kilo-cms 0.1.0

package/src/format.ts

@@ -0,0 +1,4 @@
+export function formatDateTime(value: string | Date | null | undefined) {
+  if (!value) return '—'
+  return new Date(value).toLocaleString('en-US', { dateStyle: 'medium', timeStyle: 'short' })
+}

package/src/listQuery.ts

@@ -0,0 +1,23 @@
+export type ListQuery = {
+  q: string
+  filtersRaw: string
+  sortBy: string
+  sortDir: 'asc' | 'desc'
+  page: number
+  pageSize: number | 'all'
+  trashed: boolean
+}
+
+export function parseListQuery(url: string, defaultSortBy: string): ListQuery {
+  const params = new URL(url).searchParams
+  const pageSizeRaw = params.get('pageSize')
+  return {
+    q: params.get('q')?.trim().slice(0, 100) || '',
+    filtersRaw: params.get('filters') || '[]',
+    sortBy: params.get('sortBy') || defaultSortBy,
+    sortDir: params.get('sortDir') === 'desc' ? 'desc' : 'asc',
+    page: Math.max(1, Math.trunc(Number(params.get('page')) || 1)),
+    pageSize: pageSizeRaw === 'all' ? 'all' : Math.min(100, Math.max(1, Math.trunc(Number(pageSizeRaw)) || 20)),
+    trashed: params.get('trashed') === '1',
+  }
+}

package/src/locale-settings.ts

@@ -0,0 +1,23 @@
+import 'server-only'
+import { cache } from 'react'
+import { asc } from 'drizzle-orm'
+import { db } from './db'
+import { cmsLocales } from './schema'
+import { fallbackLocaleConfig, type LocaleConfig } from './collections/locale'
+
+/** The live, admin-editable locale list — request-deduplicated the same way `getSiteSettings`
+ *  is (`src/lib/seo.ts`), and with the same graceful-fallback-on-error posture: an empty table
+ *  or a DB error both fall back to `fallbackLocaleConfig`, never a hard failure. */
+export const getLocaleConfig = cache(async function getLocaleConfig(): Promise<LocaleConfig> {
+  try {
+    const rows = await db.select().from(cmsLocales).orderBy(asc(cmsLocales.sortOrder))
+    if (!rows.length) return fallbackLocaleConfig
+    return {
+      codes: rows.map((row: any) => row.code),
+      default: rows.find((row: any) => row.isDefault)?.code ?? rows[0].code,
+      labels: Object.fromEntries(rows.map((row: any) => [row.code, row.label])),
+    }
+  } catch {
+    return fallbackLocaleConfig
+  }
+})

package/src/media-storage.ts

@@ -0,0 +1,19 @@
+import 'server-only'
+import { randomUUID } from 'node:crypto'
+import { storage } from './storage'
+
+// Files live in one flat directory/key-space, independent of which folder they're organized
+// under in the media library. `folder` is pure metadata — moving a file between folders must
+// never change its URL, or every place that already saved that URL (a content field, rich
+// text, a raw <img> tag) would break the moment the file gets reorganized.
+
+export async function uploadFile(data: Buffer, contentType: string, extension: string): Promise<{ url: string }> {
+  const key = `${randomUUID()}.${extension}`
+  return storage.put(key, data, contentType)
+}
+
+/** Best-effort delete of an uploaded file's stored copy. Swallows a missing file — the DB row
+ *  being gone is what matters; the file may already be absent (e.g. a manual cleanup). */
+export async function removeUploadedFile(url: string) {
+  await storage.remove(url)
+}

package/src/permissions.ts

@@ -0,0 +1,37 @@
+import { headers } from 'next/headers'
+import { eq } from 'drizzle-orm'
+import { auth, db } from './db'
+import { roles } from './schema'
+import { emptyRolePermissions, fullRolePermissions, type ActionKey, type ContentTypeKey, type StoredRolePermissions, type SystemPermission } from './content-types'
+
+export { contentTypeDefs, systemPermissions, systemPermissionLabels, actionLabels, type ActionKey, type ContentTypeKey, type SystemPermission } from './content-types'
+
+export async function getSessionWithPermissions() {
+  const session = await auth.api.getSession({ headers: await headers() })
+  if (!session) return null
+  const [role] = await db.select().from(roles).where(eq(roles.id, session.user.role)).limit(1)
+  const isSystem = role?.isSystem ?? false
+  const permissions: StoredRolePermissions = isSystem ? fullRolePermissions() : (role?.permissions as StoredRolePermissions | undefined) ?? emptyRolePermissions
+
+  return {
+    session,
+    isSystem,
+    can(type: ContentTypeKey, action: ActionKey) { return permissions.contentTypes[type]?.actions.includes(action) ?? false },
+    allowedFields(type: ContentTypeKey) { return permissions.contentTypes[type]?.fields ?? [] },
+    hasSystem(permission: SystemPermission) { return permissions.system.includes(permission) },
+  }
+}
+
+export type SessionWithPermissions = NonNullable<Awaited<ReturnType<typeof getSessionWithPermissions>>>
+
+export async function requireAction(type: ContentTypeKey, action: ActionKey) {
+  const result = await getSessionWithPermissions()
+  if (!result || !result.can(type, action)) return null
+  return result
+}
+
+export async function requireSystem(permission: SystemPermission) {
+  const result = await getSessionWithPermissions()
+  if (!result || !result.hasSystem(permission)) return null
+  return result.session
+}

package/src/publishing-workflow-db.ts

@@ -0,0 +1,11 @@
+import 'server-only'
+
+import { eq } from 'drizzle-orm'
+import { db } from './db'
+import { siteSettings } from './schema'
+import { normalizePublishingWorkflow, type ApprovalContentType } from './publishing-workflow'
+
+export async function contentRequiresApproval(type: ApprovalContentType) {
+  const [settings] = await db.select({ publishingWorkflow: siteSettings.publishingWorkflow }).from(siteSettings).where(eq(siteSettings.id, 'default')).limit(1)
+  return normalizePublishingWorkflow(settings?.publishingWorkflow).approvalRequired.includes(type)
+}

package/src/publishing-workflow.ts

@@ -0,0 +1,20 @@
+import { reviewableSlugs } from './collections/registry'
+import type { EntrySlug } from './collections/types'
+
+/** Every review-enabled entry can be put behind an approval gate. */
+export type ApprovalContentType = EntrySlug
+export const allApprovalContentTypes: ApprovalContentType[] = [...reviewableSlugs]
+export type PublishingWorkflow = { approvalRequired: ApprovalContentType[] }
+
+// Literal, not derived: this is the historical default and matches cms_site_settings'
+// column default. Changing it would silently re-gate existing installs.
+export const defaultPublishingWorkflow: PublishingWorkflow = { approvalRequired: ['services', 'projects', 'blog'] }
+
+export function normalizePublishingWorkflow(value: unknown): PublishingWorkflow {
+  if (!value || typeof value !== 'object') return defaultPublishingWorkflow
+  const candidate = value as { approvalRequired?: unknown }
+  const approvalRequired = Array.isArray(candidate.approvalRequired)
+    ? candidate.approvalRequired.filter((item): item is ApprovalContentType => typeof item === 'string' && (allApprovalContentTypes as string[]).includes(item))
+    : defaultPublishingWorkflow.approvalRequired
+  return { approvalRequired }
+}

package/src/richtext.ts

@@ -0,0 +1,5 @@
+export type RichTextMark = { type: 'bold' | 'italic' | 'strike' | 'code' | 'link'; attrs?: { href?: string } }
+export type RichTextNode = { type: string; text?: string; attrs?: Record<string, unknown>; marks?: RichTextMark[]; content?: RichTextNode[] }
+export type RichTextDocument = { type: 'doc'; content?: RichTextNode[] }
+
+export const emptyRichText: RichTextDocument = { type: 'doc', content: [{ type: 'paragraph' }] }

package/src/routes/admin/ai/settings/route.ts

@@ -0,0 +1,20 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { getAiProviderAvailability, saveAiKeys } from '../../../../ai-config'
+import { aiProviders } from '../../../../ai-types'
+import { getSessionWithPermissions, requireSystem } from '../../../../permissions'
+
+export async function GET() {
+  const result = await getSessionWithPermissions()
+  if (!result) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  return NextResponse.json({ providers: await getAiProviderAvailability(), canManage: result.hasSystem('ai.manage') })
+}
+
+const schema = z.object({ keys: z.object({ manus: z.string().max(500).optional(), deepseek: z.string().max(500).optional(), openai: z.string().max(500).optional(), anthropic: z.string().max(500).optional() }).default({}), clear: z.array(z.enum(aiProviders)).max(aiProviders.length).default([]) })
+
+export async function PUT(request: Request) {
+  if (!await requireSystem('ai.manage')) return NextResponse.json({ error: 'Only administrators can change AI keys.' }, { status: 403 })
+  const parsed = schema.safeParse(await request.json())
+  if (!parsed.success) return NextResponse.json({ error: 'Invalid AI key settings.' }, { status: 400 })
+  try { return NextResponse.json({ providers: await saveAiKeys(parsed.data.keys, parsed.data.clear), canManage: true }) } catch (error) { return NextResponse.json({ error: error instanceof Error ? error.message : 'Could not save AI key settings.' }, { status: 400 }) }
+}

package/src/routes/admin/ai/write/route.ts

@@ -0,0 +1,21 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { pollManusWrite, startAiWrite } from '../../../../ai-writer'
+import { aiProviders } from '../../../../ai-types'
+import { getSessionWithPermissions } from '../../../../permissions'
+
+const input = z.object({ provider: z.enum(aiProviders), action: z.enum(['prompt', 'continue', 'improve', 'summarize']), prompt: z.string().trim().max(4_000).optional(), selection: z.string().max(12_000).optional(), documentText: z.string().max(16_000).optional() }).superRefine((value, context) => { if (value.action === 'prompt' && !value.prompt) context.addIssue({ code: 'custom', path: ['prompt'], message: 'Write an instruction for AI.' }); if (['improve', 'summarize'].includes(value.action) && !value.selection?.trim()) context.addIssue({ code: 'custom', path: ['selection'], message: 'Select text in the editor first.' }) })
+
+export async function POST(request: Request) {
+  if (!await getSessionWithPermissions()) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const parsed = input.safeParse(await request.json())
+  if (!parsed.success) return NextResponse.json({ error: parsed.error.issues[0]?.message || 'Invalid AI request.' }, { status: 400 })
+  try { return NextResponse.json(await startAiWrite(parsed.data.provider, parsed.data)) } catch (error) { return NextResponse.json({ error: error instanceof Error ? error.message : 'AI provider request failed.' }, { status: 502 }) }
+}
+
+export async function GET(request: Request) {
+  if (!await getSessionWithPermissions()) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const taskId = new URL(request.url).searchParams.get('taskId') || ''
+  if (!/^[A-Za-z0-9]{22}$/.test(taskId)) return NextResponse.json({ error: 'Invalid Manus task.' }, { status: 400 })
+  try { return NextResponse.json(await pollManusWrite(taskId)) } catch (error) { return NextResponse.json({ error: error instanceof Error ? error.message : 'Could not check Manus task.' }, { status: 502 }) }
+}

package/src/routes/admin/api-tokens/[id]/route.ts

@@ -0,0 +1,12 @@
+import { eq } from 'drizzle-orm'
+import { NextResponse } from 'next/server'
+import { db } from '../../../../db'
+import { apiTokens } from '../../../../schema'
+import { requireSystem } from '../../../../permissions'
+
+export async function DELETE(request: Request, { params }: { params: Promise<{ id: string }> }) {
+  if (!await requireSystem('developers.manage')) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const { id } = await params
+  await db.delete(apiTokens).where(eq(apiTokens.id, id))
+  return NextResponse.json({ ok: true })
+}

package/src/routes/admin/api-tokens/route.ts

@@ -0,0 +1,26 @@
+import { desc } from 'drizzle-orm'
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { db } from '../../../db'
+import { apiTokens } from '../../../schema'
+import { requireSystem } from '../../../permissions'
+import { generateToken } from '../../../api-tokens'
+
+export async function GET() {
+  const session = await requireSystem('developers.manage')
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const rows = await db.select({ id: apiTokens.id, name: apiTokens.name, tokenPrefix: apiTokens.tokenPrefix, lastUsedAt: apiTokens.lastUsedAt, createdAt: apiTokens.createdAt }).from(apiTokens).orderBy(desc(apiTokens.createdAt))
+  return NextResponse.json(rows)
+}
+
+const schema = z.object({ name: z.string().trim().min(1).max(80) })
+
+export async function POST(request: Request) {
+  const session = await requireSystem('developers.manage')
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const parsed = schema.safeParse(await request.json())
+  if (!parsed.success) return NextResponse.json({ error: 'Give the token a name.' }, { status: 400 })
+  const { raw, hash, prefix } = generateToken()
+  const [token] = await db.insert(apiTokens).values({ id: crypto.randomUUID(), name: parsed.data.name, tokenHash: hash, tokenPrefix: prefix, createdBy: session.user.id }).returning()
+  return NextResponse.json({ id: token.id, name: token.name, tokenPrefix: token.tokenPrefix, createdAt: token.createdAt, token: raw }, { status: 201 })
+}

package/src/routes/admin/collections/[collection]/[id]/approve/route.ts

@@ -0,0 +1,22 @@
+import { NextResponse } from 'next/server'
+import { requireAction } from '../../../../../../permissions'
+import { getCollection } from '../../../../../../collections/registry'
+import { findRow, updateRow } from '../../../../../../collections/query'
+import { fireWebhook, transitions } from '../../../../../../collections/workflow'
+
+const unauthorized = () => NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+const notFound = () => NextResponse.json({ error: 'Not found' }, { status: 404 })
+
+export async function PATCH(_request: Request, { params }: { params: Promise<{ collection: string; id: string }> }) {
+  const { collection, id } = await params
+  const config = getCollection(collection)
+  if (!config?.workflow?.review) return notFound()
+  const result = await requireAction(config.slug, 'approve')
+  if (!result) return unauthorized()
+  const existing = await findRow(config.slug, id)
+  if (!existing) return notFound()
+  if (existing.reviewStatus !== 'reviewed') return NextResponse.json({ error: 'This entry must pass review before it can be approved.' }, { status: 409 })
+  const row = await updateRow(config.slug, id, transitions.approve(result.session.user.id))
+  if (row) fireWebhook(config, 'updated', row)
+  return row ? NextResponse.json(row) : notFound()
+}

package/src/routes/admin/collections/[collection]/[id]/duplicate/route.ts

@@ -0,0 +1,36 @@
+import { NextResponse } from 'next/server'
+import { requireAction } from '../../../../../../permissions'
+import { getCollection } from '../../../../../../collections/registry'
+import { duplicateResetValues, fireWebhook } from '../../../../../../collections/workflow'
+import { findRow, insertRow, isUniqueViolation, nextSortOrder, type Row } from '../../../../../../collections/query'
+
+const unauthorized = () => NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+const notFound = () => NextResponse.json({ error: 'Not found' }, { status: 404 })
+
+export async function POST(_request: Request, { params }: { params: Promise<{ collection: string; id: string }> }) {
+  const { collection, id } = await params
+  const config = getCollection(collection)
+  if (!config?.workflow?.duplicate) return notFound()
+  const result = await requireAction(config.slug, 'create')
+  if (!result) return unauthorized()
+  const source = await findRow(config.slug, id)
+  if (!source) return notFound()
+
+  const newId = crypto.randomUUID()
+  const copy: Row = { ...source, id: newId, createdAt: new Date(), updatedAt: new Date() }
+  const titleField = config.fields.find((field) => field.key === config.titleField)
+  if (titleField && (titleField.type === 'text' || titleField.type === 'textarea')) copy[config.titleField] = `${String(source[config.titleField] ?? '')} (Copy)`
+  for (const field of config.fields) {
+    if (field.type === 'text' && field.format === 'slug') copy[field.key] = `${String(source[field.key] ?? 'copy')}-copy-${newId.slice(0, 6)}`
+  }
+  Object.assign(copy, duplicateResetValues(config, result.session.user.id, config.workflow.sortOrder ? await nextSortOrder(config.slug) : 0))
+
+  try {
+    const row = await insertRow(config.slug, copy)
+    fireWebhook(config, 'created', row)
+    return NextResponse.json(row, { status: 201 })
+  } catch (error) {
+    if (isUniqueViolation(error)) return NextResponse.json({ error: 'A record with one of those unique values already exists.' }, { status: 409 })
+    throw error
+  }
+}

package/src/routes/admin/collections/[collection]/[id]/restore/route.ts

@@ -0,0 +1,19 @@
+import { NextResponse } from 'next/server'
+import { requireAction } from '../../../../../../permissions'
+import { getCollection } from '../../../../../../collections/registry'
+import { updateRow } from '../../../../../../collections/query'
+import { fireWebhook, transitions } from '../../../../../../collections/workflow'
+
+const unauthorized = () => NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+const notFound = () => NextResponse.json({ error: 'Not found' }, { status: 404 })
+
+export async function POST(_request: Request, { params }: { params: Promise<{ collection: string; id: string }> }) {
+  const { collection, id } = await params
+  const config = getCollection(collection)
+  if (!config?.workflow?.trash) return notFound()
+  const result = await requireAction(config.slug, 'delete')
+  if (!result) return unauthorized()
+  const row = await updateRow(config.slug, id, transitions.restore())
+  if (row) fireWebhook(config, 'updated', row)
+  return row ? NextResponse.json(row) : notFound()
+}

package/src/routes/admin/collections/[collection]/[id]/review/route.ts

@@ -0,0 +1,28 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { getSessionWithPermissions } from '../../../../../../permissions'
+import { getCollection } from '../../../../../../collections/registry'
+import { findRow, updateRow } from '../../../../../../collections/query'
+import { fireWebhook, transitions } from '../../../../../../collections/workflow'
+
+const schema = z.object({ decision: z.enum(['approve', 'request_changes']) })
+const unauthorized = () => NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+const notFound = () => NextResponse.json({ error: 'Not found' }, { status: 404 })
+
+export async function PATCH(request: Request, { params }: { params: Promise<{ collection: string; id: string }> }) {
+  const { collection, id } = await params
+  const config = getCollection(collection)
+  if (!config?.workflow?.review) return notFound()
+  const result = await getSessionWithPermissions()
+  if (!result || !result.can(config.slug, 'review')) return unauthorized()
+  const parsed = schema.safeParse(await request.json())
+  if (!parsed.success) return NextResponse.json({ error: 'Invalid request.' }, { status: 400 })
+  const existing = await findRow(config.slug, id)
+  if (!existing) return notFound()
+  if (existing.reviewStatus !== 'in_review') return NextResponse.json({ error: 'This entry is not awaiting review.' }, { status: 409 })
+  if (!result.isSystem && existing.reviewerId !== result.session.user.id) return NextResponse.json({ error: 'Only the assigned reviewer can review this.' }, { status: 403 })
+  const set = parsed.data.decision === 'approve' ? transitions.passReview(result.session.user.id) : transitions.requestChanges(result.session.user.id)
+  const row = await updateRow(config.slug, id, set)
+  if (row) fireWebhook(config, 'updated', row)
+  return row ? NextResponse.json(row) : notFound()
+}

package/src/routes/admin/collections/[collection]/[id]/route.ts

@@ -0,0 +1,110 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { requireAction } from '../../../../../permissions'
+import { applyFieldPermissions, redactFieldsForRead } from '../../../../../content-types'
+import { getCollection } from '../../../../../collections/registry'
+import { deleteRow, findInvalidRelation, findRow, isForeignKeyViolation, isUniqueViolation, updateRow } from '../../../../../collections/query'
+import { resolveJoinFields } from '../../../../../collections/join'
+import { parseCollectionBody, type ParseMode } from '../../../../../collections/validation'
+import { entryRequiresApproval, fireWebhook, transitions, updateWorkflowValues } from '../../../../../collections/workflow'
+import { applySlugFallbacks } from '../../../../../collections/values'
+import { getLocaleConfig } from '../../../../../locale-settings'
+
+const unauthorized = () => NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+const notFound = () => NextResponse.json({ error: 'Not found' }, { status: 404 })
+const patchSchema = z.object({ published: z.boolean() })
+
+export async function GET(_request: Request, { params }: { params: Promise<{ collection: string; id: string }> }) {
+  const { collection, id } = await params
+  const config = getCollection(collection)
+  if (!config) return notFound()
+  const result = await requireAction(config.slug, 'read')
+  if (!result) return unauthorized()
+  const row = await findRow(config.slug, id)
+  if (!row) return notFound()
+  return NextResponse.json(redactFieldsForRead(config.slug, await resolveJoinFields(config, row), result.allowedFields(config.slug)))
+}
+
+export async function PUT(request: Request, { params }: { params: Promise<{ collection: string; id: string }> }) {
+  const { collection, id } = await params
+  const config = getCollection(collection)
+  if (!config) return notFound()
+  const result = await requireAction(config.slug, 'update')
+  if (!result) return unauthorized()
+
+  const existing = await findRow(config.slug, id)
+  if (!existing) return notFound()
+
+  const body = await request.json()
+  const workflow = config.workflow
+  const wantsPublished = workflow?.publish ? Boolean(body.published) : null
+  const mode: ParseMode = workflow?.publish ? (wantsPublished ? 'live' : 'draft') : 'live'
+  const parsed = parseCollectionBody(config, body, mode, result.allowedFields(config.slug), await getLocaleConfig())
+  if (!parsed.ok) return NextResponse.json({ error: parsed.error }, { status: 400 })
+  const data = applySlugFallbacks(config, applyFieldPermissions(config.slug, parsed.data, result.allowedFields(config.slug), existing), id)
+
+  const relationError = await findInvalidRelation(config, data)
+  if (relationError) return NextResponse.json({ error: relationError }, { status: 400 })
+
+  if (wantsPublished && !result.can(config.slug, 'publish')) return unauthorized()
+  if (wantsPublished && await entryRequiresApproval(config) && existing.reviewStatus !== 'approved') return NextResponse.json({ error: 'This item has not been approved yet — publishing requires approval.' }, { status: 403 })
+
+  try {
+    const row = await updateRow(config.slug, id, {
+      ...data,
+      ...(config.touchUpdatedAt ? { updatedAt: new Date() } : {}),
+      ...updateWorkflowValues(config, result.session.user.id, wantsPublished),
+      ...(workflow?.audit && typeof body.ownerId === 'string' ? { ownerId: body.ownerId || null } : {}),
+    })
+    if (row) fireWebhook(config, 'updated', row)
+    return row ? NextResponse.json(row) : notFound()
+  } catch (error) {
+    if (isUniqueViolation(error)) return NextResponse.json({ error: 'A record with one of those unique values already exists.' }, { status: 409 })
+    throw error
+  }
+}
+
+export async function PATCH(request: Request, { params }: { params: Promise<{ collection: string; id: string }> }) {
+  const { collection, id } = await params
+  const config = getCollection(collection)
+  if (!config?.workflow?.publish) return notFound()
+  const result = await requireAction(config.slug, 'publish')
+  if (!result) return unauthorized()
+  const parsed = patchSchema.safeParse(await request.json())
+  if (!parsed.success) return NextResponse.json({ error: 'Invalid request.' }, { status: 400 })
+  const existing = await findRow(config.slug, id)
+  if (!existing) return notFound()
+  if (parsed.data.published && await entryRequiresApproval(config) && existing.reviewStatus !== 'approved') return NextResponse.json({ error: 'This item has not been approved yet — publishing requires approval.' }, { status: 403 })
+  const row = await updateRow(config.slug, id, {
+    ...updateWorkflowValues(config, result.session.user.id, parsed.data.published),
+    ...(config.touchUpdatedAt ? { updatedAt: new Date() } : {}),
+  })
+  if (row) fireWebhook(config, parsed.data.published ? 'published' : 'unpublished', row)
+  return row ? NextResponse.json(row) : notFound()
+}
+
+export async function DELETE(request: Request, { params }: { params: Promise<{ collection: string; id: string }> }) {
+  const { collection, id } = await params
+  const config = getCollection(collection)
+  if (!config) return notFound()
+  const result = await requireAction(config.slug, 'delete')
+  if (!result) return unauthorized()
+
+  const permanent = new URL(request.url).searchParams.get('permanent') === '1'
+  if (config.workflow?.trash && !permanent) {
+    const row = await updateRow(config.slug, id, {
+      ...transitions.trash(result.session.user.id),
+      ...(config.touchUpdatedAt ? { updatedAt: new Date() } : {}),
+    })
+    if (row) fireWebhook(config, 'deleted', row)
+    return row ? NextResponse.json(row) : notFound()
+  }
+
+  try {
+    const deleted = await deleteRow(config.slug, id)
+    return deleted ? NextResponse.json({ ok: true }) : notFound()
+  } catch (error) {
+    if (isForeignKeyViolation(error)) return NextResponse.json({ error: 'This record is still referenced by other records and cannot be deleted.' }, { status: 409 })
+    throw error
+  }
+}

package/src/routes/admin/collections/[collection]/[id]/schedule/route.ts

@@ -0,0 +1,42 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { requireAction } from '../../../../../../permissions'
+import { getCollection } from '../../../../../../collections/registry'
+import { findRow, updateRow } from '../../../../../../collections/query'
+import { parseCollectionBody } from '../../../../../../collections/validation'
+import { entryRequiresApproval, fireWebhook, scheduleValues } from '../../../../../../collections/workflow'
+import { getLocaleConfig } from '../../../../../../locale-settings'
+
+const schema = z.object({ scheduledAt: z.string().datetime() })
+const unauthorized = () => NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+const notFound = () => NextResponse.json({ error: 'Not found' }, { status: 404 })
+
+export async function PATCH(request: Request, { params }: { params: Promise<{ collection: string; id: string }> }) {
+  const { collection, id } = await params
+  const config = getCollection(collection)
+  if (!config?.workflow?.scheduling) return notFound()
+  const result = await requireAction(config.slug, 'publish')
+  if (!result) return unauthorized()
+
+  const parsed = schema.safeParse(await request.json())
+  if (!parsed.success) return NextResponse.json({ error: 'Invalid request.' }, { status: 400 })
+
+  const existing = await findRow(config.slug, id)
+  if (!existing) return notFound()
+
+  // Reproduces the hand-written `mustBeComplete = published || Boolean(scheduledAt)` rule:
+  // a scheduled row must already satisfy full 'live' validation. The editor PUTs its edits
+  // immediately before calling this, so validating the stored row == validating the payload.
+  const complete = parseCollectionBody(config, existing, 'live', result.allowedFields(config.slug), await getLocaleConfig())
+  if (!complete.ok) return NextResponse.json({ error: `Complete the required fields before scheduling — ${complete.error}` }, { status: 400 })
+
+  if (await entryRequiresApproval(config) && existing.reviewStatus !== 'approved')
+    return NextResponse.json({ error: 'This item has not been approved yet — publishing and scheduling require approval.' }, { status: 403 })
+
+  const row = await updateRow(config.slug, id, {
+    ...scheduleValues(config, new Date(parsed.data.scheduledAt), result.session.user.id),
+    ...(config.touchUpdatedAt ? { updatedAt: new Date() } : {}),
+  })
+  if (row) fireWebhook(config, 'updated', row)
+  return row ? NextResponse.json(row) : notFound()
+}

package/src/routes/admin/collections/[collection]/[id]/submit-review/route.ts

@@ -0,0 +1,23 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { requireAction } from '../../../../../../permissions'
+import { getCollection } from '../../../../../../collections/registry'
+import { updateRow } from '../../../../../../collections/query'
+import { fireWebhook, transitions } from '../../../../../../collections/workflow'
+
+const schema = z.object({ reviewerId: z.string().min(1) })
+const unauthorized = () => NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+const notFound = () => NextResponse.json({ error: 'Not found' }, { status: 404 })
+
+export async function PATCH(request: Request, { params }: { params: Promise<{ collection: string; id: string }> }) {
+  const { collection, id } = await params
+  const config = getCollection(collection)
+  if (!config?.workflow?.review) return notFound()
+  const result = await requireAction(config.slug, 'submit_review')
+  if (!result) return unauthorized()
+  const parsed = schema.safeParse(await request.json())
+  if (!parsed.success) return NextResponse.json({ error: 'Invalid request.' }, { status: 400 })
+  const row = await updateRow(config.slug, id, transitions.submitReview(parsed.data.reviewerId, result.session.user.id))
+  if (row) fireWebhook(config, 'updated', row)
+  return row ? NextResponse.json(row) : notFound()
+}

package/src/routes/admin/collections/[collection]/[id]/unschedule/route.ts

@@ -0,0 +1,22 @@
+import { NextResponse } from 'next/server'
+import { requireAction } from '../../../../../../permissions'
+import { getCollection } from '../../../../../../collections/registry'
+import { updateRow } from '../../../../../../collections/query'
+import { fireWebhook, unscheduleValues } from '../../../../../../collections/workflow'
+
+const unauthorized = () => NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+const notFound = () => NextResponse.json({ error: 'Not found' }, { status: 404 })
+
+export async function PATCH(_request: Request, { params }: { params: Promise<{ collection: string; id: string }> }) {
+  const { collection, id } = await params
+  const config = getCollection(collection)
+  if (!config?.workflow?.scheduling) return notFound()
+  const result = await requireAction(config.slug, 'publish')
+  if (!result) return unauthorized()
+  const row = await updateRow(config.slug, id, {
+    ...unscheduleValues(config, result.session.user.id),
+    ...(config.touchUpdatedAt ? { updatedAt: new Date() } : {}),
+  })
+  if (row) fireWebhook(config, 'updated', row)
+  return row ? NextResponse.json(row) : notFound()
+}

package/src/routes/admin/collections/[collection]/bulk/route.ts

@@ -0,0 +1,61 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { requireAction } from '../../../../../permissions'
+import { getCollection } from '../../../../../collections/registry'
+import { collectionColumn, deleteRows, idColumn, isForeignKeyViolation, updateRows, updateWhere } from '../../../../../collections/query'
+import { entryRequiresApproval, transitions } from '../../../../../collections/workflow'
+import { and, eq, inArray } from 'drizzle-orm'
+
+const bulkSchema = z.object({
+  ids: z.array(z.string().min(1).max(200)).min(1).max(200),
+  action: z.enum(['delete', 'publish', 'unpublish', 'trash', 'restore']),
+})
+
+export async function PATCH(request: Request, { params }: { params: Promise<{ collection: string }> }) {
+  const { collection } = await params
+  const config = getCollection(collection)
+  if (!config) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+
+  const parsed = bulkSchema.safeParse(await request.json())
+  if (!parsed.success) return NextResponse.json({ error: 'Invalid request.' }, { status: 400 })
+
+  const { ids, action } = parsed.data
+  const workflow = config.workflow
+  const supported = action === 'delete'
+    ? true
+    : action === 'publish' || action === 'unpublish'
+      ? Boolean(workflow?.publish)
+      : Boolean(workflow?.trash)
+  if (!supported) return NextResponse.json({ error: 'That action is not available for this collection.' }, { status: 400 })
+
+  const result = await requireAction(config.slug, action === 'publish' || action === 'unpublish' ? 'publish' : 'delete')
+  if (!result) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+  if (action === 'delete') {
+    try {
+      const count = await deleteRows(config.slug, ids)
+      return NextResponse.json({ ok: true, count })
+    } catch (error) {
+      if (isForeignKeyViolation(error)) return NextResponse.json({ error: 'Some of these records are still referenced by other records and cannot be deleted.' }, { status: 409 })
+      throw error
+    }
+  }
+
+  if (action === 'publish') {
+    const reviewStatus = collectionColumn(config.slug, 'reviewStatus')
+    const onlyApproved = await entryRequiresApproval(config)
+    const rows = await updateWhere(
+      config.slug,
+      onlyApproved && reviewStatus ? and(inArray(idColumn(config.slug), ids), eq(reviewStatus, 'approved'))! : inArray(idColumn(config.slug), ids),
+      { published: true, publishedAt: new Date(), ...(workflow?.scheduling ? { scheduledAt: null } : {}), ...(workflow?.audit ? { updatedBy: result.session.user.id } : {}) },
+    )
+    return NextResponse.json({ ok: true, count: rows.length, skipped: ids.length - rows.length })
+  }
+
+  const set = action === 'unpublish'
+    ? { published: false, ...(workflow?.audit ? { updatedBy: result.session.user.id } : {}) }
+    : action === 'trash'
+      ? transitions.trash(result.session.user.id)
+      : transitions.restore()
+  return NextResponse.json({ ok: true, count: await updateRows(config.slug, ids, set) })
+}