@michaelthielemann/kestrel 4.1.3 → 5.0.2

package/layers/core/modules/auto-discovery/scan.ts

@@ -1,170 +0,0 @@
-import { readdirSync } from 'node:fs'
-import { basename, join } from 'node:path'
-import { fileURLToPath } from 'node:url'
-import { blockNameFromFile } from './extract-block'
-
-type Lister = (dir: string) => string[]
-
-/**
- * Resolves a bare `@michaelthielemann/kestrel-*` package specifier to its real entry FILE PATH, via Node's
- * own ESM resolution from THIS module's own location — not the bare specifier itself, which a Nitro
- * virtual module (no real file path of its own) cannot resolve reliably: Rollup falls back to resolving a
- * virtual's imports from the project root, and under pnpm's isolated `node_modules` a package the
- * CONSUMER never declared a direct dependency on (only the engine did, transitively) is invisible there —
- * observed as `Cannot find package` at runtime, npm's flat hoisting having accidentally masked it in
- * testing. This module's own file, once installed, sits inside the engine's package tree, so resolving
- * from here walks the engine's OWN nested `node_modules`, where pnpm DID link the real dependency.
- */
-export function resolvePackageEntry(spec: string): string {
-  return fileURLToPath(import.meta.resolve(spec))
-}
-
-const isDefinition = (name: string) =>
-  name.endsWith('.ts') && !name.endsWith('.test.ts') && !name.endsWith('.d.ts')
-
-export function listDefinitionFiles(dir: string, list: Lister = readdirSync): string[] {
-  let entries: string[]
-  try {
-    entries = list(dir)
-  } catch (err) {
-    if ((err as NodeJS.ErrnoException).code === 'ENOENT') return []
-    throw err
-  }
-  return entries
-    .filter(isDefinition)
-    .sort()
-    .map((name) => join(dir, name))
-}
-
-/**
- * Definition files across every layer's `subdir`, deduped by BASENAME with LAYER PRIORITY: `layerRoots` is
- * Nuxt's `_layers` order (consumer/highest-priority first), so a consumer's `collections/pages.ts` (or
- * `field-types/color.ts`) SHADOWS the same-named lower-layer file — a deterministic override, instead of
- * importing both and relying on the registry's last-write-wins under an alphabetical path sort (which made
- * "who wins" a coincidence of the node_modules path). Mirrors `collectBlockSfcs`'s name-first dedup.
- */
-export function collectDefinitions(layerRoots: string[], subdir: string, list?: Lister): string[] {
-  const byBasename = new Map<string, string>()
-  for (const root of layerRoots) {
-    for (const file of listDefinitionFiles(join(root, subdir), list)) {
-      const name = basename(file)
-      if (!byBasename.has(name)) byBasename.set(name, file) // first (highest-priority layer) wins
-    }
-  }
-  return [...byBasename.values()].sort()
-}
-
-const isVue = (name: string) => name.endsWith('.vue') && !name.endsWith('.test.vue')
-
-/** `.vue` files in `dir`, sorted; `[]` when the dir is absent. Mirrors `listDefinitionFiles` for blocks. */
-export function listVueFiles(dir: string, list: Lister = readdirSync): string[] {
-  let entries: string[]
-  try {
-    entries = list(dir)
-  } catch (err) {
-    if ((err as NodeJS.ErrnoException).code === 'ENOENT') return []
-    throw err
-  }
-  return entries.filter(isVue).sort().map((name) => join(dir, name))
-}
-
-/** Block SFCs across every layer's `app/blocks/` dir, deduped by BLOCK NAME with LAYER PRIORITY: `layerRoots`
- *  is Nuxt's `_layers` order (consumer/highest-priority first), so the first file seen for a given block name
- *  wins. This matches how the display component is resolved (project-first), so a same-named override takes
- *  its schema AND its template from the same layer — a plain alphabetical path sort handed the schema to
- *  whichever path sorted last (typically the node_modules layer), silently splitting the two. */
-export function collectBlockSfcs(layerRoots: string[], subdir = 'app/blocks', list?: Lister): string[] {
-  const byName = new Map<string, string>()
-  for (const root of layerRoots) {
-    for (const file of listVueFiles(join(root, subdir), list)) {
-      const name = blockNameFromFile(basename(file))
-      if (!byName.has(name)) byName.set(name, file) // first (highest-priority layer) wins
-    }
-  }
-  // Name-unique now, so the final sort is only for a deterministic, stable import order.
-  return [...byName.values()].sort()
-}
-
-/**
- * Each layer's OWN `server/db/manifest.ts` (ADR-0012 ownership manifest), one per layer that has one.
- * Unlike `collectDefinitions`, this does NOT dedupe by basename: every layer's manifest is a distinct
- * module contribution (no shadow/override semantics — `media`'s manifest and `public`'s manifest both
- * happen to be named `manifest.ts`, and both must survive). Layer order is whatever `layerRoots` is.
- */
-export function collectManifestFiles(layerRoots: string[], list?: Lister): string[] {
-  const files: string[] = []
-  for (const root of layerRoots) {
-    for (const file of listDefinitionFiles(join(root, 'server/db'), list)) {
-      if (basename(file) === 'manifest.ts') files.push(file)
-    }
-  }
-  return files
-}
-
-export function renderRegistry(absPaths: string[]): string {
-  if (!absPaths.length) return 'export default []'
-  const imports = absPaths.map((p, i) => `import _${i} from ${JSON.stringify(p)}`)
-  const arr = absPaths.map((_, i) => `_${i}`).join(', ')
-  return `${imports.join('\n')}\nexport default [${arr}]`
-}
-
-/**
- * A registry combining package-provided items (each package's `kestrelDiscovery.<property>`, read via a
- * bare specifier — no filesystem/`node_modules` guessing) with consumer/layer-scanned files, with a
- * SAME-NAME layer item overriding a package's (via `mergeKestrelDiscovered`, evaluated at virtual-load
- * time — package names aren't knowable at codegen time without loading the package, which this
- * deliberately avoids doing at build time). `nameOfExpr` is a JS arrow-function source string the
- * generated module evaluates per item (e.g. `'(x) => x.name'` for collections,
- * `'(x) => __kestrelTableName(x)'` for schema-tables, paired with `extraImports` supplying
- * `__kestrelTableName`).
- */
-export function renderPackageMergedRegistry(opts: {
-  packages: string[]
-  property: 'collections' | 'schemaTables'
-  consumerFiles: string[]
-  nameOfExpr: string
-  extraImports?: string
-  preamble?: string
-}): string {
-  const pkgImports = opts.packages.map((spec, i) => `import { kestrelDiscovery as __pkg${i} } from ${JSON.stringify(spec)}`)
-  const pkgSpread = opts.packages.map((_, i) => `...(__pkg${i}.${opts.property} ?? [])`).join(', ')
-  const consumerImports = opts.consumerFiles.map((p, i) => `import _c${i} from ${JSON.stringify(p)}`)
-  const consumerArr = opts.consumerFiles.map((_, i) => `_c${i}`).join(', ')
-  return [
-    opts.preamble ?? '',
-    opts.extraImports ?? '',
-    `import { mergeKestrelDiscovered } from ${JSON.stringify(resolvePackageEntry('@michaelthielemann/kestrel-core'))}`,
-    ...pkgImports,
-    ...consumerImports,
-    `export default mergeKestrelDiscovered([${pkgSpread}], [${consumerArr}], ${opts.nameOfExpr})`,
-  ].filter(Boolean).join('\n')
-}
-
-/**
- * A registry concatenating package-provided items (`kestrelDiscovery.<property>`) with consumer/layer-
- * scanned files — NO dedup (mirrors `collectManifestFiles`'s own "every contribution is distinct, no
- * shadow semantics" contract; unlike collections/schema-tables, two manifests sharing a name is not a
- * schema conflict, so there is nothing to override).
- */
-export function renderPackageConcatRegistry(opts: {
-  packages: string[]
-  property: 'manifest'
-  consumerFiles: string[]
-  preamble?: string
-}): string {
-  const pkgImports = opts.packages.map((spec, i) => `import { kestrelDiscovery as __pkg${i} } from ${JSON.stringify(spec)}`)
-  // `opts.packages` is expected to be pre-filtered to packages that actually contribute this property (the
-  // caller's per-category list), so every `.manifest` read here SHOULD be defined — but the spread stays
-  // conditional (`...(x ? [x] : [])`, not a bare `x`) as a defense-in-depth guard: a package mis-listed in
-  // the wrong `PACKAGE_*` category contributes nothing instead of polluting the array with `undefined`.
-  const pkgItems = opts.packages.map((_, i) => `...(__pkg${i}.${opts.property} ? [__pkg${i}.${opts.property}] : [])`)
-  const consumerImports = opts.consumerFiles.map((p, i) => `import _c${i} from ${JSON.stringify(p)}`)
-  const consumerArr = opts.consumerFiles.map((_, i) => `_c${i}`)
-  const all = [...pkgItems, ...consumerArr].join(', ')
-  return [
-    opts.preamble ?? '',
-    ...pkgImports,
-    ...consumerImports,
-    `export default [${all}]`,
-  ].filter(Boolean).join('\n')
-}

package/layers/core/modules/auto-discovery/virtual.d.ts

@@ -1,20 +0,0 @@
-declare module '#kestrel/collections' {
-  const collections: unknown[]
-  export default collections
-}
-declare module '#kestrel/blocks' {
-  const blocks: unknown[]
-  export default blocks
-}
-declare module '#kestrel/schema-tables' {
-  const tables: unknown[]
-  export default tables
-}
-declare module '#kestrel/module-manifests' {
-  import type { OwnershipManifest } from '@michaelthielemann/kestrel-contracts'
-  const manifests: OwnershipManifest[]
-  export default manifests
-}
-declare module '#build/kestrel-layouts.mjs' {
-  export const kestrelLayouts: string[]
-}

package/layers/core/modules/component-namespace/index.ts

@@ -1,44 +0,0 @@
-import { addComponentsDir, defineNuxtModule } from '@nuxt/kit'
-import { resolve } from 'node:path'
-import { KESTREL_COMPONENT_PREFIX, KESTREL_OVERRIDE_PRIORITY } from './shared'
-
-/** Where a consumer places a component that replaces a shipped one, relative to their `srcDir`. */
-export const KESTREL_OVERRIDE_DIR = 'Kestrel/components'
-
-/**
- * RULING: the app-side layers (`admin`, `ui`, and the `app/` halves of `media`/`public`) stay LAYERS —
- * they are not bridged into packages, and there is no `addComponentsDir`/`addImportsDir`
- * module doing so. `admin` is the layer with the most at stake here: it registers by far the most
- * components under `kestrelComponents()` (`layers/admin/nuxt.config.ts`, alongside `media`/`public`/`ui`),
- * so it is the layer this override mechanism protects most. This module's own override mechanism (below)
- * is WHY: it depends on Kestrel's own components being real, Nuxt-scannable `.vue` files in a real layer,
- * resolved at a higher `addComponentsDir` priority than a consumer's override — a package's compiled
- * `dist` output cannot participate in that priority system the same way. Bridging would cost the admin its
- * per-component override story for no boot-order/discovery benefit these app-side files need (none of the
- * eager-module-load or field-type-registration hazards the *server*-side package cut existed to fix apply
- * here). Revisit only with strong evidence the cost is worth paying — see `docs/internals/layers-and-packages.md` §
- * "The component/composable bridge".
- *
- * Composables are a separate question this mechanism does NOT cover: none of `admin`/`ui`'s ~30
- * `use*`-named composables carry a `useKestrel*` prefix, and none need to — every one is internal editor
- * state/logic (`useEditForm`, `useBlockTree`, `useCollectionOps`, …). Kestrel's own layers reuse them
- * freely across the merged auto-import namespace (`media` uses `ui`'s `useT`/`useToast`/`useDragReorder`);
- * what stays true is that no extension, package, or third-party consumer imports one, and none is ever
- * documented as something a consumer reaches for — a consumer builds their own UI against collections/
- * pipelines/field types, not by importing Kestrel's editor internals. There is consequently no override
- * mechanism for composables (unlike components) and none is needed.
- */
-
-export default defineNuxtModule({
-  meta: { name: 'kestrel-component-namespace' },
-  setup(_options, nuxt) {
-    // The trailing `components` segment is load-bearing: Nuxt reports a missing registered directory
-    // (NUXT_B3001) unless the path matches its default-components pattern, which requires that suffix.
-    // Without it every consumer who never uses the seam would see a build warning.
-    addComponentsDir({
-      path: resolve(nuxt.options.srcDir, KESTREL_OVERRIDE_DIR),
-      prefix: KESTREL_COMPONENT_PREFIX,
-      priority: KESTREL_OVERRIDE_PRIORITY,
-    })
-  },
-})

package/layers/core/modules/component-namespace/shared.ts

@@ -1,24 +0,0 @@
-import { fileURLToPath } from 'node:url'
-
-export const KESTREL_COMPONENT_PREFIX = 'Kestrel'
-
-/**
- * Above every layer-derived priority (Nuxt assigns `layerCount - i`, so the consumer's app dir — index 0
- * — otherwise always wins). A consumer file that lands on a `Kestrel*` name anywhere but the override
- * directory therefore loses instead of silently replacing the admin component.
- */
-export const KESTREL_LAYER_PRIORITY = 100
-
-/** The one supported override seam, above the layers. */
-export const KESTREL_OVERRIDE_PRIORITY = 200
-
-/**
- * The components directory of a Kestrel layer, namespaced. Nuxt drops a prefix the filename already
- * carries, so `KestrelImg.vue` stays `KestrelImg` while `ui/Button.vue` becomes `KestrelUiButton`.
- * Pass the layer's own `import.meta.url`.
- */
-export const kestrelComponents = (layerUrl: string) => ({
-  path: fileURLToPath(new URL('./app/components', layerUrl)),
-  prefix: KESTREL_COMPONENT_PREFIX,
-  priority: KESTREL_LAYER_PRIORITY,
-})

package/layers/core/modules/kestrel/app-shell.ts

@@ -1,55 +0,0 @@
-export type AppShellDiagnostic = { level: 'error' | 'warn'; message: string }
-
-export type AppShellInput = {
-  mainComponent: string | null | undefined
-  pagesEnabled: boolean
-  read: (file: string) => string
-}
-
-const withoutComments = (src: string) => src.replace(/<!--[\s\S]*?-->/g, '')
-
-// `<nuxt-page />` is as valid as `<NuxtPage />`; matching only the Pascal spelling would flag a working app.
-const kebab = (tag: string) => tag.replace(/(?!^)([A-Z])/g, '-$1').toLowerCase()
-const uses = (src: string, tag: string) => new RegExp(`<\\s*(${tag}|${kebab(tag)})[\\s/>]`, 'i').test(src)
-
-const FIX = `
-  <template>
-    <NuxtLayout>
-      <NuxtPage />
-    </NuxtLayout>
-  </template>`
-
-/** Reports only — assigning `mainComponent` would defeat a legitimate override. See ADR-0005. */
-export function diagnoseAppShell({ mainComponent, pagesEnabled, read }: AppShellInput): AppShellDiagnostic[] {
-  const found: AppShellDiagnostic[] = []
-
-  if (!pagesEnabled) {
-    found.push({
-      level: 'error',
-      message:
-        'the pages feature is disabled (`pages: false`), so no route is registered at all — the admin is a set of pages under `app/pages/admin/`. Remove the override to reach /admin.',
-    })
-  }
-
-  if (mainComponent) {
-    let src: string | undefined
-    try {
-      src = withoutComments(read(mainComponent))
-    } catch {
-      // An unreadable app root is Nuxt's to report; guessing here would produce a phantom error.
-    }
-    if (src !== undefined && !uses(src, 'NuxtPage')) {
-      found.push({
-        level: 'error',
-        message: `${mainComponent} renders no <NuxtPage />, so NO route renders — including /admin. It shadows Kestrel's own app.vue because the consumer layer wins. Either delete it (Kestrel ships a working one) or make it:${FIX}`,
-      })
-    } else if (src !== undefined && !uses(src, 'NuxtLayout')) {
-      found.push({
-        level: 'warn',
-        message: `${mainComponent} renders no <NuxtLayout />, so page-level \`layout\` is ignored and the admin loses its navigation shell. Wrap <NuxtPage /> in <NuxtLayout>.`,
-      })
-    }
-  }
-
-  return found
-}

package/layers/core/modules/kestrel/auto-imports.ts

@@ -1,44 +0,0 @@
-/**
- * Kestrel's authoring API, registered as Nuxt/Nitro auto-imports so a site built on Kestrel can write
- * `defineCollection({...})` or `getCollection('pages')` without importing — the same surface a 3.x site
- * had when this code still lived in the layers' `server/utils`. The names are read off the packages'
- * real exports at build time, so a new public function is auto-importable the moment it is exported;
- * every name stays importable explicitly from its package as well.
- */
-export interface AutoImportEntry {
-  name: string
-  from: string
-}
-
-const PKG = '@michaelthielemann/kestrel-'
-
-/** Order matters: a name exported by several packages (re-exports) is registered from the first one. */
-const SERVER_PACKAGES = ['core', 'fields', 'contracts', 'auth', 'access', 'media', 'collections', 'publishing', 'delivery-live', 'delivery-static']
-const APP_PACKAGES = ['core/client', 'fields/client']
-
-/** `kestrelDiscovery`: module manifests for the discovery module, never something a site calls.
- *  `renderRouteLive`: the public layer's own `server/utils` wrapper of the same name is the wired one, and
- *  Nitro's directory scan already auto-imports it — registering the package export too only draws a
- *  "duplicated imports" warning on every build. */
-const EXCLUDED = new Set(['default', 'kestrelDiscovery', 'renderRouteLive'])
-
-async function collect(packages: string[]): Promise<AutoImportEntry[]> {
-  const seen = new Set<string>()
-  const entries: AutoImportEntry[] = []
-  for (const pkg of packages) {
-    const from = PKG + pkg
-    const mod = (await import(from)) as Record<string, unknown>
-    for (const name of Object.keys(mod)) {
-      if (EXCLUDED.has(name) || seen.has(name)) continue
-      seen.add(name)
-      entries.push({ name, from })
-    }
-  }
-  return entries
-}
-
-/** Server-only (Nitro) authoring API: every runtime export of the server packages. */
-export const serverAutoImports = (): Promise<AutoImportEntry[]> => collect(SERVER_PACKAGES)
-
-/** App-side (Vue) authoring API: every runtime export of the client entry points. */
-export const appAutoImports = (): Promise<AutoImportEntry[]> => collect(APP_PACKAGES)

package/layers/core/modules/kestrel/index.ts

@@ -1,144 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { defineNuxtModule } from '@nuxt/kit'
-import { resolveKestrel, type KestrelConfig } from '@michaelthielemann/kestrel-core'
-import { diagnoseAppShell } from './app-shell'
-import { appAutoImports, serverAutoImports } from './auto-imports'
-
-/**
- * The `kestrel` config namespace (`kestrel: { … }` in nuxt.config, sourced from `kestrel.config.ts`).
- * Lives in `core` so it runs before the `media`/`public` layer modules and populates runtimeConfig
- * first. It bridges the resolved config to what the CLIENT + Nitro need: `runtimeConfig.media.*`,
- * `runtimeConfig.public.{locales,primaryLocale}`, and the `/uploads` static serving. Server runtime
- * utils (db/locale/site-url) read the same resolved values directly via `server/utils/kestrel-config.ts`.
- */
-export default defineNuxtModule<KestrelConfig>({
-  meta: { name: 'kestrel', configKey: 'kestrel' },
-  async setup(options, nuxt) {
-    const c = resolveKestrel(options, process.env, nuxt.options.rootDir)
-
-    // Registered through hooks rather than `addImports`/`addServerImports`, which need an active Kit
-    // instance (`useNuxt()`) that plain `setup()` callers (tests) do not provide.
-    const [app, server] = await Promise.all([appAutoImports(), serverAutoImports()])
-    // The packages' own compiled output must not be rewritten by the auto-import transform: it would
-    // inject an import for a symbol a dist file declares itself. Only the `kestrel-*` packages are
-    // excluded — never `node_modules` as a whole: in a consumer the engine's own layers live there too,
-    // and their server plugins rely on the transform for Nitro's `defineNitroPlugin` & co.
-    const ownDist = /[\\/](node_modules|packages)[\\/](@michaelthielemann[\\/])?kestrel-[^\\/]+[\\/]/
-    const imports = (nuxt.options.imports ||= {} as typeof nuxt.options.imports)
-    imports.transform ||= {}
-    imports.transform.exclude = [...(imports.transform.exclude ?? []), ownDist]
-    nuxt.hook('imports:extend', (imports) => {
-      imports.push(...app)
-    })
-    nuxt.hook('nitro:config', (config) => {
-      config.imports ||= {}
-      config.imports.imports ||= []
-      config.imports.imports.push(...server)
-      const prior = config.imports.exclude
-      const excluded = Array.isArray(prior) ? [...prior] : prior ? [prior] : []
-      config.imports.exclude = [...excluded, ownDist]
-    })
-
-    // `app:resolve` is the first hook where `mainComponent` is settled across all layers. In dev it fires
-    // on every watched change, so an unfixed problem would repaint the whole message on each keystroke.
-    const reported = new Set<string>()
-    nuxt.hook('app:resolve', (app) => {
-      for (const d of diagnoseAppShell({
-        mainComponent: app.mainComponent,
-        pagesEnabled: nuxt.options.pages !== false,
-        read: (file) => readFileSync(file, 'utf8'),
-      })) {
-        if (reported.has(d.message)) continue
-        reported.add(d.message)
-        console[d.level === 'error' ? 'error' : 'warn'](`[kestrel] ${d.message}`)
-      }
-    })
-
-    const rc = nuxt.options.runtimeConfig
-    rc.media = {
-      driver: c.media.driver,
-      maxUploadBytes: c.media.maxUploadBytes,
-      allowedMimes: c.media.allowedMimes,
-      imagePolicy: c.media.imagePolicy,
-      local: { dir: c.media.dir, baseUrl: c.media.baseUrl },
-      // Non-secret S3 settings come from the resolved config; the credentials are env-only (never
-      // committed) and merged in here so the server driver gets everything from runtimeConfig.
-      s3: {
-        ...c.media.s3,
-        accessKeyId: process.env.KESTREL_S3_ACCESS_KEY_ID ?? '',
-        secretAccessKey: process.env.KESTREL_S3_SECRET_ACCESS_KEY ?? '',
-        sessionToken: process.env.KESTREL_S3_SESSION_TOKEN ?? '',
-      },
-    }
-    const pub = (rc.public ??= {} as never) as Record<string, unknown>
-    pub.locales = c.supportedLocales
-    pub.primaryLocale = c.primaryLocale
-    pub.prefixPrimary = c.prefixPrimary
-    // The public head (canonical/og:url/hreflang) needs the absolute origin CLIENT-side too (SPA navs
-    // update the head after hydration). Not a secret — it is the site's own public address.
-    pub.siteUrl = c.siteUrl ?? ''
-    pub.siteName = c.siteName ?? ''
-    // Reference desktop width (px) for the admin page-builder preset; the editor's scale-to-fit shrinks it.
-    pub.previewDesktopWidth = c.preview.desktopWidth
-    // Whether the admin shows the EU AI Act disclosure controls on a media asset; the data itself is
-    // always resolved server-side, so flipping this off only hides the editor.
-    pub.aiDisclosureEnabled = c.aiDisclosure.enabled
-    // Article metadata is an APP-side concern on both ends — the admin SEO panel decides whether to offer
-    // the fields, the public page decides whether to publish them as JSON-LD — so the flag has to be
-    // client-visible. It gates a disclosure, not a secret.
-    pub.seoArticleMeta = c.seo.articleMeta
-
-    // Server-only resolved settings, so server utils read the CONSUMER's `kestrel: {}` (via this module)
-    // rather than importing Kestrel's own `kestrel.config.ts` file. Essential when Kestrel is consumed as
-    // a layer: the package's config file is empty, the real config lives in the consumer's nuxt.config.
-    const srv = (rc.kestrel ??= {} as never) as Record<string, unknown>
-    srv.dbPath = c.dbPath
-    srv.siteUrl = c.siteUrl
-    srv.siteName = c.siteName
-    srv.siteDescription = c.siteDescription
-    // Built-in collection toggles (pages/media) — read by the register plugin to gate built-ins.
-    srv.collections = c.collections
-    // Read by the upload route to decide whether to run the AI-signal scan at all.
-    srv.aiDisclosure = c.aiDisclosure
-    // Answer-engine toggles; `llmsFull` is server-only (it gates a Nitro route and what the publisher writes).
-    srv.seo = c.seo
-    // Read by delivery-live's catch-all/read pipeline (see `KestrelConfig.delivery`'s own TSDoc) to
-    // decide whether to answer at all — everything else about it stays 'static'-shaped either way.
-    srv.delivery = c.delivery
-    // Extra path prefixes the live catch-all must fall through on (see `KestrelConfig.deliveryExempt`).
-    srv.deliveryExempt = c.deliveryExempt
-    // Static-publish target for the runtime publisher (server-only). S3 creds are env-only; prefer the
-    // output-specific creds, fall back to the shared media creds so a single S3 account "just works".
-    srv.output = {
-      driver: c.output.driver,
-      dir: c.output.dir,
-      publicDir: c.output.publicDir,
-      auto: c.output.auto,
-      publishOnSave: c.output.publishOnSave,
-      reconcileMinutes: c.output.reconcileMinutes,
-      verbose: c.output.verbose,
-      s3: {
-        ...c.output.s3,
-        accessKeyId: process.env.KESTREL_OUTPUT_S3_ACCESS_KEY_ID ?? process.env.KESTREL_S3_ACCESS_KEY_ID ?? '',
-        secretAccessKey: process.env.KESTREL_OUTPUT_S3_SECRET_ACCESS_KEY ?? process.env.KESTREL_S3_SECRET_ACCESS_KEY ?? '',
-        sessionToken: process.env.KESTREL_OUTPUT_S3_SESSION_TOKEN ?? process.env.KESTREL_S3_SESSION_TOKEN ?? '',
-      },
-    }
-
-    nuxt.options.nitro ??= {}
-    // Only the local driver serves uploads off disk from the app origin (dev + baked into `nuxt
-    // generate`). On S3 the bucket/CDN serves them, so we must not register a publicAssets entry for
-    // a directory that isn't the store (it would 404 or shadow real keys).
-    if (c.media.driver === 'local') {
-      nuxt.options.nitro.publicAssets = [
-        ...(nuxt.options.nitro.publicAssets ?? []),
-        { baseURL: c.media.baseUrl, dir: c.media.dir, maxAge: 0 },
-      ]
-      // Uploads are served from the app origin; never let the browser content-sniff past the declared type.
-      nuxt.options.nitro.routeRules = {
-        ...(nuxt.options.nitro.routeRules ?? {}),
-        [`${c.media.baseUrl}/**`]: { headers: { 'X-Content-Type-Options': 'nosniff' } },
-      }
-    }
-  },
-})

package/layers/core/modules/plugin-order/index.ts

@@ -1,69 +0,0 @@
-import { defineNuxtModule } from '@nuxt/kit'
-import { assertEffectiveOrderMatches, resolvePluginOrder, validatePluginOrder } from './plugin-order'
-
-/**
- * Owns the execution order of the plugins Kestrel's own 6 layers ship (core/fields/media/auth/
- * collections/public — see `plugin-order.ts`'s `PLUGIN_ORDER`), replacing Nitro's layer-then-filename
- * sort with an explicit, declared list. A consumer's own plugins (and any extension layer's) are
- * untouched — they keep using Nitro's default scan-and-append, landing wherever their own layer position
- * in `extends` naturally puts them; this module only orders Kestrel's own.
- *
- * Mechanism: the `nitro:config` hook's config object (which becomes `nitro.options` once Nitro's own
- * instance is built) gets `.plugins` pushed with `PLUGIN_ORDER`'s resolved absolute paths, in order — this
- * hook runs BEFORE Nitro's own `scanPlugins` step. That step only appends a scanned file when it is not
- * ALREADY in `nitro.options.plugins`
- * (`nitropack/dist/core/index.mjs`: `if (!nitro.options.plugins.includes(plugin)) plugins.push(plugin)`),
- * so every one of our explicitly-pushed paths is skipped by the scan (already present, same absolute path)
- * and keeps our declared position — nothing needs renaming or moving on disk. `nitro:config` alone only
- * proves what WE push, though — a separate `nitro:init` hook (which fires after every `nitro:config` hook
- * and Nitro's own scan-and-append have both already run, against the fully-built Nitro instance) asserts
- * the REAL, final `nitro.options.plugins` still starts with our declared order, contiguous and duplicate-
- * free — see `assertEffectiveOrderMatches`'s own TSDoc for why this observer, not the push alone, is what
- * actually proves "declared order ≡ effective order".
- *
- * The ADR-0029 eager-barrel-load guard for a future `00.*` plugin: NOT a mechanism in this module. It
- * doesn't need to be — `@michaelthielemann/kestrel-media`/`@michaelthielemann/kestrel-collections`/`@michaelthielemann/kestrel-publishing`'s own barrels now
- * self-guard (a used-binding `@michaelthielemann/kestrel-fields` import, first), so importing ANY of them is safe from ANY
- * plugin position, including a hypothetical new `00.*` file. The computed rail proving this
- * (`test/architecture/kestrel-discovery.test.ts`'s "every package whose OWN module graph reaches
- * buildCollection()...") already re-checks every package on every test run, so a FUTURE package that
- * starts calling `buildCollection()` without the guard fails there — independent of whatever plugin order
- * this module declares. Plugin order literally cannot reintroduce this hazard class any more, which is the
- * honest, verifiable version of "prevents a future 00.* plugin from eagerly loading a heavy barrel
- * pre-seed": the guard lives at the package boundary, not the boot-order boundary.
- */
-/** The minimal shape this module needs from `nuxt` — narrowed so a test can pass a plain mock object
- *  instead of a real Nuxt instance (mirrors testing `defineNuxtModule`'s callback logic directly, not
- *  through Nuxt's own module-loading machinery). */
-export interface MinimalNuxt {
-  options: { _layers: readonly { cwd: string }[] }
-  hook: {
-    (name: 'nitro:config', fn: (nitro: { plugins?: (string | undefined)[] }) => void): void
-    (name: 'nitro:init', fn: (nitro: { options: { plugins: (string | undefined)[] } }) => void): void
-  }
-}
-
-/** The module's actual logic, exported separately from `defineNuxtModule`'s wrapper so a test can call it
- *  against a plain mock `nuxt`/`nitro` pair and assert `nitro.plugins` ends up EXACTLY
- *  `resolvePluginOrder(roots)`, in order — the "declared order ≡ effective order" proof, at unit speed,
- *  independent of the real-boot proof (a real `nuxt build`, inspected directly). */
-export function setupPluginOrder(nuxt: MinimalNuxt): void {
-  const roots = nuxt.options._layers.map((layer) => layer.cwd)
-  validatePluginOrder(roots) // throws — fails the build loudly on any drift, before Nitro ever scans
-
-  nuxt.hook('nitro:config', (nitro) => {
-    nitro.plugins ||= []
-    nitro.plugins.push(...resolvePluginOrder(roots))
-  })
-
-  nuxt.hook('nitro:init', (nitro) => {
-    assertEffectiveOrderMatches(nitro.options.plugins, resolvePluginOrder(roots))
-  })
-}
-
-export default defineNuxtModule({
-  meta: { name: 'kestrel-plugin-order' },
-  setup(_options, nuxt) {
-    setupPluginOrder(nuxt)
-  },
-})