kilo-cms 0.1.0

package/src/schema/locales.ts

@@ -0,0 +1,13 @@
+import { boolean, integer, pgTable, text } from 'drizzle-orm/pg-core'
+
+// Admin-editable locale list for `FieldConfig.localized` fields — see
+// src/lib/locale-settings.ts (server read, request-cached) and CmsLocalesProvider (client).
+// An empty table is a valid state (falls back to `fallbackLocaleConfig` in
+// src/lib/collections/locale.ts), so there's no seed migration — the first row is created via
+// the admin UI at /admin/settings/locales.
+export const cmsLocales = pgTable('cms_locales', {
+  code: text('code').primaryKey(), // e.g. 'id', 'en' — used as the storage key on localized fields
+  label: text('label').notNull(), // e.g. 'Indonesia' — shown on the locale tab
+  isDefault: boolean('is_default').notNull().default(false),
+  sortOrder: integer('sort_order').notNull().default(0),
+})

package/src/schema/media.ts

@@ -0,0 +1,22 @@
+import { boolean, integer, pgTable, text, timestamp } from 'drizzle-orm/pg-core'
+import { timestamps } from './helpers'
+
+export const mediaFolders = pgTable('cms_media_folders', {
+  id: text('id').primaryKey(),
+  name: text('name').notNull(),
+  slug: text('slug').notNull().unique(),
+  pinned: boolean('pinned').notNull().default(false),
+  ...timestamps,
+})
+
+export const media = pgTable('cms_media', {
+  id: text('id').primaryKey(),
+  filename: text('filename').notNull(),
+  url: text('url').notNull().unique(),
+  folder: text('folder').notNull().default('uploads'),
+  mimeType: text('mime_type').notNull(),
+  size: integer('size').notNull(),
+  starred: boolean('starred').notNull().default(false),
+  deletedAt: timestamp('deleted_at'),
+  ...timestamps,
+})

package/src/schema/rbac.ts

@@ -0,0 +1,11 @@
+import { boolean, jsonb, pgTable, text } from 'drizzle-orm/pg-core'
+import { timestamps } from './helpers'
+import type { StoredRolePermissions } from '../content-types'
+
+export const roles = pgTable('cms_roles', {
+  id: text('id').primaryKey(),
+  name: text('name').notNull(),
+  permissions: jsonb('permissions').$type<StoredRolePermissions>().notNull().default({ contentTypes: {}, system: [] }),
+  isSystem: boolean('is_system').notNull().default(false),
+  ...timestamps,
+})

package/src/schema/settings.ts

@@ -0,0 +1,28 @@
+import { jsonb, pgTable, text } from 'drizzle-orm/pg-core'
+import { timestamps } from './helpers'
+import type { CmsAppearance } from '../cms-appearance'
+import type { PublishingWorkflow } from '../publishing-workflow'
+
+// `settings` is the one hand-written content type left (see content-types.ts) — this table
+// backs it directly, plus the CMS's own appearance/workflow-policy config.
+export const siteSettings = pgTable('cms_site_settings', {
+  id: text('id').primaryKey(),
+  siteName: text('site_name').notNull().default('Kilo CMS'),
+  logoLight: text('logo_light'),
+  logoDark: text('logo_dark'),
+  metaTitle: text('meta_title').notNull().default(''),
+  metaDescription: text('meta_description').notNull().default(''),
+  metaImage: text('meta_image'),
+  cmsAppearance: jsonb('cms_appearance').$type<CmsAppearance>().notNull().default({ preset: 'acid', light: {}, dark: {} }),
+  publishingWorkflow: jsonb('publishing_workflow').$type<PublishingWorkflow>().notNull().default({ approvalRequired: ['services', 'projects', 'blog'] }),
+  ...timestamps,
+})
+
+export const aiSettings = pgTable('cms_ai_settings', {
+  id: text('id').primaryKey(),
+  manusApiKey: text('manus_api_key'),
+  deepseekApiKey: text('deepseek_api_key'),
+  openaiApiKey: text('openai_api_key'),
+  anthropicApiKey: text('anthropic_api_key'),
+  ...timestamps,
+})

package/src/secrets.ts

@@ -0,0 +1,26 @@
+import 'server-only'
+
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'node:crypto'
+
+const VERSION = 'v1'
+
+function encryptionKey(domain: string) {
+  const source = process.env.CMS_ENCRYPTION_KEY || process.env.BETTER_AUTH_SECRET
+  if (!source || source === 'replace-with-a-long-random-secret') throw new Error('Set CMS_ENCRYPTION_KEY before saving secrets.')
+  return createHash('sha256').update(`the-usual:${domain}:${source}`).digest()
+}
+
+export function encryptSecret(value: string, domain: string) {
+  const iv = randomBytes(12)
+  const cipher = createCipheriv('aes-256-gcm', encryptionKey(domain), iv)
+  const encrypted = Buffer.concat([cipher.update(value, 'utf8'), cipher.final()])
+  return [VERSION, iv.toString('base64url'), cipher.getAuthTag().toString('base64url'), encrypted.toString('base64url')].join(':')
+}
+
+export function decryptSecret(payload: string, domain: string) {
+  const [version, ivValue, tagValue, encryptedValue] = payload.split(':')
+  if (version !== VERSION || !ivValue || !tagValue || !encryptedValue) throw new Error('Stored secret is invalid. Save it again.')
+  const decipher = createDecipheriv('aes-256-gcm', encryptionKey(domain), Buffer.from(ivValue, 'base64url'))
+  decipher.setAuthTag(Buffer.from(tagValue, 'base64url'))
+  return Buffer.concat([decipher.update(Buffer.from(encryptedValue, 'base64url')), decipher.final()]).toString('utf8')
+}

package/src/seo.ts

@@ -0,0 +1,69 @@
+import { eq } from 'drizzle-orm'
+import { cache } from 'react'
+import type { Metadata } from 'next'
+import { db } from './db'
+import { siteSettings } from './schema'
+import { defaultCmsAppearance, normalizeCmsAppearance } from './cms-appearance'
+import { defaultPublishingWorkflow, normalizePublishingWorkflow } from './publishing-workflow'
+
+export const defaultSiteSettings = {
+  siteName: 'Kilo CMS',
+  logoLight: null as string | null,
+  logoDark: null as string | null,
+  metaTitle: 'The Usual — Ideas with a pulse',
+  metaDescription: 'Independent creative studio for brands with something to say.',
+  metaImage: null as string | null,
+  cmsAppearance: defaultCmsAppearance,
+  publishingWorkflow: defaultPublishingWorkflow,
+}
+
+export type SiteSettings = typeof defaultSiteSettings
+
+export const getSiteSettings = cache(async function getSiteSettings(): Promise<SiteSettings> {
+  try {
+    const [settings] = await db.select().from(siteSettings).where(eq(siteSettings.id, 'default')).limit(1)
+    if (!settings) return defaultSiteSettings
+    return {
+      siteName: settings.siteName || defaultSiteSettings.siteName,
+      logoLight: settings.logoLight,
+      logoDark: settings.logoDark,
+      metaTitle: settings.metaTitle || defaultSiteSettings.metaTitle,
+      metaDescription: settings.metaDescription || defaultSiteSettings.metaDescription,
+      metaImage: settings.metaImage,
+      cmsAppearance: normalizeCmsAppearance(settings.cmsAppearance),
+      publishingWorkflow: normalizePublishingWorkflow(settings.publishingWorkflow),
+    }
+  } catch {
+    return defaultSiteSettings
+  }
+})
+
+const siteUrl = process.env.NEXT_PUBLIC_SITE_URL
+
+export async function siteMetadata(): Promise<Metadata> {
+  const settings = await getSiteSettings()
+  const icon = settings.logoLight ?? settings.logoDark
+  return {
+    metadataBase: siteUrl ? new URL(siteUrl) : undefined,
+    title: { default: settings.metaTitle, template: `%s — ${settings.siteName}` },
+    description: settings.metaDescription,
+    icons: icon ? { icon } : undefined,
+    openGraph: { siteName: settings.siteName, images: settings.metaImage ? [settings.metaImage] : undefined },
+  }
+}
+
+type MetaOverride = { title?: string | null; description?: string | null; image?: string | null }
+
+export async function pageMetadata(override: MetaOverride): Promise<Metadata> {
+  const settings = await getSiteSettings()
+  const title = override.title?.trim() || settings.metaTitle
+  const description = override.description?.trim() || settings.metaDescription
+  const image = override.image || settings.metaImage || undefined
+
+  return {
+    title,
+    description,
+    openGraph: { title, description, images: image ? [image] : undefined },
+    twitter: { card: 'summary_large_image', title, description, images: image ? [image] : undefined },
+  }
+}

package/src/storage/index.ts

@@ -0,0 +1,20 @@
+import 'server-only'
+import type { StorageDriver } from './types'
+import { localDriver } from './local'
+import { s3Driver } from './s3-compatible'
+import { vercelBlobDriver } from './vercel-blob'
+
+const drivers: Record<string, StorageDriver> = {
+  local: localDriver,
+  s3: s3Driver,
+  'vercel-blob': vercelBlobDriver,
+}
+
+const kind = process.env.STORAGE_DRIVER || 'local'
+const selected = drivers[kind]
+if (!selected && process.env.NODE_ENV !== 'production') {
+  console.error(`Unknown STORAGE_DRIVER "${kind}" — expected "local", "s3", or "vercel-blob". Falling back to "local".`)
+}
+
+export const storage: StorageDriver = selected ?? localDriver
+export type { StorageDriver } from './types'

package/src/storage/local.ts

@@ -0,0 +1,27 @@
+import 'server-only'
+import { mkdir, writeFile, unlink } from 'node:fs/promises'
+import path from 'node:path'
+import type { StorageDriver } from './types'
+
+// Not viable on serverless hosts (Vercel, etc.) — the filesystem is ephemeral and not shared
+// across invocations/regions. This driver is for local dev and traditional (non-serverless)
+// hosting only; see docs for the s3/vercel-blob drivers when deploying serverless.
+function diskPath(key: string) {
+  return path.join(process.cwd(), 'public', 'uploads', key)
+}
+
+export const localDriver: StorageDriver = {
+  async put(key, data) {
+    const directory = path.join(process.cwd(), 'public', 'uploads')
+    await mkdir(directory, { recursive: true })
+    await writeFile(diskPath(key), data)
+    return { url: `/uploads/${key}` }
+  },
+  async remove(url) {
+    const key = url.split('/').pop()
+    if (!key) return
+    try {
+      await unlink(diskPath(key))
+    } catch { /* already gone */ }
+  },
+}

package/src/storage/s3-compatible.ts

@@ -0,0 +1,31 @@
+import 'server-only'
+import { S3Client, PutObjectCommand, DeleteObjectCommand } from '@aws-sdk/client-s3'
+import type { StorageDriver } from './types'
+
+// One driver for any S3-compatible bucket — covers Cloudflare R2 and Supabase Storage (both
+// expose an S3-compatible API) without pulling in a separate SDK per provider. Only the env
+// vars differ between providers; see .env.example for per-provider setup notes.
+function config() {
+  const { S3_ENDPOINT: endpoint, S3_REGION: region = 'auto', S3_BUCKET: bucket, S3_ACCESS_KEY_ID: accessKeyId, S3_SECRET_ACCESS_KEY: secretAccessKey, S3_PUBLIC_URL_BASE: publicUrlBase } = process.env
+  if (!endpoint || !bucket || !accessKeyId || !secretAccessKey || !publicUrlBase) {
+    throw new Error('STORAGE_DRIVER=s3 requires S3_ENDPOINT, S3_BUCKET, S3_ACCESS_KEY_ID, S3_SECRET_ACCESS_KEY, and S3_PUBLIC_URL_BASE.')
+  }
+  const client = new S3Client({ endpoint, region, credentials: { accessKeyId, secretAccessKey }, forcePathStyle: true })
+  return { client, bucket, publicUrlBase }
+}
+
+export const s3Driver: StorageDriver = {
+  async put(key, data, contentType) {
+    const { client, bucket, publicUrlBase } = config()
+    await client.send(new PutObjectCommand({ Bucket: bucket, Key: key, Body: data, ContentType: contentType }))
+    return { url: `${publicUrlBase.replace(/\/$/, '')}/${key}` }
+  },
+  async remove(url) {
+    const key = url.split('/').pop()
+    if (!key) return
+    try {
+      const { client, bucket } = config()
+      await client.send(new DeleteObjectCommand({ Bucket: bucket, Key: key }))
+    } catch { /* already gone, or misconfigured — deletion is best-effort */ }
+  },
+}

package/src/storage/types.ts

@@ -0,0 +1,8 @@
+import 'server-only'
+
+/** A pluggable object-storage backend for uploaded media. `remove` must never throw — a
+ *  missing/already-deleted object is not an error, since the DB row being gone is what matters. */
+export interface StorageDriver {
+  put(key: string, data: Buffer, contentType: string): Promise<{ url: string }>
+  remove(url: string): Promise<void>
+}

package/src/storage/vercel-blob.ts

@@ -0,0 +1,17 @@
+import 'server-only'
+import { put, del } from '@vercel/blob'
+import type { StorageDriver } from './types'
+
+// addRandomSuffix: false — our key is already a random UUID, and keeping the key stable is what
+// lets `remove` recover it from the stored URL alone (same contract as the other drivers).
+export const vercelBlobDriver: StorageDriver = {
+  async put(key, data, contentType) {
+    const blob = await put(key, data, { access: 'public', contentType, addRandomSuffix: false })
+    return { url: blob.url }
+  },
+  async remove(url) {
+    try {
+      await del(url)
+    } catch { /* already gone */ }
+  },
+}

package/src/useBodyScrollLock.ts

@@ -0,0 +1,12 @@
+'use client'
+
+import { useEffect } from 'react'
+
+export function useBodyScrollLock(locked: boolean) {
+  useEffect(() => {
+    if (!locked) return
+    const previous = document.body.style.overflow
+    document.body.style.overflow = 'hidden'
+    return () => { document.body.style.overflow = previous }
+  }, [locked])
+}

package/src/useLocalStorageState.ts

@@ -0,0 +1,26 @@
+'use client'
+
+import { useEffect, useState } from 'react'
+
+export function useLocalStorageState<T>(key: string, initial: T): [T, (value: T) => void] {
+  // The first browser render must use the same value as SSR. Reading storage here
+  // can make the client render a saved table layout before React has hydrated the
+  // server-rendered default layout.
+  const [state, setState] = useState<T>(initial)
+  const [ready, setReady] = useState(false)
+
+  useEffect(() => {
+    try {
+      const raw = window.localStorage.getItem(key)
+      if (raw) setState({ ...initial, ...JSON.parse(raw) })
+    } catch { /* storage unavailable or invalid saved value */ }
+    setReady(true)
+  }, [key])
+
+  useEffect(() => {
+    if (!ready) return
+    try { window.localStorage.setItem(key, JSON.stringify(state)) } catch { /* storage unavailable */ }
+  }, [key, ready, state])
+
+  return [state, setState]
+}

package/src/webhook-events.ts

@@ -0,0 +1,12 @@
+import { entries, workflowSlugs } from './collections/registry'
+
+const verbs = ['created', 'updated', 'published', 'unpublished', 'deleted'] as const
+
+export const generatedWebhookSlugs = workflowSlugs.filter((slug) => entries[slug].workflow?.webhooks)
+
+export const webhookEventGroups: Array<{ label: string; events: string[] }> = generatedWebhookSlugs.map((slug) => ({
+  label: entries[slug].label,
+  events: verbs.map((verb) => `${slug}.${verb}`),
+}))
+
+export const allWebhookEvents = webhookEventGroups.flatMap((group) => group.events)

package/src/webhooks.ts

@@ -0,0 +1,30 @@
+import 'server-only'
+
+import { createHmac } from 'node:crypto'
+import { sql } from 'drizzle-orm'
+import { db } from './db'
+import { webhookDeliveries, webhooks } from './schema'
+import { decryptSecret } from './secrets'
+
+export const WEBHOOK_SECRET_DOMAIN = 'cms-webhook-secrets'
+export { allWebhookEvents } from './webhook-events'
+
+export async function triggerWebhooks(event: string, payload: unknown) {
+  const subscribed = await db.select().from(webhooks).where(sql`${webhooks.enabled} = true and ${webhooks.events} @> ${JSON.stringify([event])}::jsonb`)
+  await Promise.all(subscribed.map(async (webhook: any) => {
+    const body = JSON.stringify({ event, data: payload, timestamp: new Date().toISOString() })
+    let statusCode: number | null = null
+    let success = false
+    let error: string | null = null
+    try {
+      const secret = decryptSecret(webhook.encryptedSecret, WEBHOOK_SECRET_DOMAIN)
+      const signature = createHmac('sha256', secret).update(body).digest('hex')
+      const response = await fetch(webhook.url, { method: 'POST', headers: { 'Content-Type': 'application/json', 'X-Webhook-Signature': signature, 'X-Webhook-Event': event }, body, signal: AbortSignal.timeout(5000) })
+      statusCode = response.status
+      success = response.ok
+    } catch (caught) {
+      error = caught instanceof Error ? caught.message : 'Delivery failed'
+    }
+    await db.insert(webhookDeliveries).values({ id: crypto.randomUUID(), webhookId: webhook.id, event, statusCode, success, error })
+  }))
+}