kilo-cms 0.1.0

package/src/routes/admin/media/stats/route.ts

@@ -0,0 +1,14 @@
+import { isNotNull, isNull, sql } from 'drizzle-orm'
+import { NextResponse } from 'next/server'
+import { db } from '../../../../db'
+import { media } from '../../../../schema'
+import { getSessionWithPermissions } from '../../../../permissions'
+
+export async function GET() {
+  if (!await getSessionWithPermissions()) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const [[active], [trash]] = await Promise.all([
+    db.select({ count: sql<number>`count(*)`, bytes: sql<number>`coalesce(sum(${media.size}), 0)` }).from(media).where(isNull(media.deletedAt)),
+    db.select({ count: sql<number>`count(*)` }).from(media).where(isNotNull(media.deletedAt)),
+  ])
+  return NextResponse.json({ count: Number(active?.count ?? 0), bytes: Number(active?.bytes ?? 0), trashCount: Number(trash?.count ?? 0) })
+}

package/src/routes/admin/roles/[id]/route.ts

@@ -0,0 +1,43 @@
+import { eq } from 'drizzle-orm'
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { db } from '../../../../db'
+import { roles } from '../../../../schema'
+import { requireSystem } from '../../../../permissions'
+import { contentTypeKeys, systemPermissions } from '../../../../content-types'
+
+const contentTypePermissionSchema = z.object({ actions: z.array(z.enum(['create', 'read', 'update', 'delete', 'publish', 'submit_review', 'review', 'approve'])), fields: z.array(z.string().max(60)) })
+const permissionsSchema = z.object({
+  contentTypes: z.record(z.string(), contentTypePermissionSchema).default({}).refine((value) => Object.keys(value).every((key) => (contentTypeKeys as string[]).includes(key)), 'Unknown content type.'),
+  system: z.array(z.enum(systemPermissions)).default([]),
+})
+const updateSchema = z.object({ name: z.string().trim().min(1).max(80), permissions: permissionsSchema })
+
+export async function GET(_: Request, { params }: { params: Promise<{ id: string }> }) {
+  if (!await requireSystem('roles.manage')) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const { id } = await params
+  const [role] = await db.select().from(roles).where(eq(roles.id, id)).limit(1)
+  return role ? NextResponse.json(role) : NextResponse.json({ error: 'Not found' }, { status: 404 })
+}
+
+export async function PUT(request: Request, { params }: { params: Promise<{ id: string }> }) {
+  if (!await requireSystem('roles.manage')) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const { id } = await params
+  const [existing] = await db.select({ isSystem: roles.isSystem }).from(roles).where(eq(roles.id, id)).limit(1)
+  if (!existing) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+  if (existing.isSystem) return NextResponse.json({ error: 'The Administrator role cannot be changed.' }, { status: 403 })
+  const parsed = updateSchema.safeParse(await request.json())
+  if (!parsed.success) return NextResponse.json({ error: parsed.error.issues.map((issue) => `${issue.path.join(' ')}: ${issue.message}`).join(' · ') }, { status: 400 })
+  const [role] = await db.update(roles).set({ name: parsed.data.name, permissions: parsed.data.permissions, updatedAt: new Date() }).where(eq(roles.id, id)).returning()
+  return NextResponse.json(role)
+}
+
+export async function DELETE(_: Request, { params }: { params: Promise<{ id: string }> }) {
+  if (!await requireSystem('roles.manage')) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const { id } = await params
+  const [existing] = await db.select({ isSystem: roles.isSystem }).from(roles).where(eq(roles.id, id)).limit(1)
+  if (!existing) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+  if (existing.isSystem) return NextResponse.json({ error: 'The Administrator role cannot be deleted.' }, { status: 403 })
+  await db.delete(roles).where(eq(roles.id, id))
+  return NextResponse.json({ ok: true })
+}

package/src/routes/admin/roles/route.ts

@@ -0,0 +1,34 @@
+import { asc, sql } from 'drizzle-orm'
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { db } from '../../../db'
+import { roles, user } from '../../../schema'
+import { requireSystem } from '../../../permissions'
+import { contentTypeKeys, systemPermissions } from '../../../content-types'
+
+export async function GET() {
+  if (!await requireSystem('roles.manage')) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const [roleRows, userCounts] = await Promise.all([
+    db.select().from(roles).orderBy(asc(roles.name)),
+    db.select({ role: user.role, count: sql<number>`count(*)::int` }).from(user).groupBy(user.role),
+  ])
+  const counts = new Map(userCounts.map((row: any) => [row.role, row.count]))
+  return NextResponse.json(roleRows.map((role: any) => ({ ...role, userCount: counts.get(role.id) ?? 0 })))
+}
+
+const contentTypePermissionSchema = z.object({ actions: z.array(z.enum(['create', 'read', 'update', 'delete', 'publish', 'submit_review', 'review', 'approve'])), fields: z.array(z.string().max(60)) })
+const permissionsSchema = z.object({
+  contentTypes: z.record(z.string(), contentTypePermissionSchema).default({}).refine((value) => Object.keys(value).every((key) => (contentTypeKeys as string[]).includes(key)), 'Unknown content type.'),
+  system: z.array(z.enum(systemPermissions)).default([]),
+})
+const createSchema = z.object({ id: z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, 'Use lowercase letters, numbers, and hyphens only').max(60), name: z.string().trim().min(1).max(80), permissions: permissionsSchema.default({ contentTypes: {}, system: [] }) })
+
+export async function POST(request: Request) {
+  if (!await requireSystem('roles.manage')) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const parsed = createSchema.safeParse(await request.json())
+  if (!parsed.success) return NextResponse.json({ error: parsed.error.issues.map((issue) => `${issue.path.join(' ')}: ${issue.message}`).join(' · ') }, { status: 400 })
+  try {
+    const [role] = await db.insert(roles).values({ id: parsed.data.id, name: parsed.data.name, permissions: parsed.data.permissions, isSystem: false }).returning()
+    return NextResponse.json(role, { status: 201 })
+  } catch { return NextResponse.json({ error: 'A role with that ID already exists.' }, { status: 409 }) }
+}

package/src/routes/admin/settings/route.ts

@@ -0,0 +1,45 @@
+import { NextResponse } from 'next/server'
+import { eq } from 'drizzle-orm'
+import { z } from 'zod'
+import { db } from '../../../db'
+import { siteSettings } from '../../../schema'
+import { defaultSiteSettings } from '../../../seo'
+import { requireAction } from '../../../permissions'
+import { applyFieldPermissions } from '../../../content-types'
+import { defaultCmsAppearance, normalizeCmsAppearance } from '../../../cms-appearance'
+import { allApprovalContentTypes, defaultPublishingWorkflow, normalizePublishingWorkflow } from '../../../publishing-workflow'
+
+const optionalImage = z.union([z.string().url(), z.string().regex(/^\/uploads\/(?:[a-z0-9-]+\/)?[a-z0-9-]+\.(jpg|png|webp)$/), z.literal(''), z.null()]).transform((value) => value || null)
+const tokenMap = z.record(z.string(), z.union([z.string().regex(/^#[0-9a-fA-F]{6}$/), z.number().int().min(0).max(64)])).default({})
+const appearanceSchema = z.object({ preset: z.string().max(40), light: tokenMap, dark: tokenMap }).transform(normalizeCmsAppearance)
+const workflowSchema = z.object({ approvalRequired: z.array(z.enum(allApprovalContentTypes as [string, ...string[]])).default([]) }).transform(normalizePublishingWorkflow)
+const settingsSchema = z.object({
+  siteName: z.string().trim().min(1, 'Site name is required').max(80),
+  logoLight: optionalImage,
+  logoDark: optionalImage,
+  metaTitle: z.string().max(160).default(''),
+  metaDescription: z.string().max(300).default(''),
+  metaImage: optionalImage,
+  cmsAppearance: appearanceSchema.default(defaultCmsAppearance),
+  publishingWorkflow: workflowSchema.default(defaultPublishingWorkflow),
+})
+
+export async function GET() {
+  if (!await requireAction('settings', 'read')) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const [settings] = await db.select().from(siteSettings).where(eq(siteSettings.id, 'default')).limit(1)
+  return NextResponse.json(settings || defaultSiteSettings)
+}
+
+export async function PUT(request: Request) {
+  const result = await requireAction('settings', 'update')
+  if (!result) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const body = await request.json()
+  const parsed = settingsSchema.safeParse(body)
+  if (!parsed.success) return NextResponse.json({ error: parsed.error.issues.map((issue) => `${issue.path.join(' ')}: ${issue.message}`).join(' · ') }, { status: 400 })
+
+  const [existing] = await db.select().from(siteSettings).where(eq(siteSettings.id, 'default')).limit(1)
+  const submitted = applyFieldPermissions('settings', parsed.data, result.allowedFields('settings'), existing ?? defaultSiteSettings)
+  const data = { ...submitted, updatedAt: new Date() }
+  const [settings] = await db.insert(siteSettings).values({ id: 'default', ...data }).onConflictDoUpdate({ target: siteSettings.id, set: data }).returning()
+  return NextResponse.json(settings)
+}

package/src/routes/admin/single/[type]/route.ts

@@ -0,0 +1,54 @@
+import { NextResponse } from 'next/server'
+import { requireAction } from '../../../../permissions'
+import { applyFieldPermissions, blankFieldValues, redactFieldsForRead } from '../../../../content-types'
+import { getSingle } from '../../../../collections/registry'
+import { findInvalidRelation, findRowBy, isUniqueViolation } from '../../../../collections/query'
+import { resolveJoinFields } from '../../../../collections/join'
+import { readSingle, writeSingle } from '../../../../collections/single'
+import { parseCollectionBody, type ParseMode } from '../../../../collections/validation'
+import { fireWebhook, updateWorkflowValues } from '../../../../collections/workflow'
+import { getLocaleConfig } from '../../../../locale-settings'
+
+const unauthorized = () => NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+const notFound = () => NextResponse.json({ error: 'Not found' }, { status: 404 })
+
+export async function GET(_request: Request, { params }: { params: Promise<{ type: string }> }) {
+  const { type } = await params
+  const config = getSingle(type)
+  if (!config) return notFound()
+  const result = await requireAction(config.slug, 'read')
+  if (!result) return unauthorized()
+  const row = await resolveJoinFields(config, await readSingle(config))
+  return NextResponse.json(redactFieldsForRead(config.slug, row, result.allowedFields(config.slug)))
+}
+
+export async function PUT(request: Request, { params }: { params: Promise<{ type: string }> }) {
+  const { type } = await params
+  const config = getSingle(type)
+  if (!config) return notFound()
+  const result = await requireAction(config.slug, 'update')
+  if (!result) return unauthorized()
+
+  const body = await request.json()
+  const wantsPublished = config.workflow?.publish ? Boolean(body.published) : null
+  if (wantsPublished && !result.can(config.slug, 'publish')) return unauthorized()
+
+  const mode: ParseMode = config.workflow?.publish ? (wantsPublished ? 'live' : 'draft') : 'live'
+  const parsed = parseCollectionBody(config, body, mode, result.allowedFields(config.slug), await getLocaleConfig())
+  if (!parsed.ok) return NextResponse.json({ error: parsed.error }, { status: 400 })
+
+  const existing = await findRowBy(config.slug, config.fixedKey.column, config.fixedKey.value)
+  const data = applyFieldPermissions(config.slug, parsed.data, result.allowedFields(config.slug), existing ?? blankFieldValues[config.slug])
+
+  const relationError = await findInvalidRelation(config, data)
+  if (relationError) return NextResponse.json({ error: relationError }, { status: 400 })
+
+  try {
+    const row = await writeSingle(config, data, updateWorkflowValues(config, result.session.user.id, wantsPublished))
+    fireWebhook(config, existing ? 'updated' : 'created', row)
+    return NextResponse.json(row)
+  } catch (error) {
+    if (isUniqueViolation(error)) return NextResponse.json({ error: 'A record with one of those unique values already exists.' }, { status: 409 })
+    throw error
+  }
+}

package/src/routes/admin/singles/route.ts

@@ -0,0 +1,15 @@
+import { NextResponse } from 'next/server'
+import { getSessionWithPermissions } from '../../../permissions'
+import { getSingle, singleSlugs } from '../../../collections/registry'
+import type { SingleConfig } from '../../../collections/types'
+
+export async function GET() {
+  const result = await getSessionWithPermissions()
+  if (!result) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const visible = (singleSlugs as string[])
+    .map((slug) => getSingle(slug))
+    .filter((config): config is SingleConfig => Boolean(config))
+    .filter((config) => result.can(config.slug, 'read'))
+    .map((config) => ({ slug: config.slug, label: config.label }))
+  return NextResponse.json(visible)
+}

package/src/routes/admin/upload/route.ts

@@ -0,0 +1,55 @@
+import { NextResponse } from 'next/server'
+import { eq } from 'drizzle-orm'
+import { db } from '../../../db'
+import { media, mediaFolders } from '../../../schema'
+import { getSessionWithPermissions } from '../../../permissions'
+import { uploadFile } from '../../../media-storage'
+
+export const runtime = 'nodejs'
+
+const extensions: Record<string, string> = {
+  'image/jpeg': 'jpg',
+  'image/png': 'png',
+  'image/webp': 'webp',
+  'image/gif': 'gif',
+  'image/svg+xml': 'svg',
+  'video/mp4': 'mp4',
+  'video/webm': 'webm',
+  'video/quicktime': 'mov',
+  'audio/mpeg': 'mp3',
+  'audio/wav': 'wav',
+  'audio/ogg': 'ogg',
+  'application/pdf': 'pdf',
+}
+
+// Per-category ceilings — video/audio need far more headroom than a compressed image.
+const maxBytesByPrefix: Array<[string, number]> = [
+  ['image/', 8 * 1024 * 1024],
+  ['video/', 80 * 1024 * 1024],
+  ['audio/', 25 * 1024 * 1024],
+]
+const defaultMaxBytes = 20 * 1024 * 1024 // pdf and anything else in the allowlist
+
+function maxBytesFor(mimeType: string) {
+  return maxBytesByPrefix.find(([prefix]) => mimeType.startsWith(prefix))?.[1] ?? defaultMaxBytes
+}
+
+export async function POST(request: Request) {
+  if (!await getSessionWithPermissions()) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+  const formData = await request.formData()
+  const file = formData.get('file')
+  const requestedFolder = String(formData.get('folder') || 'uploads')
+  if (!file || typeof file === 'string' || !('arrayBuffer' in file) || !('type' in file) || !(file.type in extensions)) return NextResponse.json({ error: 'Unsupported file type.' }, { status: 400 })
+  const maxBytes = maxBytesFor(file.type)
+  if (file.size > maxBytes) return NextResponse.json({ error: `File must be smaller than ${Math.round(maxBytes / (1024 * 1024))} MB.` }, { status: 400 })
+  if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(requestedFolder)) return NextResponse.json({ error: 'Invalid media folder.' }, { status: 400 })
+  if (requestedFolder !== 'uploads') { const [folder] = await db.select().from(mediaFolders).where(eq(mediaFolders.slug, requestedFolder)).limit(1); if (!folder) return NextResponse.json({ error: 'Media folder not found.' }, { status: 400 }) }
+
+  // Storage is flat — `folder` is pure metadata for organizing the media library, never part
+  // of the file's key, so moving a file between folders later can never break its URL.
+  const { url } = await uploadFile(Buffer.from(await file.arrayBuffer()), file.type, extensions[file.type])
+  const filename = url.split('/').pop() ?? url
+  await db.insert(media).values({ id: crypto.randomUUID(), filename, url, folder: requestedFolder, mimeType: file.type, size: file.size })
+  return NextResponse.json({ url })
+}

package/src/routes/admin/users/[id]/route.ts

@@ -0,0 +1,24 @@
+import { eq } from 'drizzle-orm'
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { db } from '../../../../db'
+import { user } from '../../../../schema'
+import { requireSystem } from '../../../../permissions'
+
+export async function GET(_: Request, { params }: { params: Promise<{ id: string }> }) {
+  if (!await requireSystem('users.manage')) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const { id } = await params
+  const [row] = await db.select({ id: user.id, name: user.name, email: user.email, role: user.role }).from(user).where(eq(user.id, id)).limit(1)
+  return row ? NextResponse.json(row) : NextResponse.json({ error: 'Not found' }, { status: 404 })
+}
+
+const schema = z.object({ name: z.string().trim().min(1).max(120).optional(), email: z.string().trim().email().optional(), role: z.string().min(1).max(60).optional() })
+
+export async function PATCH(request: Request, { params }: { params: Promise<{ id: string }> }) {
+  if (!await requireSystem('users.manage')) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const { id } = await params
+  const parsed = schema.safeParse(await request.json())
+  if (!parsed.success) return NextResponse.json({ error: 'Invalid request.' }, { status: 400 })
+  const [row] = await db.update(user).set(parsed.data).where(eq(user.id, id)).returning({ id: user.id, name: user.name, email: user.email, role: user.role })
+  return row ? NextResponse.json(row) : NextResponse.json({ error: 'Not found' }, { status: 404 })
+}

package/src/routes/admin/users/route.ts

@@ -0,0 +1,24 @@
+import { asc, eq } from 'drizzle-orm'
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { auth, db } from '../../../db'
+import { user } from '../../../schema'
+import { getSessionWithPermissions, requireSystem } from '../../../permissions'
+
+export async function GET() {
+  if (!await getSessionWithPermissions()) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const rows = await db.select({ id: user.id, name: user.name, email: user.email, role: user.role }).from(user).orderBy(asc(user.name))
+  return NextResponse.json(rows)
+}
+
+const createSchema = z.object({ name: z.string().trim().min(1).max(120), email: z.string().trim().email(), password: z.string().min(12).max(200), role: z.string().min(1).max(60) })
+
+export async function POST(request: Request) {
+  if (!await requireSystem('users.manage')) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const parsed = createSchema.safeParse(await request.json())
+  if (!parsed.success) return NextResponse.json({ error: parsed.error.issues.map((issue) => `${issue.path.join(' ')}: ${issue.message}`).join(' · ') }, { status: 400 })
+  const result = await auth.api.signUpEmail({ body: { name: parsed.data.name, email: parsed.data.email, password: parsed.data.password } })
+  if (!result.user) return NextResponse.json({ error: 'Could not create user — email may already be in use.' }, { status: 400 })
+  await db.update(user).set({ role: parsed.data.role }).where(eq(user.id, result.user.id))
+  return NextResponse.json({ id: result.user.id, name: parsed.data.name, email: parsed.data.email, role: parsed.data.role }, { status: 201 })
+}

package/src/routes/admin/webhooks/[id]/route.ts

@@ -0,0 +1,38 @@
+import { desc, eq } from 'drizzle-orm'
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { db } from '../../../../db'
+import { webhookDeliveries, webhooks } from '../../../../schema'
+import { requireSystem } from '../../../../permissions'
+import { decryptSecret } from '../../../../secrets'
+import { allWebhookEvents, WEBHOOK_SECRET_DOMAIN } from '../../../../webhooks'
+
+export async function GET(request: Request, { params }: { params: Promise<{ id: string }> }) {
+  if (!await requireSystem('developers.manage')) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const { id } = await params
+  const [webhook] = await db.select().from(webhooks).where(eq(webhooks.id, id)).limit(1)
+  if (!webhook) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+  const deliveries = await db.select().from(webhookDeliveries).where(eq(webhookDeliveries.webhookId, id)).orderBy(desc(webhookDeliveries.createdAt)).limit(20)
+  let secret = ''
+  try { secret = decryptSecret(webhook.encryptedSecret, WEBHOOK_SECRET_DOMAIN) } catch { /* stored before secrets existed, or corrupted — leave blank */ }
+  return NextResponse.json({ id: webhook.id, name: webhook.name, url: webhook.url, events: webhook.events, enabled: webhook.enabled, secret, deliveries })
+}
+
+const schema = z.object({ name: z.string().trim().min(1).max(80), url: z.string().url(), events: z.array(z.enum(allWebhookEvents as [string, ...string[]])).max(allWebhookEvents.length), enabled: z.boolean() })
+
+export async function PUT(request: Request, { params }: { params: Promise<{ id: string }> }) {
+  if (!await requireSystem('developers.manage')) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const { id } = await params
+  const parsed = schema.safeParse(await request.json())
+  if (!parsed.success) return NextResponse.json({ error: parsed.error.issues.map((issue) => `${issue.path.join(' ')}: ${issue.message}`).join(' · ') }, { status: 400 })
+  const [webhook] = await db.update(webhooks).set({ name: parsed.data.name, url: parsed.data.url, events: parsed.data.events, enabled: parsed.data.enabled, updatedAt: new Date() }).where(eq(webhooks.id, id)).returning()
+  if (!webhook) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+  return NextResponse.json({ id: webhook.id, name: webhook.name, url: webhook.url, events: webhook.events, enabled: webhook.enabled })
+}
+
+export async function DELETE(request: Request, { params }: { params: Promise<{ id: string }> }) {
+  if (!await requireSystem('developers.manage')) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const { id } = await params
+  await db.delete(webhooks).where(eq(webhooks.id, id))
+  return NextResponse.json({ ok: true })
+}

package/src/routes/admin/webhooks/route.ts

@@ -0,0 +1,26 @@
+import { desc } from 'drizzle-orm'
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { randomBytes } from 'node:crypto'
+import { db } from '../../../db'
+import { webhooks } from '../../../schema'
+import { requireSystem } from '../../../permissions'
+import { encryptSecret } from '../../../secrets'
+import { allWebhookEvents, WEBHOOK_SECRET_DOMAIN } from '../../../webhooks'
+
+export async function GET() {
+  if (!await requireSystem('developers.manage')) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const rows = await db.select({ id: webhooks.id, name: webhooks.name, url: webhooks.url, events: webhooks.events, enabled: webhooks.enabled, createdAt: webhooks.createdAt }).from(webhooks).orderBy(desc(webhooks.createdAt))
+  return NextResponse.json(rows)
+}
+
+const schema = z.object({ name: z.string().trim().min(1).max(80), url: z.string().url(), events: z.array(z.enum(allWebhookEvents as [string, ...string[]])).max(allWebhookEvents.length), enabled: z.boolean().default(true) })
+
+export async function POST(request: Request) {
+  if (!await requireSystem('developers.manage')) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const parsed = schema.safeParse(await request.json())
+  if (!parsed.success) return NextResponse.json({ error: parsed.error.issues.map((issue) => `${issue.path.join(' ')}: ${issue.message}`).join(' · ') }, { status: 400 })
+  const secret = randomBytes(24).toString('base64url')
+  const [webhook] = await db.insert(webhooks).values({ id: crypto.randomUUID(), name: parsed.data.name, url: parsed.data.url, events: parsed.data.events, enabled: parsed.data.enabled, encryptedSecret: encryptSecret(secret, WEBHOOK_SECRET_DOMAIN) }).returning()
+  return NextResponse.json({ id: webhook.id, name: webhook.name, url: webhook.url, events: webhook.events, enabled: webhook.enabled, secret }, { status: 201 })
+}

package/src/routes/cron/publish-scheduled.ts

@@ -0,0 +1,37 @@
+import { and, eq, isNotNull, isNull, lte } from 'drizzle-orm'
+import { NextResponse } from 'next/server'
+import { entries, workflowSlugs } from '../../collections/registry'
+import { collectionColumn, updateWhere } from '../../collections/query'
+
+export const runtime = 'nodejs'
+
+export async function GET(request: Request) {
+  const token = request.headers.get('authorization')?.replace('Bearer ', '')
+  if (!token || token !== process.env.CRON_SECRET) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+  const now = new Date()
+  const byType: Array<{ slug: string; published: number; ids: string[] }> = []
+
+  for (const slug of workflowSlugs) {
+    const config = entries[slug]
+    if (!config.workflow?.scheduling) continue
+    const scheduledAt = collectionColumn(slug, 'scheduledAt')
+    const published = collectionColumn(slug, 'published')
+    if (!scheduledAt || !published) continue
+    const deletedAt = config.workflow.trash ? collectionColumn(slug, 'deletedAt') : null
+
+    const rows = await updateWhere(
+      slug,
+      and(eq(published, false), ...(deletedAt ? [isNull(deletedAt)] : []), isNotNull(scheduledAt), lte(scheduledAt, now))!,
+      { published: true, publishedAt: now, scheduledAt: null },
+    )
+    byType.push({ slug, published: rows.length, ids: rows.map((row) => String(row.id)) })
+  }
+
+  return NextResponse.json({
+    ok: true,
+    published: byType.reduce((sum, item) => sum + item.published, 0),
+    ids: byType.flatMap((item) => item.ids),
+    byType,
+  })
+}

package/src/routes/setup/admin.ts

@@ -0,0 +1,19 @@
+import { NextResponse } from 'next/server'
+import { eq } from 'drizzle-orm'
+import { auth, db } from '../../db'
+import { user } from '../../schema'
+
+export async function POST(request: Request) {
+  const token = request.headers.get('authorization')?.replace('Bearer ', '')
+  if (!token || token !== process.env.CMS_SETUP_TOKEN) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+  const body = await request.json() as { name?: string; email?: string; password?: string }
+  if (!body.name || !body.email || !body.password || body.password.length < 12) {
+    return NextResponse.json({ error: 'name, email, and a password of at least 12 characters are required' }, { status: 400 })
+  }
+
+  const result = await auth.api.signUpEmail({ body: { name: body.name, email: body.email, password: body.password } })
+  if (!result.user) return NextResponse.json({ error: 'Could not create user' }, { status: 400 })
+  await db.update(user).set({ role: 'admin' }).where(eq(user.id, result.user.id))
+  return NextResponse.json({ ok: true, userId: result.user.id })
+}

package/src/schema/admin-ui.ts

@@ -0,0 +1,18 @@
+import { jsonb, pgTable, text } from 'drizzle-orm/pg-core'
+import { timestamps } from './helpers'
+import type { ContentViewSettings } from '../collections/content-view'
+import type { DashboardConfig } from '../dashboard'
+
+export const contentViews = pgTable('cms_content_views', {
+  contentType: text('content_type').primaryKey(),
+  config: jsonb('config').$type<ContentViewSettings>().notNull(),
+  ...timestamps,
+})
+
+export const dashboards = pgTable('cms_dashboards', {
+  id: text('id').primaryKey(),
+  name: text('name').notNull().default('Main dashboard'),
+  config: jsonb('config').$type<DashboardConfig>().notNull(),
+  createdBy: text('created_by'),
+  ...timestamps,
+})

package/src/schema/auth.ts

@@ -0,0 +1,49 @@
+import { boolean, pgTable, text, timestamp } from 'drizzle-orm/pg-core'
+import { timestamps } from './helpers'
+
+// Better Auth tables (user/session/account/verification) — column shapes are dictated by the
+// auth library, not by this project's conventions. Keep them together; they only ever change
+// together when the auth adapter changes.
+
+export const user = pgTable('user', {
+  id: text('id').primaryKey(),
+  name: text('name').notNull(),
+  email: text('email').notNull().unique(),
+  emailVerified: boolean('email_verified').default(false).notNull(),
+  image: text('image'),
+  role: text('role').default('editor').notNull(),
+  ...timestamps,
+})
+
+export const session = pgTable('session', {
+  id: text('id').primaryKey(),
+  expiresAt: timestamp('expires_at').notNull(),
+  token: text('token').notNull().unique(),
+  ipAddress: text('ip_address'),
+  userAgent: text('user_agent'),
+  userId: text('user_id').notNull().references(() => user.id, { onDelete: 'cascade' }),
+  ...timestamps,
+})
+
+export const account = pgTable('account', {
+  id: text('id').primaryKey(),
+  accountId: text('account_id').notNull(),
+  providerId: text('provider_id').notNull(),
+  userId: text('user_id').notNull().references(() => user.id, { onDelete: 'cascade' }),
+  accessToken: text('access_token'),
+  refreshToken: text('refresh_token'),
+  idToken: text('id_token'),
+  accessTokenExpiresAt: timestamp('access_token_expires_at'),
+  refreshTokenExpiresAt: timestamp('refresh_token_expires_at'),
+  scope: text('scope'),
+  password: text('password'),
+  ...timestamps,
+})
+
+export const verification = pgTable('verification', {
+  id: text('id').primaryKey(),
+  identifier: text('identifier').notNull(),
+  value: text('value').notNull(),
+  expiresAt: timestamp('expires_at').notNull(),
+  ...timestamps,
+})

package/src/schema/developer-tools.ts

@@ -0,0 +1,44 @@
+import { boolean, integer, jsonb, pgTable, text, timestamp } from 'drizzle-orm/pg-core'
+import { timestamps } from './helpers'
+
+export const emailSettings = pgTable('cms_email_settings', {
+  id: text('id').primaryKey(),
+  host: text('host'),
+  port: integer('port'),
+  secure: boolean('secure').notNull().default(true),
+  username: text('username'),
+  encryptedPassword: text('encrypted_password'),
+  fromAddress: text('from_address'),
+  fromName: text('from_name'),
+  ...timestamps,
+})
+
+export const apiTokens = pgTable('cms_api_tokens', {
+  id: text('id').primaryKey(),
+  name: text('name').notNull(),
+  tokenHash: text('token_hash').notNull().unique(),
+  tokenPrefix: text('token_prefix').notNull(),
+  lastUsedAt: timestamp('last_used_at'),
+  createdBy: text('created_by'),
+  ...timestamps,
+})
+
+export const webhooks = pgTable('cms_webhooks', {
+  id: text('id').primaryKey(),
+  name: text('name').notNull(),
+  url: text('url').notNull(),
+  encryptedSecret: text('encrypted_secret').notNull(),
+  events: jsonb('events').$type<string[]>().notNull().default([]),
+  enabled: boolean('enabled').notNull().default(true),
+  ...timestamps,
+})
+
+export const webhookDeliveries = pgTable('cms_webhook_deliveries', {
+  id: text('id').primaryKey(),
+  webhookId: text('webhook_id').notNull().references(() => webhooks.id, { onDelete: 'cascade' }),
+  event: text('event').notNull(),
+  statusCode: integer('status_code'),
+  success: boolean('success').notNull(),
+  error: text('error'),
+  createdAt: timestamp('created_at').defaultNow().notNull(),
+})

package/src/schema/helpers.ts

@@ -0,0 +1,35 @@
+import { boolean, integer, text, timestamp } from 'drizzle-orm/pg-core'
+
+export const timestamps = {
+  createdAt: timestamp('created_at').defaultNow().notNull(),
+  updatedAt: timestamp('updated_at').defaultNow().notNull(),
+}
+
+export const workflowColumns = {
+  createdBy: text('created_by'),
+  ownerId: text('owner_id'),
+  updatedBy: text('updated_by'),
+  reviewerId: text('reviewer_id'),
+  approverId: text('approver_id'),
+  reviewStatus: text('review_status').notNull().default('draft'),
+  reviewedAt: timestamp('reviewed_at'),
+  approvedAt: timestamp('approved_at'),
+  published: boolean('published').notNull().default(false),
+  publishedAt: timestamp('published_at'),
+  deletedAt: timestamp('deleted_at'),
+  sortOrder: integer('sort_order').notNull().default(0),
+}
+
+export const publishColumns = {
+  createdBy: text('created_by'),
+  ownerId: text('owner_id'),
+  updatedBy: text('updated_by'),
+  published: boolean('published').notNull().default(false),
+  publishedAt: timestamp('published_at'),
+}
+
+/** Engine-owned scheduling column. Spread into any table whose entry declares
+ *  `workflow.scheduling`. Never declare `scheduledAt` as a FieldConfig. */
+export const schedulingColumns = {
+  scheduledAt: timestamp('scheduled_at', { withTimezone: true }),
+}

package/src/schema/index.ts

@@ -0,0 +1,33 @@
+// Barrel of kilo-cms's OWN tables only — auth, RBAC, media, settings, dev-tools, admin-ui,
+// locales. A host app's own content tables (services/projects/whatever a project defines via
+// defineCollectionTable) live in the HOST's own schema, never here. The host's own schema
+// barrel re-exports this one (`export * from 'kilo-cms/schema'`) so drizzle-kit sees both sets
+// of tables in one merged diff target — see apps/site/drizzle.app.config.ts's comment for why
+// that matters.
+export * from './helpers'
+export * from './auth'
+export * from './rbac'
+export * from './media'
+export * from './settings'
+export * from './developer-tools'
+export * from './admin-ui'
+export * from './locales'
+
+import { user, session, account, verification } from './auth'
+import { roles } from './rbac'
+import { mediaFolders, media } from './media'
+import { siteSettings, aiSettings } from './settings'
+import { emailSettings, apiTokens, webhooks, webhookDeliveries } from './developer-tools'
+import { contentViews, dashboards } from './admin-ui'
+import { cmsLocales } from './locales'
+
+// The object better-auth's drizzle adapter needs, and the base every host schema barrel
+// spreads into its own merged `schema` object.
+export const schema = {
+  user, session, account, verification, roles,
+  mediaFolders, media,
+  siteSettings, aiSettings,
+  emailSettings, apiTokens, webhooks, webhookDeliveries,
+  contentViews, dashboards,
+  cmsLocales,
+}