lives in the ADMIN (client) layer and is unreachable from a
-// server layer, so the record-duplicate operation gets its own pure, node-tested helper here in `fields`
-// (the block-content-shape home) rather than inverting the layer dependency. No field-def dependency — a
-// plain traversal of the `{ id, type, props?, slots? }` node shape — so it unit-tests hard.
-
-type GenId = () => string
-
-interface BlockNode {
-  id: string
-  type: string
-  props?: Record<string, unknown>
-  slots?: Record<string, unknown>
-  [key: string]: unknown
-}
-
-/**
- * Return a copy of a block `content` array with a FRESH id on every node at every slot depth, so a
- * duplicated record never shares block identity with its source (the id-addressed tree, error addressing
- * and per-record edit state all rely on ids being unique per record). Props and slot structure are deep-
- * cloned and preserved verbatim. A non-array `content` (or a non-object node) passes through untouched.
- * `genId` is injectable for deterministic tests; it defaults to `crypto.randomUUID`.
- */
-export function regenerateBlockIds(content: unknown, genId: GenId = randomUUID): unknown {
-  if (!Array.isArray(content)) return content
-  return content.map((node) => cloneNode(node, genId))
-}
-
-function cloneNode(node: unknown, genId: GenId): unknown {
-  if (!node || typeof node !== 'object' || Array.isArray(node)) return node
-  const n = node as BlockNode
-  const copy: BlockNode = { ...n, id: genId() }
-  if (n.props && typeof n.props === 'object') copy.props = structuredClone(n.props)
-  if (n.slots && typeof n.slots === 'object' && !Array.isArray(n.slots)) {
-    copy.slots = Object.fromEntries(
-      Object.entries(n.slots).map(([name, arr]) => [name, Array.isArray(arr) ? arr.map((c) => cloneNode(c, genId)) : arr]),
-    )
-  }
-  return copy
-}