@michaelthielemann/kestrel 3.0.1 → 4.0.1

package/layers/admin/app/composables/useListRows.ts

@@ -20,12 +20,15 @@ interface ListResponse {
   total: number
   page: number
   perPage: number
+  /** Set by `validateOut` — count of rows in `data` replaced with the quarantine shape. */
+  quarantinedCount?: number
 }
 
 export function useListRows(opts: ListRowsOptions) {
   const { t } = useT()
   const rows = ref<Record<string, unknown>[]>([])
   const total = ref(0)
+  const quarantinedCount = ref(0)
   // Surfaced when a (re)fetch fails — an inline error + Retry, never a silent stale list or a thrown
   // error boundary. Distinct from the empty state (which only shows when the fetch SUCCEEDED with no rows).
   const error = ref<string | null>(null)
@@ -37,12 +40,13 @@ export function useListRows(opts: ListRowsOptions) {
     const mine = ++seq
     const locale = opts.locale()
     try {
-      const res = await $fetch<ListResponse>(`/api/${opts.collection.value}`, {
+      const res = await $fetch<ListResponse>(`/api/${opts.collection.value}/readMany`, {
         query: { ...opts.effectiveQuery.value, ...(locale ? { locale } : {}) },
       })
       if (mine !== seq) return
       rows.value = res.data
       total.value = res.total
+      quarantinedCount.value = res.quarantinedCount ?? 0
       error.value = null
       // A page that emptied out from under us — e.g. bulk-deleting the last rows of the trailing page —
       // would otherwise strand the user on an out-of-range page showing the "create your first" empty
@@ -60,9 +64,10 @@ export function useListRows(opts: ListRowsOptions) {
     }
   }
 
-  return { rows, total, error, totalPages, fetchRows } as {
+  return { rows, total, quarantinedCount, error, totalPages, fetchRows } as {
     rows: Ref<Record<string, unknown>[]>
     total: Ref<number>
+    quarantinedCount: Ref<number>
     error: Ref<string | null>
     totalPages: ComputedRef<number>
     fetchRows: () => Promise<void>

package/layers/admin/app/composables/useListUrlState.ts

@@ -1,7 +1,7 @@
 import type { Ref } from 'vue'
 import type { ListColumn } from '../utils/list-columns'
 import { toQuery, toggleSort, parseListQuery, type FilterCell, type ListState } from '../utils/list-query'
-import { clampPerPage, DEFAULT_PER_PAGE } from '../../../core/app/utils/list-limits'
+import { clampPerPage, DEFAULT_PER_PAGE } from '@michaelthielemann/kestrel-core/client'
 
 /**
  * The URL is the SINGLE SOURCE OF TRUTH for a collection list's committed state (sort · page · perPage ·

package/layers/admin/app/composables/usePublishStatus.ts

@@ -1,7 +1,7 @@
 import { ref, toValue } from 'vue'
 import type { MaybeRefOrGetter } from 'vue'
 
-/** The live publish state of a record's static page, as returned by `GET /api/publish-status`. */
+/** The live publish state of a record's static page, as returned by `GET /api/publishStatus`. */
 export interface PublishStatusData {
   route: string | null
   status: 'success' | 'error' | null
@@ -59,7 +59,7 @@ export function usePublishStatus(args: {
       return
     }
     try {
-      const res = await $fetch<PublishStatusData>('/api/publish-status', {
+      const res = await $fetch<PublishStatusData>('/api/publishStatus', {
         query: { collection: toValue(args.collection), id, locale: toValue(args.locale) },
       })
       if (token === pollToken) data.value = res

package/layers/admin/app/layouts/admin.vue

@@ -124,7 +124,6 @@ useHead(() => ({
     min-height: 0;
   }
 
-  // Collapsed rail: narrow to icon-only width.
   &--rail-collapsed &__rail {
     flex-basis: var(--rail-width-collapsed);
     width: var(--rail-width-collapsed);

package/layers/admin/app/pages/admin/[collection]/[id].vue

@@ -43,8 +43,8 @@ const heading = computed(() =>
       : t('editor.editRecord', { collection: singular.value, id }),
 )
 
-// The external-tab button always works now: with unsaved edits it opens a preview TICKET (no save, no
-// publish), otherwise the record's own URL — so the tooltip has to say which of the two you'd get.
+// The external-tab button opens a preview ticket when there are unsaved edits (no save, no publish),
+// otherwise the record's own URL — so the tooltip has to say which of the two you'd get.
 const previewTitle = computed(() => t(editorRef.value?.dirty ? 'editor.previewUnsaved' : 'editor.openInNewTab'))
 
 const skipGuard = ref(false)
@@ -121,9 +121,10 @@ async function confirmDelete() {
         <KestrelUiButton type="button" variant="ghost" size="sm" icon="external-link" :title="previewTitle" :aria-label="previewTitle" :loading="editorRef?.previewOpening" @click="editorRef?.openPreview()" />
         <KestrelUiButton type="button" variant="secondary" size="sm" icon="x" :disabled="saving" @click="toList">{{ t('common.cancel') }}</KestrelUiButton>
         <KestrelUiButton v-if="id !== 'new'" variant="danger" size="sm" icon="trash" :loading="deleting" @click="onDelete">{{ t('common.delete') }}</KestrelUiButton>
-        <KestrelUiButton type="submit" :form="EDITOR_FORM_ID" variant="primary" size="sm" icon="check" :loading="saving">{{ t('common.save') }}</KestrelUiButton>
+        <!-- A quarantined record is read-only: no Save, no Publish — there is nothing valid to write. -->
+        <KestrelUiButton v-if="!editorRef?.quarantined" type="submit" :form="EDITOR_FORM_ID" variant="primary" size="sm" icon="check" :loading="saving">{{ t('common.save') }}</KestrelUiButton>
         <!-- Publishing is its own decision: Save persists, Publish writes the static page (ADR-0008). -->
-        <KestrelUiButton v-if="editorRef?.canPublish !== false" type="button" variant="secondary" size="sm" icon="upload" :loading="editorRef?.publishing" :disabled="saving" @click="editorRef?.publish()">{{ t('common.publish') }}</KestrelUiButton>
+        <KestrelUiButton v-if="editorRef?.canPublish !== false && !editorRef?.quarantined" type="button" variant="secondary" size="sm" icon="upload" :loading="editorRef?.publishing" :disabled="saving" @click="editorRef?.publish()">{{ t('common.publish') }}</KestrelUiButton>
         <KestrelEditorStatus class="record__ampel" :dirty="editorRef?.dirty ?? false" :saving="saving" :has-status="editorRef?.hasStatus ?? false" :status="editorRef?.status" :saved-status="editorRef?.savedStatus" :page-like="editorRef?.pageLike ?? false" :live="editorRef?.live" />
       </div>
     </div>

package/layers/admin/app/pages/admin/index.vue

@@ -17,7 +17,7 @@ try {
 // Broken-reference count for the alert banner — fire-and-forget so it never delays the dashboard, and a
 // failure (or a not-yet-built index) simply shows no banner.
 const brokenCount = ref(0)
-$fetch<unknown[]>('/api/references/broken')
+$fetch<unknown[]>('/api/brokenRefs')
   .then((r) => { brokenCount.value = r.length })
   .catch(() => { brokenCount.value = 0 })
 </script>

package/layers/admin/app/pages/admin/references.vue

@@ -4,7 +4,7 @@ definePageMeta({ layout: 'admin', middleware: 'admin-auth' })
 // The global broken-references report: every record that links to a deleted or unpublished target. The
 // referrer keeps its last published output (the stale link stays live) until it is re-edited — this is
 // the editor's queue for fixing those. Derived on read, so an entry clears once the link is fixed or the
-// target restored. Admin-only (the `references` API resource is outside the public set).
+// target restored. Admin-only (the `brokenRefs` pipeline is outside the public set).
 interface BrokenRow {
   source: { collection: string; id: number }
   target: { collection: string; id: number }
@@ -17,7 +17,7 @@ const broken = ref<BrokenRow[]>([])
 // the green all-clear (that would imply a verified-clean site when nothing was actually verified).
 const loadError = ref(false)
 try {
-  broken.value = await $fetch<BrokenRow[]>('/api/references/broken')
+  broken.value = await $fetch<BrokenRow[]>('/api/brokenRefs')
 } catch {
   loadError.value = true
 }

package/layers/admin/app/utils/block-tree.ts

@@ -1,4 +1,4 @@
-import type { SerializedBlock } from '../../../core/server/utils/serialize-collection'
+import type { SerializedBlock } from '@michaelthielemann/kestrel-core'
 import { reorder } from '../../../ui/app/utils/reorder'
 import { initialValues } from './edit-form'
 

package/layers/admin/app/utils/collection-ops.ts

@@ -1,17 +1,42 @@
 // Wire shapes for the collection batch endpoint, shared by the ops composable and the delete dialog.
 // Mirrors media/app/utils/ops.ts: one definition, no drift between the caller and the confirm UI.
+import type { SerializedAction } from '@michaelthielemann/kestrel-core'
 
 /** The four batch actions the command endpoint accepts (a row action is a bulk op with one id). */
 export type BatchAction = 'delete' | 'publish' | 'unpublish' | 'duplicate'
 
-/** POST /api/{collection}/bulk response. For `duplicate`, `ids` are the CREATED rows. */
+/** The built-in actions the admin renders with its own dedicated presentation (Delete/Duplicate buttons,
+ *  the Publish/Unpublish pair) — always present on the wire, but never re-rendered generically. */
+const BUILTIN_ACTION_NAMES = new Set(['deleteMany', 'duplicate'])
+
+/** The schema-driven actions beyond the built-ins — what a consumer's `definePipeline` adds. */
+export function customActions(actions: SerializedAction[]): SerializedAction[] {
+  return actions.filter((a) => !BUILTIN_ACTION_NAMES.has(a.name))
+}
+
+/** Custom actions invokable from the bulk-selection bar. */
+export function bulkCustomActions(actions: SerializedAction[]): SerializedAction[] {
+  return customActions(actions).filter((a) => a.kind === 'bulk' || a.kind === 'both')
+}
+
+/** Custom actions invokable from a single row. */
+export function recordCustomActions(actions: SerializedAction[]): SerializedAction[] {
+  return customActions(actions).filter((a) => a.kind === 'record' || a.kind === 'both')
+}
+
+/** What a batch pipeline answers with: `deleteMany`/`updateMany` a count plus the ids they touched,
+ *  `duplicate` the created rows. */
+export type BatchPipelineResult = { count: number, ids: number[] } | { id: number }[]
+
+/** The batch outcome the list UI reports. For `duplicate`, `ids` are the CREATED rows. A custom action's
+ *  `action` is its pipeline name — not one of the four built-ins. */
 export interface BulkResult {
-  action: BatchAction
+  action: BatchAction | (string & {})
   count: number
   ids: number[]
 }
 
-/** GET /api/references/referrers?ids=1,2,3 response: id -> how many other records reference it.
+/** GET /api/{collection}/referrers?ids=1,2,3 response: id -> how many other records reference it.
  *  `checked` is false when the index lookup itself failed, in which case `counts` is empty because nothing
  *  could be read — NOT because nothing links to the selection. */
 export interface ReferrerCounts {

package/layers/admin/app/utils/edit-form.ts

@@ -1,5 +1,4 @@
-import type { FieldDef } from '../../../core/server/utils/defineCollection'
-import type { SerializedField } from '../../../core/server/utils/serialize-collection'
+import type { FieldDef, SerializedField } from '@michaelthielemann/kestrel-core'
 import { resolveFieldEmpty } from '../../../ui/app/utils/field-empty'
 
 export interface ServerIssue {
@@ -208,6 +207,39 @@ function flattenBlocksById(blocks: readonly unknown[] | null | undefined, into:
   }
 }
 
+/** One stale reference a record holds. Wire shape of `DeadRef` (kept structural here so this module stays
+ *  Vue-free and doesn't import the admin-only `dead-refs.ts` type file). */
+interface DeadRefLike {
+  field: string
+  blockId?: string
+}
+
+/**
+ * Carry dead-reference warnings across a `content` change, mirroring `reconcileBlockErrors`: a warning at
+ * a block (by stable id) is dropped once THAT field's value changes (the user swapped the broken
+ * reference) or the block is removed; it survives a pure reorder. Root-level (non-block) dead refs are
+ * untouched here — `setField` drops those directly when their own field is edited.
+ */
+export function reconcileDeadRefs<T extends DeadRefLike>(
+  refs: readonly T[],
+  prev: readonly unknown[] | null | undefined,
+  next: readonly unknown[] | null | undefined,
+): T[] {
+  const prevById = new Map<string, BlockLike>()
+  const nextById = new Map<string, BlockLike>()
+  flattenBlocksById(prev, prevById)
+  flattenBlocksById(next, nextById)
+  return refs.filter((r) => {
+    if (!r.blockId) return true
+    const before = prevById.get(r.blockId)
+    const after = nextById.get(r.blockId)
+    if (!before || !after) return false
+    const beforeVal = (before.props ?? {})[r.field]
+    const afterVal = (after.props ?? {})[r.field]
+    return valuesEqual(beforeVal, afterVal)
+  })
+}
+
 /** Structural deep-equality for the value shapes the editor tracks (primitives, arrays, plain objects). */
 export function valuesEqual(a: unknown, b: unknown): boolean {
   if (a === b) return true

package/layers/admin/app/utils/editor-expose.ts

@@ -31,4 +31,6 @@ export interface EditorExpose {
   /** Open the record in a new tab: the saved URL, or the unsaved state carried by a preview ticket. */
   openPreview: () => Promise<void>
   previewOpening: boolean
+  /** The loaded row is the quarantine shape — read-only, hosts must hide Save/Publish. */
+  quarantined: boolean
 }

package/layers/admin/app/utils/editor-form-context.ts

@@ -1,6 +1,5 @@
 import type { ComputedRef, InjectionKey, Ref } from 'vue'
-import type { FieldDef } from '../../../core/server/utils/defineCollection'
-import type { LayoutNode } from '../../../core/server/utils/field-layout'
+import type { FieldDef, LayoutNode } from '@michaelthielemann/kestrel-core'
 import type { BlockErrorMap } from './edit-form'
 import type { DeadRef } from './dead-refs'
 

package/layers/admin/app/utils/field-keys.ts

@@ -1,4 +1,4 @@
-import type { SerializedField } from '../../../core/server/utils/serialize-collection'
+import type { SerializedField } from '@michaelthielemann/kestrel-core'
 
 /**
  * The jsKey (wire key) for a field — NOT a DB column name. The server marks single relation/media fields

package/layers/admin/app/utils/list-columns.ts

@@ -1,5 +1,6 @@
-import type { SerializedCollection, SerializedField } from '../../../core/server/utils/serialize-collection'
-import { fieldFilterKind, META_FILTER_KIND, type FilterKind } from '../../../core/app/utils/filter-ops'
+import { META_FILTER_KIND, fieldFilterKind } from '@michaelthielemann/kestrel-core/client'
+import type { FilterKind } from '@michaelthielemann/kestrel-core/client'
+import type { SerializedCollection, SerializedField } from '@michaelthielemann/kestrel-core'
 import { jsKey } from './field-keys'
 
 export type ListColumnType = 'meta' | 'field' | 'translations' | 'deadRefs'

package/layers/admin/app/utils/list-query.ts

@@ -1,5 +1,5 @@
-import { FILTER_RE, isFilterOp, opAllowed, type FilterOp } from '../../../core/app/utils/filter-ops'
-import { clampPerPage } from '../../../core/app/utils/list-limits'
+import { FILTER_RE, clampPerPage, isFilterOp, opAllowed } from '@michaelthielemann/kestrel-core/client'
+import type { FilterOp } from '@michaelthielemann/kestrel-core/client'
 import type { ListColumn } from './list-columns'
 
 // The page-size bounds live in ONE shared module (core/app/utils/list-limits) so the client list, the

package/layers/admin/app/utils/populate-blocks.ts

@@ -1,6 +1,6 @@
-import type { SerializedBlock, SerializedField } from '../../../core/server/utils/serialize-collection'
+import type { SerializedBlock, SerializedField } from '@michaelthielemann/kestrel-core'
 import type { ResolvedMedia } from '../../../media/app/composables/useMediaResolver'
-import { collectRichtextRefs, resolveRichtextLinks } from '../../../fields/app/utils/richtext-links'
+import { collectRichtextRefs, resolveRichtextLinks } from '@michaelthielemann/kestrel-core/client'
 
 // Single source of truth for the resolved-media shape lives in the media layer (admin → media).
 export type { ResolvedMedia }

package/layers/admin/app/utils/reauth.ts

@@ -1,10 +1,9 @@
 import { safeRedirect } from './safe-redirect'
 
-// The auth bootstrap endpoints the server always permits (login/session/logout). A 401 from these is
-// not a stale session — a wrong-password login 401s — so it must not trigger a re-auth redirect. Matched
-// exactly (not by `/api/auth/` prefix) so a guarded endpoint under a consumer collection named `auth`
-// (e.g. `/api/auth/5`) still re-authenticates.
-const BOOTSTRAP_PATHS = new Set(['/api/auth/login', '/api/auth/session', '/api/auth/logout'])
+// The auth endpoints (login/session/logout). A 401 from these is not a stale session — a wrong-password
+// login 401s — so it must not trigger a re-auth redirect. Matched exactly, so a guarded endpoint under a
+// consumer collection named `auth` (e.g. `/api/auth/readOne/5`) still re-authenticates.
+const BOOTSTRAP_PATHS = new Set(['/api/login', '/api/session', '/api/logout'])
 
 /**
  * Decide whether a failed `$fetch` should bounce the user to the login screen, and to which URL.
@@ -12,7 +11,7 @@ const BOOTSTRAP_PATHS = new Set(['/api/auth/login', '/api/auth/session', '/api/a
  * Returns the login redirect target for a 401 raised by a guarded `/api/*` call made from inside the
  * admin SPA — but stays null for:
  *  - non-401 statuses and non-`/api` requests (nothing to re-authenticate);
- *  - the auth-bootstrap endpoints (`/api/auth/*`): a wrong-password login 401s and must stay put;
+ *  - the auth endpoints: a wrong-password login 401s and must stay put;
  *  - any location that isn't a safe admin redirect target — which also rules out the login page itself
  *    (no redirect loop) and public/SSG pages (the static site never logs in).
  */

package/layers/auth/server/plugins/01.register-auth-pipelines.ts

@@ -0,0 +1,7 @@
+import { registerPipeline } from '@michaelthielemann/kestrel-core'
+import { buildAuthPipelines } from '@michaelthielemann/kestrel-auth'
+
+// Registration only — nothing resolves a pipeline here; the registry is read on the first request.
+export default defineNitroPlugin(() => {
+  for (const def of buildAuthPipelines()) registerPipeline(def)
+})

package/layers/collections/server/plugins/01.register.ts

@@ -1,22 +1,19 @@
 import collections from '#kestrel/collections'
 import blocks from '#kestrel/blocks'
-import { registerBlock, type BlockDef } from '../../../fields/server/utils/defineBlock'
-import { ensureBuilt } from '../../../fields/server/utils/buildCollection'
+import { registerBlock, type BlockDef } from '@michaelthielemann/kestrel-fields'
+import { ensureBuilt, collectionEnabled, registerCollection  } from '@michaelthielemann/kestrel-core'
 import { resolveServerKestrel, serverRuntimeConfig } from '../../../core/server/utils/server-config'
-import { collectionEnabled } from '../../../core/server/schema/bootstrap'
-import type { CollectionDef } from '../../../core/server/utils/defineCollection'
-import type { BuiltCollection } from '../../../core/server/utils/collection-types'
-
+import type { BuiltCollection, CollectionDef } from '@michaelthielemann/kestrel-core'
 // Auto-discovered collection files default-export either a plain CollectionDef (the common consumer
 // form, `export default defineCollection(…)`) or an already-built collection (advanced). `ensureBuilt`
 // normalizes both so the registry only ever holds BuiltCollections.
 //
-// NOTE on ordering: the `01.` prefix sorts only WITHIN this (collections) layer. Nitro runs plugins by
-// layer-then-filename, so this plugin does NOT run second — in-repo it runs LAST (after core's
-// 00.migrate/02.schema-sync/03.record-refs), and the cross-layer order differs again for an
-// `extends: ['@michaelthielemann/kestrel']` consumer. That is safe ONLY because nothing reads the registry at plugin init:
-// migrate/schema-sync read the `#kestrel/collections` virtual directly, and the ref/cleanup/publish
-// plugins register deferred listeners. Keep that invariant — do not add an init-time allCollections() read.
+// NOTE on ordering: this plugin's real execution position is declared data now
+// (layers/core/modules/plugin-order/plugin-order.ts), not an accident of filename/layer scan order — it
+// runs after every core plugin (00.migrate/02.schema-sync included), identically in both build contexts.
+// It is order-free regardless: nothing reads the registry at plugin init — migrate/schema-sync read the
+// `#kestrel/collections` virtual directly, and the ref/cleanup/publish plugins register deferred listeners.
+// Keep that invariant — do not add an init-time allCollections() read.
 export default defineNitroPlugin(() => {
   for (const block of blocks as BlockDef[]) registerBlock(block)
   // Built-in collections (`pages`, `media`) register by default but can be disabled per consumer via

package/layers/collections/server/plugins/02.register-relation-populate.ts

@@ -1,15 +1,13 @@
-import { registerFieldPopulator } from '../../../core/server/utils/populate'
-import { buildRelationFieldPopulator, skipMissing } from '../utils/populate-relations'
-import { getCollection } from '../../../core/server/utils/registry'
-import { getOne } from '../../../core/server/utils/crud'
-
+import { getCollection, getOne, registerFieldPopulator, useDb } from '@michaelthielemann/kestrel-core'
+import { isPubliclyReadable, publicReadableResources } from '@michaelthielemann/kestrel-access'
+import { buildRelationFieldPopulator, skipMissing } from '@michaelthielemann/kestrel-collections'
 // Expand relation fields to the fully-populated related record(s) under `$<name>` at read time (depth ≥ 1).
 // The related read is published-only (a draft target is skipped, never leaked to a public read), tolerates a
 // stale/deleted id (getOne 404 → null via `skipMissing`, other errors propagate — fail-loud), and runs at
 // `depth - 1`, so `populateRow` bails at 0 and cycles terminate. Registered per-type; the shared field-tree
 // walker (fields layer) dispatches it.
-// The reachability predicate is the registry-driven public set, NOT the guard's full decision — the guard
-// also folds in `registeredGrants()`, which this omits. So a collection opened to anonymous by a registered
+// The reachability predicate is the declared public set, NOT the guard's full decision — the guard also
+// folds in `registeredGrants()`, which this omits. So a collection opened to anonymous by a registered
 // grant is served on its own route but stays unexpanded here: fail-closed drift, never a widening.
 export default defineNitroPlugin(() => {
   registerFieldPopulator('relation', buildRelationFieldPopulator((collection, id, depth, locale, publicOnly) => {

package/layers/{fields → core}/app/utils/field-factories.ts

@@ -1,4 +1,4 @@
-import type { FieldDef } from '../../../core/server/utils/defineCollection'
+import type { FieldDef } from '@michaelthielemann/kestrel-core'
 
 /**
  * Field factories for single-file (SFC) block authoring, à la Pruvious. A block's schema is declared as its

package/layers/core/modules/auto-discovery/extract-block.ts

@@ -1,9 +1,9 @@
 import { readFileSync } from 'node:fs'
 import { basename } from 'node:path'
 import { parse } from '@babel/parser'
-import type { FieldDef } from '../../server/utils/defineCollection'
-import * as factoryModule from '../../../fields/app/utils/field-factories'
-import { KESTREL_FIELD } from '../../../fields/app/utils/field-factories'
+import type { FieldDef } from '@michaelthielemann/kestrel-core'
+import * as factoryModule from '../../app/utils/field-factories'
+import { KESTREL_FIELD } from '../../app/utils/field-factories'
 
 /** The extracted block definition (shape mirrors `BlockDef`, kept structural so this build-time module
  *  needs no `layers/fields` runtime import). */

package/layers/core/modules/auto-discovery/index.ts

@@ -1,9 +1,10 @@
 import { existsSync } from 'node:fs'
 import { join } from 'node:path'
 import { addComponentsDir, addTemplate, addTypeTemplate, createResolver, defineNuxtModule } from '@nuxt/kit'
-import { collectBlockSfcs, collectDefinitions, renderRegistry } from './scan'
+import { collectBlockSfcs, collectDefinitions, collectManifestFiles, renderPackageConcatRegistry, renderPackageMergedRegistry, renderRegistry, resolvePackageEntry } from './scan'
 import { renderBlockRegistry } from './extract-block'
 import { offerableLayouts, renderLayoutRegistry } from '../../app/utils/layouts'
+import { PACKAGE_COLLECTIONS, PACKAGE_MANIFESTS, PACKAGE_SCHEMA_TABLES } from './package-registry'
 
 export default defineNuxtModule({
   meta: { name: 'kestrel-auto-discovery' },
@@ -18,6 +19,7 @@ export default defineNuxtModule({
     // Blocks are authored as single `.vue` files under each layer's `app/blocks/` — the SFC is BOTH the
     // schema source (extracted at build into `#kestrel/blocks`) AND the display component. Register the dir
     // so `app/blocks/Hero.vue` resolves as the global `BlocksHero` that the public BlockRenderer renders.
+    // No Kestrel package ships a block today, so this stays a pure consumer-dir scan (nothing to bridge).
     for (const root of roots) {
       const dir = join(root, 'app/blocks')
       if (existsSync(dir)) addComponentsDir({ path: dir, prefix: 'Blocks', global: true, pathPrefix: false })
@@ -34,21 +36,77 @@ export default defineNuxtModule({
 
     nuxt.hook('nitro:config', (nitro) => {
       nitro.virtual ||= {}
-      // Consumer field types register as a side effect on import, and the schema engine builds a table the
-      // moment a collection/block module loads. So the collections + blocks registries import the field-type
-      // registry FIRST — guaranteeing custom types are registered before any column / validator is built.
+      // `@michaelthielemann/kestrel-fields`'s built-in descriptors (text/richtext/number/…) seed `core`'s field-type registry
+      // as a side effect of importing the package itself — core cannot import fields, so this is the one
+      // place that import happens. Resolved to a real file path (`resolvePackageEntry`), not left as the
+      // bare specifier: a Nitro virtual module has no real file of its own for a bundler to resolve a bare
+      // import FROM, so it falls back to the project root — where, under a real consumer's pnpm install,
+      // this package isn't visible (only the engine directly depends on it). Prepended so it always runs, even with zero consumer
+      // field types (an empty `collectDefinitions` result would otherwise generate `export default []`,
+      // importing nothing). Consumer field types register as a side effect on import too, and the schema
+      // engine builds a table the moment a collection/block module loads — so the collections/blocks/
+      // schema-tables/module-manifests virtuals ALL import the field-type seed FIRST (every one of them can
+      // now reach a package's `buildCollection()` call transitively via `kestrelDiscovery`, per ADR-0029 —
+      // an ESM barrel is an eager, whole-module-graph load — so all four need the same guard, not only the
+      // two that directly build collections themselves).
+      const importFieldTypesSeed = `import { fieldTypes as __kestrelSeed } from ${JSON.stringify(resolvePackageEntry('@michaelthielemann/kestrel-fields'))}\n`
+        + `if (!__kestrelSeed || typeof __kestrelSeed !== 'object') throw new Error('[kestrel] built-in field types failed to seed')\n`
+      // A real runtime check on the imported binding, not a bare `import "path"` or a discarded `void x`
+      // — Nitro's dev build tree-shakes an import whose binding has no provable effect, silently dropping
+      // the seed and breaking every collection. A `throw` Rollup can't prove unreachable survives.
+      // MUST be a static `import` (not `import()`): a dynamic import runs as an ordinary statement AFTER
+      // every static import of the same module has already evaluated (ESM linking order), which would run
+      // it too late — after a collection's own static import has already tried to build its table. A static
+      // import evaluates before any sibling static import declared after it, which is what orders this
+      // correctly. Every virtual below imports `@michaelthielemann/kestrel-fields` directly for this reason (on top of, not
+      // instead of, `#kestrel/field-types` for collections/blocks — chaining virtual-imports-virtual was
+      // unreliable in Nitro dev, so the real package import stays even where the virtual ALSO gets imported).
+      const importFieldTypesVirtual = `${importFieldTypesSeed}import { default as __kestrelFieldTypes } from '#kestrel/field-types'\n`
+        + `if (!__kestrelFieldTypes) throw new Error('[kestrel] #kestrel/field-types failed to load')\n`
+
       nitro.virtual['#kestrel/field-types'] = () =>
-        renderRegistry(collectDefinitions(roots, 'server/field-types'))
+        `${importFieldTypesSeed}${renderRegistry(collectDefinitions(roots, 'server/field-types'))}`
+
       nitro.virtual['#kestrel/collections'] = () =>
-        `import '#kestrel/field-types'\n` + renderRegistry(collectDefinitions(roots, 'server/collections'))
+        renderPackageMergedRegistry({
+          packages: PACKAGE_COLLECTIONS.map(resolvePackageEntry),
+          property: 'collections',
+          consumerFiles: collectDefinitions(roots, 'server/collections'),
+          nameOfExpr: '(x) => x.name',
+          preamble: importFieldTypesVirtual,
+        })
+
       // Extract each `app/blocks/*.vue` into a plain BlockDef inlined as JSON (no per-file imports needed).
+      // No package ships a block today (see above), so this stays the plain consumer-dir scan, prefixed
+      // with the same seed a block's field-typed props may need.
       nitro.virtual['#kestrel/blocks'] = () =>
-        `import '#kestrel/field-types'\n` + renderBlockRegistry(collectBlockSfcs(roots))
-      // Standalone (non-collection) tables: each layer's `server/schema-tables/*.ts` default-exports one
-      // drizzle table (media → folders, public → publish_deps/publish_status; consumers can add their own).
-      // The schema engine consumes this instead of core hardcoding upper-layer tables.
+        `${importFieldTypesVirtual}${renderBlockRegistry(collectBlockSfcs(roots))}`
+
+      // Standalone (non-collection) tables: each package's `kestrelDiscovery.schemaTables`, merged with
+      // each layer's `server/schema-tables/*.ts` default export (media → folders, public → publish_deps/
+      // publish_status/…; consumers can add their own). The schema engine consumes this instead of core
+      // hardcoding upper-layer tables.
       nitro.virtual['#kestrel/schema-tables'] = () =>
-        renderRegistry(collectDefinitions(roots, 'server/schema-tables'))
+        renderPackageMergedRegistry({
+          packages: PACKAGE_SCHEMA_TABLES.map(resolvePackageEntry),
+          property: 'schemaTables',
+          consumerFiles: collectDefinitions(roots, 'server/schema-tables'),
+          nameOfExpr: '(x) => __kestrelTableName(x)',
+          extraImports: `import { getTableName as __kestrelTableName } from 'drizzle-orm'`,
+          preamble: importFieldTypesVirtual,
+        })
+
+      // Per-module ownership manifests (ADR-0012): each package's `kestrelDiscovery.manifest` plus each
+      // layer's `server/db/manifest.ts` default export, for the `db:migrate-module` task to enumerate
+      // without core importing an upper layer (or a package) directly. No dedup — every contribution is a
+      // distinct module (see `collectManifestFiles`'s own TSDoc).
+      nitro.virtual['#kestrel/module-manifests'] = () =>
+        renderPackageConcatRegistry({
+          packages: PACKAGE_MANIFESTS.map(resolvePackageEntry),
+          property: 'manifest',
+          consumerFiles: collectManifestFiles(roots),
+          preamble: importFieldTypesVirtual,
+        })
     })
   },
 })

package/layers/core/modules/auto-discovery/package-registry.ts

@@ -0,0 +1,19 @@
+/**
+ * Kestrel's own packages that ship discoverable content, by category — a package declares WHAT it
+ * contributes via its own `kestrelDiscovery` named export (see `@michaelthielemann/kestrel-core`'s `KestrelPackageDiscovery`
+ * TSDoc); this module still needs an explicit list of WHICH packages to check, since a Nitro virtual's
+ * generated source is plain text written before anything runs — there is no filesystem/`node_modules` scan
+ * to discover the list itself. Deliberately per-category, not one flat package list: a virtual only ever
+ * imports a package here if that package actually contributes to ITS category, so (for example) building
+ * the schema-tables virtual never eagerly touches `@michaelthielemann/kestrel-collections`, which has none.
+ *
+ * A package with content in a new category is added to the matching list below when that lands — an
+ * explicit, reviewable registration, not a guess. `test/architecture/kestrel-discovery.test.ts`'s
+ * "bidirectional consistency" suite computes, against every real workspace package's actual
+ * `kestrelDiscovery` export, that these three lists are exactly right (nothing missing, nothing stale) —
+ * so a package that starts or stops contributing a category and forgets to update the matching list here
+ * fails a fast unit test, not a runtime 404 discovered later.
+ */
+export const PACKAGE_COLLECTIONS = ['@michaelthielemann/kestrel-media', '@michaelthielemann/kestrel-collections', '@michaelthielemann/kestrel-publishing']
+export const PACKAGE_SCHEMA_TABLES = ['@michaelthielemann/kestrel-media', '@michaelthielemann/kestrel-publishing']
+export const PACKAGE_MANIFESTS = ['@michaelthielemann/kestrel-media', '@michaelthielemann/kestrel-publishing']