@michaelthielemann/kestrel 4.1.3 → 5.0.0

package/package.json

@@ -1,166 +1,40 @@
 {
   "name": "@michaelthielemann/kestrel",
-  "version": "4.1.3",
-  "description": "A slim, collection-driven Nuxt 4 CMS meta-layer with a runtime schema engine. Add `extends: ['@michaelthielemann/kestrel']`, define collections, and the database migrates itself.",
+  "version": "5.0.0",
+  "description": "Kestrel core: contract registry, boot check and pipeline runner. Ships no contracts and no modules.",
+  "type": "module",
   "license": "Apache-2.0",
-  "author": "Michael Thielemann <283621694+MichaelThielemann@users.noreply.github.com>",
-  "homepage": "https://github.com/MichaelThielemann/kestrel#readme",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/MichaelThielemann/kestrel.git"
+  "engines": {
+    "node": ">=22.13.0"
   },
-  "bugs": "https://github.com/MichaelThielemann/kestrel/issues",
-  "keywords": [
-    "cms",
-    "nuxt",
-    "nuxt-layer",
-    "static-site-generator",
-    "drizzle",
-    "sqlite",
-    "headless-cms"
-  ],
-  "type": "module",
-  "main": "./nuxt.config.ts",
   "bin": {
-    "kestrel": "./scripts/kestrel.mjs"
+    "kestrel": "./dist/cli.js"
   },
-  "publishConfig": {
-    "access": "public",
-    "provenance": true
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./*": {
+      "types": "./dist/*.d.ts",
+      "default": "./dist/*.js"
+    }
   },
-  "//publish": "Consumed as a meta-layer: `extends: ['@michaelthielemann/kestrel']`. `main` points at the layer's nuxt.config so the BARE specifier resolves — without it c12 can't resolve the package, silently drops the whole layer (\"Cannot extend config from …\"), and every auto-import/component vanishes. Use `main`, NOT `exports` (exports would gate subpaths like `@michaelthielemann/kestrel/scripts/hash-password.mjs` + the deep config-type import); `bin` resolves by path from the package root, so it coexists with `main` untouched. `files` ships the entry + sub-layers + operator scripts + the `kestrel init` templates; the `!**/*.test.ts` globs strip tests — they are GLOBAL, so nothing under `templates/` may be named `*.test.ts` or it vanishes from the tarball. Template dotfiles are `_`-prefixed for the same class of reason: npm strips a literal `.gitignore` from a tarball and then applies it, taking its listed siblings with it. Releases run from the tag workflow via npm trusted publishing (OIDC), so no npm token exists anywhere.",
   "files": [
-    "NOTICE",
-    "nuxt.config.ts",
-    "kestrel.config.ts",
-    "layers",
-    "scripts",
-    "templates",
-    "!**/*.test.ts",
-    "!**/*.dom.test.ts",
-    "!**/*.nuxt.test.ts"
+    "dist",
+    "README.md"
   ],
-  "engines": {
-    "node": ">=22.12.0"
-  },
-  "//lint": "The root eslint.config.mjs imports the generated playground/.nuxt/eslint.config.mjs (Nuxt-aware: auto-import globals for every layer + extension) — `nuxt prepare` must run first or that import 404s on a fresh checkout. Cheap on a warm .nuxt cache, so it's chained rather than a separate step.",
   "dependencies": {
-    "@babel/parser": "^7.29.8",
-    "@internationalized/date": "^3.12.3",
-    "@tiptap/extension-highlight": "^3.29.2",
-    "@tiptap/extension-subscript": "^3.29.2",
-    "@tiptap/extension-superscript": "^3.29.2",
-    "@tiptap/extension-text-align": "^3.29.2",
-    "@tiptap/pm": "^3.29.2",
-    "@tiptap/starter-kit": "^3.29.2",
-    "@tiptap/vue-3": "^3.29.2",
-    "@types/better-sqlite3": "^7.6.13",
-    "@types/jsdom": "^28.0.3",
-    "@types/sanitize-html": "^2.16.1",
-    "aws4fetch": "^1.0.20",
-    "better-sqlite3": "^12.11.1",
-    "dompurify": "^3.4.13",
-    "drizzle-orm": "^0.45.2",
-    "drizzle-zod": "^0.8.3",
-    "effect": "~3.22.1",
-    "exifr": "^7.1.3",
-    "file-type": "^22.0.1",
-    "jsdom": "^29.1.1",
-    "nanoid": "^5.1.16",
-    "nitropack": "^2.13.4",
-    "nuxt": "^4.5.2",
-    "reka-ui": "^2.10.1",
-    "sanitize-html": "^2.17.6",
-    "sass": "^1.102.0",
-    "sharp": "^0.35.3",
-    "thumbhash": "^0.1.1",
-    "typescript": "^6.0.3",
-    "zod": "^4.4.3",
-    "@michaelthielemann/kestrel-access": "0.1.0",
-    "@michaelthielemann/kestrel-auth": "0.1.0",
-    "@michaelthielemann/kestrel-contracts": "0.1.0",
-    "@michaelthielemann/kestrel-collections": "0.1.0",
-    "@michaelthielemann/kestrel-core": "0.1.0",
-    "@michaelthielemann/kestrel-delivery-live": "0.1.0",
-    "@michaelthielemann/kestrel-delivery-static": "0.1.0",
-    "@michaelthielemann/kestrel-fields": "0.1.0",
-    "@michaelthielemann/kestrel-media": "0.1.0",
-    "@michaelthielemann/kestrel-publishing": "0.1.0"
-  },
-  "//peers": "Framework singletons the layer sources import by bare specifier. Peers, not dependencies: a second copy breaks identity (two Vue instances; an h3 v1 `createError` handed to an h3 v2 error handler, which surfaces our 400/404/409 as bare 500s). All optional, because kestrel's own `nuxt` dependency already supplies them transitively — the entry pins identity where a copy exists rather than demanding one, and a required peer would ERESOLVE-fail npm installs on any Nuxt whose bundled range we did not anticipate. Each is also a devDependency so this repo resolves it without auto-install-peers writing a phantom root dependency into the lockfile.",
-  "peerDependencies": {
-    "@nuxt/kit": "^4.4.0",
-    "h3": "^1.15.0 || ^2.0.0",
-    "vue": "^3.5.0",
-    "vue-router": "^4.5.0 || ^5.0.0"
+    "zod": "^3.23.8"
   },
-  "peerDependenciesMeta": {
-    "@nuxt/kit": {
-      "optional": true
-    },
-    "h3": {
-      "optional": true
-    },
-    "vue": {
-      "optional": true
-    },
-    "vue-router": {
-      "optional": true
-    }
-  },
-  "devDependencies": {
-    "@arethetypeswrong/cli": "^0.18.5",
-    "@fast-check/vitest": "^0.4.1",
-    "@microsoft/api-extractor": "^7.58.13",
-    "@nuxt/eslint": "^1.9.0",
-    "@nuxt/kit": "^4.5.2",
-    "@nuxt/test-utils": "^4.1.0",
-    "@stryker-mutator/core": "^10.0.0",
-    "@stryker-mutator/vitest-runner": "^10.0.0",
-    "@vitejs/plugin-vue": "^6.0.8",
-    "@vitest/coverage-v8": "4.1.10",
-    "@vue/test-utils": "^2.4.11",
-    "drizzle-kit": "^0.31.10",
-    "eslint": "^9.39.1",
-    "eslint-plugin-boundaries": "^7.2.0",
-    "eslint-plugin-jsdoc": "^64.2.1",
-    "eslint-plugin-tsdoc": "^0.5.2",
-    "eslint-plugin-vuejs-accessibility": "^2.4.1",
-    "fast-check": "^4.9.0",
-    "h3": "^1.15.11",
-    "happy-dom": "^20.11.2",
-    "playwright-core": "^1.62.1",
-    "publint": "^0.3.24",
-    "typedoc": "^0.28.20",
-    "vitest": "^4.1.10",
-    "vitest-openapi": "^1.0.3",
-    "vue": "3.5.35",
-    "vue-router": "^5.2.0",
-    "vue-tsc": "^3.3.9"
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/MichaelThielemann/kestrel.git",
+    "directory": "packages/core"
   },
+  "homepage": "https://github.com/MichaelThielemann/kestrel#readme",
+  "bugs": "https://github.com/MichaelThielemann/kestrel/issues",
   "scripts": {
-    "dev": "nuxt dev",
-    "build": "nuxt build",
-    "build:packages": "pnpm -F @michaelthielemann/kestrel-contracts build && pnpm -F @michaelthielemann/kestrel-core build && pnpm -F @michaelthielemann/kestrel-fields build && pnpm -F @michaelthielemann/kestrel-auth build && pnpm -F @michaelthielemann/kestrel-access build && pnpm -F @michaelthielemann/kestrel-media build && pnpm -F @michaelthielemann/kestrel-collections build && pnpm -F @michaelthielemann/kestrel-publishing build && pnpm -F @michaelthielemann/kestrel-delivery-live build && pnpm -F @michaelthielemann/kestrel-delivery-static build",
-    "preview": "nuxt preview",
-    "generate": "nuxt generate",
-    "db:generate": "drizzle-kit generate",
-    "db:migrate": "drizzle-kit migrate",
-    "test": "vitest run",
-    "test:coverage": "node scripts/coverage-all.mjs",
-    "test:watch": "vitest",
-    "test:e2e": "vitest run --config vitest.e2e.config.ts",
-    "test:nuxt": "vitest run --config vitest.nuxt.config.ts",
-    "test:packages": "pnpm --filter \"@michaelthielemann/kestrel-*\" -r test",
-    "typecheck": "node scripts/typecheck.mjs",
-    "typecheck:packages": "pnpm --filter \"@michaelthielemann/kestrel-*\" -r typecheck",
-    "lint": "nuxt prepare playground && eslint .",
-    "docs:api": "nuxt prepare playground && typedoc",
-    "api:check": "pnpm -F @michaelthielemann/kestrel-contracts build && api-extractor run -c packages/kestrel-contracts/api-extractor.json && pnpm -F @michaelthielemann/kestrel-core build && api-extractor run -c packages/kestrel-core/api-extractor.json && api-extractor run -c packages/kestrel-core/api-extractor.client.json && pnpm -F @michaelthielemann/kestrel-fields build && api-extractor run -c packages/kestrel-fields/api-extractor.json && api-extractor run -c packages/kestrel-fields/api-extractor.client.json && pnpm -F @michaelthielemann/kestrel-auth build && api-extractor run -c packages/kestrel-auth/api-extractor.json && pnpm -F @michaelthielemann/kestrel-access build && api-extractor run -c packages/kestrel-access/api-extractor.json && pnpm -F @michaelthielemann/kestrel-media build && api-extractor run -c packages/kestrel-media/api-extractor.json && pnpm -F @michaelthielemann/kestrel-collections build && api-extractor run -c packages/kestrel-collections/api-extractor.json && pnpm -F @michaelthielemann/kestrel-publishing build && api-extractor run -c packages/kestrel-publishing/api-extractor.json && pnpm -F @michaelthielemann/kestrel-delivery-live build && api-extractor run -c packages/kestrel-delivery-live/api-extractor.json && pnpm -F @michaelthielemann/kestrel-delivery-static build && api-extractor run -c packages/kestrel-delivery-static/api-extractor.json",
-    "api:update": "pnpm -F @michaelthielemann/kestrel-contracts build && api-extractor run --local -c packages/kestrel-contracts/api-extractor.json && pnpm -F @michaelthielemann/kestrel-core build && api-extractor run --local -c packages/kestrel-core/api-extractor.json && api-extractor run --local -c packages/kestrel-core/api-extractor.client.json && pnpm -F @michaelthielemann/kestrel-fields build && api-extractor run --local -c packages/kestrel-fields/api-extractor.json && api-extractor run --local -c packages/kestrel-fields/api-extractor.client.json && pnpm -F @michaelthielemann/kestrel-auth build && api-extractor run --local -c packages/kestrel-auth/api-extractor.json && pnpm -F @michaelthielemann/kestrel-access build && api-extractor run --local -c packages/kestrel-access/api-extractor.json && pnpm -F @michaelthielemann/kestrel-media build && api-extractor run --local -c packages/kestrel-media/api-extractor.json && pnpm -F @michaelthielemann/kestrel-collections build && api-extractor run --local -c packages/kestrel-collections/api-extractor.json && pnpm -F @michaelthielemann/kestrel-publishing build && api-extractor run --local -c packages/kestrel-publishing/api-extractor.json && pnpm -F @michaelthielemann/kestrel-delivery-live build && api-extractor run --local -c packages/kestrel-delivery-live/api-extractor.json && pnpm -F @michaelthielemann/kestrel-delivery-static build && api-extractor run --local -c packages/kestrel-delivery-static/api-extractor.json",
-    "pkg:lint": "publint . && pnpm -F @michaelthielemann/kestrel-contracts build && publint packages/kestrel-contracts && attw --pack packages/kestrel-contracts --profile esm-only && pnpm -F @michaelthielemann/kestrel-core build && publint packages/kestrel-core && attw --pack packages/kestrel-core --profile esm-only && pnpm -F @michaelthielemann/kestrel-fields build && publint packages/kestrel-fields && attw --pack packages/kestrel-fields --profile esm-only && pnpm -F @michaelthielemann/kestrel-auth build && publint packages/kestrel-auth && attw --pack packages/kestrel-auth --profile esm-only && pnpm -F @michaelthielemann/kestrel-access build && publint packages/kestrel-access && attw --pack packages/kestrel-access --profile esm-only && pnpm -F @michaelthielemann/kestrel-media build && publint packages/kestrel-media && attw --pack packages/kestrel-media --profile esm-only && pnpm -F @michaelthielemann/kestrel-collections build && publint packages/kestrel-collections && attw --pack packages/kestrel-collections --profile esm-only && pnpm -F @michaelthielemann/kestrel-publishing build && publint packages/kestrel-publishing && attw --pack packages/kestrel-publishing --profile esm-only && pnpm -F @michaelthielemann/kestrel-delivery-live build && publint packages/kestrel-delivery-live && attw --pack packages/kestrel-delivery-live --profile esm-only && pnpm -F @michaelthielemann/kestrel-delivery-static build && publint packages/kestrel-delivery-static && attw --pack packages/kestrel-delivery-static --profile esm-only",
-    "ci:consumer-template": "node scripts/consumer-template-ci.mjs",
-    "dashboard": "npx tsx scripts/dashboard.mjs",
-    "hash-password": "node scripts/hash-password.mjs"
+    "build": "tsc -b tsconfig.json"
   }
 }

package/NOTICE

@@ -1,12 +0,0 @@
-Kestrel
-Copyright 2026 Michael Thielemann
-
-Licensed under the Apache License, Version 2.0 (the "License"); you may not use
-this software except in compliance with the License. You may obtain a copy of
-the License in the LICENSE file distributed with this software, or at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-This product is provided free of charge and is developed and made available
-outside of any commercial activity. It comes with NO WARRANTY and no commercial
-support; see sections 7 and 8 of the License.

package/kestrel.config.ts

@@ -1,28 +0,0 @@
-import type { KestrelConfig } from '@michaelthielemann/kestrel-core'
-
-/**
- * Central Kestrel configuration (everything except auth/session, which stays env-only because secrets
- * don't belong in committed config). This one file is the single source: it flows into `nuxt.config`'s
- * `kestrel: { … }`, into `drizzle.config` (so `drizzle-kit` uses the same DB), and into the server at
- * runtime. Precedence per setting: the matching `KESTREL_*` env var → a value here → a built-in default.
- *
- * This instance's non-auth config lives here (not in `.env`) so `nuxt.config`, `drizzle-kit` and the
- * runtime server all derive the SAME values from one place — in particular the same SQLite file, so
- * `pnpm dev`, `pnpm build` and a migration never drift onto different DBs (they set no `KESTREL_*`, so
- * this file wins). `.env` keeps only the auth/session secrets. An explicit `KESTREL_*` env var OVERRIDES
- * this file — the escape-hatch for a per-environment value or an isolated test (the e2e suite sets
- * `KESTREL_DB` / `KESTREL_MEDIA_LOCAL_DIR` / `KESTREL_SITE_URL` per run). The static-publish `output`
- * target is left to its defaults (local `.data/published`, auto-publish on).
- */
-export default {
-  db: '.data/dev.sqlite',
-  siteUrl: 'http://localhost:3000',
-  locales: ['en', 'de'],
-  primaryLocale: 'en',
-  media: {
-    driver: 'local',
-    uploadDir: '.data/uploads',
-    baseUrl: '/uploads',
-    maxBytes: 26214400, // 25 MiB
-  },
-} satisfies KestrelConfig

package/layers/access/nuxt.config.ts

@@ -1,5 +0,0 @@
-// Authorization (authz) layer — the access guard, policy, CSRF + (later) the grant registry. Split out of
-// `auth` (which keeps authentication: session/password/login). Composes AFTER `auth`: the guard verifies the
-// session (via auth's `verifySession`/`sessionSettings`) to derive the request principal, then evaluates the
-// policy. Keeping authz separate is the seam a future User&Roles extension plugs into.
-export default defineNuxtConfig({})

package/layers/access/server/middleware/00.ip-allowlist.ts

@@ -1,52 +0,0 @@
-// Stage-level IP gate: the ENFORCEMENT of an allow-list Kestrel provides; the list itself is consumer
-// config (env `KESTREL_IP_ALLOWLIST`, typically only on non-public DEV/EDIT stages). Runs before the API
-// access-guard (00. sort prefix) and covers every route this app defines — the admin UI, public preview,
-// and API. It does NOT cover assets Nitro serves itself ahead of this stack (`/_nuxt/**`, and `/uploads`
-// when `media.driver: 'local'`) — the `00.` prefix only orders files within this layer, while Nitro's own
-// static handler is unconditionally unshifted to the front of the whole handler list. `off` when no list
-// is set → zero cost on PROD/local.
-import { clientIp } from '@michaelthielemann/kestrel-auth'
-import { allowlistConfig, ipAllowed, ipv4ToInt, isRendererContext, isStageGatePassedContext, markStageGatePassed } from '@michaelthielemann/kestrel-access'
-
-// A listener that never shows the gate a usable client address blocks everything, which looks like an
-// outage rather than a misconfiguration unless we say once what to set.
-let warnedUnresolvable = false
-
-export default defineEventHandler((event) => {
-  const { mode, cidrs } = allowlistConfig()
-  if (mode === 'off') return
-
-  // The runtime publisher renders the public site via a nested in-process $fetch (renderer principal), and
-  // build-time prerender the same. Neither is an external client — exempt them or publishing 403s itself.
-  if (import.meta.prerender === true || isRendererContext()) return
-
-  // Nitro's other in-process sub-requests (the SSR page's own `$fetch`, the preview) run through this
-  // stack on a mocked socket with no peer, so they could never match a CIDR — gating them would 403 the
-  // very pages the gate protects. They are recognised by the async context of the request that spawned
-  // them: a missing peer alone is NOT a pass, or a listener that reports none for anybody (a unix domain
-  // socket) would turn the gate into a silent no-op.
-  if (isStageGatePassedContext() && !event.node?.req?.socket?.remoteAddress) return
-
-  const ip = clientIp(event)
-  if (ipAllowed(ip, cidrs)) {
-    // The in-process sub-requests this one spawns inherit the decision (see above).
-    markStageGatePassed()
-    return
-  }
-
-  if (ipv4ToInt(ip) === null && !warnedUnresolvable) {
-    warnedUnresolvable = true
-    console.warn(`[ip-allowlist] cannot resolve an IPv4 client address (got "${ip}") — such requests are blocked in enforce mode; set KESTREL_TRUST_PROXY when a reverse proxy fronts this listener`)
-  }
-
-  if (mode === 'log') {
-    // Calibration mode: never block, just surface what the gate WOULD reject so the operator can confirm
-    // the resolved client IP + KESTREL_TRUST_PROXY depth before switching to enforce.
-    console.warn(`[ip-allowlist] would block ${ip} — ${event.method} ${event.path} (xff=${getRequestHeader(event, 'x-forwarded-for') ?? '-'})`)
-    // Nothing is blocked in this mode, so the report is about the external request, not the in-process
-    // renders it goes on to spawn.
-    markStageGatePassed()
-    return
-  }
-  throw createError({ statusCode: 403, statusMessage: 'Forbidden' })
-})

package/layers/access/server/middleware/access-guard.ts

@@ -1,32 +0,0 @@
-import { Forbidden, Unauthorized } from '@michaelthielemann/kestrel-contracts'
-import { toHttpError } from '@michaelthielemann/kestrel-core'
-import { refreshAuthSession } from '@michaelthielemann/kestrel-auth'
-import { claimedByPipelineRoute, resolveEventPrincipal } from '@michaelthielemann/kestrel-access'
-
-export default defineEventHandler((event) => {
-  if (!event.path.startsWith('/api/')) return // default-deny applies to the API only
-
-  // Authorization itself belongs to the pipeline the URL names — its `access`/`csrf`/`ipAllowlist`
-  // declarations, evaluated by the engine before step 1. Only the principal is resolved here, because the
-  // gates need it and because the session refresh below is a property of the request, not of the route.
-  event.context.principal = resolveEventPrincipal(event)
-
-  // Default-deny for everything no pipeline claims — an unknown name, a wrong verb, a stray route a
-  // consumer mounted under /api without declaring who may run it. The admin falls through instead, so the
-  // router can still answer accurately (404 for an unknown pipeline, 405 for the wrong verb) without that
-  // answer confirming to an anonymous prober which pipelines exist. For the same reason an anonymous
-  // caller gets the access gate's 401 here, not a 403 — a 401/403 split would itself be the oracle.
-  if (!claimedByPipelineRoute(getMethod(event), event.path) && event.context.principal.role !== 'admin') {
-    // toHttpError is the same single translation every pipeline-thrown KestrelError goes through
-    // (core/server/api/[...path].ts's catch) — this middleware runs before any pipeline, so it calls the
-    // map directly instead of growing a second one.
-    if (event.context.principal.role === 'anonymous') {
-      throw toHttpError(new Unauthorized({ reason: 'Authentication required' }))
-    }
-    throw toHttpError(new Forbidden({ reason: 'Forbidden' }))
-  }
-
-  // Sliding-expiry: any authenticated API activity refreshes the session so it stays alive while in use and
-  // auto-expires after `maxAge` of inactivity (idle logout). No-op for anonymous/public requests.
-  refreshAuthSession(event)
-})

package/layers/access/server/types.d.ts

@@ -1,7 +0,0 @@
-import type { Principal } from '@michaelthielemann/kestrel-access'
-
-declare module 'h3' {
-  interface H3EventContext {
-    principal?: Principal
-  }
-}

package/layers/admin/app/components/AdminAccount.vue

@@ -1,212 +0,0 @@
-<script setup lang="ts">
-import {
-  DropdownMenuRoot, DropdownMenuTrigger, DropdownMenuPortal, DropdownMenuContent,
-  DropdownMenuLabel, DropdownMenuSeparator, DropdownMenuRadioGroup, DropdownMenuRadioItem,
-  DropdownMenuItemIndicator, DropdownMenuItem,
-} from 'reka-ui'
-
-// The rail's pseudo-account area: an avatar that opens an account menu (UI-language + sign out).
-const { t, lang } = useT()
-const { logout } = useAuth()
-
-// Single-user admin for now — static initials. A natural seam for a real display name later.
-const initials = 'AD'
-
-// reka's DropdownMenuRadioGroup emits the broad `AcceptableValue`; accept `unknown` and coerce to our lang.
-function selectLang(value: unknown) { lang.value = value as string }
-function signOut() { logout() }
-
-// Exposed for the component test: the menu itself is teleported (not rendered by happy-dom), so the
-// load-bearing handlers are asserted directly.
-defineExpose({ lang, selectLang, signOut })
-</script>
-
-<template>
-  <DropdownMenuRoot>
-    <DropdownMenuTrigger as-child>
-      <button type="button" class="rail-account__trigger" :aria-label="t('account.label')" :title="t('account.label')">
-        <span class="rail-account__avatar" aria-hidden="true">{{ initials }}</span>
-        <span class="rail-account__name rail__label">{{ t('account.name') }}</span>
-        <KestrelUiIcon name="chevron-down" class="rail-account__caret rail__label" size="1rem" />
-      </button>
-    </DropdownMenuTrigger>
-
-    <DropdownMenuPortal>
-      <DropdownMenuContent
-        class="rail-account__menu"
-        side="top"
-        align="start"
-        :side-offset="6"
-        :collision-padding="8"
-      >
-        <DropdownMenuLabel class="rail-account__head">
-          <span class="rail-account__avatar rail-account__avatar--sm" aria-hidden="true">{{ initials }}</span>
-          <span class="rail-account__head-name">{{ t('account.name') }}</span>
-        </DropdownMenuLabel>
-
-        <DropdownMenuSeparator class="rail-account__sep" />
-
-        <DropdownMenuLabel class="rail-account__group-label">{{ t('lang.label') }}</DropdownMenuLabel>
-        <DropdownMenuRadioGroup :model-value="lang" @update:model-value="selectLang">
-          <DropdownMenuRadioItem
-            v-for="l in ADMIN_LANGS"
-            :key="l"
-            :value="l"
-            class="rail-account__item"
-          >
-            <span class="rail-account__check">
-              <DropdownMenuItemIndicator>
-                <KestrelUiIcon name="check" size="1rem" />
-              </DropdownMenuItemIndicator>
-            </span>
-            <span>{{ l.toUpperCase() }}</span>
-          </DropdownMenuRadioItem>
-        </DropdownMenuRadioGroup>
-
-        <DropdownMenuSeparator class="rail-account__sep" />
-
-        <DropdownMenuItem class="rail-account__item rail-account__item--danger" @select="signOut">
-          <KestrelUiIcon name="log-out" size="1rem" class="rail-account__item-icon" />
-          <span>{{ t('nav.signOut') }}</span>
-        </DropdownMenuItem>
-      </DropdownMenuContent>
-    </DropdownMenuPortal>
-  </DropdownMenuRoot>
-</template>
-
-<style lang="scss">
-// Not scoped: Reka teleports DropdownMenuContent to <body>, where a scoped data-v selector no longer
-// matches (same reason UiMenu's styles are global). The trigger lives in the rail; keeping the whole
-// component's styles global is simplest and consistent with the other portaled overlays.
-.rail-account__trigger {
-  display: flex;
-  align-items: center;
-  gap: var(--space-3);
-  width: 100%;
-  padding: var(--space-2) var(--space-3);
-  margin-bottom: var(--space-1);
-  border: 0;
-  border-radius: var(--radius-md);
-  background: transparent;
-  color: var(--color-text);
-  font: inherit;
-  font-size: var(--text-sm);
-  text-align: left;
-  cursor: pointer;
-
-  &:hover {
-    background: var(--color-hover);
-  }
-  &:focus-visible {
-    outline: 2px solid var(--color-focus);
-    outline-offset: -2px;
-  }
-  &[data-state='open'] {
-    background: var(--color-active, var(--color-surface-2));
-  }
-}
-
-.rail-account__avatar {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  flex-shrink: 0;
-  width: 1.75rem;
-  height: 1.75rem;
-  border-radius: var(--radius-full);
-  border: 1px solid var(--color-border-strong, var(--color-border));
-  background: var(--color-surface-2);
-  color: var(--color-text);
-  font-size: var(--text-xs, 0.75rem);
-  font-weight: var(--weight-bold);
-  letter-spacing: 0.02em;
-
-  &--sm {
-    width: 1.5rem;
-    height: 1.5rem;
-  }
-}
-
-.rail-account__name {
-  font-weight: var(--weight-medium);
-}
-.rail-account__caret {
-  margin-left: auto;
-  flex-shrink: 0;
-  color: var(--color-text-muted);
-}
-
-// Menu surface — mirrors .ui-menu so the account dropdown reads like the rest of the admin chrome.
-.rail-account__menu {
-  min-width: 13rem;
-  background: var(--color-surface);
-  border: 1px solid var(--color-border);
-  border-radius: var(--radius-md);
-  box-shadow: var(--shadow-md);
-  padding: var(--space-1);
-  z-index: var(--z-dropdown);
-}
-
-.rail-account__head {
-  display: flex;
-  align-items: center;
-  gap: var(--space-2);
-  padding: var(--space-2) var(--space-2);
-}
-.rail-account__head-name {
-  font-size: var(--text-sm);
-  font-weight: var(--weight-medium);
-}
-
-.rail-account__group-label {
-  padding: var(--space-1) var(--space-2);
-  font-size: var(--text-xs, 0.75rem);
-  font-weight: var(--weight-medium);
-  color: var(--color-text-muted);
-}
-
-.rail-account__sep {
-  height: 1px;
-  margin: var(--space-1) calc(var(--space-1) * -1);
-  background: var(--color-border);
-}
-
-.rail-account__item {
-  display: flex;
-  align-items: center;
-  gap: var(--space-2);
-  width: 100%;
-  padding: var(--space-1) var(--space-2);
-  border-radius: var(--radius-sm);
-  font-size: var(--text-sm);
-  color: var(--color-text);
-  cursor: pointer;
-  user-select: none;
-
-  &[data-highlighted] {
-    background: var(--color-hover);
-    outline: none;
-  }
-  &--danger {
-    color: var(--color-danger);
-  }
-}
-
-.rail-account__check {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  width: 1rem;
-  flex-shrink: 0;
-  color: var(--color-primary);
-}
-.rail-account__item-icon {
-  flex-shrink: 0;
-}
-
-// Collapsed rail: drop the label + caret and centre the avatar (mirrors .rail__item's collapsed rule).
-.admin--rail-collapsed .rail-account__trigger {
-  justify-content: center;
-  gap: 0;
-}
-</style>

package/layers/admin/app/components/AdminNav.vue

@@ -1,44 +0,0 @@
-<script setup lang="ts">
-import { resolveLocalized } from '../../../ui/app/utils/localized'
-
-const { t, lang } = useT()
-const { collections, load } = useCollections()
-const { collapsed } = useRailCollapsed()
-const route = useRoute()
-try {
-  await load()
-} catch {
-  // Nav is non-critical chrome; a failed fetch leaves it empty rather than breaking the layout.
-}
-</script>
-
-<template>
-  <nav class="admin-nav" :aria-label="t('nav.collections')">
-    <NuxtLink
-      v-for="c in (collections ?? []).filter((c) => c.nav !== false)"
-      :key="c.name"
-      :to="`/admin/${c.name}`"
-      class="admin-nav__link rail__item"
-      :class="{ 'router-link-active': isNavItemActive(route.path, `/admin/${c.name}`) }"
-      :title="collapsed ? (resolveLocalized(c.label?.plural, lang) ?? c.name) : undefined"
-    >
-      <KestrelUiIcon :name="c.icon ?? 'file-text'" class="rail__icon" size="1.25rem" />
-      <span class="rail__label">{{ resolveLocalized(c.label?.plural, lang) ?? c.name }}</span>
-    </NuxtLink>
-  </nav>
-</template>
-
-<style lang="scss">
-.admin-nav {
-  display: flex;
-  flex-direction: column;
-  gap: var(--space-1);
-
-  // Layout, colour and active state come from the shared .rail__item (admin layout).
-  // Only the cosmetic capitalisation is nav-specific — kept CSS-only so the rendered
-  // text node stays the raw collection name (e.g. "settings").
-  &__link {
-    text-transform: capitalize;
-  }
-}
-</style>