@michaelthielemann/kestrel 4.1.2 → 5.0.0

package/layers/core/modules/plugin-order/plugin-order.ts

@@ -1,273 +0,0 @@
-import { existsSync, readdirSync } from 'node:fs'
-import { join, sep } from 'node:path'
-
-const PLUGIN_EXTENSIONS = ['js', 'mjs', 'cjs', 'ts', 'mts', 'cts', 'tsx', 'jsx']
-
-/** One of Kestrel's own `server/plugins/**` files, in the position it must execute at. */
-export interface PluginEntry {
-  /** The layer directory name (`layers/<layer>`). */
-  layer: string
-  /** Path relative to the layer root. */
-  file: string
-  /** Keys (`${layer}/${file}`) of OTHER entries that MUST appear at a lower index than this one — empty
-   *  when nothing's correctness depends on this entry's position. Machine-checked by `validatePluginOrder`
-   *  against `PLUGIN_ORDER`'s actual array positions, not merely asserted. */
-  after: string[]
-  /** One line: the real dependency this entry's `after` encodes (when non-empty), or the evidence it's
-   *  safe to reorder (when empty) — always named, never assumed. */
-  evidence: string
-}
-
-/** `${layer}/${file}` — the identity `after` references and `validatePluginOrder` indexes by. */
-const key = (p: Pick<PluginEntry, 'layer' | 'file'>): string => `${p.layer}/${p.file}`
-
-/**
- * The declared execution order for every plugin Kestrel itself ships — DATA, read and pushed by
- * `layers/core/modules/plugin-order/index.ts`, replacing Nitro's own layer-then-filename sort for these
- * files. `validatePluginOrder` (below) makes TWO kinds of drift a loud build failure instead of a silent
- * Nitro auto-append or an unenforced comment: (1) a plugin file on disk that isn't declared here (or a
- * declared entry with no file behind it), and (2) an `after` dependency whose real position in this array
- * doesn't actually satisfy it — a reshuffle that moves a dependent entry ahead of what it depends on fails
- * the SAME way a missing/phantom file does, not silently.
- *
- * Audited against a real boot in both contexts (in-repo `nuxt build` and the playground's
- * `extends: ['..', ...]` composition) via a throwaway probe module reading the resolved
- * `nitro.options.plugins`. Confirmed identical for Kestrel's own 6 layers in both contexts:
- * core → fields → media → auth → collections → public,
- * filename-sort within each layer — which is exactly what this list encodes explicitly.
- */
-export const PLUGIN_ORDER: PluginEntry[] = [
-  {
-    layer: 'core', file: 'server/plugins/00.config.ts', after: [],
-    evidence: 'Nothing depends on core/00.config.ts to come after anything else; everything downstream depends on IT (see the after: entries below).',
-  },
-  {
-    layer: 'core', file: 'server/plugins/00.migrate.ts', after: ['core/server/plugins/00.config.ts'],
-    evidence: 'Calls useDb(), which reads the config provider 00.config.ts seeds.',
-  },
-  {
-    layer: 'core', file: 'server/plugins/01.register-introspection-pipeline.ts', after: [],
-    evidence: 'registerPipeline into a Map; read lazily on first request, never at another plugin\'s init.',
-  },
-  {
-    layer: 'core', file: 'server/plugins/01.register-openapi-pipeline.ts', after: [],
-    evidence: 'registerPipeline into a Map; read lazily on first request, never at another plugin\'s init.',
-  },
-  {
-    layer: 'core', file: 'server/plugins/01.register-tooling-pipelines.ts', after: [],
-    evidence: 'registerPipeline into a Map; read lazily on first request, never at another plugin\'s init.',
-  },
-  {
-    layer: 'core', file: 'server/plugins/02.schema-sync.ts', after: ['core/server/plugins/00.migrate.ts'],
-    evidence: 'Dev-only additive auto-migration; its own header comment: "Runs after 00.migrate, so built-in collections are already migrated and this is a no-op on them".',
-  },
-  {
-    layer: 'core', file: 'server/plugins/04.outbox-worker.ts', after: [],
-    evidence: 'Starts its own setInterval poll loop against useDb(); no other plugin\'s behavior depends on when this one starts polling (the poll itself is unconditional, no readiness handshake with another plugin).',
-  },
-  {
-    layer: 'core', file: 'server/plugins/05.reindex-refs.ts', after: [],
-    evidence: 'registerReindexRefs() registers a handler on the outbox event bus; dispatched later by the outbox worker, never read at another plugin\'s init.',
-  },
-  {
-    layer: 'fields', file: 'server/plugins/01.register-blocks-pipeline.ts', after: [],
-    evidence: 'registerPipeline into a Map; read lazily on first request.',
-  },
-  {
-    layer: 'fields', file: 'server/plugins/01.register-field-populate.ts', after: [],
-    evidence: 'Registers the single global row populator; field populators (media/link/richtext/relation) are looked up at READ time, so this plugin\'s order vs. the layer plugins that register them does not matter (stated in the plugin\'s own header comment).',
-  },
-  {
-    layer: 'media', file: 'server/plugins/01.register-media-pipelines.ts', after: [],
-    evidence: 'registerPipeline into a Map; read lazily on first request.',
-  },
-  {
-    layer: 'media', file: 'server/plugins/02.register-media.ts', after: [],
-    evidence: 'registerFieldPopulator; looked up at read time, not at another plugin\'s init.',
-  },
-  {
-    layer: 'media', file: 'server/plugins/04.variant-capture.ts', after: [],
-    evidence: 'Hooks the render request context (isRendererContext) and stashes discovered variants during SSR; reconciled per-render, no dependency on another plugin having run first.',
-  },
-  {
-    layer: 'media', file: 'server/plugins/05.media-cleanup.ts', after: [],
-    evidence: 'registerMediaCleanup() registers a handler on the outbox event bus; dispatched later.',
-  },
-  {
-    layer: 'auth', file: 'server/plugins/01.register-auth-pipelines.ts', after: [],
-    evidence: 'registerPipeline into a Map; read lazily on first request.',
-  },
-  {
-    layer: 'collections', file: 'server/plugins/01.register.ts', after: [],
-    evidence: 'Reads the #kestrel/collections and #kestrel/blocks VIRTUALS directly (never allCollections()); writes the runtime registry, but no plugin in this list reads that registry at its own init — only at request time, well after every plugin has finished (documented invariant, docs/internals/architecture.md § Server plugins).',
-  },
-  {
-    layer: 'collections', file: 'server/plugins/02.register-relation-populate.ts', after: [],
-    evidence: 'registerFieldPopulator; looked up at read time.',
-  },
-  {
-    layer: 'public', file: 'server/plugins/00.ensure-snapshot-triggers.ts',
-    after: ['core/server/plugins/00.migrate.ts', 'core/server/plugins/02.schema-sync.ts'],
-    evidence: 'THE one real cross-layer dependency: needs the snapshot store\'s table to already exist, created by core\'s 00.migrate (in-repo) or 02.schema-sync (consumer). Self-tolerant even so — a boot before either has run logs a warning and returns rather than crashing (ensureSnapshotTriggers\'s own TSDoc); still placed after both so the warning path is never hit in practice.',
-  },
-  {
-    layer: 'public', file: 'server/plugins/01.register-public-pipelines.ts', after: [],
-    evidence: 'registerPipeline into a Map; read lazily on first request.',
-  },
-  {
-    layer: 'public', file: 'server/plugins/02.register-links.ts', after: [],
-    evidence: 'registerFieldPopulator; looked up at read time.',
-  },
-  {
-    layer: 'public', file: 'server/plugins/03.redirects.ts', after: [],
-    evidence: 'registerAfterStep registers a DEFERRED, when-scoped pipeline hook; invoked on a future write, not at another plugin\'s init.',
-  },
-  {
-    layer: 'public', file: 'server/plugins/05.plan-publish.ts', after: [],
-    evidence: 'Registers planPublish on the outbox bus; dispatched later by the outbox worker, after commit — never at plugin init.',
-  },
-  {
-    layer: 'public', file: 'server/plugins/zz.publish.ts', after: [],
-    evidence: 'Registers a deferred CRITICAL after-step and starts the boot publish; the boot publish\'s own registry read sits after an `await` inside publishFull, so it resumes only once the synchronous plugin loop (including collections\' 01.register) has already finished — order-free by construction (documented invariant, docs/internals/architecture.md § Server plugins).',
-  },
-]
-
-/** POSIX-normalize a path for comparison — `path.join`'s OUTPUT is OS-native (backslash on Windows), but
- *  `PluginEntry.file` is authored with literal forward slashes (`'server/plugins/00.config.ts'`) and Nuxt's
- *  own `_layers[].cwd` values are not guaranteed to be OS-native either (bundlers commonly normalize to
- *  POSIX internally regardless of platform). Comparing through one canonical POSIX form — rather than two
- *  parallel branches guessing which separator a given string happens to use — removes the asymmetry a
- *  Windows build would otherwise hit. */
-const toPosix = (p: string): string => p.split(sep).join('/')
-
-/** Find layer `name`'s root among Nuxt's resolved `_layers` cwds. Nitro plugin paths must be absolute
- *  filesystem paths — there is no bare-specifier equivalent for a Nitro plugin the way there is for a
- *  package export — so this lookup (mirroring the pattern auto-discovery used for the pre-package fields
- *  seed) is still needed. */
-function layerRoot(roots: string[], name: string): string {
-  const root = roots.find((r) => toPosix(r).endsWith(`/layers/${name}`))
-  if (!root) throw new Error(`[kestrel] plugin-order: could not locate the "${name}" layer root`)
-  return root
-}
-
-/** `PLUGIN_ORDER` (or an injected `list`, for testing drift scenarios without editing the real constant),
- *  resolved to absolute file paths in declared order — what gets pushed into `nitro.options.plugins`. */
-export function resolvePluginOrder(roots: string[], list: PluginEntry[] = PLUGIN_ORDER): string[] {
-  return list.map((p) => join(layerRoot(roots, p.layer), p.file))
-}
-
-/** Nitro's OWN plugin file extension set (`nitropack`'s `GLOB_SCAN_PATTERN` for `plugins/`) — matched
- *  exactly, not approximated, so this scan can never be fooled by a file Nitro would pick up that this
- *  didn't look for. */
-const PLUGIN_FILE_RE = new RegExp(`\\.(${PLUGIN_EXTENSIONS.join('|')})$`)
-const isPluginFile = (name: string) => PLUGIN_FILE_RE.test(name) && !name.endsWith('.test.ts') && !/\.test\.(js|mjs|cjs|mts|cts|tsx|jsx)$/.test(name)
-
-/** Every file under `dir` Nitro's own scan would find — RECURSIVELY (Nitro's glob is `plugins/**\/*.{ext}`,
- *  not a flat listing), matching Nitro's exact extension set. Mirrors Nitro's own convention for real, not
- *  approximately. */
-function walkPluginFiles(dir: string, out: string[] = []): string[] {
-  if (!existsSync(dir)) return out
-  for (const entry of readdirSync(dir, { withFileTypes: true })) {
-    const full = join(dir, entry.name)
-    if (entry.isDirectory()) walkPluginFiles(full, out)
-    else if (isPluginFile(entry.name)) out.push(full)
-  }
-  return out
-}
-
-/** Every plugin file Nitro would ACTUALLY scan across the layers `list` declares — derived from `list`
- *  itself (not a separately hardcoded layer set) so an injected test `list` governs exactly the layers it
- *  claims to, never silently falling back to a hardcoded layer set regardless of what was actually passed
- *  in — the shape a test injecting a fully isolated fake `list`/`roots` pair depends on. */
-function scanActualPlugins(roots: string[], list: PluginEntry[]): string[] {
-  const layers = [...new Set(list.map((p) => p.layer))]
-  const found: string[] = []
-  for (const layer of layers) found.push(...walkPluginFiles(join(layerRoot(roots, layer), 'server/plugins')))
-  return found.sort()
-}
-
-/** `PLUGIN_ORDER` entries reachable from `list`, by `key`. */
-function assertOrderConstraintsSatisfied(list: PluginEntry[]): void {
-  const indexOf = new Map(list.map((p, i) => [key(p), i]))
-  const violations: string[] = []
-  for (const p of list) {
-    for (const dep of p.after) {
-      const depIndex = indexOf.get(dep)
-      const ownIndex = indexOf.get(key(p))!
-      if (depIndex === undefined) {
-        violations.push(`${key(p)} declares after: "${dep}", but no such entry exists in PLUGIN_ORDER`)
-      } else if (depIndex >= ownIndex) {
-        violations.push(`${key(p)} must come after ${dep} (${p.evidence}), but is declared at index ${ownIndex} vs. ${dep}'s index ${depIndex}`)
-      }
-    }
-  }
-  if (violations.length) {
-    throw new Error(['[kestrel] plugin-order: PLUGIN_ORDER violates a declared after: dependency.', ...violations.map((v) => `  ${v}`)].join('\n'))
-  }
-}
-
-/**
- * LOUD failure for BOTH kinds of drift: (1) a plugin file present on disk but missing from `PLUGIN_ORDER`
- * (which Nitro's own scan-and-append would otherwise silently tack onto the END, in undeclared position —
- * see nitropack's `scanPlugins`/`options.plugins.push` for exactly that fallback behavior) or a declared
- * entry whose file no longer exists; (2) a declared `after` dependency the array's ACTUAL positions don't
- * satisfy — a reshuffle, not just a deletion, fails just as loudly. Throws — the ONLY way a Nuxt module's
- * `setup()` can fail the build loudly (a Nitro hook can't itself abort configuration once already running).
- * Called from `setup()`, before the `nitro:config` hook — a build-time failure, not a Nitro-time one.
- */
-export function validatePluginOrder(roots: string[], list: PluginEntry[] = PLUGIN_ORDER): void {
-  assertOrderConstraintsSatisfied(list)
-
-  const declared = new Set(resolvePluginOrder(roots, list))
-  const actual = new Set(scanActualPlugins(roots, list))
-  const missing = [...actual].filter((f) => !declared.has(f)) // on disk, not declared
-  const phantom = [...declared].filter((f) => !actual.has(f)) // declared, not on disk
-  if (missing.length === 0 && phantom.length === 0) return
-  const lines: string[] = ['[kestrel] plugin-order: PLUGIN_ORDER has drifted from the real server/plugins/ files.']
-  if (missing.length) lines.push(`  On disk but NOT declared (would silently land last, undeclared, via Nitro's own scan-and-append): ${missing.join(', ')}`)
-  if (phantom.length) lines.push(`  Declared but the file does not exist: ${phantom.join(', ')}`)
-  lines.push('  Fix PLUGIN_ORDER in layers/core/modules/plugin-order/plugin-order.ts.')
-  throw new Error(lines.join('\n'))
-}
-
-/**
- * The permanent, in-process observer of the REAL merge: `validatePluginOrder`/`resolvePluginOrder` only
- * prove what THIS module pushes — they cannot see what Nitro's own scan-and-append, another module's
- * `nitro:config` hook, or Nitro's own internal/dev-tooling plugins do to the array afterward. Called from
- * `index.ts`'s `nitro:init` hook (which receives the fully-built Nitro instance, after every `nitro:config`
- * hook AND Nitro's own scan have both already run) against the REAL `nitro.options.plugins`, this asserts
- * our declared order survived that whole pipeline intact: every `expected` path appears, in order, as ONE
- * CONTIGUOUS RUN somewhere in the real array — NOT necessarily a prefix. A real `nuxt dev` boot pushes
- * `@nuxt/devtools`'/`@nuxt/nitro-server`'s own internal plugins (an inline devtools runtime, dev-server
- * request logging) ahead of everything via their own earlier-registered `nitro:config` hooks — legitimate
- * Nuxt/Nitro tooling this module neither owns nor should reject, so "prefix" is the wrong bar; "our own
- * declared plugins never get split apart or interleaved with anyone else's" is the real, checkable
- * invariant, and is what this asserts. Also asserts the real array has no duplicate entries anywhere
- * (Nitro's own `!plugins.includes(x)` scan guard is SUPPOSED to prevent one, but this checks the outcome
- * directly rather than trusting that guard blind). Throws — a boot-time, not merely a config-time, failure.
- */
-export function assertEffectiveOrderMatches(actualPlugins: (string | undefined)[], expected: string[]): void {
-  const cleaned = actualPlugins.filter((p): p is string => typeof p === 'string')
-  const seen = new Set<string>()
-  const duplicates = new Set<string>()
-  for (const p of cleaned) {
-    if (seen.has(p)) duplicates.add(p)
-    seen.add(p)
-  }
-  if (duplicates.size) {
-    throw new Error(`[kestrel] plugin-order: nitro.options.plugins contains duplicate entries: ${[...duplicates].join(', ')}`)
-  }
-  if (expected.length === 0) return
-  let start = -1
-  for (let i = 0; i + expected.length <= cleaned.length; i++) {
-    if (expected.every((e, j) => cleaned[i + j] === e)) { start = i; break }
-  }
-  if (start === -1) {
-    throw new Error(
-      '[kestrel] plugin-order: the REAL nitro.options.plugins does not contain PLUGIN_ORDER as one unbroken, '
-      + "in-order run — something split our declared block apart or interleaved into it.\n"
-      + `  Expected (contiguous, any position): ${expected.join(', ')}\n`
-      + `  Actual full list:                    ${cleaned.join(', ')}`,
-    )
-  }
-}

package/layers/core/nuxt.config.ts

@@ -1,10 +0,0 @@
-import { fileURLToPath } from 'node:url'
-
-export default defineNuxtConfig({
-  modules: [
-    fileURLToPath(new URL('./modules/component-namespace/index.ts', import.meta.url)),
-    fileURLToPath(new URL('./modules/auto-discovery/index.ts', import.meta.url)),
-    fileURLToPath(new URL('./modules/kestrel/index.ts', import.meta.url)),
-    fileURLToPath(new URL('./modules/plugin-order/index.ts', import.meta.url)),
-  ],
-})

package/layers/core/server/api/[...path].ts

@@ -1,98 +0,0 @@
-import { getRequestHeader } from 'h3'
-import {
-  MAX_JSON_BODY, assertBodyLimit, isRoutablePipeline, toHttpError, tryResolveDefaultPipeline,
-  parseFilter, parsePipelineRoute, getCollectionOr404, useDb, readIfUnmodifiedSince,
-} from '@michaelthielemann/kestrel-core'
-import type { PipelineContext, PipelineTrace } from '@michaelthielemann/kestrel-core'
-import { runPipelineForEventAuto, resolveEventPrincipal } from '@michaelthielemann/kestrel-access'
-// The one handler behind the whole pipeline URL scheme:
-//
-//   GET  /api/<collection>/<readPipeline>[/<id>]
-//   POST /api/<collection>/<writePipeline>[/<id>]
-//   POST /api/<pipeline>                            (collection-less: login, publish, createPreview)
-//
-// It is the ONLY route file under server/api: every endpoint is a pipeline, and this is where each one is
-// resolved, verb-checked and run.
-
-/** Reads take their whole input from the query string, in the shape the read steps expect. One builder for
- *  every read pipeline — the generic list/detail reads and the editor's tooling reads pick the keys they
- *  need out of the same object. */
-function readInput(query: Record<string, unknown>): Record<string, unknown> {
-  return {
-    ...query,
-    locale: query.locale as string | undefined,
-    sort: query.sort as string | undefined,
-    page: query.page ? Number(query.page) : undefined,
-    perPage: query.perPage ? Number(query.perPage) : undefined,
-    filter: parseFilter(query),
-    depth: query.depth ? Number(query.depth) : 0,
-  }
-}
-
-function assertMethod(method: string, read: boolean, pipeline: string): void {
-  const allowed = read ? method === 'GET' || method === 'HEAD' : method === 'POST'
-  if (!allowed) {
-    throw createError({ statusCode: 405, statusMessage: `${pipeline} is a ${read ? 'read' : 'write'} pipeline — use ${read ? 'GET' : 'POST'}` })
-  }
-}
-
-/** Embed the trace as a `$`-prefixed sidecar, matching the `$media`/`$translations` convention on rows. A
- *  batch/array result (createMany, duplicate) or a bare value (a not-found singleton's `null`) has no
- *  object to spread into, so it is wrapped under `data` instead. */
-function embedTrace(result: unknown, trace: PipelineTrace): unknown {
-  if (result === null || typeof result !== 'object' || Array.isArray(result)) return { data: result, $pipeline: trace }
-  return { ...(result as Record<string, unknown>), $pipeline: trace }
-}
-
-function logPipelineRun(trace: PipelineTrace): void {
-  const steps = trace.steps.map((s) => `${s.name}${s.status === 'ok' ? '' : `:${s.status}`}=${s.ms}ms`).join(' ')
-  const pipeline = trace.collection ? `${trace.collection}/${trace.pipeline}` : trace.pipeline
-  console.log(`[kestrel] pipeline ${pipeline} ${steps} total=${trace.ms}ms`)
-}
-
-export default defineEventHandler(async (event) => {
-  const route = parsePipelineRoute(event.path)
-  const collection = route.collection === null ? null : getCollectionOr404(route.collection)
-  const resolved = tryResolveDefaultPipeline(route.collection, route.pipeline)
-  if (!isRoutablePipeline(resolved)) {
-    throw createError({ statusCode: 404, statusMessage: `Unknown pipeline: ${route.pipeline}` })
-  }
-  assertMethod(getMethod(event), resolved.read, route.pipeline)
-
-  const query = getQuery(event) as Record<string, unknown>
-  // The body is buffered HERE, before the pipeline's gates run — so it must be bounded, or an anonymous /
-  // cross-site / IP-blocked caller could stream an unbounded body into memory before being refused.
-  if (!resolved.read && !resolved.rawBody) assertBodyLimit(getRequestHeader(event, 'content-length'), MAX_JSON_BODY)
-  let ctx: PipelineContext | undefined
-  let result: unknown
-  try {
-    result = await runPipelineForEventAuto(event, {
-      op: route.pipeline,
-      collection,
-      db: collection ? useDb() : null,
-      id: route.id,
-      locale: query.locale as string | undefined,
-      // A `rawBody` pipeline owns its own body read (multipart, ciphertext, a size-capped stream), so the
-      // router must not consume the stream first.
-      input: resolved.read ? readInput(query) : resolved.rawBody ? undefined : await readBody(event),
-      // Optimistic concurrency: the editor sends the baseline it loaded, and a stale save is refused with
-      // 409. Only `updateOne` has a step that reads it.
-      work: resolved.read ? {} : { expectedUpdatedAt: readIfUnmodifiedSince(event) },
-      onContext: (c) => { ctx = c },
-    })
-  } catch (error) {
-    // The ONE call site that turns a step-raised KestrelError into an HTTP response (see
-    // utils/kestrel-error-map.ts); everything else (the runner, the drivers) passes it through untouched.
-    // Gate denials (401/403) never reach here as a KestrelError — they're already createError-shaped by
-    // the time they leave the runner (see runner.ts's denied/refused) and pass through unchanged.
-    throw toHttpError(error)
-  } finally {
-    if (import.meta.dev && ctx) logPipelineRun(ctx.trace.toJSON())
-  }
-  if (route.pipeline === 'createOne' || route.pipeline === 'createMany') setResponseStatus(event, 201)
-
-  if (ctx && query.debug === 'pipeline' && resolveEventPrincipal(event).role === 'admin') {
-    return embedTrace(result, ctx.trace.toJSON())
-  }
-  return result
-})

package/layers/core/server/plugins/00.config.ts

@@ -1,12 +0,0 @@
-import { setResolvedKestrelConfig } from '@michaelthielemann/kestrel-core'
-import { resolveServerKestrelConfig } from '../utils/server-config'
-
-// Runs before every other core plugin (00.migrate.ts included — it calls useDb(), which now reads the
-// provider) and before media/auth/collections/public's own plugins (docs/internals/architecture.md § Server
-// plugins: core → media → auth → collections → public). Resolves the config ONCE with the app's own
-// runtimeConfig-preferred, file/env-fallback precedence and pushes it into the config provider — the seam
-// package code (locale.ts, revision-retention.ts, db.ts today; the future package-side movers of the
-// same files) reads from instead of touching `useRuntimeConfig()` directly.
-export default defineNitroPlugin(() => {
-  setResolvedKestrelConfig(resolveServerKestrelConfig())
-})

package/layers/core/server/plugins/00.migrate.ts

@@ -1,12 +0,0 @@
-import { resolve } from 'node:path'
-import { existsSync } from 'node:fs'
-import { migrate } from 'drizzle-orm/better-sqlite3/migrator'
-import { useDb } from '@michaelthielemann/kestrel-core'
-
-export default defineNitroPlugin(() => {
-  // The committed drizzle-kit migrations only exist in Kestrel's own repo. When Kestrel is consumed as
-  // a layer, this folder is absent — there the schema-sync engine (02.schema-sync in dev, the db:migrate
-  // task in prod) owns the schema instead (ADR-0002), so skip rather than throw.
-  const migrationsFolder = resolve(process.cwd(), 'server/database/migrations')
-  if (existsSync(migrationsFolder)) migrate(useDb(), { migrationsFolder })
-})

package/layers/core/server/plugins/01.register-introspection-pipeline.ts

@@ -1,5 +0,0 @@
-import { buildIntrospectionPipelines, registerPipeline } from '@michaelthielemann/kestrel-core'
-// Registration only — nothing resolves a pipeline here; the registry is read on the first request.
-export default defineNitroPlugin(() => {
-  for (const def of buildIntrospectionPipelines()) registerPipeline(def)
-})

package/layers/core/server/plugins/01.register-openapi-pipeline.ts

@@ -1,5 +0,0 @@
-import { buildOpenApiPipelines, registerPipeline } from '@michaelthielemann/kestrel-core'
-// Registration only — nothing resolves a pipeline here; the registry is read on the first request.
-export default defineNitroPlugin(() => {
-  for (const def of buildOpenApiPipelines()) registerPipeline(def)
-})

package/layers/core/server/plugins/01.register-tooling-pipelines.ts

@@ -1,5 +0,0 @@
-import { buildToolingPipelines, registerPipeline } from '@michaelthielemann/kestrel-core'
-// Registration only — nothing resolves a pipeline here; the registry is read on the first request.
-export default defineNitroPlugin(() => {
-  for (const def of buildToolingPipelines()) registerPipeline(def)
-})

package/layers/core/server/plugins/02.schema-sync.ts

@@ -1,58 +0,0 @@
-import collections from '#kestrel/collections'
-import schemaTables from '#kestrel/schema-tables'
-import type { AnySQLiteTable } from 'drizzle-orm/sqlite-core'
-import { describeOp, desiredFromCollections, isDestructive, planOps, runDevSchemaSync, sqlite, useDb } from '@michaelthielemann/kestrel-core'
-import type { BuiltCollection, CollectionDef, SyncDb } from '@michaelthielemann/kestrel-core'
-import { resolveServerKestrel, serverRuntimeConfig } from '../utils/server-config'
-// Dev-only schema auto-sync (ADR-0002). Runs after 00.migrate, so built-in collections are already
-// migrated and this is a no-op on them; it additively reconciles the live DB to whatever the registered
-// collections (+ the discovered standalone tables) now compile to — so adding a collection or a field
-// shows up without a hand-written migration. NEVER auto-DDLs in production or during prerender (`nuxt
-// generate`), where schema changes go through committed migrations / an explicit migrate step instead —
-// but production DOES a read-only DRIFT CHECK and warns loudly, so an upgraded consumer that forgot to
-// run `db:migrate` sees a clear boot warning instead of scattered runtime errors.
-export default defineNitroPlugin(() => {
-  if (import.meta.prerender) return
-
-  const desired = desiredFromCollections(collections as (CollectionDef | BuiltCollection)[], {
-    // Same toggle source as the registry plugin (01.register), so a disabled built-in is dropped from
-    // the desired schema exactly as it is dropped from the runtime surface.
-    toggles: (serverRuntimeConfig()?.kestrel?.collections ?? resolveServerKestrel().collections) as Record<string, boolean>,
-    extraTables: schemaTables as AnySQLiteTable[],
-  })
-  const client = (useDb() as unknown as { $client: SyncDb }).$client
-
-  if (process.env.NODE_ENV === 'production') {
-    // Read-only: never DDL in prod. Detect + surface drift so the operator runs db:migrate. Split by kind:
-    // ADDITIVE gaps (missing table/column/index) can make the app error → a real "run db:migrate" warning.
-    // DESTRUCTIVE ops (a drop for a disabled built-in, or an unmanaged extra table) are NOT app-breaking and
-    // are withheld by db:migrate anyway → report them informationally so a permanent, unactionable
-    // "app may error" warning doesn't fire on every boot after the operator has done what it asked.
-    try {
-      const pending = planOps(client, desired)
-      const additive = pending.filter((op) => !isDestructive(op))
-      const destructive = pending.filter(isDestructive)
-      if (additive.length) {
-        console.warn(
-          `[kestrel] SCHEMA DRIFT: the live DB is missing ${additive.length} change(s) the collections expect — ` +
-          `the app may error until you run the db:migrate task. Pending:\n  - ${additive.map(describeOp).join('\n  - ')}`,
-        )
-      }
-      if (destructive.length) {
-        console.info(
-          `[kestrel] schema note: ${destructive.length} table(s)/column(s) exist that the current collections no longer ` +
-          `define (e.g. a disabled built-in or an unmanaged table). Not app-breaking; db:migrate withholds these unless ` +
-          `you opt in ({force} / {drop:[…]}):\n  - ${destructive.map(describeOp).join('\n  - ')}`,
-        )
-      }
-    } catch (error) {
-      console.warn('[kestrel] could not check schema drift at boot:', (error as Error)?.message ?? error)
-    }
-    return
-  }
-
-  // SQLite is the only backend today; this is the seam where a config-driven `resolveDialect()` would go.
-  // runDevSchemaSync isolates failures (logs loudly, keeps the server up) — an infeasible auto-sync must
-  // not 500 every route, including the admin UI needed to fix it.
-  runDevSchemaSync(client, desired, sqlite)
-})

package/layers/core/server/plugins/04.outbox-worker.ts

@@ -1,31 +0,0 @@
-import { buildOutboxPipelines, makeTicker, registerPipeline, useDb } from '@michaelthielemann/kestrel-core'
-/** Hard-coded to `content` — the only module with an outbox table today; extend alongside
- *  `pipelines/outbox.ts` if a second module gets one. */
-const OUTBOX_MODULE = 'content'
-const POLL_INTERVAL_MS = 1000
-
-/**
- * The outbox worker: NOT a Nitro `scheduledTask` (those run per-request-worker in a way that doesn't suit
- * an always-on background loop here) — a plain `setInterval` loop started at plugin init, `unref`'d so it
- * never keeps the process alive on its own (a test/dev server can still exit while it's running).
- *
- * Polls every tick, unconditionally — no `PRAGMA data_version` short-circuit: `useDb()` is the process-
- * wide singleton connection every write also goes through, and a connection never observes its OWN writes
- * bumping `data_version` (only a write from a DIFFERENT connection does), so gating on it here would go
- * permanently blind after the first write this same connection ever made. The poll query itself is a
- * covered index search (see `outbox.ts`'s `readPendingOutbox`), cheap enough at a 1s interval to not need
- * a short-circuit at all.
- */
-export default defineNitroPlugin(() => {
-  // `makeTicker` takes `useDb` itself (a thunk), not its result — nothing here calls it, so the db is
-  // still untouched at plugin-init time; the interval callback is the first thing that ever does.
-  const tick = makeTicker(useDb, OUTBOX_MODULE)
-
-  // Registration only — nothing here resolves a pipeline or reads the collection registry at init.
-  for (const def of buildOutboxPipelines()) registerPipeline(def)
-
-  const timer = setInterval(() => {
-    tick().catch((error: unknown) => console.error('[kestrel] outbox worker tick failed', error))
-  }, POLL_INTERVAL_MS)
-  timer.unref?.()
-})

package/layers/core/server/plugins/05.reindex-refs.ts

@@ -1,5 +0,0 @@
-import { registerReindexRefs } from '@michaelthielemann/kestrel-core'
-
-export default defineNitroPlugin(() => {
-  registerReindexRefs()
-})

package/layers/core/server/routes/__kestrel/dashboard.get.ts

@@ -1,29 +0,0 @@
-import { allCollections, buildPipelineIndex, renderDashboard } from '@michaelthielemann/kestrel-core'
-import { PLUGIN_ORDER } from '../../../modules/plugin-order/plugin-order'
-
-/**
- * Dev-only introspection dashboard: gathers live registry state, so it reflects the CONSUMER's own
- * collections/pipelines/overrides — not a static analysis of Kestrel's own source. File-based
- * `server/routes/**` modules are compiled into production builds unconditionally, so the
- * `import.meta.dev` check below is the real guard: Nitro inlines it to `false` in production and
- * dead-code-eliminates everything past it, leaving only the 404.
- */
-export default defineEventHandler((event) => {
-  if (!import.meta.dev) {
-    throw createError({ statusCode: 404, statusMessage: 'Not found' })
-  }
-  const collections = allCollections().map((c) => ({
-    name: c.name,
-    mode: c.def.mode,
-    translatable: Boolean(c.def.translatable),
-    fieldCount: Object.keys(c.def.fields).length,
-  }))
-  const html = renderDashboard({
-    pipelines: buildPipelineIndex(),
-    pluginOrder: PLUGIN_ORDER.map((p) => ({ layer: p.layer, file: p.file, after: p.after })),
-    collections,
-    generatedAt: new Date().toISOString(),
-  })
-  setHeader(event, 'content-type', 'text/html; charset=utf-8')
-  return html
-})

package/layers/core/server/tasks/db/migrate-module.ts

@@ -1,83 +0,0 @@
-import collections from '#kestrel/collections'
-import schemaTables from '#kestrel/schema-tables'
-import moduleManifests from '#kestrel/module-manifests'
-import type { AnySQLiteTable } from 'drizzle-orm/sqlite-core'
-import type { OwnershipManifest } from '@michaelthielemann/kestrel-contracts'
-import { buildContentManifest, describeOp, desiredFromCollections, isDestructive, opTable, orderManifests, planOps, sqlite, syncSchema, useDb } from '@michaelthielemann/kestrel-core'
-import type { BuiltCollection, CollectionDef, Dialect, SchemaSnapshot, SyncDb } from '@michaelthielemann/kestrel-core'
-import { resolveServerKestrel, serverRuntimeConfig } from '../../utils/server-config'
-// The per-module counterpart to `db:migrate` (ADR-0012): runs the SAME diff/apply engine, but scoped to
-// one ownership manifest's tables at a time, in a fixed order — `content` (the collection/base schema
-// other modules are conceptually layered on) first, then every discovered module manifest
-// (`module-order.ts`'s `MODULE_MIGRATION_ORDER`), then an `unmanaged` catch-all for any table no
-// manifest yet claims (never silently skipped). Payload/trigger mirror `db:migrate` exactly — {module:
-// "media"}=one module only, otherwise every module in order; {check:true}=dry-run, {force:true}=rebuilds,
-// {drop:[names]}=drop tables. Same dev/prod trigger shape as `db:migrate` (see that file's header).
-type ModulePayload = { module?: string; check?: boolean; force?: boolean; drop?: string[] }
-type ModuleResult =
-  | { module: string; check: true; pending: string[]; destructive: string[] }
-  | { module: string; applied: string[]; skipped: string[] }
-
-function runOne(
-  module: string,
-  tables: readonly string[],
-  client: SyncDb,
-  desired: SchemaSnapshot,
-  dialect: Dialect,
-  p: ModulePayload,
-): ModuleResult {
-  if (p.check === true) {
-    const ops = planOps(client, desired, dialect).filter((op) => tables.includes(opTable(op)))
-    const destructive = ops.filter(isDestructive).map(describeOp)
-    return { module, check: true, pending: dialect.render(ops), destructive }
-  }
-
-  const { applied, skipped } = syncSchema(client, desired, {
-    allowDestructive: p.force === true,
-    dropTables: Array.isArray(p.drop) ? p.drop : undefined,
-    tables,
-  }, dialect)
-  if (skipped.length) {
-    console.warn(`[kestrel] db:migrate-module(${module}) withheld ${skipped.length} destructive change(s) — opt in with {"force":true} (rebuilds) / {"drop":[…]} (drops):\n  - ${skipped.map(describeOp).join('\n  - ')}`)
-  }
-  console.info(`[kestrel] db:migrate-module(${module}) applied ${applied.length} statement(s)`)
-  return { module, applied, skipped: skipped.map(describeOp) }
-}
-
-export default defineTask<ModuleResult[]>({
-  meta: {
-    name: 'db:migrate-module',
-    description: 'Per-module schema migration, ordered (content → media → publishing → unmanaged). {module:"name"}=one module only, otherwise every module in order. {check}/{force}/{drop} match db:migrate.',
-  },
-  run({ payload }) {
-    const p = (payload ?? {}) as ModulePayload
-    const desired = desiredFromCollections(collections as (CollectionDef | BuiltCollection)[], {
-      toggles: (serverRuntimeConfig()?.kestrel?.collections ?? resolveServerKestrel().collections) as Record<string, boolean>,
-      extraTables: schemaTables as AnySQLiteTable[],
-    })
-    const client = (useDb() as unknown as { $client: SyncDb }).$client
-    const dialect = sqlite
-
-    const manifests = orderManifests([buildContentManifest(), ...(moduleManifests as OwnershipManifest[])])
-    const claimed = new Set(manifests.flatMap((m) => m.tables))
-    // The `unmanaged` bucket's table list: every table any pending op touches that no manifest claims —
-    // computed up front so both `check` and apply modes scope to the SAME set (rather than an unfiltered
-    // rescan, which in apply mode would re-touch already-migrated tables and in check mode would re-list
-    // every module's pending ops a second time under `unmanaged`).
-    const unmanagedTables = [...new Set(planOps(client, desired, dialect).map(opTable))].filter((t) => !claimed.has(t))
-
-    if (p.module) {
-      const manifest = manifests.find((m) => m.module === p.module)
-      const tables = manifest ? manifest.tables : p.module === 'unmanaged' ? unmanagedTables : undefined
-      if (!tables) {
-        const known = [...manifests.map((m) => m.module), 'unmanaged'].join(', ')
-        throw new Error(`kestrel: db:migrate-module: unknown module "${p.module}" — known: ${known}`)
-      }
-      return { result: [runOne(p.module, tables, client, desired, dialect, p)] }
-    }
-
-    const results = manifests.map((m) => runOne(m.module, m.tables, client, desired, dialect, p))
-    results.push(runOne('unmanaged', unmanagedTables, client, desired, dialect, p))
-    return { result: results }
-  },
-})