@michaelthielemann/kestrel 3.0.1 → 4.0.0

package/layers/public/server/utils/page-resolve.ts

@@ -1,208 +0,0 @@
-import { and, asc, eq, getTableColumns } from 'drizzle-orm'
-import { list } from '../../../core/server/utils/crud'
-import { captureRead } from '../../../core/server/utils/read-capture'
-import { pagePathTag, translationGroupTag } from './publish/invalidation'
-import type { BuiltCollection } from '../../../core/server/utils/collection-types'
-import type { BetterSQLite3Database } from 'drizzle-orm/better-sqlite3'
-
-export interface PageAlternate { locale: string; path: string }
-/** One published page above this one in the path hierarchy — a real, linkable breadcrumb step. */
-export interface PageAncestor {
-  path: string
-  title?: string
-  /** The ancestor's OWN locale, so the crumb builds the URL that was actually published. Absent for a
-   *  non-translatable collection, whose rows have a single unprefixed (primary-locale) URL — prefixing
-   *  one of those with the reader's locale would link a page `nuxt generate` never wrote. */
-  locale?: string
-}
-export interface ResolvedPage {
-  collection: string
-  page: Record<string, unknown>
-  alternates: PageAlternate[]
-  ancestors: PageAncestor[]
-}
-
-/** The matched page (or null) plus the collections whose lookup threw. `failed` is non-empty ⇒ the scan
- *  was INCOMPLETE, so `page: null` must never be treated as an authoritative "no such page". */
-export interface PageResolution {
-  page: ResolvedPage | null
-  failed: string[]
-}
-
-/**
- * The page's published, INDEXABLE translation siblings (self included) as locale→path pairs — the hreflang
- * set the public head emits. Mirrors the sitemap's rules exactly so the two never disagree: published-only
- * (a draft URL must never be advertised to crawlers), `seo.noindex` variants EXCLUDED (advertising an
- * hreflang to a noindexed page is a conflicting signal), null-path rows skipped, and a single-member group
- * returns [] (hreflang is meaningless for a lone page). EVERY sibling in the group is `captureRead`-tagged,
- * filtered-out ones included, so an incremental publish re-renders every group member when a sibling is
- * renamed/published/unpublished — otherwise a baked page would keep a stale/dead hreflang href. The GROUP
- * itself is tagged too: a sibling that does not exist yet has no id to have been captured, so the group tag
- * is the only edge a later CREATE can match.
- */
-function publishedAlternates(db: BetterSQLite3Database, c: BuiltCollection, page: Record<string, unknown>): PageAlternate[] {
-  if (c.def.mode !== 'multi' || !c.def.translatable) return []
-  const group = page.translationGroup
-  if (typeof group !== 'string' || !group) return []
-  captureRead(translationGroupTag(c.def.name, group))
-  const cols = getTableColumns(c.table) as Record<string, never>
-  // A status-less pageLike collection has no draft state — every sibling is "published".
-  const hasStatus = Object.hasOwn(cols, 'status')
-  const proj: Record<string, unknown> = { id: cols.id, locale: cols.locale, path: cols.path }
-  if (hasStatus) proj.status = cols.status
-  if (c.def.seo) proj.seo = cols.seo
-  // Read the WHOLE group and filter in JS: a row excluded by SQL is never captured, so a draft sibling
-  // would carry no dependency edge for the publish tag `<coll>:<id>` to match, and this page would keep a
-  // baked hreflang set missing the newly-published sibling until the next full generate.
-  const rows = db.select(proj as never)
-    .from(c.table)
-    .where(eq(cols.translationGroup, group))
-    .orderBy(asc(cols.locale))
-    .all() as Array<{ id: number; locale: string; path: unknown; status?: string; seo?: { noindex?: boolean } | null }>
-  const alternates: PageAlternate[] = []
-  let selfAdvertisable = false
-  for (const r of rows) {
-    // Capture the sibling as a publish dependency even if it is filtered out below — a draft/noindexed/
-    // null-path sibling that later becomes advertisable must still re-render this page's hreflang set.
-    captureRead(c.def.name, r.id)
-    if (hasStatus && r.status !== 'published') continue // a draft URL must never be advertised
-    if (typeof r.path !== 'string' || !r.path) continue // null/empty path — no advertisable URL
-    if (r.seo?.noindex) continue // noindexed — never advertise it via hreflang (matches the sitemap)
-    if (r.id === page.id) selfAdvertisable = true
-    alternates.push({ locale: r.locale, path: r.path })
-  }
-  // A hreflang set with no self-reference is a signal search engines ignore wholesale — if the page
-  // being rendered didn't itself survive the filters above, advertise nothing rather than an orphan set.
-  if (!selfAdvertisable) return []
-  return alternates.length >= 2 ? alternates : []
-}
-
-/** Every strict path prefix of a page's path, outermost first: `/blog/hello` → `['/', '/blog']`. The
- *  site root is an ancestor of everything except itself. */
-function ancestorPaths(path: string): string[] {
-  if (path === '/' || !path.startsWith('/')) return []
-  const segments = path.split('/').filter(Boolean)
-  const paths = ['/']
-  for (let i = 1; i < segments.length; i += 1) paths.push(`/${segments.slice(0, i).join('/')}`)
-  return paths
-}
-
-/**
- * The page's breadcrumb trail: the published, INDEXABLE page at each ancestor path, in the page's own
- * locale. A path segment with no page behind it is SKIPPED rather than synthesised — schema.org
- * breadcrumb items are links, and a trail that points at a 404 is a worse signal than a shorter trail.
- * The filters mirror the sitemap's, so a breadcrumb never advertises what the sitemap withholds.
- *
- * TWO dependency edges are captured per ancestor, because neither covers the other:
- *  - the PATH (`pagePathTag`), for every path looked in — including those with no page at all and those
- *    whose lookup threw. Kestrel has no parent/child relation between pages, so an ancestor is a
- *    path-prefix match, and a page CREATED at `/blog` after `/blog/hello` was published has no id anything
- *    could have captured beforehand. A path is knowable before its page exists.
- *  - the RECORD (`<coll>:<id>`) of whatever row sits there, captured before the filters below so a
- *    currently-invisible one counts too — the edge that carries a rename, a `noindex` or an unpublish,
- *    none of which `crumbTags` can see (see the comment at that capture).
- * `publishedAlternates` pairs a group tag with a record tag for exactly the same reason.
- */
-function publishedAncestors(
-  db: BetterSQLite3Database,
-  collections: BuiltCollection[],
-  path: string,
-  locale: string | undefined,
-  publishedOnly: boolean,
-): PageAncestor[] {
-  const out: PageAncestor[] = []
-  for (const ancestorPath of ancestorPaths(path)) {
-    // Before the scan, so the edge exists whatever the scan finds — no page, a draft, a noindexed one, or
-    // a collection whose table could not be read. A write at this path emits the same tag (`crumbTags` in
-    // classifyWrite), which is what repairs this page's trail.
-    captureRead(pagePathTag(ancestorPath))
-    for (const c of collections) {
-      if (!c.def.pageLike) continue
-      // Project only what a crumb needs — never the row: this runs once per path segment per render, and
-      // pulling every page's block JSON to read a title would multiply the cost of a full publish.
-      const cols = getTableColumns(c.table) as Record<string, never>
-      const hasStatus = Object.hasOwn(cols, 'status')
-      const proj: Record<string, unknown> = { id: cols.id, path: cols.path }
-      if (hasStatus) proj.status = cols.status
-      if (c.def.seo) proj.seo = cols.seo
-      if (c.def.translatable) proj.locale = cols.locale
-      if (Object.hasOwn(cols, 'title')) proj.title = cols.title
-      const scoped = c.def.translatable && locale ? and(eq(cols.path, ancestorPath), eq(cols.locale, locale)) : eq(cols.path, ancestorPath)
-      let row: { id: number; status?: string; seo?: { title?: string; noindex?: boolean } | null; title?: unknown; locale?: string } | undefined
-      try {
-        // Order by locale so an unscoped lookup (no locale requested) still answers deterministically
-        // rather than with whatever row the table happens to yield first.
-        const q = db.select(proj as never).from(c.table).where(scoped)
-        row = (c.def.translatable ? q.orderBy(asc(cols.locale)) : q).limit(1).get() as typeof row
-      } catch (error) {
-        // Same isolation rule as the main scan: a drifted collection loses its crumbs, loudly, instead of
-        // failing the whole render.
-        console.error(`[kestrel] resolvePage: skipped ancestor lookup in ${c.def.name}:`, (error as Error)?.message ?? error)
-        continue
-      }
-      if (!row) continue
-      // BOTH edges are needed, and neither subsumes the other — the same pairing `publishedAlternates`
-      // uses. The record tag covers every change to the row sitting here, INCLUDING the ones that make it
-      // stop being a crumb: the explicit publish action classifies its write as `before === after` (the
-      // record's current state), so a rename, a `noindex` or an unpublish is invisible in `crumbTags`,
-      // which only ever names where the record is NOW. `<coll>:<id>` is in that write's tag list whatever
-      // the row looks like, so it is what repairs the trail. Captured BEFORE the filters below, so a
-      // draft/noindexed/shadowing row — one that is currently NOT the crumb — still carries the edge that
-      // fires when it goes away.
-      captureRead(c.def.name, row.id)
-      if (publishedOnly && hasStatus && row.status !== 'published') break
-      if (row.seo?.noindex) break
-      const ancestor: PageAncestor = { path: ancestorPath }
-      const title = row.seo?.title || (typeof row.title === 'string' ? row.title : undefined)
-      if (title) ancestor.title = title
-      if (c.def.translatable && row.locale) ancestor.locale = row.locale
-      out.push(ancestor)
-      break
-    }
-  }
-  return out
-}
-
-/**
- * The first page-like record (across all collections, in registration order) whose `path` matches,
- * populated at depth 1 — or null, alongside the collections that could not be read at all. Reuses the
- * access-scoped `list()` so media/links populate exactly as a direct collection read would.
- * `publishedOnly` defaults true: a static render (prerender / runtime publisher) and an anonymous live
- * request must never see drafts. The authenticated-admin live preview passes false to surface a draft at
- * its real URL. Registration order is the precedence rule when two page-like collections happen to share
- * a path.
- */
-export function resolvePage(db: BetterSQLite3Database, collections: BuiltCollection[], path: string, locale?: string, publishedOnly = true): PageResolution {
-  const failed: string[] = []
-  for (const c of collections) {
-    if (!c.def.pageLike) continue
-    // withTotal:false — read only the first row, skip count(). capture:false — don't tag the whole
-    // collection here (the self-lookup is by path); instead tag the found record below, so this page
-    // depends on its OWN record, not on every sibling in the collection (precise invalidation).
-    let result: ReturnType<typeof list>
-    try {
-      result = list(db, c, { filter: [{ field: 'path', op: 'eq', value: path }], locale, depth: 1, perPage: 1, withTotal: false, capture: false }, publishedOnly)
-    } catch (error) {
-      // Table not migrated yet (e.g. a bare prerender DB) — isolate this collection's drift from the rest,
-      // but never silently: an unread collection is indistinguishable from one with no matching page, and
-      // the publisher would write a 404 over every one of its routes.
-      failed.push(c.def.name)
-      console.error(`[kestrel] resolvePage: skipped collection ${c.def.name}:`, (error as Error)?.message ?? error)
-      continue
-    }
-    const { data } = result
-    if (data.length) {
-      captureRead(c.def.name, (data[0] as { id?: number }).id ?? null)
-      return {
-        page: {
-          collection: c.def.name,
-          page: data[0]!,
-          alternates: publishedAlternates(db, c, data[0]!),
-          ancestors: publishedAncestors(db, collections, path, locale, publishedOnly),
-        },
-        failed,
-      }
-    }
-  }
-  return { page: null, failed }
-}

package/layers/public/server/utils/populate-links.ts

@@ -1,66 +0,0 @@
-import type { FieldPopulator } from '../../../core/server/utils/populate'
-import { memoDuringPrerender } from '../../../core/server/utils/prerender-memo'
-import { memoResolver } from '../../../core/server/utils/resolve-scope'
-import { captureRead } from '../../../core/server/utils/read-capture'
-import { collectRichtextRefs, resolveRichtextLinks } from '../../../fields/app/utils/richtext-links'
-
-// The localized-href-for-a-page-row rule lives once in core (`pageRowHref`); the link populator/resolver
-// use it as the target-row href. The resolver (link-resolve) STATUS-GATES: a missing OR draft target
-// renders `'#'` (no draft-slug leak); only a published target gets its real path.
-
-// Resolves an internal link `{collection, id}` to the target's localized path, or null when it has no
-// public path (target missing, not page-like, or no path). The locale is the TARGET row's own, so the
-// resolver takes no locale argument — mirroring how the media populator injects its by-id resolver.
-export type ResolveHref = (collection: string, id: number) => string | null
-
-interface InternalLink { type: 'internal'; collection: string; id: number; href?: string }
-
-function isInternal(value: unknown): value is InternalLink {
-  if (!value || typeof value !== 'object') return false
-  const v = value as Record<string, unknown>
-  return v.type === 'internal' && typeof v.collection === 'string' && typeof v.id === 'number'
-}
-
-// Replace an internal link value in place with a cloned `{...value, href}` (KestrelLink reads value.href).
-// external / email / tel and unresolvable internals pass through untouched (the latter render '#').
-function resolveLink(value: unknown, resolveHref: ResolveHref): unknown {
-  if (!isInternal(value)) return value
-  const href = resolveHref(value.collection, value.id)
-  return href == null ? value : { ...value, href }
-}
-
-/**
- * The `link` + `richtext` field populators. `link` replaces an internal link value with `{...value, href}`;
- * `richtext` rewrites `kestrel:` internal-link markers in the HTML to resolved localized paths. Both are
- * bare-keyed in every key-mode (link/richtext are not single-ref columns), so `keyMode` is irrelevant.
- * Registered per-type via `registerFieldPopulator`; the shared field-tree walker drives them over
- * top-level fields, block props, and (now) repeater entries. Both share one prerender memo so a target is
- * resolved once per generate across links and richtext alike.
- */
-export function buildLinkFieldPopulators(resolveHref: ResolveHref): { link: FieldPopulator; richtext: FieldPopulator } {
-  // Same composition as the relation/media populators: build-wide memo during generate, request-/publish-
-  // run-wide via the resolve scope (budgeted per live request, read-tags replayed on hits).
-  // memoResolver OUTERMOST so a per-scope budget-skip null is never cached build-wide by the prerender memo.
-  const key = (collection: string, id: number) => `link:${collection}:${id}`
-  const resolve = memoResolver(memoDuringPrerender(resolveHref, key), key)
-  return {
-    // captureRead runs even on a memo hit (each embedding page must record the dep), so it sits here, not
-    // inside `resolve`: it durably ties this render's route to `<collection>:<id>`, so renaming the target
-    // re-renders the referrer instead of leaving a baked href pointing at the pruned old path. A DRAFT
-    // target is tagged for the same reason: resolution is status-gated, so the referrer baked '#', and this
-    // edge is what lets the availability tag `<collection>:<id>` (planInvalidation's publish/unpublish/
-    // delete branches) re-render it into the real path. A dangling target's tag is simply inert — no write
-    // ever emits it.
-    link: (bag, key) => {
-      const value = bag[key]
-      if (isInternal(value)) captureRead(value.collection, value.id)
-      bag[key] = resolveLink(value, resolve)
-    },
-    richtext: (bag, key) => {
-      const html = bag[key]
-      if (typeof html !== 'string') return
-      for (const ref of collectRichtextRefs(html)) captureRead(ref.collection, ref.id)
-      bag[key] = resolveRichtextLinks(html, resolve)
-    },
-  }
-}

package/layers/public/server/utils/preview-token.ts

@@ -1,109 +0,0 @@
-import { randomBytes } from 'node:crypto'
-import type { H3Event } from 'h3'
-
-/**
- * Short-lived tickets carrying the editor's UNSAVED form state to a real page render. The editor's own
- * iframe gets unsaved content over postMessage, but an external tab has no parent window to talk to — so
- * instead of saving (which would publish intent the user never expressed) it mints a ticket and opens
- * `<url>?kestrel-preview-token=…`. Nothing is written to the DB; the ticket lives in this process only.
- *
- * The admin session is the actual gate (both endpoints are admin-only under the default-deny API guard).
- * The owner binding on top is NOT per-session isolation today: Kestrel has one shared admin credential and
- * `derivePrincipal` (access layer) never mints more than one admin identity, so every caller that reaches
- * this store has already been narrowed by `requireAdmin` to the same principal, and `previewOwner()`
- * resolves to the literal string `'admin'` every time — `t.owner === owner` cannot currently be false for
- * an admin caller. The binding is kept because it is the seam that makes the check meaningful the moment
- * (if ever) a per-user identity is added upstream; until then it costs nothing and documents the intent.
- * Tickets stay readable until they expire — a preview tab may be reloaded — and the store bounds itself in
- * both directions: a sweep on every mint, and a hard cap that evicts the oldest ticket.
- *
- * In-memory by design: previewing is a per-editor, per-minute affair, and a second server instance would
- * simply re-mint. Nothing durable depends on it.
- */
-export interface PreviewPayload {
-  collection: string
-  /** The record being previewed, or null for one that has never been saved. */
-  id: number | null
-  locale?: string
-  /** The editor's populated values — the same tree the live-preview bridge posts into the iframe. */
-  values: Record<string, unknown>
-}
-
-export interface PreviewTicket {
-  token: string
-  expiresAt: number
-}
-
-export interface PreviewStore {
-  mint: (owner: string, payload: PreviewPayload) => PreviewTicket
-  read: (token: string, owner: string) => PreviewPayload | null
-  size: () => number
-}
-
-export interface PreviewStoreOptions {
-  ttlMs?: number
-  max?: number
-  now?: () => number
-  randomToken?: () => string
-}
-
-const TTL_MS = 10 * 60 * 1000
-const MAX_TICKETS = 32
-
-export function createPreviewStore(opts: PreviewStoreOptions = {}): PreviewStore {
-  const ttlMs = opts.ttlMs ?? TTL_MS
-  const max = opts.max ?? MAX_TICKETS
-  const now = opts.now ?? Date.now
-  const randomToken = opts.randomToken ?? (() => randomBytes(24).toString('base64url'))
-  // Insertion-ordered, which is what makes "evict the oldest" a single `keys().next()`.
-  const tickets = new Map<string, { owner: string; payload: PreviewPayload; expiresAt: number }>()
-
-  function sweep(at: number): void {
-    for (const [token, t] of tickets) if (t.expiresAt <= at) tickets.delete(token)
-  }
-
-  return {
-    mint(owner, payload) {
-      const at = now()
-      sweep(at)
-      while (tickets.size >= max) tickets.delete(tickets.keys().next().value as string)
-      const token = randomToken()
-      const expiresAt = at + ttlMs
-      tickets.set(token, { owner, payload, expiresAt })
-      return { token, expiresAt }
-    },
-    read(token, owner) {
-      const t = tickets.get(token)
-      if (!t) return null
-      if (t.expiresAt <= now()) {
-        tickets.delete(token)
-        return null
-      }
-      // Bound to the minting owner rather than trusted on token possession alone — inert while every admin
-      // caller resolves to the same owner (see the module docstring), but the check a future per-user
-      // identity would need is already the one being run, not one that would need to be added later.
-      return t.owner === owner ? t.payload : null
-    },
-    size: () => tickets.size,
-  }
-}
-
-/**
- * Who a ticket belongs to. In production this only ever runs after `requireAdmin(event)` has already
- * thrown for anyone but the admin principal, and `derivePrincipal` (access layer) always gives that
- * principal a fixed `userId: 'admin'` — so the first branch always wins and this always returns the
- * literal `'admin'`. The `role` / `'anonymous'` fallbacks are unreached by any principal shape
- * `derivePrincipal` produces today; kept as a defensive default rather than a non-null assertion, since
- * this function has no way to enforce that invariant itself.
- */
-export function previewOwner(event: H3Event): string {
-  const principal = event.context.principal as { userId?: string | null; role?: string } | undefined
-  return principal?.userId ?? principal?.role ?? 'anonymous'
-}
-
-/** The process-wide store the two `/api/preview` handlers share. */
-let shared: PreviewStore | null = null
-export function usePreviewStore(): PreviewStore {
-  shared ??= createPreviewStore()
-  return shared
-}

package/layers/public/server/utils/publish/coalesce.ts

@@ -1,22 +0,0 @@
-import type { Invalidation } from './invalidation'
-
-/**
- * Merge a burst of invalidations collected during a debounce window into one: any `full` wins (a
- * full rebuild subsumes everything); otherwise union the `tags`/`render`/`prune` sets (dedup, stable
- * insertion order); all-`noop` (or empty) collapses to `noop`.
- */
-export function coalesce(items: Invalidation[]): Invalidation {
-  if (items.some((i) => i.type === 'full')) return { type: 'full' }
-  const tags = new Set<string>()
-  const render = new Set<string>()
-  const prune = new Set<string>()
-  let any = false
-  for (const i of items) {
-    if (i.type !== 'tags') continue
-    any = true
-    for (const t of i.tags) tags.add(t)
-    for (const r of i.render) render.add(r)
-    for (const p of i.prune) prune.add(p)
-  }
-  return any ? { type: 'tags', tags: [...tags], render: [...render], prune: [...prune] } : { type: 'noop' }
-}

package/layers/public/server/utils/publish/deps-persistence.ts

@@ -1,43 +0,0 @@
-import { eq } from 'drizzle-orm'
-import type { BetterSQLite3Database } from 'drizzle-orm/better-sqlite3'
-import { publishDeps } from '../../database/publish-deps'
-import type { DepsPersistence } from './deps'
-
-/** No-op persistence: a `DepsStore` backed by it runs purely in-memory. */
-const inMemoryOnly: DepsPersistence = { load: () => [], save: () => {}, remove: () => {}, clearAll: () => {} }
-
-/**
- * SQLite-backed durable persistence for the publish deps index. Takes the drizzle db as an argument (the
- * caller passes `useDb()`) so this stays a pure function of an injected db — fully unit-testable against an
- * in-memory database, no auto-import in the module. Tags are stored JSON-encoded (a small bounded set per
- * route).
- *
- * Probes the `publish_deps` table once on creation: if it is absent (a not-yet-migrated deploy — prod never
- * auto-DDLs, so an operator must run `db:migrate`) it warns and returns an in-memory-only no-op rather than
- * crashing the boot publish + every write. Full durability (cross-restart pruning) returns once the table
- * exists. Probing once (not per-op) keeps ALL of load/save/remove/clearAll consistent — the boot publish
- * calls `save()` per route, so a resilient `load()` alone was not enough.
- */
-export function createSqlitePersistence(db: BetterSQLite3Database): DepsPersistence {
-  try {
-    db.select().from(publishDeps).limit(1).all()
-  } catch {
-    console.warn('[kestrel] publish_deps table is missing — run the `db:migrate` task. Falling back to in-memory deps (no cross-restart prune until migrated).')
-    return inMemoryOnly
-  }
-  return {
-    load() {
-      return db.select().from(publishDeps).all().map((r) => [r.route, JSON.parse(r.tags) as string[]] as const)
-    },
-    save(route, tags) {
-      const json = JSON.stringify([...tags])
-      db.insert(publishDeps).values({ route, tags: json }).onConflictDoUpdate({ target: publishDeps.route, set: { tags: json } }).run()
-    },
-    remove(route) {
-      db.delete(publishDeps).where(eq(publishDeps.route, route)).run()
-    },
-    clearAll() {
-      db.delete(publishDeps).run()
-    },
-  }
-}

package/layers/public/server/utils/publish/deps.ts

@@ -1,87 +0,0 @@
-/**
- * Routes whose captured dependency tags intersect `changed`. The publisher captures, per published
- * route, the set of data tags it read while rendering (`<coll>` for a `list`, `<coll>:<id>` for a
- * `getOne`, `<coll>` for a singleton). On a write, the changed tags `{coll, coll:id}` map back to
- * exactly the routes that embed that data — so editing one speaker re-renders its detail page + the
- * overview that lists speakers, and nothing else. Pure.
- */
-export function routesForTags(changed: Iterable<string>, index: Map<string, Set<string>>): string[] {
-  const want = new Set(changed)
-  const out: string[] = []
-  for (const [route, tags] of index) {
-    for (const t of tags) {
-      if (want.has(t)) { out.push(route); break }
-    }
-  }
-  return out
-}
-
-/**
- * Routes the publisher previously wrote (tracked in the deps index) that are no longer in the published
- * set — a page that was unpublished, deleted, or whose slug changed. Their static files must be removed
- * on the next full publish. Pure; the diff drives a targeted prune (it only ever deletes files this
- * publisher created — output ≡ DB, no opt-in toggle).
- */
-export function staleRoutes(tracked: Iterable<string>, publishedNow: Iterable<string>): string[] {
-  const live = new Set(publishedNow)
-  return [...tracked].filter((route) => !live.has(route))
-}
-
-/**
- * Durable backing for the deps index: a write-through `route → tags` store that survives a restart.
- * The in-memory index is the (synchronous) query layer; this port persists every mutation and is read
- * back once on construction to rehydrate. Kept abstract so `DepsStore` stays pure-unit-testable (a fake
- * port in node tests) while production injects the SQLite-backed adapter (`createSqlitePersistence`).
- */
-export interface DepsPersistence {
-  /** Every persisted `route → tags` pair (read once on DepsStore construction to rehydrate). */
-  load(): Iterable<readonly [string, Iterable<string>]>
-  /** Persist (upsert) a route's tag set. */
-  save(route: string, tags: Iterable<string>): void
-  /** Remove a route. */
-  remove(route: string): void
-  /** Drop every route. */
-  clearAll(): void
-}
-
-/**
- * In-memory `route → tags` index, populated as routes are published and queried on each write — the fast
- * synchronous query layer. When constructed with a `DepsPersistence`, the index is rehydrated from it on
- * boot and every mutation is written through, so the store survives a restart: a boot full-publish's
- * `staleRoutes` can then prune pages that were unpublished/deleted while the server was down.
- */
-export class DepsStore {
-  private index = new Map<string, Set<string>>()
-
-  constructor(private persistence?: DepsPersistence) {
-    if (persistence) for (const [route, tags] of persistence.load()) this.index.set(route, new Set(tags))
-  }
-
-  /** Replace the tag set captured for `route`. */
-  record(route: string, tags: Iterable<string>): void {
-    const set = new Set(tags)
-    this.index.set(route, set)
-    this.persistence?.save(route, set)
-  }
-
-  /** Routes whose tags intersect `changed`. */
-  routesForTags(changed: Iterable<string>): string[] {
-    return routesForTags(changed, this.index)
-  }
-
-  /** Every route with a captured tag set. */
-  routes(): string[] {
-    return [...this.index.keys()]
-  }
-
-  /** Drop `route` from the index (on prune/unpublish). */
-  forget(route: string): void {
-    this.index.delete(route)
-    this.persistence?.remove(route)
-  }
-
-  clear(): void {
-    this.index.clear()
-    this.persistence?.clearAll()
-  }
-}