katecms 0.0.0-stage → 1.0.0-beta.1

package/dist/runtime/pages/index.vue

@@ -0,0 +1,399 @@
+<script setup>
+import { computed } from "vue";
+import { useCookie, useHead, useRoute } from "#imports";
+import { useCmsPaths } from "../composables/useCmsPaths";
+const themeOrder = ["system", "light", "dark"];
+const theme = useCookie("katecms-theme", {
+  default: () => "system",
+  maxAge: 60 * 60 * 24 * 365,
+  sameSite: "lax",
+  watch: true
+});
+const themeMode = computed(() => themeOrder.includes(theme.value) ? theme.value : "system");
+const themeClass = computed(() => themeMode.value === "system" ? "" : `katecms-theme-${themeMode.value}`);
+const themeLabel = computed(() => {
+  if (themeMode.value === "light") {
+    return "Light theme. Switch to dark";
+  }
+  if (themeMode.value === "dark") {
+    return "Dark theme. Switch to system";
+  }
+  return "System theme. Switch to light";
+});
+useHead(() => ({
+  bodyAttrs: {
+    id: "katecms-body",
+    class: themeClass.value
+  },
+  titleTemplate: (title) => title ? `${title} - KateCMS` : "KateCMS"
+}));
+function cycleTheme() {
+  const index = themeOrder.indexOf(themeMode.value);
+  theme.value = themeOrder[(index + 1) % themeOrder.length] ?? "system";
+}
+const route = useRoute();
+const paths = useCmsPaths();
+const rootClass = "katecms";
+const isAuthPage = computed(() => {
+  const path = route.path.length > 1 ? route.path.replace(/\/+$/, "") : route.path;
+  return path === paths.login || path === paths.register;
+});
+const sidebarHidden = useCookie("katecms-sidebar-hidden", {
+  default: () => false,
+  maxAge: 60 * 60 * 24 * 365,
+  sameSite: "lax",
+  watch: true
+});
+function toggleSidebar() {
+  sidebarHidden.value = !sidebarHidden.value;
+}
+</script>
+
+<template>
+  <NuxtPage v-if="isAuthPage" />
+  <div
+    v-else
+    :class="[rootClass, { 'is-sidebar-hidden': sidebarHidden }]"
+  >
+    <div :class="[`${rootClass}-header`]">
+      <KateCmsUiButton
+        tag="button"
+        :class="`${rootClass}-sidebar-toggle`"
+        :variant="['tertiary', 'icon']"
+        :title="sidebarHidden ? 'Show sidebar' : 'Hide sidebar'"
+        :aria-label="sidebarHidden ? 'Show sidebar' : 'Hide sidebar'"
+        :aria-expanded="sidebarHidden ? 'false' : 'true'"
+        aria-controls="katecms-sidebar"
+        @click="toggleSidebar"
+      >
+        <svg
+          xmlns="http://www.w3.org/2000/svg"
+          viewBox="0 0 24 24"
+          fill="none"
+          aria-hidden="true"
+        >
+          <path
+            d="M5 4.75h14c.69 0 1.25.56 1.25 1.25v12c0 .69-.56 1.25-1.25 1.25H5c-.69 0-1.25-.56-1.25-1.25V6c0-.69.56-1.25 1.25-1.25Z"
+            stroke="currentColor"
+            stroke-width="1.6"
+          />
+          <path
+            d="M9 4.75v14.5"
+            stroke="currentColor"
+            stroke-width="1.6"
+          />
+        </svg>
+      </KateCmsUiButton>
+      <KateCmsUiButton
+        tag="button"
+        :class="`${rootClass}-theme-toggle`"
+        :variant="['tertiary', 'icon']"
+        :title="themeLabel"
+        :aria-label="themeLabel"
+        @click="cycleTheme"
+      >
+        <svg
+          v-if="themeMode === 'system'"
+          xmlns="http://www.w3.org/2000/svg"
+          viewBox="0 0 24 24"
+          fill="none"
+          aria-hidden="true"
+        >
+          <rect
+            x="3.75"
+            y="4.75"
+            width="16.5"
+            height="11.5"
+            rx="1.5"
+            stroke="currentColor"
+            stroke-width="1.6"
+          />
+          <path
+            d="M8.5 19.75h7M12 16.25v3.5"
+            stroke="currentColor"
+            stroke-width="1.6"
+            stroke-linecap="round"
+          />
+        </svg>
+        <svg
+          v-else-if="themeMode === 'light'"
+          xmlns="http://www.w3.org/2000/svg"
+          viewBox="0 0 24 24"
+          fill="none"
+          aria-hidden="true"
+        >
+          <circle
+            cx="12"
+            cy="12"
+            r="4"
+            stroke="currentColor"
+            stroke-width="1.6"
+          />
+          <path
+            d="M12 2.5v2.2M12 19.3v2.2M2.5 12h2.2M19.3 12h2.2M5.1 5.1l1.6 1.6M17.3 17.3l1.6 1.6M18.9 5.1l-1.6 1.6M6.7 17.3l-1.6 1.6"
+            stroke="currentColor"
+            stroke-width="1.6"
+            stroke-linecap="round"
+          />
+        </svg>
+        <svg
+          v-else
+          xmlns="http://www.w3.org/2000/svg"
+          viewBox="0 0 24 24"
+          fill="none"
+          aria-hidden="true"
+        >
+          <path
+            d="M16.2 14.8A6.2 6.2 0 0 1 9.4 4.6 6.4 6.4 0 1 0 16.2 14.8Z"
+            stroke="currentColor"
+            stroke-width="1.6"
+            stroke-linejoin="round"
+          />
+        </svg>
+      </KateCmsUiButton>
+      <KateCmsAppUser />
+    </div>
+
+    <div
+      id="katecms-sidebar"
+      :class="[`${rootClass}-sidebar`]"
+      :inert="sidebarHidden || void 0"
+      :aria-hidden="sidebarHidden ? 'true' : void 0"
+    >
+      <div :class="[`${rootClass}-sidebar-wrap`]">
+        <KateCmsAppMenu />
+      </div>
+    </div>
+
+    <div :class="[`${rootClass}-main`]">
+      <NuxtPage />
+    </div>
+  </div>
+</template>
+
+<style>
+body#katecms-body {
+  --katecms-color-accent: #2F6FED;
+  --katecms-color-accent-hover: #1E58D4;
+  --katecms-color-accent-wash: #EAF1FD;
+  --katecms-color-ink: #141A2A;
+  --katecms-color-muted: #6B7280;
+  --katecms-color-bg: #F6F7F8;
+  --katecms-color-surface: #FFFFFF;
+  --katecms-color-border: #E6E8EB;
+  --katecms-color-on-accent: #FFFFFF;
+  --katecms-color-overlay: rgba(20, 26, 42, 0.45);
+  --katecms-color-success: #2A9A66;
+  --katecms-color-success-bg: #E7F6EE;
+  --katecms-color-info: #2A7BBD;
+  --katecms-color-info-bg: #E7F2FA;
+  --katecms-color-warning: #C4851A;
+  --katecms-color-warning-bg: #FBF3E3;
+  --katecms-color-danger: #D64545;
+  --katecms-color-danger-bg: #FDECEC;
+  --katecms-shadow-sm: 0 1px 2px rgba(20, 26, 42, 0.05);
+  --katecms-shadow-md: 0 8px 24px rgba(20, 26, 42, 0.08);
+  color-scheme: light;
+  color-scheme: light dark;
+  --katecms-border-radius: 0.375rem;
+  --katecms-border-radius-inter: 0.3125rem;
+  --katecms-sidebar-w: 15.625rem;
+  --katecms-topbar-h: 3.375rem;
+  -webkit-font-smoothing: antialiased;
+  -moz-osx-font-smoothing: grayscale;
+  -webkit-text-size-adjust: 100%;
+  -webkit-tap-highlight-color: transparent;
+  font-family: system-ui, sans-serif;
+  font-size: 0.9375rem;
+  font-weight: 400;
+  font-style: normal;
+  font-variant: normal;
+  font-stretch: normal;
+  line-height: 1.5;
+  letter-spacing: normal;
+  word-spacing: normal;
+  text-align: start;
+  text-indent: 0;
+  text-transform: none;
+  text-shadow: none;
+  text-rendering: optimizeLegibility;
+  color: var(--katecms-color-ink);
+  background-color: var(--katecms-color-surface);
+  background-image: none;
+  caret-color: var(--katecms-color-ink);
+  accent-color: var(--katecms-color-accent);
+  tab-size: 4;
+  hyphens: none;
+  word-break: normal;
+  overflow-wrap: break-word;
+  direction: ltr;
+  margin: 0;
+  padding: 0;
+  border: 0;
+  min-height: 100%;
+  overflow: hidden;
+}
+body#katecms-body *,
+body#katecms-body *::before,
+body#katecms-body *::after {
+  box-sizing: border-box;
+}
+body#katecms-body * {
+  scrollbar-width: thin;
+  scrollbar-color: var(--katecms-color-muted) transparent;
+  font-family: inherit;
+}
+body#katecms-body img,
+body#katecms-body svg,
+body#katecms-body video,
+body#katecms-body canvas {
+  max-width: 100%;
+  height: auto;
+}
+body#katecms-body form {
+  margin: 0;
+  padding: 0;
+  border: 0;
+  background: none;
+  color: inherit;
+  font: inherit;
+  min-width: 0;
+}
+body#katecms-body.katecms-theme-light {
+  --katecms-color-accent: #2F6FED;
+  --katecms-color-accent-hover: #1E58D4;
+  --katecms-color-accent-wash: #EAF1FD;
+  --katecms-color-ink: #141A2A;
+  --katecms-color-muted: #6B7280;
+  --katecms-color-bg: #F6F7F8;
+  --katecms-color-surface: #FFFFFF;
+  --katecms-color-border: #E6E8EB;
+  --katecms-color-on-accent: #FFFFFF;
+  --katecms-color-overlay: rgba(20, 26, 42, 0.45);
+  --katecms-color-success: #2A9A66;
+  --katecms-color-success-bg: #E7F6EE;
+  --katecms-color-info: #2A7BBD;
+  --katecms-color-info-bg: #E7F2FA;
+  --katecms-color-warning: #C4851A;
+  --katecms-color-warning-bg: #FBF3E3;
+  --katecms-color-danger: #D64545;
+  --katecms-color-danger-bg: #FDECEC;
+  --katecms-shadow-sm: 0 1px 2px rgba(20, 26, 42, 0.05);
+  --katecms-shadow-md: 0 8px 24px rgba(20, 26, 42, 0.08);
+  color-scheme: light;
+}
+body#katecms-body.katecms-theme-dark {
+  --katecms-color-accent: #2F6FED;
+  --katecms-color-accent-hover: #1E58D4;
+  --katecms-color-accent-wash: #243456;
+  --katecms-color-ink: #E8EBF3;
+  --katecms-color-muted: #98A2B6;
+  --katecms-color-bg: #10141C;
+  --katecms-color-surface: #1A2030;
+  --katecms-color-border: #313A4E;
+  --katecms-color-on-accent: #FFFFFF;
+  --katecms-color-overlay: rgba(0, 0, 0, 0.64);
+  --katecms-color-success: #4ECA8E;
+  --katecms-color-success-bg: #143226;
+  --katecms-color-info: #79B7E4;
+  --katecms-color-info-bg: #152A3E;
+  --katecms-color-warning: #E6B15A;
+  --katecms-color-warning-bg: #3A2C14;
+  --katecms-color-danger: #F08B8B;
+  --katecms-color-danger-bg: #3C1E1E;
+  --katecms-shadow-sm: 0 1px 2px rgba(0, 0, 0, 0.45);
+  --katecms-shadow-md: 0 8px 24px rgba(0, 0, 0, 0.5);
+  color-scheme: dark;
+}
+
+@media (prefers-color-scheme: dark) {
+  body#katecms-body:not(.katecms-theme-light):not(.katecms-theme-dark) {
+    --katecms-color-accent: #2F6FED;
+    --katecms-color-accent-hover: #1E58D4;
+    --katecms-color-accent-wash: #243456;
+    --katecms-color-ink: #E8EBF3;
+    --katecms-color-muted: #98A2B6;
+    --katecms-color-bg: #10141C;
+    --katecms-color-surface: #1A2030;
+    --katecms-color-border: #313A4E;
+    --katecms-color-on-accent: #FFFFFF;
+    --katecms-color-overlay: rgba(0, 0, 0, 0.64);
+    --katecms-color-success: #4ECA8E;
+    --katecms-color-success-bg: #143226;
+    --katecms-color-info: #79B7E4;
+    --katecms-color-info-bg: #152A3E;
+    --katecms-color-warning: #E6B15A;
+    --katecms-color-warning-bg: #3A2C14;
+    --katecms-color-danger: #F08B8B;
+    --katecms-color-danger-bg: #3C1E1E;
+    --katecms-shadow-sm: 0 1px 2px rgba(0, 0, 0, 0.45);
+    --katecms-shadow-md: 0 8px 24px rgba(0, 0, 0, 0.5);
+    color-scheme: dark;
+  }
+}
+html:has(> body#katecms-body) {
+  height: 100%;
+  margin: 0;
+  padding: 0;
+}
+</style>
+
+<style scoped>
+body#katecms-body .katecms {
+  display: grid;
+  grid-template-columns: var(--katecms-sidebar-w) minmax(0, 1fr);
+  grid-template-rows: auto 1fr;
+  gap: 0;
+  grid-template-areas: "sidebar header" "sidebar main";
+  width: 100%;
+  height: 100vh;
+}
+@media (prefers-reduced-motion: no-preference) {
+  body#katecms-body .katecms {
+    transition: grid-template-columns 0.3s ease;
+  }
+}
+body#katecms-body .katecms.is-sidebar-hidden {
+  grid-template-columns: 0 minmax(0, 1fr);
+}
+body#katecms-body .katecms.is-sidebar-hidden .katecms-sidebar {
+  border-right-width: 0;
+}
+body#katecms-body .katecms-header {
+  grid-area: header;
+  display: flex;
+  align-items: center;
+  justify-content: flex-end;
+  gap: 0.75rem;
+  padding: 0 0.75rem;
+  border-bottom: 1px solid var(--katecms-color-border);
+  box-shadow: var(--katecms-shadow-sm);
+  min-height: var(--katecms-topbar-h);
+}
+body#katecms-body .katecms-header :deep(.katecms-btn.katecms-sidebar-toggle) {
+  margin-right: auto;
+  color: var(--katecms-color-ink);
+}
+body#katecms-body .katecms-header :deep(.katecms-btn.katecms-theme-toggle) {
+  color: var(--katecms-color-ink);
+}
+body#katecms-body .katecms-sidebar {
+  grid-area: sidebar;
+  min-width: 0;
+  overflow: hidden;
+  border-right: 1px solid var(--katecms-color-border);
+  background-color: var(--katecms-color-bg);
+}
+body#katecms-body .katecms-sidebar-wrap {
+  width: var(--katecms-sidebar-w);
+  min-height: 100%;
+}
+body#katecms-body .katecms-main {
+  grid-area: main;
+  display: flex;
+  flex-direction: column;
+  min-width: 0;
+  min-height: 0;
+  overflow: hidden;
+}
+</style>

package/dist/runtime/pages/index.vue.d.ts

@@ -0,0 +1,3 @@
+declare const __VLS_export: import("vue").DefineComponent<{}, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {}, string, import("vue").PublicProps, Readonly<{}> & Readonly<{}>, {}, {}, {}, {}, string, import("vue").ComponentProvideOptions, true, {}, any>;
+declare const _default: typeof __VLS_export;
+export default _default;

package/dist/runtime/server/api/_katecms/auth/login.post.d.ts

@@ -0,0 +1,5 @@
+import type { SafeUser } from '@katecms/core';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    user: SafeUser;
+}>>;
+export default _default;

package/dist/runtime/server/api/_katecms/auth/login.post.js

@@ -0,0 +1,44 @@
+import { createError, defineEventHandler, readBody } from "h3";
+import {
+  MAX_PASSWORD_LENGTH,
+  findUserByEmail,
+  toSafeUser,
+  verifyPassword
+} from "@katecms/core";
+import { getDb } from "../../../utils/db.js";
+import { setUserSession } from "../../../utils/session.js";
+import {
+  assertAuthAttemptAllowed,
+  getAuthAttemptKeys,
+  invalidCredentialsError,
+  recordAuthAttemptFailure,
+  recordAuthAttemptSuccess
+} from "../../../utils/auth-rate-limit.js";
+export default defineEventHandler(async (event) => {
+  const body = await readBody(event);
+  const email = typeof body?.email === "string" ? body.email.trim() : "";
+  const password = typeof body?.password === "string" ? body.password : "";
+  if (!email || !password) {
+    throw createError({ statusCode: 422, statusMessage: "Unprocessable Entity", message: "Enter email and password." });
+  }
+  const attemptKeys = getAuthAttemptKeys(event, "login", email);
+  assertAuthAttemptAllowed(event, attemptKeys);
+  function fail() {
+    const { retryAfterMs } = recordAuthAttemptFailure(attemptKeys);
+    throw invalidCredentialsError(retryAfterMs);
+  }
+  if (password.length > MAX_PASSWORD_LENGTH) {
+    fail();
+  }
+  const user = await findUserByEmail(getDb(), email);
+  if (!user || user.status === "banned") {
+    fail();
+  }
+  const ok = await verifyPassword(password, user.password_hash);
+  if (!ok) {
+    fail();
+  }
+  recordAuthAttemptSuccess(attemptKeys);
+  await setUserSession(event, user.id, user.session_version);
+  return { user: toSafeUser(user) };
+});

package/dist/runtime/server/api/_katecms/auth/logout.post.d.ts

@@ -0,0 +1,4 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    ok: true;
+}>>;
+export default _default;

package/dist/runtime/server/api/_katecms/auth/logout.post.js

@@ -0,0 +1,6 @@
+import { defineEventHandler } from "h3";
+import { clearUserSession } from "../../../utils/session.js";
+export default defineEventHandler(async (event) => {
+  await clearUserSession(event);
+  return { ok: true };
+});

package/dist/runtime/server/api/_katecms/auth/register.post.d.ts

@@ -0,0 +1,19 @@
+import type { SafeUser } from '@katecms/core';
+/**
+ * Self-service registration.
+ *
+ * The first account ever created becomes `owner` (the protected superuser);
+ * every later registration is a `subscriber`. The "is this the first user?"
+ * check and the INSERT run inside a single transaction so two concurrent
+ * first-time registrations can't both claim ownership.
+ *
+ * `registration: false` rejects every account after the first. Admin user
+ * creation does not use this handler.
+ *
+ * A duplicate email is a generic 422. The message does not say the address
+ * is already registered, and no session is issued.
+ */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    user: SafeUser;
+}>>;
+export default _default;

package/dist/runtime/server/api/_katecms/auth/register.post.js

@@ -0,0 +1,83 @@
+import { createError, defineEventHandler, readBody } from "h3";
+import { useRuntimeConfig } from "#imports";
+import {
+  OWNER_ROLE,
+  SUBSCRIBER_ROLE,
+  createUser,
+  hasAnyUser,
+  hashPassword,
+  isUniqueConstraintError,
+  toSafeUser,
+  validateEmail,
+  validatePassword
+} from "@katecms/core";
+import { getDb } from "../../../utils/db.js";
+import { setUserSession } from "../../../utils/session.js";
+import {
+  assertAuthAttemptAllowed,
+  getAuthAttemptKeys,
+  recordAuthAttemptFailure,
+  recordAuthAttemptSuccess,
+  throwTooManyAttempts
+} from "../../../utils/auth-rate-limit.js";
+export default defineEventHandler(async (event) => {
+  const body = await readBody(event);
+  const email = typeof body?.email === "string" ? body.email.trim() : "";
+  const password = typeof body?.password === "string" ? body.password : "";
+  const passwordConfirm = typeof body?.passwordConfirm === "string" ? body.passwordConfirm : "";
+  const attemptKeys = getAuthAttemptKeys(event, "register", email);
+  assertAuthAttemptAllowed(event, attemptKeys);
+  const failValidation = (statusMessage) => {
+    const { retryAfterMs } = recordAuthAttemptFailure(attemptKeys);
+    if (retryAfterMs > 0) {
+      throwTooManyAttempts(event, retryAfterMs);
+    }
+    throw createError({ statusCode: 422, statusMessage: "Unprocessable Entity", message: statusMessage });
+  };
+  const emailCheck = validateEmail(email);
+  if (!emailCheck.ok) {
+    failValidation(emailCheck.error);
+  }
+  const passwordCheck = validatePassword(password);
+  if (!passwordCheck.ok) {
+    failValidation(passwordCheck.error);
+  }
+  if (password !== passwordConfirm) {
+    failValidation("Passwords do not match.");
+  }
+  const passwordHash = await hashPassword(password);
+  const registrationOpen = useRuntimeConfig().katecms?.registration === true;
+  try {
+    const user = await getDb().transaction().execute(async (trx) => {
+      const isFirstUser = !await hasAnyUser(trx);
+      if (!isFirstUser && !registrationOpen) {
+        throw createError({
+          statusCode: 403,
+          statusMessage: "Forbidden",
+          message: "Registration is disabled."
+        });
+      }
+      return createUser(trx, {
+        email,
+        password_hash: passwordHash,
+        role: isFirstUser ? OWNER_ROLE : SUBSCRIBER_ROLE
+      });
+    });
+    recordAuthAttemptSuccess(attemptKeys);
+    await setUserSession(event, user.id, user.session_version);
+    return { user: toSafeUser(user) };
+  } catch (error) {
+    if (isUniqueConstraintError(error)) {
+      const { retryAfterMs } = recordAuthAttemptFailure(attemptKeys);
+      if (retryAfterMs > 0) {
+        throwTooManyAttempts(event, retryAfterMs);
+      }
+      throw createError({
+        statusCode: 422,
+        statusMessage: "Unprocessable Entity",
+        message: "Could not create the account."
+      });
+    }
+    throw error;
+  }
+});

package/dist/runtime/server/api/_katecms/auth/state.get.d.ts

@@ -0,0 +1,9 @@
+import { type AuthState } from '@katecms/core';
+/**
+ * Combined auth snapshot for the route guard:
+ * - hasUsers drives the first-run flow (no users -> /admin/register, else /admin/login);
+ * - user drives the authenticated redirects (keep logged-in users out of the
+ *   auth pages).
+ */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<AuthState>>;
+export default _default;

package/dist/runtime/server/api/_katecms/auth/state.get.js

@@ -0,0 +1,12 @@
+import { defineEventHandler } from "h3";
+import { hasAnyUser } from "@katecms/core";
+import { getDb } from "../../../utils/db.js";
+import { getCurrentUser } from "../../../utils/session.js";
+export default defineEventHandler(async (event) => {
+  const hasUsers = await hasAnyUser(getDb());
+  const user = await getCurrentUser(event);
+  return {
+    user,
+    hasUsers
+  };
+});

package/dist/runtime/server/api/_katecms/collections/[collection]/[id].delete.d.ts

@@ -0,0 +1,15 @@
+import type { AdminCollectionMeta } from '../../../../../utils/collections.js';
+type DeleteEntryResult = {
+    collection: AdminCollectionMeta;
+    ok: true;
+};
+type EmptyTrashResult = {
+    collection: AdminCollectionMeta;
+    deleted: number;
+};
+/**
+ * Permanently delete one entry (`/:id`) or every trashed entry the actor may
+ * delete (`/trash`). Nitro would otherwise treat `trash` as `:id`.
+ */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<DeleteEntryResult | EmptyTrashResult>>;
+export default _default;

package/dist/runtime/server/api/_katecms/collections/[collection]/[id].delete.js

@@ -0,0 +1,59 @@
+import { defineEventHandler, getRouterParam } from "h3";
+import { useRuntimeConfig } from "#imports";
+import {
+  canOnEntry,
+  deleteCollection,
+  deleteTrashedCollections,
+  findCollectionById,
+  listCollections
+} from "@katecms/core";
+import { getDb } from "../../../../utils/db.js";
+import { requireUser } from "../../../../utils/session.js";
+import { requireEntryPermission, requirePermission } from "../../../../utils/permissions.js";
+import {
+  fail,
+  readCollectionSlug,
+  readEntryId,
+  requireCollection,
+  toCollectionMeta
+} from "../../../../utils/collections.js";
+export default defineEventHandler(async (event) => {
+  const actor = await requireUser(event);
+  const collectionSlug = readCollectionSlug(getRouterParam(event, "collection"));
+  const rawId = getRouterParam(event, "id");
+  const def = requireCollection(collectionSlug);
+  const roles = useRuntimeConfig().katecms?.roles ?? {};
+  requirePermission(actor, "collections", "delete", roles, collectionSlug);
+  const db = getDb();
+  if (rawId === "trash") {
+    const rows = await listCollections(db, collectionSlug, { status: "trash" });
+    const ids = rows.filter((row) => canOnEntry(actor, "collections", "delete", { authorId: row.author_id }, {
+      roles,
+      scope: collectionSlug,
+      userId: actor.id
+    })).map((row) => row.id);
+    const deleted = await deleteTrashedCollections(db, collectionSlug, ids);
+    return {
+      collection: toCollectionMeta(collectionSlug, def),
+      deleted
+    };
+  }
+  const id = readEntryId(rawId);
+  const existing = await findCollectionById(db, id);
+  if (!existing || existing.type !== collectionSlug) {
+    fail(404, "Entry not found.");
+  }
+  requireEntryPermission(
+    actor,
+    "collections",
+    "delete",
+    { authorId: existing.author_id },
+    roles,
+    collectionSlug
+  );
+  await deleteCollection(db, id);
+  return {
+    collection: toCollectionMeta(collectionSlug, def),
+    ok: true
+  };
+});

package/dist/runtime/server/api/_katecms/collections/[collection]/[id].get.d.ts

@@ -0,0 +1,4 @@
+import type { CollectionEntryResponse } from '../../../../../utils/collections.js';
+/** Fetch a single collection entry (including trash). */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<CollectionEntryResponse>>;
+export default _default;