@michaelthielemann/kestrel 4.1.3 → 5.0.2

package/layers/media/server/middleware/ondemand-variants.ts

@@ -1,38 +0,0 @@
-import type { H3Event } from 'h3'
-import { clientIp } from '@michaelthielemann/kestrel-auth'
-import { allowlistMode, ipAllowed, parseAllowlist } from '@michaelthielemann/kestrel-access'
-import { deriveOnDemand, variantKeyFromPath, useStorageDriver, mediaRuntimeConfig, useMediaDb } from '@michaelthielemann/kestrel-media'
-import { DEFAULT_IMAGE_POLICY } from '@michaelthielemann/kestrel-core'
-
-/**
- * Whether the IP allow-list would deny this request, checked directly rather than relied on by ordering:
- * Nitro sorts middleware by layer scan dir first, and media's precedes access's, so the real
- * access/00.ip-allowlist gate has NOT run yet when this middleware short-circuits with a derived response.
- */
-export function deniedByAllowlist(event: H3Event): boolean {
-  const mode = allowlistMode(process.env.KESTREL_IP_ALLOWLIST_MODE, process.env.KESTREL_IP_ALLOWLIST)
-  if (mode !== 'enforce') return false
-  return !ipAllowed(clientIp(event), parseAllowlist(process.env.KESTREL_IP_ALLOWLIST))
-}
-
-// Dev only: a GET for a not-yet-generated variant under the media baseUrl derives it from the original and
-// serves it, so a newly-declared size/format shows in the editor preview without a full publish. On a hit
-// this is a no-op — the static /uploads handler serves the cached file.
-export default defineEventHandler(async (event) => {
-  if (!import.meta.dev || event.method !== 'GET') return
-  if (deniedByAllowlist(event)) return
-  const cfg = mediaRuntimeConfig()
-  const key = variantKeyFromPath(event.path, cfg.baseUrl)
-  if (key == null) return
-  const driver = useStorageDriver()
-  if (await driver.exists?.(key)) return
-  // Dev is the diagnosis environment, so surface a real derive failure (missing original, sharp reject)
-  // instead of silently 404ing — a broken preview <img> with no log violates the fail-loud convention.
-  const result = await deriveOnDemand(useMediaDb().db, driver, cfg.imagePolicy ?? DEFAULT_IMAGE_POLICY, key).catch((error) => {
-    console.warn(`[kestrel] on-demand variant derive failed for ${key}:`, (error as Error)?.message ?? error)
-    return null
-  })
-  if (!result) return
-  setResponseHeader(event, 'content-type', result.mime)
-  return result.bytes
-})

package/layers/media/server/plugins/01.register-media-pipelines.ts

@@ -1,7 +0,0 @@
-import { registerPipeline } from '@michaelthielemann/kestrel-core'
-import { buildMediaPipelines } from '@michaelthielemann/kestrel-media'
-
-// Registration only — nothing resolves a pipeline here; the registry is read on the first request.
-export default defineNitroPlugin(() => {
-  for (const def of buildMediaPipelines()) registerPipeline(def)
-})

package/layers/media/server/plugins/02.register-media.ts

@@ -1,22 +0,0 @@
-import { eq, getTableColumns } from 'drizzle-orm'
-import { registerFieldPopulator } from '@michaelthielemann/kestrel-core'
-import {
-  media as mediaTable,
-  buildMediaFieldPopulator,
-  resolveMedia,
-  useStorageDriver,
-  mediaCollectionEnabled,
-  useMediaDb,
-} from '@michaelthielemann/kestrel-media'
-
-export default defineNitroPlugin(() => {
-  // A consumer who turned the built-in off has no `media` table, so a row that still carries a media id
-  // must stay unpopulated rather than blow up the read path.
-  if (!mediaCollectionEnabled()) return
-  const cols = getTableColumns(mediaTable) as Record<string, never>
-  registerFieldPopulator('media', buildMediaFieldPopulator((id, locale) => {
-    const driver = useStorageDriver()
-    const row = useMediaDb().db.select().from(mediaTable).where(eq(cols.id, id)).get()
-    return row ? resolveMedia(row as never, locale, (k) => driver.publicUrl(k)) : null
-  }))
-})

package/layers/media/server/plugins/04.variant-capture.ts

@@ -1,27 +0,0 @@
-import { isRendererContext } from '@michaelthielemann/kestrel-access'
-import { recordVariants, saveDiscoveredVariants, useMediaDb } from '@michaelthielemann/kestrel-media'
-
-/**
- * Auto-discovery capture. `KestrelImg`/`useMediaVariant` stash their concrete specs on the render's
- * `event.context.kestrelVariants` during SSR. Renders count when they are either a PUBLISH render (the
- * incremental publisher runs it under `runAsRenderer`, see `render-live.ts`) OR a build-time PRERENDER
- * render (the classic `nuxt generate` topology) — so live preview / stray runtime renders never pollute the
- * scan. For a publish, `publishFull` reconciles the drained accumulator once at the end; the generate
- * topology has no such orchestrator, so each prerendered route reconciles inline WITHOUT draining and the
- * growing accumulator converges to the full used set by the last route.
- *
- * Gating uses the unforgeable AsyncLocalStorage signal `isRendererContext()` (the same one
- * `delivery-live`'s catch-all uses), not the spoofable `x-kestrel-publish` header.
- *
- * NOTE: relies on `beforeResponse` firing for the publisher's `localFetch` renders / the prerenderer, and on
- * the app→server `event.context` bridge — verified by a real publish/generate, not the headless unit suite.
- */
-export default defineNitroPlugin((nitroApp) => {
-  nitroApp.hooks.hook('beforeResponse', (event) => {
-    const isPrerender = import.meta.prerender === true
-    if (!isRendererContext() && !isPrerender) return
-    const specs = (event.context as { kestrelVariants?: unknown[] }).kestrelVariants
-    if (Array.isArray(specs) && specs.length) recordVariants(specs as never)
-    if (isPrerender) saveDiscoveredVariants(useMediaDb().db, { clear: false })
-  })
-})

package/layers/media/server/plugins/05.media-cleanup.ts

@@ -1,5 +0,0 @@
-import { registerMediaCleanup } from '@michaelthielemann/kestrel-media'
-
-export default defineNitroPlugin(() => {
-  registerMediaCleanup()
-})

package/layers/media/server/tasks/media/backfill.ts

@@ -1,17 +0,0 @@
-import { runBackfill, useStorageDriver, mediaRuntimeConfig, useMediaDb } from '@michaelthielemann/kestrel-media'
-import { DEFAULT_IMAGE_POLICY } from '@michaelthielemann/kestrel-core'
-
-/**
- * Reconcile every media row's derivatives to the active variant registry: generate the missing sizes/formats
- * (from the stored original) and prune the deregistered ones. `{check:true}` is a dry-run (report only).
- * Trigger (like `db:migrate` — no `nuxi task run`): dev `GET /_nitro/tasks/media:backfill`; prod `runTask(
- * 'media:backfill', { payload })` from the admin endpoint (`POST /api/media/backfill`) or a cron scheduledTask.
- */
-export default defineTask({
-  meta: { name: 'media:backfill', description: 'Generate missing image variants + prune deregistered ones; {check:true}=dry-run' },
-  async run({ payload }) {
-    const policy = mediaRuntimeConfig().imagePolicy ?? DEFAULT_IMAGE_POLICY
-    const result = await runBackfill(useMediaDb().db, useStorageDriver(), policy, { check: !!(payload as { check?: boolean })?.check })
-    return { result }
-  },
-})

package/layers/public/app/app.vue

@@ -1,5 +0,0 @@
-<template>
-  <NuxtLayout>
-    <NuxtPage />
-  </NuxtLayout>
-</template>

package/layers/public/app/components/BlockRenderer.vue

@@ -1,56 +0,0 @@
-<script setup lang="ts">
-import { computed, inject, resolveDynamicComponent } from 'vue'
-import BlockRenderer from './BlockRenderer.vue'
-import { blockEditKey } from '../utils/block-edit-context'
-
-interface BlockNode { id?: string; type: string; props?: Record<string, unknown>; slots?: Record<string, BlockNode[]> }
-const props = defineProps<{ blocks: BlockNode[] }>()
-
-// Absent on the public site (plain render); present inside the admin preview (selection-aware wrapper).
-const edit = inject(blockEditKey, null)
-
-const pascal = (s: string) => s.replace(/(^|[-_])(\w)/g, (_m, _sep, c: string) => c.toUpperCase())
-
-const items = computed(() =>
-  props.blocks.map((block, i) => {
-    // A block type with no display component is a content condition, not a programming error: this
-    // resolver hands back the bare name for it silently, leaving the message below as the one diagnostic.
-    const resolved = resolveDynamicComponent('Blocks' + pascal(block.type))
-    const component = typeof resolved === 'string' ? null : resolved
-    if (!component && import.meta.dev) console.warn(`[kestrel] no display component for block type "${block.type}"`)
-    const { $media, ...fields } = (block.props ?? {}) as Record<string, unknown>
-    return { key: block.id ?? i, id: block.id, component, fields, media: $media as Record<string, unknown> | undefined, slots: block.slots }
-  }),
-)
-</script>
-
-<template>
-  <template v-for="item in items" :key="item.key">
-    <!-- Public render path: no edit context → plain markup, unchanged. -->
-    <component :is="item.component" v-if="item.component && !edit" v-bind="item.fields" :media="item.media">
-      <!-- Each declared slot's child blocks recurse through the same renderer (props + nested $media). -->
-      <template v-for="(slotBlocks, slotName) in item.slots" #[slotName]>
-        <BlockRenderer :blocks="slotBlocks" />
-      </template>
-    </component>
-    <!-- Editor preview path: same component, wrapped in a clickable, highlightable marker. `.prevent`
-         cancels any anchor navigation from a link-bearing block; `.stop` keeps a nested-block click from
-         also selecting its ancestors. The marker is `display: contents` (see KestrelPreviewBridge), so it
-         generates no box: the block root stays the parent's real flex/grid item, so flex/grid-item props,
-         `gap`, and root-keyed breakpoints render as on the published site. (`>` combinators are unaffected
-         either way — the marker element stays in the DOM tree.) -->
-    <div
-      v-else-if="item.component"
-      class="block-edit-marker"
-      :class="{ 'block-edit-marker--selected': item.id != null && edit!.selectedId.value === item.id }"
-      :data-block-id="item.id"
-      @click.prevent.stop="item.id != null && edit!.select(item.id)"
-    >
-      <component :is="item.component" v-bind="item.fields" :media="item.media">
-        <template v-for="(slotBlocks, slotName) in item.slots" #[slotName]>
-          <BlockRenderer :blocks="slotBlocks" />
-        </template>
-      </component>
-    </div>
-  </template>
-</template>

package/layers/public/app/components/KestrelLink.vue

@@ -1,26 +0,0 @@
-<script setup lang="ts">
-import { computed, useSlots } from 'vue'
-import type { LinkValue } from '@michaelthielemann/kestrel-core'
-import { linkToHref, linkLabel } from '../utils/link-href'
-
-// Generic renderer for the `link` field type, for consumer projects + blocks. Renders an <a> for any
-// LinkValue; external links open in a new, isolated tab. Renders nothing for a null/empty value.
-const props = defineProps<{ value?: LinkValue | null }>()
-const slots = useSlots()
-const href = computed(() => linkToHref(props.value))
-const isExternal = computed(() => props.value?.type === 'external')
-// An unresolved internal link (draft/missing target) falls back to '#' with no target-derived label —
-// only render it if it still has an accessible name from elsewhere, or it's a tabbable link to nowhere.
-const dead = computed(() => props.value?.type === 'internal' && href.value === '#')
-const named = computed(() => !!linkLabel(props.value) || !!slots.default)
-</script>
-
-<template>
-  <a
-    v-if="value && href && (!dead || named)"
-    class="kestrel-link"
-    :href="href"
-    :target="isExternal ? '_blank' : undefined"
-    :rel="isExternal ? 'noopener noreferrer' : undefined"
-  ><slot>{{ linkLabel(value) }}</slot></a>
-</template>

package/layers/public/app/components/KestrelPreviewBridge.vue

@@ -1,133 +0,0 @@
-<script setup lang="ts">
-import { computed, nextTick, onMounted, onUnmounted, provide, ref, shallowRef } from 'vue'
-import { blockEditKey } from '../utils/block-edit-context'
-import {
-  parseEditorMessage, readyMessage, selectMessage,
-  type PreviewBlockNode,
-} from '../utils/preview-protocol'
-
-/**
- * The iframe half of the editor live preview. Wraps the page's BlockRenderer via a scoped slot: it
- * exposes the LIVE block tree (the editor's in-memory content, received over postMessage) — falling
- * back to the server-rendered `blocks` prop until the first message — and provides the block-edit
- * context so the renderer emits clickable, highlightable markers. Mounted only in preview mode
- * (`?kestrel-preview=1` + admin, or the dedicated fallback page), and lazy-loaded there, so none of
- * this ships in the normal public bundle.
- *
- * SECURITY: messages are trusted only when `event.origin` is OUR origin AND `event.source` is the
- * embedding parent window — a third-party page that frames the site (or is framed by it) can never
- * inject preview content. Outbound posts target our own origin only.
- */
-const props = defineProps<{ blocks?: unknown[] }>()
-
-// Live tree: null until the editor's first content message, then always the message payload.
-// shallowRef — each message replaces the whole tree; BlockRenderer keys by block id.
-const live = shallowRef<PreviewBlockNode[] | null>(null)
-const blocks = computed<unknown[]>(() => live.value ?? (Array.isArray(props.blocks) ? props.blocks : []))
-
-// Selection: local state, synced both ways (click here → editor tree; tree click → highlight here).
-const selectedId = ref<string | null>(null)
-provide(blockEditKey, {
-  selectedId,
-  select: (id: string) => {
-    selectedId.value = id // highlight immediately; the editor echoes the selection back
-    post(selectMessage(id))
-  },
-})
-
-function post(msg: unknown) {
-  // Posting to self when opened directly (parent === window) is harmless — our own listener ignores
-  // frame→editor types — and keeping it unconditional keeps the handshake testable.
-  window.parent.postMessage(msg, window.location.origin)
-}
-
-function onMessage(e: MessageEvent) {
-  if (e.origin !== window.location.origin || e.source !== window.parent) return
-  const m = parseEditorMessage(e.data)
-  if (!m) return
-  if (m.kestrel === 'preview:content') {
-    const prev = selectedId.value
-    live.value = m.blocks
-    selectedId.value = m.selectedId
-    // A selection made while the frame was still loading arrives with the first content push (not as a
-    // separate selected message) — scroll to it like a live selection would.
-    if (m.selectedId && m.selectedId !== prev) void scrollToSelected(m.selectedId)
-  } else {
-    selectedId.value = m.selectedId
-    void scrollToSelected(m.selectedId)
-  }
-}
-
-// Bring an externally-selected block into view (tree-pane click in the editor).
-async function scrollToSelected(id: string | null) {
-  if (!id) return
-  await nextTick()
-  const el = Array.from(document.querySelectorAll('[data-block-id]')).find((n) => n.getAttribute('data-block-id') === id)
-  // The marker is `display: contents` (no box of its own), so scroll its rendered child instead.
-  ;(el?.firstElementChild ?? el)?.scrollIntoView({ block: 'nearest' })
-}
-
-// The preview is a canvas, not a browsing context: swallow every link navigation (consumer layout nav,
-// CTA anchors) AND form submission in the CAPTURE phase, so neither native navigation nor Vue Router
-// (which respects defaultPrevented) can steer the iframe away from the previewed page. Block clicks
-// still select — preventDefault does not stop propagation, so the marker handlers keep working.
-// (Programmatic navigation from consumer script can't be intercepted here; the editor host snaps the
-// frame back on load when its location no longer matches the preview URL.)
-function onClickCapture(e: MouseEvent) {
-  const a = (e.target as Element | null)?.closest?.('a[href]')
-  if (a) e.preventDefault()
-}
-function onSubmitCapture(e: Event) {
-  e.preventDefault()
-}
-
-onMounted(() => {
-  window.addEventListener('message', onMessage)
-  document.addEventListener('click', onClickCapture, true)
-  document.addEventListener('submit', onSubmitCapture, true)
-  // Handshake: tell the editor this document (fresh mount OR reload) is ready for the current state.
-  post(readyMessage())
-})
-onUnmounted(() => {
-  window.removeEventListener('message', onMessage)
-  document.removeEventListener('click', onClickCapture, true)
-  document.removeEventListener('submit', onSubmitCapture, true)
-})
-</script>
-
-<template>
-  <slot :blocks="blocks" />
-</template>
-
-<style lang="scss">
-// Selection chrome for the marker wrappers BlockRenderer emits when the edit context is present.
-// This document is the CONSUMER's public page (no admin design tokens), so the colors are concrete
-// values with overridable custom properties — a consumer can theme them from their own CSS.
-//
-// The marker itself is `display: contents`: it generates NO box, so the block root stays the parent's
-// real flex/grid ITEM exactly as on the published site — this restores flex/grid-item props, `gap`, and
-// breakpoints keyed to the block root, which a wrapper box would break by displacing the root. (It does
-// NOT change `>` combinators: the marker element is still in the DOM tree, so `parent > block-root`
-// rules match the same as before — unchanged either way.) The highlight chrome therefore lives on the
-// block root via `> *`. Events are unaffected — the marker div is still in the DOM/event path.
-.block-edit-marker {
-  display: contents;
-
-  > * {
-    cursor: pointer;
-    outline: 2px solid transparent;
-    outline-offset: -2px;
-    transition: outline-color 120ms ease;
-  }
-  &:hover > * {
-    outline-color: var(--kestrel-preview-hover, rgba(100, 116, 139, 0.55));
-  }
-  &--selected > * {
-    // Selection ring drawn with `outline` (not box-shadow) so a consumer block that carries its own root
-    // box-shadow keeps it while selected — a box-shadow ring here would replace it. Slightly thicker than
-    // the hover ring for contrast on dark/indigo consumer sites.
-    outline-color: var(--kestrel-preview-accent, #4f46e5);
-    outline-width: 3px;
-  }
-}
-</style>

package/layers/public/app/composables/public-page.ts

@@ -1,24 +0,0 @@
-import type { ComputedRef } from 'vue'
-
-export interface PublicPageState {
-  collection: string | null
-  page: Record<string, unknown> | null
-}
-
-/** The record rendered by the catch-all page, shared with layouts (language menu & co.); the page and a
- *  layout share no other channel, so the catch-all mirrors its resolved `{ collection, page }` here. */
-export const usePublicPageState = () =>
-  useState<PublicPageState>('public-page', () => ({ collection: null, page: null }))
-
-/** Content locale of the current public route, derived from the URL prefix scheme. Reads the locale set
- *  from `runtimeConfig.public` via the public-layer `pickPublicLocales` (NOT admin's `useContentLocales`,
- *  which would make the public site depend on `layers/admin`). */
-export function usePublicLocale(): ComputedRef<string> {
-  const route = useRoute()
-  const { locales, primary, prefixPrimary } = pickPublicLocales(
-    useRuntimeConfig().public as { locales?: unknown; primaryLocale?: unknown; prefixPrimary?: unknown },
-  )
-  return computed(
-    () => resolvePublicRoute(route.path.split('/').filter(Boolean), locales, primary, prefixPrimary).locale,
-  )
-}

package/layers/public/app/error.vue

@@ -1,12 +0,0 @@
-<script setup lang="ts">
-import type { NuxtError } from '#app'
-defineProps<{ error: NuxtError }>()
-</script>
-
-<template>
-  <main>
-    <h1>{{ error.statusCode }}</h1>
-    <p>{{ error.statusCode === 404 ? 'Page not found.' : 'Something went wrong.' }}</p>
-    <NuxtLink to="/">Home</NuxtLink>
-  </main>
-</template>

package/layers/public/app/layouts/default.vue

@@ -1,5 +0,0 @@
-<template>
-  <main>
-    <slot />
-  </main>
-</template>

package/layers/public/app/pages/[...slug].vue

@@ -1,239 +0,0 @@
-<script setup lang="ts">
-import type { LayoutKey } from '#app'
-import type { SiteHead } from '../utils/site-head'
-
-// The record decides its own layout, so route-meta resolution is opted out of and this page renders the
-// `<NuxtLayout>` itself. Side effect worth knowing: the layout becomes a CHILD of the page, so it can read
-// `usePublicPageState()` during SSR — as its parent it rendered before the page had written it.
-definePageMeta({ layout: false })
-
-interface RenderedPage {
-  title?: string
-  layout?: string | null
-  seo?: {
-    title?: string
-    description?: string
-    noindex?: boolean
-    $media?: { image?: { src: string; width: number | null; height: number | null } | null }
-    author?: string
-    publishedDate?: string
-    keywords?: string
-  }
-  content?: unknown[]
-  status?: string
-}
-
-const route = useRoute()
-// Locale routing is config-driven (KESTREL_LOCALES / KESTREL_PRIMARY_LOCALE → runtimeConfig.public), NOT
-// hardcoded to en/de — otherwise every non-default locale's prerendered pages 404. Mirrors the server's
-// prefix scheme (primary unprefixed, others `/<locale>/…`) via the pure `resolvePublicRoute`.
-const { locales, primary, prefixPrimary } = pickPublicLocales(
-  useRuntimeConfig().public as { locales?: unknown; primaryLocale?: unknown; prefixPrimary?: unknown },
-)
-const { locale, path } = resolvePublicRoute(route.path.split('/').filter(Boolean), locales, primary, prefixPrimary)
-
-// Resolve across ALL pageLike collections (not just `pages`) via the generic route resolver, so a
-// consumer's own pageLike collection renders to static HTML too. `useRequestFetch` forwards the
-// incoming request's cookies to the SSR sub-fetch, so an authenticated admin's session reaches
-// `/api/route` and a draft renders at its real URL (the live preview); anonymous + the static render
-// stay published-only (the handler enforces it).
-const requestFetch = useRequestFetch()
-const { data: resolved, error: resolveError } = await useAsyncData(`page:${locale}:${path}`, () =>
-  requestFetch('/api/route', {
-    query: { path, locale },
-  }).then((r) => r as {
-    collection: string | null
-    page: (RenderedPage & Record<string, unknown>) | null
-    alternates?: Array<{ locale: string; path: string }>
-    ancestors?: Array<{ path: string; title?: string; locale?: string }>
-    site?: SiteHead | null
-  }),
-)
-// Ticket preview (ADR-0008): `?kestrel-preview-token=…` carries the editor's UNSAVED state, so an external
-// tab can show work in progress without a save and without publishing. The ticket is admin-only and
-// session-bound server-side; an expired/foreign/unknown one reads as null and the saved record renders.
-const previewToken = route.query[PREVIEW_TOKEN_QUERY]
-const { data: ticket } = typeof previewToken === 'string' && previewToken
-  ? await useAsyncData(`kestrel-preview-ticket:${previewToken}`, () =>
-      requestFetch('/api/preview', { query: { token: previewToken } })
-        .then((r) => r as { payload?: { values?: Record<string, unknown> } } | null)
-        .catch(() => null))
-  : { data: ref<{ payload?: { values?: Record<string, unknown> } } | null>(null) }
-const previewValues = computed(() => ticket.value?.payload?.values ?? null)
-const previewingTicket = computed(() => previewValues.value !== null)
-
-const page = computed(() => previewPage(resolved.value?.page ?? null, previewValues.value) as (RenderedPage & Record<string, unknown>) | null)
-// `fallback` below only rescues a truthy name that is missing from the layout map, so the empty cases have
-// to be coalesced here — see resolvePageLayout. The cast is the one honest bridge in this file: the stored
-// name is arbitrary editor data, while `NuxtLayout` types `name` as the union of layouts that existed at
-// build time. Narrowing to that union is impossible for a value read from the DB, and `fallback` is exactly
-// the runtime guard for a name outside it.
-const pageLayout = computed(() => resolvePageLayout(page.value?.layout) as LayoutKey)
-
-// The layout (language menu & co.) needs the resolved record and its collection; pages and layouts share
-// no other channel, so mirror the fetch result into the shared state — reactively, so client-side
-// navigations update it too.
-const pageState = usePublicPageState()
-watchEffect(() => {
-  pageState.value = {
-    collection: resolved.value?.collection ?? null,
-    page: page.value,
-  }
-})
-
-// A draft only ever resolves here for an authenticated admin (anonymous + the static render are
-// published-only), so its presence is an unambiguous "you are previewing an unpublished page" signal.
-const isDraftPreview = computed(() => page.value?.status === 'draft')
-
-// What this tab is actually showing, when it is not the live page. A ticket outranks the draft notice: the
-// content on screen was never saved at all, which is the stronger caveat.
-const previewNotice = computed(() => {
-  if (previewingTicket.value) return 'Preview — unsaved changes, not published'
-  return isDraftPreview.value ? 'Draft preview — not published' : ''
-})
-
-// Editor live-preview mode: `?kestrel-preview=1` AND an authenticated admin session. The session is
-// checked server-side (cookies forwarded, same seam as the draft fetch above) so SSR and hydration
-// agree on which branch renders; an anonymous visitor with the query param gets the normal page.
-// The bridge component is Lazy — its chunk (message channel + marker chrome) loads only in this mode.
-const previewRequested = route.query[PREVIEW_QUERY] === '1'
-const { data: previewSession } = previewRequested
-  ? await useAsyncData('kestrel-preview-session', () =>
-      requestFetch<{ authenticated: boolean }>('/api/session').catch(() => ({ authenticated: false })))
-  : { data: ref<{ authenticated: boolean } | null>(null) }
-const previewActive = computed(() => previewRequested && previewSession.value?.authenticated === true)
-
-// `useAsyncData` resolves even when the fetch threw, so the resolver's own failure has to be re-raised here
-// or the root's empty document (a 200 WITH a body) reads as a successful render and the publisher bakes it
-// over the live page. Unconditional on purpose, not just for `/`: on any other path the failure would fall
-// through to the 404 below, which asserts "no such page" from a lookup that never completed — a claim
-// crawlers and caches act on, and one the publisher files as a skip instead of the error the editor shows.
-if (resolveError.value) throw resolveError.value
-
-// The site root stays reachable (empty document) before a home page is published;
-// any other unmatched path is a genuine 404.
-if (!page.value && path !== '/') throw createError({ statusCode: 404, statusMessage: 'Page not found' })
-
-// Canonical / Open Graph / twitter card / hreflang: pure model (`buildPageHead`) fed from the resolved
-// page + the public runtime config. Absolute-URL emissions (canonical, og:url, hreflang, relative
-// og:image) require a configured siteUrl and degrade away without one.
-const publicRc = useRuntimeConfig().public as { siteUrl?: string; siteName?: string; seoArticleMeta?: boolean }
-const seo = page.value?.seo ?? {}
-const siteHead = resolved.value?.site ?? null
-const fallbacks = siteHeadFallbacks(seo, siteHead)
-// og:title stays the bare page title (og:site_name already carries the site); only <title> is composed.
-const pageTitle = seo.title || page.value?.title
-const documentTitle = composeTitle(pageTitle, siteHead)
-const head = buildPageHead({
-  siteUrl: typeof publicRc.siteUrl === 'string' ? publicRc.siteUrl : '',
-  siteName: typeof publicRc.siteName === 'string' ? publicRc.siteName : '',
-  path,
-  locale,
-  primary,
-  prefixPrimary,
-  title: pageTitle,
-  description: fallbacks.description,
-  image: fallbacks.image,
-  alternates: resolved.value?.alternates ?? [],
-})
-
-// schema.org JSON-LD — the one grounding signal every major answer engine documents. Same inputs as the
-// head above, so the two can never disagree; it degrades away without a siteUrl and is suppressed for a
-// noindex page or an unsaved ticket preview. Article metadata is published ONLY with `seo.articleMeta`
-// on: the fields may hold values (the column always round-trips them) that this installation must not
-// disclose, so the flag gates emission, not storage.
-const jsonLd = buildJsonLd({
-  siteUrl: typeof publicRc.siteUrl === 'string' ? publicRc.siteUrl : '',
-  siteName: typeof publicRc.siteName === 'string' ? publicRc.siteName : '',
-  canonical: head.canonical,
-  locale,
-  primary,
-  prefixPrimary,
-  title: pageTitle,
-  description: fallbacks.description,
-  imageUrl: head.meta.ogImage,
-  noindex: previewingTicket.value || seo.noindex,
-  ancestors: resolved.value?.ancestors ?? [],
-  article: publicRc.seoArticleMeta === true
-    ? { author: seo.author, publishedDate: seo.publishedDate, keywords: seo.keywords }
-    : null,
-})
-
-// Set the document language from the resolved locale so prerendered /de pages ship <html lang="de">
-// (WCAG 2.2 SC 3.1.1); without this every page would carry the build-default language.
-// Point AI agents at the generated llms.txt (alongside the robots.txt comment + sitemap) on every page.
-useHead({
-  htmlAttrs: { lang: locale },
-  // `textContent` (not innerHTML) is unhead's XSS-safe arm for a data script: it takes the object and
-  // serializes it itself, so editor-authored strings can never close the <script>.
-  script: jsonLd ? [{ type: 'application/ld+json' as const, textContent: jsonLd }] : [],
-  link: [
-    // `rel` needs the literal type: unhead keys its link union on it, and inside an array literal that
-    // reaches `link:` through a spread there is no contextual type to stop TS widening it to `string`.
-    ...(head.canonical ? [{ rel: 'canonical' as const, href: head.canonical }] : []),
-    ...head.links,
-    { rel: 'alternate' as const, type: 'text/markdown', href: '/llms.txt', title: 'llms.txt' },
-  ],
-})
-useSeoMeta({
-  title: documentTitle,
-  description: fallbacks.description,
-  // A ticket preview is unsaved content at a real URL — never indexable, whatever the record's own SEO says.
-  robots: previewingTicket.value || seo.noindex ? 'noindex, nofollow' : undefined,
-  ogTitle: head.meta.ogTitle,
-  ogDescription: head.meta.ogDescription,
-  ogUrl: head.meta.ogUrl,
-  ogType: head.meta.ogType,
-  ogSiteName: head.meta.ogSiteName,
-  ogImage: head.meta.ogImage,
-  ogImageWidth: head.meta.ogImageWidth,
-  ogImageHeight: head.meta.ogImageHeight,
-  twitterCard: head.meta.twitterCard,
-})
-</script>
-
-<template>
-  <NuxtLayout :name="pageLayout" fallback="default">
-    <article>
-      <!-- Only ever shown to an authenticated admin previewing an unpublished page (drafts never resolve
-           for anonymous visitors or the static render), so it never ships to the public/static site.
-           Suppressed inside the editor preview iframe — the editor's own status ampel covers it. -->
-      <div v-if="previewNotice && !previewActive" class="kestrel-draft-badge" role="status">
-        <span class="kestrel-draft-badge__dot" aria-hidden="true" />
-        {{ previewNotice }}
-      </div>
-      <!-- Editor preview: the bridge swaps in the editor's live (unsaved) tree over postMessage and makes
-           blocks selectable; the saved content renders until the first message. Normal path unchanged. -->
-      <LazyKestrelPreviewBridge v-if="previewActive" :blocks="(page?.content as any[]) ?? []" v-slot="{ blocks }">
-        <KestrelBlockRenderer :blocks="(blocks as any[])" />
-      </LazyKestrelPreviewBridge>
-      <KestrelBlockRenderer v-else :blocks="(page?.content as any[]) ?? []" />
-    </article>
-  </NuxtLayout>
-</template>
-
-<style scoped>
-/* Self-contained (no token dependency) so it renders identically whatever layout the consumer ships. */
-.kestrel-draft-badge {
-  position: fixed;
-  inset-block-start: 0.75rem;
-  inset-inline-end: 0.75rem;
-  z-index: 2147483647;
-  display: inline-flex;
-  align-items: center;
-  gap: 0.4rem;
-  padding: 0.35rem 0.7rem;
-  border-radius: 999px;
-  background: #1e293b;
-  color: #fff;
-  font: 600 0.78rem/1 ui-sans-serif, system-ui, sans-serif;
-  box-shadow: 0 2px 8px rgba(0, 0, 0, 0.25);
-  pointer-events: none;
-}
-.kestrel-draft-badge__dot {
-  width: 0.5rem;
-  height: 0.5rem;
-  border-radius: 50%;
-  background: #fbbf24;
-}
-</style>