@michaelthielemann/kestrel 4.1.3 → 5.0.0

package/layers/public/server/plugins/zz.publish.ts

@@ -1,127 +0,0 @@
-import { renderRouteLive } from '../utils/publish/render-live'
-import {
-  createPublishQueue,
-  setPublishRuntime,
-  DepsStore,
-  createSqlitePersistence,
-  usePublishingDb,
-  outputDriver,
-  publishInvalidation,
-  resumePublishRuns,
-  startPublishRun,
-  setRenderRouteLive,
-  type PublishDelivery,
-} from '@michaelthielemann/kestrel-publishing'
-
-/**
- * The in-server publish runtime (the production operation model). Wires the queue + deps index and gates
- * whether they exist at all, on `output.auto`, skipped in dev (a dev publish would write Vite-dev HTML
- * without hashed `_nuxt`):
- *
- *  1. THE RUNTIME ITSELF — `setPublishRuntime` publishes the queue + deps index via `usePublishRuntime()`.
- *     The `planPublish` outbox handler (`handlers/plan-publish.ts`, registered independently by
- *     `05.plan-publish.ts`) is the actual AUTO-TRIGGER: it classifies every content/media write into an
- *     invalidation and enqueues it, but only when this plugin has actually set a runtime — a no-op
- *     otherwise (dev, or `output.auto` off), so the gate lives here even though the trigger does not.
- *  2. BOOT PUBLISH — a full publish on startup resyncs this build's `_nuxt` + records every route's deps.
- *     DETACHED (`runNitroPlugins` is synchronous + unawaited; `localFetch` is already wired before plugins
- *     run + before the server listens), so it never blocks boot. A FULL run (boot's own, and the
- *     reconciler's below) goes through `startPublishRun`, so its command -> snapshot -> delivery ->
- *     done sequence is persisted to `publish_runs` and survives a crash — an incremental (tag) run a
- *     content/media write triggers stays a direct `publishInvalidation` call, since it is not part of
- *     the owned sequence.
- *  3. RECONCILER — an optional periodic full publish (`output.reconcileMinutes`) self-heals any missed
- *     invalidation, also tracked as an owned run. The self-heal is real, not just "re-render everything
- *     and hope": every full/reconcile publish live-renders each published route and compares its
- *     fingerprint against the currently recorded snapshot (`publisher.ts`'s `PublishMode: 'reconcile'`,
- *     ADR-0013's amendment) — a mismatch (a missed invalidation, a template/component deploy) records +
- *     delivers the fresh render; a match costs nothing beyond the render itself.
- *
- * Crash-resume (ADR-0025): `resumePublishRuns` marks any run a crash left `running` as `failed` — it does
- * NOT redeliver — and runs BEFORE the boot enqueue below, which fires unconditionally regardless of what
- * resume found. The queue remains the ONLY caller that ever invokes a delivery; resume never bypasses its
- * single-flight guard.
- */
-export default defineNitroPlugin(() => {
-  if (import.meta.dev) return
-  const output = (useRuntimeConfig().kestrel as { output?: { auto?: boolean; publishOnSave?: boolean; reconcileMinutes?: number; verbose?: boolean } }).output
-  if (!output?.auto) return
-
-  // Wired explicitly here (not a module-load side effect) — see tasks/publish/run.ts's own comment for
-  // why: it removes any dependency on import-order/instance-identity between this plugin's own
-  // `@michaelthielemann/kestrel-publishing` import and the one `publisher.ts`'s internals resolve. Idempotent.
-  setRenderRouteLive(renderRouteLive)
-
-  // `output.verbose`: on top of the one-line summary, itemise each incremental republish with a
-  // timestamped per-route line (rendered / pruned) for traceability. Off by default. (A queued FULL run
-  // — boot / reconciler — is a bulk resync and stays a summary; publishInvalidation returns no per-route
-  // list for it.)
-  const verbose = output.verbose ?? false
-  const stamp = () => new Date().toISOString()
-
-  const driver = outputDriver()
-  // Durable deps: rehydrate `route → tags` from SQLite so the boot full-publish below can prune routes
-  // that were unpublished/deleted while the server was down (staleRoutes over a non-empty tracked set).
-  const deps = new DepsStore(createSqlitePersistence(usePublishingDb().db))
-
-  // The delivery port for a FULL run: the real renderer, driven the same way a queued full invalidation
-  // always was. `startPublishRun` persists the command -> snapshot -> delivery -> done sequence around
-  // this call; this closure is only the "delivery" step itself.
-  const fullDelivery: PublishDelivery = {
-    deliver: async () => {
-      const { rendered, pruned, counts } = await publishInvalidation({ type: 'full' }, driver, deps)
-      if (counts.rendered === 0 && counts.pruned === 0) return
-      console.info(`[kestrel] published ${counts.rendered} route(s) (pruned ${counts.pruned})`)
-      if (verbose) {
-        for (const route of rendered) console.info(`[kestrel] ${stamp()} rendered ${route}`)
-        for (const route of pruned) console.info(`[kestrel] ${stamp()} pruned ${route}`)
-      }
-    },
-  }
-
-  const queue = createPublishQueue({
-    run: async (inv) => {
-      if (inv.type === 'full') {
-        const result = await startPublishRun(fullDelivery)
-        // Rethrow on a recorded failure so the queue's own retry-on-failure fires (its `.catch()` calls
-        // `onError` below and re-queues the batch) — `startPublishRun` itself never throws for a delivery
-        // failure (it resolves with the outcome as data), so restoring that retry has to happen here.
-        // `id: 0` is the synthetic placeholder `startPublishRun`'s missing-table fallback returns (no real
-        // row backs it) — label it distinctly rather than a misleading "#0".
-        if (result.status === 'failed') throw new Error(`publish run #${result.id === 0 ? 'untracked' : result.id} failed: ${result.error}`)
-        return
-      }
-      const { rendered, pruned, counts } = await publishInvalidation(inv, driver, deps)
-      if (counts.rendered === 0 && counts.pruned === 0) return
-      // Incremental runs name the routes; a queued full run (the reconciler) prints counts only.
-      const list = rendered.length ? `: ${rendered.join(', ')}` : ''
-      console.info(`[kestrel] published ${counts.rendered} route(s)${list} (pruned ${counts.pruned})`)
-      if (verbose) {
-        for (const route of rendered) console.info(`[kestrel] ${stamp()} rendered ${route}`)
-        for (const route of pruned) console.info(`[kestrel] ${stamp()} pruned ${route}`)
-      }
-    },
-    onError: (error) => console.error('[kestrel] publish run failed:', error),
-  })
-
-  // The explicit publish action (`POST /api/publish`) enqueues through this same queue, so a publish and
-  // a write-driven prune are serialized by one single-flight run rather than racing each other.
-  setPublishRuntime({ queue, deps })
-
-  // Boot publish goes THROUGH the queue (not a direct publishFull) so it shares the single-flight guard:
-  // otherwise a boot full-publish could overlap a write-triggered incremental or the reconciler, and both
-  // runs share the module-level variant accumulator (corrupting the registry) and can interleave
-  // render/prune (leaving an unpublished page live). The queue serializes them, and it is the ONLY
-  // AUTOMATIC caller that ever invokes a delivery — `resumePublishRuns` below just updates rows, so there
-  // is nothing left to race it. (The `publish:run` Nitro task — `tasks/publish/run.ts` — is a documented
-  // exception: an operator-triggered manual run that calls `publishFull` directly, outside this queue.)
-  //
-  // Resume runs first, awaited: it is a plain DB update (never invokes delivery, so it cannot itself
-  // crash the process the way a redelivered render could), which is what guarantees the boot enqueue below
-  // always fires — a resume that instead redelivered and crashed again the same way would leave the row
-  // `running` forever and never reach this line, an infinite boot loop that never makes progress.
-  void resumePublishRuns().finally(() => queue.enqueue({ type: 'full' }))
-
-  const mins = output.reconcileMinutes ?? 0
-  if (mins > 0) setInterval(() => queue.enqueue({ type: 'full' }), mins * 60_000).unref?.()
-})

package/layers/public/server/routes/llms-full.txt.get.ts

@@ -1,99 +0,0 @@
-import { getTableColumns } from 'drizzle-orm'
-import { localePath, useDb, primaryLocale, prefixPrimaryLocale, allCollections } from '@michaelthielemann/kestrel-core'
-import type { BuiltCollection } from '@michaelthielemann/kestrel-core'
-import { isPubliclyReadable, publicReadableResources } from '@michaelthielemann/kestrel-access'
-import { LLMS_FULL_HEADING_OFFSET, buildLlmsFullTxt, recordMarkdown, collectionHeading, siteBaseUrl, siteName, siteDescription, llmsFullEnabled } from '@michaelthielemann/kestrel-publishing'
-import type { LlmsFullSection, LlmsFullPage } from '@michaelthielemann/kestrel-publishing'
-// The long form of llms.txt: every published, indexable page's full Markdown body in one document, so an
-// answer engine can ground on the site without crawling it. Same registry-driven public set and the same
-// status/noindex filters as `llms.txt` and the sitemap (single source: the auth policy).
-//
-// OPT-IN (`kestrel.seo.llmsFull`, default off), for two reasons that both matter: it aggregates the whole
-// site into one scrapeable artifact — a disclosure decision that belongs to the consumer, not to an
-// upgrade — and unlike `llms.txt` it must read every row's block content, which the publisher would
-// re-render on every incremental publish.
-export default defineEventHandler((event) => {
-  if (!llmsFullEnabled()) throw createError({ statusCode: 404, statusMessage: 'Not Found' })
-  const db = useDb()
-  const base = siteBaseUrl()
-  const primary = primaryLocale()
-  const prefixPrimary = prefixPrimaryLocale()
-
-  setHeader(event, 'content-type', 'text/plain; charset=utf-8')
-  // Without an absolute origin every `Source:` line would be a relative path resolving against whatever
-  // host fetched the file — the same rule `llms.txt` applies to its link list.
-  if (!base) {
-    console.warn('[kestrel] llms-full.txt: siteUrl is unset — omitting page bodies (their URLs would be relative)')
-    return buildLlmsFullTxt({ siteName: siteName(), siteDescription: siteDescription() || undefined, sections: [] })
-  }
-
-  interface Loaded { c: BuiltCollection; rows: Record<string, unknown>[] }
-  const pub = publicReadableResources()
-  const loaded: Loaded[] = []
-  for (const c of allCollections()) {
-    if (!c.def.pageLike) continue
-    if (!isPubliclyReadable(c.def.name, pub)) continue
-    // Project the listing columns plus ONLY the prose-bearing fields — this route does have to read block
-    // content, but a media/relation/json column still has no business being loaded to render text.
-    const cols = getTableColumns(c.table) as Record<string, never>
-    const proj: Record<string, unknown> = { id: cols.id, path: cols.path }
-    if (c.def.translatable) proj.locale = cols.locale
-    if (c.def.status) proj.status = cols.status
-    if (c.def.seo) proj.seo = cols.seo
-    if (c.def.blocks?.enabled) proj.content = cols.content
-    for (const [key, field] of Object.entries(c.def.fields)) {
-      if (field.type === 'text' || field.type === 'richtext' || field.type === 'repeater') proj[key] = cols[key]
-    }
-    try {
-      loaded.push({ c, rows: db.select(proj as never).from(c.table).all() as Record<string, unknown>[] })
-    } catch (error) {
-      // Skipping keeps a bare prerender DB publishable, but a drifted table drops the whole section — a
-      // silent gap the publisher would write straight over the live artifact.
-      console.error(`[kestrel] llms-full.txt: skipped collection ${c.def.name}:`, (error as Error)?.message ?? error)
-    }
-  }
-
-  const advertisable = (c: BuiltCollection, row: Record<string, unknown>): string | null => {
-    if (c.def.status && row.status !== 'published') return null
-    const path = row.path as string | null
-    if (!path) return null
-    if ((row.seo as { noindex?: boolean } | null)?.noindex) return null
-    return base + localePath(path, (row.locale as string | undefined) ?? primary, primary, prefixPrimary)
-  }
-
-  // Internal richtext links are stored as `kestrel:<collection>:<id>` markers. Resolve them from the rows
-  // already loaded — the same status/noindex gate, so a marker pointing at a draft or a noindexed page
-  // declines and the link degrades to its own text instead of leaking an unpublished URL.
-  const linkTargets = new Map<string, string>()
-  for (const { c, rows } of loaded) {
-    for (const row of rows) {
-      const url = advertisable(c, row)
-      if (url) linkTargets.set(`${c.def.name}:${row.id as number}`, url)
-    }
-  }
-  const resolveLink = (collection: string, id: number): string | null => linkTargets.get(`${collection}:${id}`) ?? null
-
-  const sections: LlmsFullSection[] = []
-  for (const { c, rows } of loaded) {
-    const pages: LlmsFullPage[] = []
-    for (const row of rows) {
-      const url = advertisable(c, row)
-      if (!url) continue
-      const seo = (row.seo ?? {}) as { title?: string; description?: string }
-      pages.push({
-        title: seo.title || (row.title as string | undefined) || (row.path as string),
-        url,
-        description: seo.description || undefined,
-        // `title` already IS this page's heading — emitting it again as body text would repeat every
-        // page title twice in the document.
-        body: recordMarkdown(c.def, row, { headingOffset: LLMS_FULL_HEADING_OFFSET, skipFields: ['title'], resolveLink }),
-      })
-    }
-    if (pages.length) {
-      pages.sort((a, b) => a.url.localeCompare(b.url))
-      sections.push({ heading: collectionHeading(c.def, primary), pages })
-    }
-  }
-
-  return buildLlmsFullTxt({ siteName: siteName(), siteDescription: siteDescription() || undefined, sections })
-})

package/layers/public/server/routes/llms.txt.get.ts

@@ -1,66 +0,0 @@
-import { getTableColumns } from 'drizzle-orm'
-import { localePath, useDb, primaryLocale, prefixPrimaryLocale, allCollections } from '@michaelthielemann/kestrel-core'
-import { isPubliclyReadable, publicReadableResources } from '@michaelthielemann/kestrel-access'
-import { collectionHeading, buildLlmsTxt, siteBaseUrl, siteName, siteDescription } from '@michaelthielemann/kestrel-publishing'
-import type { LlmsSection, LlmsEntry } from '@michaelthielemann/kestrel-publishing'
-
-// Generates an `llms.txt` (llmstxt.org): the site name + description, then one section per pageLike
-// collection listing its published, indexable records — the SAME registry-driven public set the sitemap
-// advertises (single source: the auth policy). Safe to serve publicly and to prerender.
-export default defineEventHandler((event) => {
-  const db = useDb()
-  const base = siteBaseUrl()
-  const primary = primaryLocale()
-  const prefixPrimary = prefixPrimaryLocale()
-
-  const pub = publicReadableResources()
-  const sections: LlmsSection[] = []
-  // Without an absolute origin, every resource URL would be a relative path — omit the page sections (keep
-  // the site name + description) rather than emit a link list that resolves against the wrong host.
-  if (!base) console.warn('[kestrel] llms.txt: siteUrl is unset — omitting page links (they would be relative)')
-  for (const c of base ? allCollections() : []) {
-    if (!c.def.pageLike) continue
-    if (!isPubliclyReadable(c.def.name, pub)) continue
-    // Project ONLY the columns this listing reads — never SELECT *, which would pull every row's
-    // block-content JSON into memory just to emit a link; the runtime publisher re-renders this route on
-    // every incremental publish. Optional columns exist only when the def declares them (buildTable adds no
-    // locale/status/seo column otherwise), and a `cols.<missing>` would be undefined and make the select
-    // throw — gate on the same flags, as the sitemap does. `title` is a plain field, so probe the table.
-    const cols = getTableColumns(c.table) as Record<string, never>
-    const proj: Record<string, unknown> = { path: cols.path }
-    if (c.def.translatable) proj.locale = cols.locale
-    if (c.def.status) proj.status = cols.status
-    if (c.def.seo) proj.seo = cols.seo
-    if (Object.hasOwn(cols, 'title')) proj.title = cols.title
-    let rows: Record<string, unknown>[]
-    try {
-      rows = db.select(proj as never).from(c.table).all() as Record<string, unknown>[]
-    } catch (error) {
-      // Skipping keeps a bare prerender DB publishable, but a drifted table drops the whole section — a
-      // silent gap the publisher would write straight over the live artifact.
-      console.error(`[kestrel] llms.txt: skipped collection ${c.def.name}:`, (error as Error)?.message ?? error)
-      continue
-    }
-    const entries: LlmsEntry[] = []
-    for (const row of rows) {
-      if (c.def.status && row.status !== 'published') continue
-      const path = row.path as string | null
-      if (!path) continue
-      const seo = (row.seo ?? {}) as { title?: string; description?: string; noindex?: boolean }
-      if (seo.noindex) continue
-      const locale = (row.locale as string | undefined) ?? primary
-      entries.push({
-        title: seo.title || (row.title as string | undefined) || path,
-        url: base + localePath(path, locale, primary, prefixPrimary),
-        description: seo.description || undefined,
-      })
-    }
-    if (entries.length) {
-      entries.sort((a, b) => a.url.localeCompare(b.url))
-      sections.push({ heading: collectionHeading(c.def, primary), entries })
-    }
-  }
-
-  setHeader(event, 'content-type', 'text/plain; charset=utf-8')
-  return buildLlmsTxt({ siteName: siteName(), siteDescription: siteDescription() || undefined, sections })
-})

package/layers/public/server/routes/redirects.json.get.ts

@@ -1,58 +0,0 @@
-import { eq } from 'drizzle-orm'
-import { getCollection, useDb } from '@michaelthielemann/kestrel-core'
-import { compilePublishableRedirects, serializeRedirects, REDIRECTS_COLLECTION, REDIRECTS_FIELD } from '@michaelthielemann/kestrel-publishing'
-
-/**
- * The redirect artifact the edge polls. A save publishes it directly (see `plugins/03.redirects.ts`);
- * this route is what makes it survive everything else — it is prerendered into `.output/public`, so the
- * build-time deploy's reconcile keeps it instead of pruning a key it cannot account for, and a full
- * publish re-renders it from the live DB. Public and cheap: one row, no user input.
- *
- * Zero redirects is a supported state, and so is a collection a consumer toggled off — both serve `[]`,
- * never a 404, because an edge that cannot fetch the file has to keep its last good state and would
- * otherwise burn its cold-start budget retrying.
- */
-
-/** A table that does not exist yet — the release adds one, so a consumer can generate before their
- *  `db:migrate`. `[]` is the truth there, not a degrade. */
-function tableIsAbsent(error: unknown): boolean {
-  return /no such table/i.test((error as Error)?.message ?? '')
-}
-
-/**
- * Render the artifact, or fail loudly. The distinction is deliberate and narrow: only a missing table
- * yields `[]`, because only then is "no redirects" a FACT. Any other read failure (a drifted column, an
- * I/O error) throws — at build time an errored route costs the deploy its reconcile, which is the
- * conservative direction, and at runtime `publishMeta` writes nothing on a non-200, where an empty body
- * would instead overwrite a good live artifact with "no redirects". A failed read must never be an
- * authoritative empty result.
- */
-export function renderRedirects(readRows: () => unknown): string {
-  let rows: unknown
-  try {
-    rows = readRows()
-  } catch (error) {
-    if (!tableIsAbsent(error)) throw error
-    console.warn('[kestrel] redirects.json: the redirects table does not exist yet — serving an empty list. Run `db:migrate`.')
-    return serializeRedirects([])
-  }
-  const { rules, skipped } = compilePublishableRedirects(rows)
-  for (const message of skipped) {
-    console.error(`[kestrel] redirects.json: skipped an unpublishable rule — ${message}`)
-  }
-  return serializeRedirects(rules)
-}
-
-export default defineEventHandler((event) => {
-  setHeader(event, 'content-type', 'application/json; charset=utf-8')
-  const collection = getCollection(REDIRECTS_COLLECTION)
-  if (!collection) return serializeRedirects([])
-
-  const cols = collection.table as unknown as Record<string, never>
-  return renderRedirects(() => {
-    const row = useDb().select().from(collection.table).where(eq(cols.singletonKey, REDIRECTS_COLLECTION)).get() as
-      | Record<string, unknown>
-      | undefined
-    return row?.[REDIRECTS_FIELD]
-  })
-})

package/layers/public/server/routes/robots.txt.get.ts

@@ -1,11 +0,0 @@
-import { siteBaseUrl, buildRobots, llmsFullEnabled } from '@michaelthielemann/kestrel-publishing'
-
-export default defineEventHandler((event) => {
-  const base = siteBaseUrl()
-  setHeader(event, 'content-type', 'text/plain; charset=utf-8')
-  return buildRobots({
-    sitemapUrl: base ? `${base}/sitemap.xml` : undefined,
-    llmsUrl: base ? `${base}/llms.txt` : undefined,
-    llmsFullUrl: base && llmsFullEnabled() ? `${base}/llms-full.txt` : undefined,
-  })
-})

package/layers/public/server/routes/sitemap.xml.get.ts

@@ -1,79 +0,0 @@
-import { getTableColumns } from 'drizzle-orm'
-import { localePath, useDb, primaryLocale, prefixPrimaryLocale, allCollections, isDeliveryLive } from '@michaelthielemann/kestrel-core'
-import { isPubliclyReadable, publicReadableResources } from '@michaelthielemann/kestrel-access'
-import { currentRoutes, usePublishingDb, buildSitemap, withHreflang, siteBaseUrl } from '@michaelthielemann/kestrel-publishing'
-import type { SitemapCandidate } from '@michaelthielemann/kestrel-publishing'
-
-// Lists every published, indexable page-like record (across all pageLike collections) as a
-// sitemap. Filters status/noindex itself, so it is safe to serve publicly and to prerender. Under
-// `delivery: 'live'`, a route must ALSO have a current, non-retracted snapshot — the row's own
-// status/noindex fields and the snapshot store are two independent "is this reachable" facts (a direct
-// snapshot retraction leaves the row untouched, see `@michaelthielemann/kestrel-publishing`'s `server/db/snapshots.ts`), and this route is what a crawler
-// actually finds, so both must agree before a route is listed.
-export default defineEventHandler((event) => {
-  const db = useDb()
-  const base = siteBaseUrl()
-  // Without an absolute origin (kestrel.siteUrl / KESTREL_SITE_URL) every <loc> would be a RELATIVE path,
-  // which the sitemaps.org schema rejects outright — a worse result than an empty sitemap. Emit a valid
-  // empty one + warn, mirroring robots.txt omitting its `Sitemap:` directive when the base is unset.
-  if (!base) {
-    console.warn('[kestrel] sitemap.xml: siteUrl is unset — emitting an empty sitemap (relative <loc> URLs would be invalid)')
-    setHeader(event, 'content-type', 'application/xml; charset=utf-8')
-    return buildSitemap([])
-  }
-  const primary = primaryLocale()
-  const prefixPrimary = prefixPrimaryLocale()
-  const candidates: SitemapCandidate[] = []
-  // One set lookup for the whole candidate list instead of one currentSnapshot query per candidate.
-  const liveRoutes = isDeliveryLive() ? new Set(currentRoutes(usePublishingDb().db)) : null
-
-  // A sitemap must only advertise publicly-reachable URLs, so it tracks the SAME registry-driven
-  // public set the public render path uses (single source: the auth policy).
-  const pub = publicReadableResources()
-  for (const c of allCollections()) {
-    if (!c.def.pageLike) continue
-    if (!isPubliclyReadable(c.def.name, pub)) continue
-    // Project ONLY the columns the sitemap reads — never SELECT *, which would pull every row's
-    // block-content JSON (and every other field) into memory just to emit a URL; the runtime publisher
-    // re-renders this route on every incremental publish. Optional columns exist only when the def
-    // declares them (buildTable adds no locale/status/seo column otherwise), and a `cols.<missing>` would
-    // be undefined and make the select throw — gate on the same flags, as allPublishedRoutes does.
-    const cols = getTableColumns(c.table) as Record<string, never>
-    const proj: Record<string, unknown> = { path: cols.path, updatedAt: cols.updatedAt }
-    if (c.def.translatable) proj.locale = cols.locale
-    if (c.def.translatable && c.def.mode !== 'single') proj.translationGroup = cols.translationGroup
-    if (c.def.status) proj.status = cols.status
-    if (c.def.seo) proj.seo = cols.seo
-    let rows: Record<string, unknown>[]
-    try {
-      rows = db.select(proj as never).from(c.table).all() as Record<string, unknown>[]
-    } catch (error) {
-      // Skipping keeps a bare prerender DB publishable, but a drifted table de-indexes every page of the
-      // collection — a silent gap the publisher would write straight over the live sitemap.
-      console.error(`[kestrel] sitemap.xml: skipped collection ${c.def.name}:`, (error as Error)?.message ?? error)
-      continue
-    }
-    for (const row of rows) {
-      if (c.def.status && row.status !== 'published') continue
-      const path = row.path as string | null
-      if (!path) continue
-      const seo = (row.seo ?? {}) as { noindex?: boolean }
-      if (seo.noindex) continue
-      const locale = (row.locale as string | undefined) ?? primary
-      const route = localePath(path, locale, primary, prefixPrimary)
-      if (liveRoutes && !liveRoutes.has(route)) continue
-      candidates.push({
-        loc: base + route,
-        lastmod: row.updatedAt instanceof Date ? row.updatedAt.toISOString() : undefined,
-        locale,
-        group: (row.translationGroup as string | undefined) ?? null,
-      })
-    }
-  }
-
-  // Link each page's published, indexable locale variants via hreflang alternates before serializing.
-  const entries = withHreflang(candidates, primary)
-  entries.sort((a, b) => a.loc.localeCompare(b.loc))
-  setHeader(event, 'content-type', 'application/xml; charset=utf-8')
-  return buildSitemap(entries)
-})

package/layers/public/server/tasks/publish/run.ts

@@ -1,32 +0,0 @@
-import { renderRouteLive } from '../../utils/publish/render-live'
-import { publishFull, outputDriver, DepsStore, createSqlitePersistence, usePublishingDb, setRenderRouteLive } from '@michaelthielemann/kestrel-publishing'
-
-/**
- * The shared publish engine, exposed as a Nitro task. Renders every published page (+ sitemap/robots)
- * via the live server, mirrors `_nuxt`/assets, and always prunes the routes that left the published set
- * (output ≡ DB). Like every full publish it HOLDS BACK routes with unpublished changes (ADR-0008) — a
- * resync must not push work in progress live; those pages go out when they are published.
- *
- * Triggering (Nuxt 4.4 / Nitro 2.13 — there is NO `nuxi task run`):
- *   - dev:  GET http://localhost:3000/_nitro/tasks/publish:run   (the dev-only task route; plumbing smoke test)
- *   - prod: the boot-publish plugin (`zz.publish.ts`) runs this on startup; for an on-demand prod trigger,
- *           expose your own authenticated route that calls `runTask('publish:run')` (the built node-server
- *           has no task endpoint/CLI — only `runTask()` from inside the process + cron `scheduledTasks`).
- */
-export default defineTask({
-  meta: { name: 'publish:run', description: 'Render all published pages to the configured static output (HTML + _nuxt + assets)' },
-  async run() {
-    // Wired explicitly here (not a module-load side effect): Nitro dev re-evaluates a task's module graph
-    // per invocation for hot-reload, which can give this call and `publisher.ts`'s a differently-scoped
-    // `@michaelthielemann/kestrel-publishing` instance if the wiring only ran once, earlier, at a boot-time import — calling
-    // the setter fresh, synchronously, right before the only call that needs it removes that dependency on
-    // import-order/instance-identity entirely. Idempotent: safe to call before every run.
-    setRenderRouteLive(renderRouteLive)
-    // The same durable store the boot-publish plugin uses, so a manually-triggered run also prunes
-    // routes that left the published set and records deps for later incremental publishes.
-    const deps = new DepsStore(createSqlitePersistence(usePublishingDb().db))
-    const result = await publishFull(outputDriver(), deps)
-    console.info(`[kestrel] publish:run rendered ${result.rendered} route(s), pruned ${result.pruned}`)
-    return { result }
-  },
-})

package/layers/public/server/utils/publish/render-live.ts

@@ -1,26 +0,0 @@
-import { runAsRenderer } from '@michaelthielemann/kestrel-access'
-
-/** Render a public route via the in-process server, returning its HTML buffer (200) or a null body with the
- *  HTTP status, so the caller can tell a broken page (5xx — a server-error RESPONSE, not a throw) from an
- *  expected non-200 (a draft / unpublish race → 404 / redirect). The PRODUCER's own render primitive — the
- *  delivery-static side never calls this; see `@michaelthielemann/kestrel-delivery-static`'s `render-route.ts`. `@michaelthielemann/kestrel-publishing`
- *  never imports this directly (a package cannot reach `useNitroApp`) — each real
- *  entry point (`zz.publish.ts`, `tasks/publish/run.ts`) instead calls `setRenderRouteLive(renderRouteLive)`
- *  itself, right before the call that needs it (see either file's own comment for why NOT a module-load
- *  side effect: Nitro dev can re-evaluate a task's module graph per invocation). */
-export async function renderRouteLive(route: string): Promise<{ body: Buffer | null; status: number }> {
-  // Run as the renderer principal so the nested $fetch('/api/route') passes the access guard (it is not a
-  // public endpoint). The ALS context propagates through localFetch → the page render → the nested fetch.
-  // useNitroApp is imported LAZILY (not via the Nitro auto-import) on purpose: a static import gives this
-  // module an edge to nitropack's app.mjs, which both defines useNitroApp AND loads the plugin registry
-  // that reaches this file (via zz.publish) — a build-time circular dependency. A dynamic import is a chunk
-  // boundary, so that cycle disappears from the build graph; it's the same nitroApp singleton either way
-  // (Rollup bundles the literal specifier; useNitroApp is only CALLED here at publish time, long after boot).
-  const { useNitroApp } = await import('nitropack/runtime')
-  // Every consumer that needs to know "is this OUR OWN in-process render" (delivery-live's catch-all,
-  // media's variant-capture scan) reads `isRendererContext()`/`import.meta.prerender` instead of a header —
-  // both are set by `runAsRenderer` below and an external request can't forge either.
-  const res = await runAsRenderer(() => useNitroApp().localFetch(route, { method: 'GET' }))
-  if (res.status !== 200) return { body: null, status: res.status }
-  return { body: Buffer.from(await res.arrayBuffer()), status: res.status }
-}

package/layers/ui/app/assets/scss/_base.scss

@@ -1,16 +0,0 @@
-body {
-  font-family: var(--font-sans);
-  font-size: var(--text-base);
-  color: var(--color-text);
-  background: var(--color-bg);
-}
-
-a {
-  color: var(--color-primary);
-}
-
-/* Opt-in reading measure for form-heavy pages inside the now full-bleed admin shell. */
-.u-measure {
-  max-width: var(--content-measure);
-  margin-inline: auto;
-}

package/layers/ui/app/assets/scss/_datepicker.scss

@@ -1,82 +0,0 @@
-@use 'mixins' as *;
-
-// Shared chrome for the date pickers. The calendar popover is teleported to <body> by Reka, so these
-// must stay GLOBAL (non-scoped) — a `scoped` block would silently drop them. Both DatePicker and
-// DateRangePicker @include this so neither silently borrows the other's styles (`__sep` is only used
-// by the range variant, the rest by both).
-@mixin ui-datepicker {
-  .ui-datepicker {
-    &__field {
-      display: inline-flex;
-      align-items: center;
-      gap: 1px;
-      padding: var(--space-2) var(--space-3);
-      border: 1px solid var(--color-control-border, var(--color-border));
-      border-radius: var(--radius-md);
-      background: var(--color-surface);
-
-      &[aria-invalid='true'] { border-color: var(--color-danger); }
-    }
-    &__segment {
-      @include focus-ring;
-      padding: 0 1px;
-      border-radius: var(--radius-sm);
-
-      &[data-placeholder] { color: var(--color-text-muted); }
-      // The fill alone can't tell a keyboard user which segment the arrow keys will change (reka hides
-      // the caret), so the ring has to survive it — only pointer focus drops the outline.
-      &:focus { background: var(--color-active); color: var(--color-text); }
-      &:focus:not(:focus-visible) { outline: none; }
-    }
-    &__sep { margin: 0 var(--space-2); color: var(--color-text-muted); }
-    &__trigger {
-      @include focus-ring;
-      margin-inline-start: var(--space-2);
-      border: 0;
-      background: transparent;
-      cursor: pointer;
-    }
-    &__content {
-      background: var(--color-surface);
-      border: 1px solid var(--color-border);
-      border-radius: var(--radius-md);
-      box-shadow: var(--shadow-md);
-      padding: var(--space-3);
-      z-index: var(--z-dropdown);
-    }
-    &__header {
-      display: flex;
-      align-items: center;
-      justify-content: space-between;
-      margin-bottom: var(--space-2);
-    }
-    &__nav {
-      @include focus-ring;
-      border: 0;
-      background: transparent;
-      cursor: pointer;
-      font-size: var(--text-lg);
-      padding: 0 var(--space-2);
-    }
-    &__heading { font-weight: var(--weight-medium); font-size: var(--text-sm); }
-    &__weekday { font-size: var(--text-sm); color: var(--color-text-muted); padding: var(--space-1); font-weight: var(--weight-normal); }
-    &__cell {
-      @include focus-ring;
-      display: inline-flex;
-      align-items: center;
-      justify-content: center;
-      width: 2rem;
-      height: 2rem;
-      border: 0;
-      border-radius: var(--radius-sm);
-      background: transparent;
-      color: var(--color-text);
-      cursor: pointer;
-
-      &[data-today] { font-weight: var(--weight-bold); }
-      &[data-selected] { background: var(--color-primary); color: var(--color-on-primary); }
-      &[data-outside-view] { color: var(--color-text-muted); }
-      &[data-disabled] { opacity: 0.4; cursor: not-allowed; }
-    }
-  }
-}

package/layers/ui/app/assets/scss/_mixins.scss

@@ -1,50 +0,0 @@
-// Focus ring is INSET (negative offset, drawn within the border-box) so a scrolling/overflow ancestor
-// can never clip it at an edge — and so the ring looks identical across every component, whether it
-// @includes this mixin or mirrors it inline.
-@mixin focus-ring {
-  &:focus-visible {
-    outline: 2px solid var(--color-focus);
-    outline-offset: -2px;
-  }
-}
-
-@mixin sr-only {
-  position: absolute;
-  width: 1px;
-  height: 1px;
-  padding: 0;
-  margin: -1px;
-  overflow: hidden;
-  clip: rect(0, 0, 0, 0);
-  white-space: nowrap;
-  border: 0;
-}
-
-// Shared chrome for text-like form controls (input/textarea/select/time). Per-component extras
-// (width, ::placeholder, resize, …) stay in the component.
-@mixin input-base {
-  @include focus-ring;
-  padding: var(--space-2) var(--space-3);
-  // Interactive control boundary needs 3:1 (WCAG 1.4.11). Admin themes define --color-control-border;
-  // the public SSG site has no such token, so it falls back to --color-border (unchanged there).
-  border: 1px solid var(--color-control-border, var(--color-border));
-  border-radius: var(--radius-md);
-  background: var(--color-surface);
-  color: var(--color-text);
-  font-size: var(--text-base);
-
-  &[aria-invalid='true'] {
-    border-color: var(--color-danger);
-  }
-  &:disabled {
-    opacity: 0.6;
-    cursor: not-allowed;
-  }
-}
-
-// Slim variant of `input-base`'s box, for dense chrome (e.g. the preview toolbar's W×H fields). ONLY the
-// padding shrinks: at the unchanged --text-base the control still measures ~29px tall, clearing the 24×24
-// minimum target size (WCAG 2.2 SC 2.5.8, AA). Do not also shrink the font — that would drop under it.
-@mixin input-slim {
-  padding: var(--space-1) var(--space-2);
-}