@michaelthielemann/kestrel 4.1.2 → 5.0.0

package/layers/public/modules/prerender-routes/discover.ts

@@ -1,37 +0,0 @@
-import type Database from 'better-sqlite3'
-import { pagesToRoutes, type PageRouteRow } from './routes'
-
-/** Tables the schema engine marked routable, by their partial `path` index (see `collectPageRoutes`).
- *  Empty means this file holds no page-like collection at all — a structural fact about the schema, not a
- *  statement about how many pages exist: a CMS with one page still has its table and that index. */
-export function pageLikeTables(db: Database.Database): string[] {
-  return (db
-    .prepare("SELECT DISTINCT tbl_name AS name FROM sqlite_master WHERE type = 'index' AND sql LIKE '%path is not null%'")
-    .all() as { name: string }[]).map((t) => t.name)
-}
-
-/**
- * Page routes to seed for `nuxt generate`, discovered straight from the build-time DB (no registry is
- * available at build). Every page-like collection carries a **partial unique index on `path`**
- * (`… WHERE path is not null`) — the schema engine's marker for a routable table — so we enumerate those.
- * That is reliable where "has a `path` column" is NOT: the media `folders` registry has a `path` column +
- * a plain unique index, but no such partial clause, so it is correctly excluded. Per pageLike table:
- * published rows (only where a `status` column exists) with a non-null path, keyed by their own `locale`
- * (or the primary locale for a non-translatable collection). Returns the deduped, sorted route list
- * (always including the root).
- */
-export function collectPageRoutes(db: Database.Database, primaryLocale: string, prefixPrimary = false): string[] {
-  const rows: PageRouteRow[] = []
-  for (const name of pageLikeTables(db)) {
-    const q = `"${name.replace(/"/g, '""')}"`
-    const cols = (db.prepare(`PRAGMA table_info(${q})`).all() as { name: string }[]).map((c) => c.name)
-    const statusClause = cols.includes('status') ? "status = 'published' AND " : ''
-    if (cols.includes('locale')) {
-      rows.push(...(db.prepare(`SELECT path, locale FROM ${q} WHERE ${statusClause}path IS NOT NULL`).all() as PageRouteRow[]))
-    } else {
-      const bare = db.prepare(`SELECT path FROM ${q} WHERE ${statusClause}path IS NOT NULL`).all() as { path: string | null }[]
-      for (const r of bare) rows.push({ path: r.path, locale: primaryLocale })
-    }
-  }
-  return pagesToRoutes(rows, primaryLocale, prefixPrimary)
-}

package/layers/public/modules/prerender-routes/index.ts

@@ -1,88 +0,0 @@
-import { cpus } from 'node:os'
-import { existsSync } from 'node:fs'
-import { defineNuxtModule } from '@nuxt/kit'
-import Database from 'better-sqlite3'
-import { collectPageRoutes, pageLikeTables } from './discover'
-import { localePath, resolveKestrel } from '@michaelthielemann/kestrel-core'
-import type { KestrelConfig } from '@michaelthielemann/kestrel-core'
-import { META_KEYS } from '@michaelthielemann/kestrel-core'
-import { recordRouteDiscovery, type RouteDiscovery } from '@michaelthielemann/kestrel-delivery-static'
-// Read published paths from EVERY page-like collection straight from the DB at build time so
-// `nuxt generate` prerenders one HTML file per page (see `collectPageRoutes` for how pageLike tables
-// are identified). The server's migrate-on-boot hasn't run yet at this point, so a DB that isn't there
-// yet degrades to the root alone — reported as `incomplete`, because a deploy that reconciles must be
-// able to tell that degrade apart from a CMS that genuinely holds one page.
-// `reconciles` (an S3 deploy follows this build) makes an unreadable-but-present DB fail the build
-// instead: there the degraded tree would also be uploaded over a real live site. Without that step there
-// is nothing destructive downstream, so a degrade stays a warning.
-export function discoverRoutes(path: string, primary: string, prefixPrimary: boolean, reconciles = false): RouteDiscovery {
-  const root = localePath('/', primary, primary, prefixPrimary) // `/` or `/<primary>` when the primary is prefixed
-  if (path === ':memory:') return { routes: [root], incomplete: 'the build ran against an in-memory database — only the site root was prerendered' }
-  if (!existsSync(path)) {
-    console.warn(`[kestrel] prerender: no database at ${path} — prerendering the site root only`)
-    return { routes: [root], incomplete: `no database at ${path} — only the site root was prerendered` }
-  }
-  let db: Database.Database | undefined
-  try {
-    db = new Database(path, { readonly: true, fileMustExist: true })
-    // Opening the file is not enumerating it: an unmigrated, zero-byte or simply wrong `KESTREL_DB` file
-    // opens as a valid EMPTY database, and the root-only route list it yields is byte-identical to a
-    // complete enumeration. Report the missing schema so a reconcile downstream can tell the two apart.
-    if (!pageLikeTables(db).length) {
-      const why = `the database at ${path} holds no page-like table — only the site root was prerendered`
-      console.warn(`[kestrel] prerender: ${why}`)
-      return { routes: [root], incomplete: why }
-    }
-    return { routes: collectPageRoutes(db, primary, prefixPrimary) }
-  } catch (error) {
-    const why = `cannot read the database at ${path}: ${(error as Error)?.message ?? error}`
-    if (reconciles) throw new Error(`[kestrel] prerender: ${why} — refusing to ship a site with no pages to an S3 target`)
-    console.warn(`[kestrel] prerender: ${why} — prerendering the site root only`)
-    return { routes: [root], incomplete: why }
-  } finally {
-    db?.close()
-  }
-}
-
-export default defineNuxtModule({
-  meta: { name: 'kestrel-prerender-routes' },
-  setup(_options, nuxt) {
-    // Build-time: resolve directly from the consumer's config (runtimeConfig/useRuntimeConfig aren't
-    // available here), rather than the request-time locale.ts globals.
-    const c = resolveKestrel(nuxt.options.kestrel as KestrelConfig, process.env, nuxt.options.rootDir)
-    // The editor-preview fallback page must NEVER be prerendered: the classic `nuxt generate` (static
-    // preset) auto-seeds every static page path, and this page 404s without an admin session — a
-    // guaranteed prerender error on every SSG build. Registered unconditionally (before the output.auto
-    // early-return) so both publishing models exclude it.
-    nuxt.hook('nitro:config', (nitro) => {
-      nitro.prerender ||= {}
-      nitro.prerender.ignore = [...(nitro.prerender.ignore ?? []), '/__kestrel/preview']
-    })
-    // The runtime publisher (output.auto) and build-time prerendering are mutually exclusive: a prerendered
-    // `.output/public/<route>/index.html` SHADOWS the live SSR route, so the publisher's localFetch would
-    // read STALE build-time HTML instead of rendering fresh. With auto on, the publisher (boot + on-write)
-    // owns publishing — so skip prerender seeding entirely. (auto off = the classic `nuxt generate` SSG model.)
-    if (c.output.auto) return
-    nuxt.hook('nitro:config', (nitro) => {
-      // Only an S3 target reconciles (deletes what this build didn't produce); a local build leaves the
-      // tree on disk, so an incomplete enumeration destroys nothing there. `nitro.static` is the same flag
-      // the deploy itself gates on: this hook also runs for `nuxt dev` and a plain `nuxt build`, and
-      // neither ships anything, so there a degrade must stay a warning instead of failing the command.
-      const reconciles = c.output.driver === 's3' && nitro.static === true
-      const discovery = discoverRoutes(c.dbPath, c.primaryLocale, c.prefixPrimary, reconciles)
-      // Hand the deploy module the completeness of THIS enumeration — the only step that knows it.
-      recordRouteDiscovery(nuxt, discovery)
-      nitro.prerender ||= {}
-      // Every meta artifact EXCEPT `llms-full.txt`, which is seeded only when the consumer opted in — the
-      // route 404s otherwise, and a prerender error fails the whole `nuxt generate`.
-      const meta = META_KEYS.filter((k) => k !== 'llms-full.txt' || c.seo.llmsFull).map((k) => `/${k}`)
-      nitro.prerender.routes = [...new Set([...(nitro.prerender.routes ?? []), ...discovery.routes, ...meta])]
-      // Render pages in parallel — the dominant lever on `nuxt generate` wall-clock as page count grows.
-      // Safe: page reads are synchronous better-sqlite3 (WAL + busy_timeout, can't interleave mid-statement);
-      // the one WRITE on this path — the variant-registry capture — is an IMMEDIATE transaction, so
-      // concurrent prerender writers (and a co-running server publisher) serialize instead of losing updates.
-      // Capped to avoid memory over-subscription; overridable.
-      nitro.prerender.concurrency ??= Math.min(Math.max(cpus().length, 2), 8)
-    })
-  },
-})

package/layers/public/modules/prerender-routes/routes.ts

@@ -1,16 +0,0 @@
-import { localePath } from '@michaelthielemann/kestrel-core'
-
-export interface PageRouteRow {
-  path: string | null
-  locale: string
-}
-
-export function pagesToRoutes(rows: PageRouteRow[], primaryLocale: string, prefixPrimary = false): string[] {
-  // The site root is the primary-locale home — `/` normally, `/<primary>` when the primary is prefixed.
-  const routes = new Set<string>([localePath('/', primaryLocale, primaryLocale, prefixPrimary)])
-  for (const { path, locale } of rows) {
-    if (!path) continue
-    routes.add(localePath(path, locale, primaryLocale, prefixPrimary))
-  }
-  return [...routes].sort()
-}

package/layers/public/modules/prune-media/index.ts

@@ -1,48 +0,0 @@
-import { defineNuxtModule } from '@nuxt/kit'
-import Database from 'better-sqlite3'
-import { resolveKestrel, type KestrelConfig } from '@michaelthielemann/kestrel-core'
-import { isEnvTrue } from '@michaelthielemann/kestrel-delivery-static'
-import { pruneUnreferencedMedia, mediaOwnedKeys } from './prune-media'
-
-// The set of storage keys the media library owns (originals + derivatives), read straight from the DB at
-// build time. Returns null when the registry can't be read (no DB, no media table) — the caller then SKIPS
-// the prune entirely rather than risk deleting extension/consumer blobs (e.g. gallery ciphertext).
-function readOwnedKeys(dbPath: string): Set<string> | null {
-  if (dbPath === ':memory:') return null
-  try {
-    const db = new Database(dbPath, { readonly: true, fileMustExist: true })
-    try {
-      const rows = db.prepare('SELECT storage_key AS storageKey, derivatives FROM media').all() as { storageKey: string; derivatives: string | null }[]
-      return mediaOwnedKeys(rows.map((r) => ({ storageKey: r.storageKey, derivatives: r.derivatives ? JSON.parse(r.derivatives) : null })))
-    } finally {
-      db.close()
-    }
-  } catch {
-    return null
-  }
-}
-
-// `nuxt generate` bakes the WHOLE upload dir into .output/public/<baseUrl>; without this, images of
-// deleted/unpublished pages ship to prod. At `compiled` (full output on disk, post prerender-abort) delete
-// every baked media file no generated page references — prunes the BAKE only, so a wrong prune costs a
-// re-generate, not data. Local-driver only (only it registers the /uploads publicAssets that gets baked).
-// If deploy-output is ever added to modules[], it must come AFTER this so the prune runs before the ship.
-export default defineNuxtModule({
-  meta: { name: 'kestrel-prune-media' },
-  setup(_options, nuxt) {
-    const c = resolveKestrel(nuxt.options.kestrel as KestrelConfig, process.env, nuxt.options.rootDir)
-    if (c.media.driver !== 'local') return
-    const dryRun = isEnvTrue(process.env.KESTREL_OUTPUT_DRY_RUN)
-    nuxt.hook('nitro:init', (nitro) => {
-      nitro.hooks.hook('compiled', () => {
-        if (nitro.options.static !== true) return
-        const ownedKeys = readOwnedKeys(c.dbPath)
-        if (!ownedKeys) {
-          console.log('[kestrel] media prune skipped: media registry unavailable (would risk deleting extension/consumer blobs)')
-          return
-        }
-        pruneUnreferencedMedia(nitro.options.output.publicDir, c.media.baseUrl, { dryRun, ownedKeys, log: (m) => console.log(`[kestrel] ${m}`) })
-      })
-    })
-  },
-})

package/layers/public/modules/prune-media/prune-media.ts

@@ -1,81 +0,0 @@
-import { existsSync, readFileSync, readdirSync, rmSync } from 'node:fs'
-import { join, relative, sep } from 'node:path'
-
-function escapeRe(s: string): string {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
-}
-
-// Prefix-relative keys referenced in `text`. The charset stops at ?/#/quote/space, so query strings,
-// fragments and srcset descriptors (320w, 2x) fall outside the key; the leading `/` keeps `/uploads` from
-// matching `/myuploads`.
-export function referencedKeys(text: string, prefix: string): Set<string> {
-  const out = new Set<string>()
-  const re = new RegExp(`${escapeRe(prefix)}/([A-Za-z0-9._/-]+)`, 'g')
-  for (const m of text.matchAll(re)) out.add(m[1])
-  return out
-}
-
-// The prunable candidates: unreferenced files that the media library OWNS. When `ownedKeys` is given, a
-// file not in it (gallery ciphertext / index, or any consumer blob written via useStorageDriver) is NEVER
-// a candidate — those are baked deliberately and their URLs are built at runtime, so they never appear as
-// literal keys in the output. Without `ownedKeys` the legacy "prune any unreferenced key" behaviour holds.
-export function planMediaPrune(files: string[], referenced: Set<string>, ownedKeys?: Set<string>): string[] {
-  return files.filter((f) => !referenced.has(f) && (!ownedKeys || ownedKeys.has(f)))
-}
-
-// The storage keys the media library owns: every original + every derivative object it tracks. Used to
-// scope the bake prune so it can only ever delete media-library artifacts, never extension/consumer blobs.
-export function mediaOwnedKeys(rows: { storageKey?: string | null; derivatives?: Record<string, { key?: string }> | null }[]): Set<string> {
-  const out = new Set<string>()
-  for (const r of rows) {
-    if (r.storageKey) out.add(r.storageKey)
-    for (const e of Object.values(r.derivatives ?? {})) if (e?.key) out.add(e.key)
-  }
-  return out
-}
-
-function walkFiles(dir: string): string[] {
-  return readdirSync(dir, { recursive: true, withFileTypes: true })
-    .filter((e) => e.isFile())
-    .map((e) => join(e.parentPath, e.name))
-}
-
-export interface PruneResult {
-  kept: number
-  pruned: number
-}
-
-export interface PruneOptions {
-  /** Report what would be deleted without touching the filesystem. */
-  dryRun?: boolean
-  /** Restrict deletion to these media-library-owned keys; anything else baked under the root is kept. */
-  ownedKeys?: Set<string>
-  log?: (msg: string) => void
-}
-
-// Delete every baked upload under `publicDir/<baseUrl>` that no generated .html/.css/.json references.
-// Over-scanning those files is keep-on-doubt (a key seen anywhere is kept). No-op when the dir is absent
-// (S3 media / nothing baked). Touches only the bake — the library upload dir is elsewhere.
-export function pruneUnreferencedMedia(publicDir: string, baseUrl: string, opts: PruneOptions = {}): PruneResult {
-  const prefix = baseUrl.replace(/\/+$/, '')
-  if (!prefix) return { kept: 0, pruned: 0 } // an empty baseUrl would target the whole output — refuse
-  const uploadsDir = join(publicDir, prefix)
-  if (!existsSync(uploadsDir)) return { kept: 0, pruned: 0 }
-
-  const referenced = new Set<string>()
-  for (const abs of walkFiles(publicDir)) {
-    // Also scan JS chunks: a media URL can be emitted only from client JS (a background image, a config
-    // object), never as literal HTML/CSS — pruning it would 404 the live reference.
-    if (!/\.(?:html|css|json|m?js)$/i.test(abs)) continue
-    for (const k of referencedKeys(readFileSync(abs, 'utf8'), prefix)) referenced.add(k)
-  }
-
-  const files = walkFiles(uploadsDir).map((abs) => ({ abs, key: relative(uploadsDir, abs).split(sep).join('/') }))
-  const prune = new Set(planMediaPrune(files.map((f) => f.key), referenced, opts.ownedKeys))
-  const toDelete = files.filter((f) => prune.has(f.key))
-  if (!opts.dryRun) for (const f of toDelete) rmSync(f.abs, { force: true })
-
-  const kept = files.length - toDelete.length
-  opts.log?.(`media prune${opts.dryRun ? ' (dry-run)' : ''}: kept ${kept}, ${opts.dryRun ? 'would prune' : 'pruned'} ${toDelete.length} unreferenced file(s)`)
-  return { kept, pruned: toDelete.length }
-}

package/layers/public/nuxt.config.ts

@@ -1,14 +0,0 @@
-import { fileURLToPath } from 'node:url'
-
-import { kestrelComponents } from '../core/modules/component-namespace/shared'
-
-export default defineNuxtConfig({
-  components: [kestrelComponents(import.meta.url)],
-  modules: [
-    fileURLToPath(new URL('./modules/prerender-routes/index.ts', import.meta.url)),
-    fileURLToPath(new URL('./modules/prune-media/index.ts', import.meta.url)),
-    // AFTER prune-media so the bake is pruned before it ships. Self-gates to output.driver:'s3' + a real
-    // `nuxt generate`; a no-op otherwise. Without it, output.driver:'s3' + output.auto:false shipped nothing.
-    fileURLToPath(new URL('./modules/deploy-output/index.ts', import.meta.url)),
-  ],
-})

package/layers/public/server/delivery-live/serve.ts

@@ -1,111 +0,0 @@
-import { getMethod, getRequestHeader, sendRedirect, send, setHeader, setResponseStatus, type H3Event } from 'h3'
-import { isRendererContext } from '@michaelthielemann/kestrel-access'
-import { cacheControlFor, isDeliveryExemptPath, isDeliveryLive } from '@michaelthielemann/kestrel-core'
-import { usePublishingDb, currentSnapshot, htmlKeyForRoute } from '@michaelthielemann/kestrel-publishing'
-import { liveRedirectFor } from '@michaelthielemann/kestrel-delivery-live'
-
-// Requests this adapter must never answer, whatever `currentSnapshot` says: the admin app, the pipeline
-// API, Nitro's own internals (tasks — e.g. the manual `publish:run` trigger), built assets, and the
-// editor's preview ticket flow. `META_ROUTES` mirrors `@michaelthielemann/kestrel-core`'s own `META_KEYS`
-// (sitemap/robots/llms/redirects) — those are rendered by their own routes, not snapshots. Every prefix
-// is slash-terminated (`normalizeExemptPrefix`'s own rule): a bare `/admin` would also match `/admin-guide`
-// — a DIFFERENT, publishable route this adapter must still serve from its own snapshot.
-const EXEMPT_PREFIXES = ['/api/', '/admin/', '/_nuxt/', '/_nitro/', '/__kestrel/']
-const META_ROUTES = new Set(['/sitemap.xml', '/robots.txt', '/llms.txt', '/llms-full.txt', '/redirects.json'])
-
-// EXEMPT_PREFIXES is slash-terminated the same way (see the const's own comment), so the bare form gets
-// the same exact-path treatment `isDeliveryExemptPath` applies to the configured entries — matching only
-// `startsWith(prefix)` left it unmatched, contrary to `deliveryExempt`'s own documented examples
-// (`/health`, `/feed.xml`).
-function isExempt(path: string): boolean {
-  if (META_ROUTES.has(path)) return true
-  if (path === '/admin') return true // the bare admin root has no trailing segment to anchor a '/admin/' prefix match
-  if (EXEMPT_PREFIXES.some((prefix) => path === prefix.slice(0, -1) || path.startsWith(prefix))) return true
-  return isDeliveryExemptPath(path)
-}
-
-// A route's own trailing slash is not a distinct route: '/route/' must resolve the same snapshot as
-// '/route'. Only the FINAL slash is stripped (one normalization pass), so a prefix match like '/admin/'
-// against '/admin/foo/' still sees '/admin/foo' and still starts with '/admin/'. The root path is its
-// own fixed point and is never touched.
-function normalizeTrailingSlash(path: string): string {
-  return path !== '/' && path.endsWith('/') ? path.slice(0, -1) : path
-}
-
-// RFC 7232 §3.2: If-None-Match may carry a comma-separated list of ETags, and a bare `*` matches any
-// current representation (always a match, as long as the resource exists — checked by the caller).
-// This route's ETag is always strong (`"<fingerprint>"`), so a weak validator (`W/"..."`) never matches
-// under strong comparison, per the same section.
-function ifNoneMatchHits(header: string | undefined, etag: string): boolean {
-  if (!header) return false
-  const trimmed = header.trim()
-  if (trimmed === '*') return true
-  return trimmed.split(',').some((candidate) => candidate.trim() === etag)
-}
-
-/**
- * The delivery-live catch-all: under `delivery: 'live'`, answers public content traffic exclusively from
- * `published_snapshots` — a configured redirect, 200 with the snapshot's own html, or 404. Wired as a
- * Nitro MIDDLEWARE (see `middleware/delivery-live-catchall.ts`) rather than a route, since a middleware
- * runs ahead of Nuxt's page router; middleware return values are ignored by h3, so this writes the
- * response itself and returns whether it did.
- *
- * Returns `false` (unhandled — the caller falls through to ordinary page rendering) for everything the
- * adapter must not touch: `delivery: 'static'` (the default), a response already sent, a non-GET/HEAD
- * request, a non-content path (admin/api/assets/meta/consumer-exempted routes), or the producer's OWN
- * internal render fetch. That last one is `isRendererContext()`/`import.meta.prerender` — the SAME
- * unforgeable AsyncLocalStorage marker `pipelines/route.ts` and `00.ip-allowlist.ts` already trust for
- * exactly this "is this our own in-process render, not an external request" question (`render-live.ts`'s
- * `renderRouteLive` runs its `localFetch` inside `runAsRenderer`, which sets it) — NOT a request header,
- * which any external client could forge. Without this bypass, a publish's own render would loop back
- * into this catch-all and get served its route's CURRENT (about-to-be-superseded) snapshot instead of
- * ever reaching a real page render, so a
- * publish under `'live'` could never record a fresh one.
- */
-export async function serveLiveRoute(event: H3Event): Promise<boolean> {
-  if (event.node?.res?.writableEnded) return false
-  if (!isDeliveryLive()) return false
-  if (import.meta.prerender === true || isRendererContext()) return false
-  const method = getMethod(event)
-  if (method !== 'GET' && method !== 'HEAD') return false
-  const path = normalizeTrailingSlash(event.path.split('?')[0] || '/')
-  if (isExempt(path)) return false
-
-  // Live mode is the app's own edge — there is no separate njs/edge script in front of it the way the
-  // static topology has, so a configured redirect has to be honoured here too, before the 404.
-  const redirect = liveRedirectFor(path)
-  if (redirect) {
-    await sendRedirect(event, redirect.target, redirect.status)
-    return true
-  }
-
-  const snapshot = currentSnapshot(usePublishingDb().db, path)
-  if (!snapshot) {
-    setResponseStatus(event, 404)
-    await send(event, 'Not Found', 'text/plain')
-    return true
-  }
-
-  // The fingerprint is a sha256 of the exact rendered bytes (publisher.ts), so a STRONG ETag is exact:
-  // any two responses sharing it are byte-identical, never merely semantically equivalent. Cache-Control
-  // mirrors delivery-static's own policy for an html key (`cacheControlFor`/`REVALIDATE_CACHE`) so the
-  // two adapters agree on cacheability for the same snapshot. NOTE: this ETag/304 state lives only in
-  // `published_snapshots`, read fresh per request — there is no separate in-process cache to invalidate,
-  // so this is safe across multiple server processes sharing the DB.
-  const etag = `"${snapshot.fingerprint}"`
-  const cacheControl = cacheControlFor(htmlKeyForRoute(path))
-  setHeader(event, 'etag', etag)
-  if (cacheControl) setHeader(event, 'cache-control', cacheControl)
-
-  if (ifNoneMatchHits(getRequestHeader(event, 'if-none-match'), etag)) {
-    setResponseStatus(event, 304)
-    await send(event, undefined)
-    return true
-  }
-
-  const body = Buffer.from(snapshot.html, 'utf8')
-  setHeader(event, 'content-length', body.byteLength)
-  setResponseStatus(event, 200)
-  await send(event, method === 'HEAD' ? undefined : snapshot.html, 'text/html; charset=utf-8')
-  return true
-}

package/layers/public/server/middleware/delivery-live-catchall.ts

@@ -1,7 +0,0 @@
-import { serveLiveRoute } from '../delivery-live/serve'
-
-// Runs on every request; only intercepts when serveLiveRoute's own gate says so (delivery-live/ stays
-// the single owner of when/how this adapter answers — see its TSDoc).
-export default defineEventHandler(async (event) => {
-  await serveLiveRoute(event)
-})

package/layers/public/server/pipelines/index.ts

@@ -1,23 +0,0 @@
-import type { PipelineDef } from '@michaelthielemann/kestrel-core'
-import {
-  buildPublishPipelines,
-  buildPublishRunsPipelines,
-  buildLinkPipelines,
-  buildPreviewPipelines,
-  buildRoutePipelines,
-} from '@michaelthielemann/kestrel-publishing'
-import { buildDeliveryLivePipelines } from '@michaelthielemann/kestrel-delivery-live'
-
-/** The public layer's own API surface: the render entry, the preview ticket pair, the publish action and
- *  its status read, the orchestrator's admin progress read, the editor's link resolver, and the
- *  delivery-live read API. All collection-less, so each lives at `/api/<name>`. */
-export function buildPublicPipelines(): PipelineDef[] {
-  return [
-    ...buildRoutePipelines(),
-    ...buildPreviewPipelines(),
-    ...buildPublishPipelines(),
-    ...buildPublishRunsPipelines(),
-    ...buildLinkPipelines(),
-    ...buildDeliveryLivePipelines(),
-  ]
-}

package/layers/public/server/plugins/00.ensure-snapshot-triggers.ts

@@ -1,14 +0,0 @@
-import type Database from 'better-sqlite3'
-import { useDb } from '@michaelthielemann/kestrel-core'
-import { ensureSnapshotTriggers } from '@michaelthielemann/kestrel-publishing'
-
-// Layer order puts every core-layer plugin (00.migrate, 02.schema-sync) before this layer's, so
-// `published_snapshots` already exists here for either provisioning path (a committed migration inside
-// Kestrel's own repo, or the schema engine for a consumer layer) — except a boot before EITHER has run,
-// which `ensureSnapshotTriggers` itself tolerates (warns, does not crash). Skipped during prerender, same
-// as `02.schema-sync`: no DDL runs in that phase.
-export default defineNitroPlugin(() => {
-  if (import.meta.prerender) return
-  const client = (useDb() as unknown as { $client: Database.Database }).$client
-  ensureSnapshotTriggers(client)
-})

package/layers/public/server/plugins/01.register-public-pipelines.ts

@@ -1,7 +0,0 @@
-import { registerPipeline } from '@michaelthielemann/kestrel-core'
-import { buildPublicPipelines } from '../pipelines'
-
-// Registration only — nothing resolves a pipeline here; the registry is read on the first request.
-export default defineNitroPlugin(() => {
-  for (const def of buildPublicPipelines()) registerPipeline(def)
-})

package/layers/public/server/plugins/02.register-links.ts

@@ -1,16 +0,0 @@
-import { registerFieldPopulator } from '@michaelthielemann/kestrel-core'
-import { buildLinkFieldPopulators, resolveInternalHref } from '@michaelthielemann/kestrel-publishing'
-
-// Resolve internal links to the target record's localized public path at read time (page-like targets;
-// external/email/tel pass through). The resolver IS status-gated: a link to a DRAFT resolves to nothing and
-// bakes `'#'`, so an unpublished slug never reaches published HTML. The href therefore encodes availability,
-// which is why flipping a target's status re-renders its referrers; the editor warns about the resulting
-// draft/dead links separately. (See link-resolve.ts.)
-//
-// Registered as `link` + `richtext` per-type populators; the shared field-tree walker dispatches them over
-// top-level fields, block props, slots, and repeater entries.
-export default defineNitroPlugin(() => {
-  const { link, richtext } = buildLinkFieldPopulators(resolveInternalHref)
-  registerFieldPopulator('link', link)
-  registerFieldPopulator('richtext', richtext)
-})

package/layers/public/server/plugins/03.redirects.ts

@@ -1,55 +0,0 @@
-import { Effect } from 'effect'
-import { collectionOf, registerAfterStep } from '@michaelthielemann/kestrel-core'
-import type { StepDef } from '@michaelthielemann/kestrel-core'
-import { outputDriver, REDIRECTS_COLLECTION, REDIRECTS_FIELD, writeRedirectsArtifact } from '@michaelthielemann/kestrel-publishing'
-import { invalidateLiveRedirects } from '@michaelthielemann/kestrel-delivery-live'
-
-/**
- * Publish `redirects.json` on every save of the redirects singleton — deliberately decoupled from the
- * publish cycle, so a redirect goes live without a full republish (and without an editor pressing
- * Publish, which after ADR-0008 they otherwise would have to).
- *
- * A CRITICAL after-step, not a non-critical one: a save that reports success while the edge still serves
- * the old rules is exactly the failure this feature cannot have — its failure becomes the save's response.
- * Registered in every environment, unlike the publish plugin — that one is dev-gated because a dev publish
- * would write Vite-dev HTML with no hashed `_nuxt`, a CONTENT problem this artifact does not have (it is
- * `JSON.stringify` of DB rows, byte-identical either way).
- *
- * Where it lands is `output.dir` / the S3 prefix — the same target the publisher uses. With the classic
- * `output.auto: false` + `driver: 'local'` build model that is NOT the deployed tree, so there a
- * redirect goes live with the next `nuxt generate` instead; documented under Redirects in
- * `docs/guide/redirects.md`.
- */
-export default defineNitroPlugin(() => {
-  const writeRedirectsStep: StepDef = {
-    name: 'writeRedirects',
-    when: (ctx) => collectionOf(ctx).def.name === REDIRECTS_COLLECTION,
-    whenLabel: `collection is "${REDIRECTS_COLLECTION}"`,
-    fn: (ctx) => Effect.gen(function* () {
-      const row = ctx.output as Record<string, unknown>
-      // The row is already committed regardless of what the static artifact write below does (see its
-      // own comment) — the live catch-all reads straight from the row, so its cache drops unconditionally,
-      // in lockstep with every save.
-      invalidateLiveRedirects()
-      // A JS try/catch does NOT observe an Effect failure crossing a `yield*` — only Effect's own
-      // combinators do — so the survivor rewrap has to be Effect.catchAll, not a wrapping try/catch.
-      yield* Effect.tryPromise({ try: () => writeRedirectsArtifact(row[REDIRECTS_FIELD], outputDriver()), catch: (error) => error }).pipe(
-        Effect.catchAll((error) => Effect.sync(() => {
-          // The row is already committed (CRUD holds no transaction), so the only honest message is
-          // "saved, but not live". Short and ASCII on purpose: h3 truncates nothing but the reason phrase is
-          // the wire's, and the cause goes in `data` where nothing can strip it. `savedUpdatedAt` lets the
-          // editor rebaseline on this failure the same way it would on success — it only rebaselines then.
-          throw createError({
-            statusCode: 500,
-            statusMessage: 'Redirects saved, but publishing redirects.json failed. Save again to retry.',
-            data: {
-              cause: (error as Error)?.message ?? String(error),
-              savedUpdatedAt: new Date(row.updatedAt as string | number).getTime(),
-            },
-          })
-        })),
-      )
-    }),
-  }
-  registerAfterStep({ step: writeRedirectsStep, critical: true, ops: ['updateOne'] })
-})

package/layers/public/server/plugins/05.plan-publish.ts

@@ -1,5 +0,0 @@
-import { registerPlanPublish } from '@michaelthielemann/kestrel-publishing'
-
-export default defineNitroPlugin(() => {
-  registerPlanPublish()
-})