A real CMS, not a starter kit.

You never build an admin screen. Declare a collection in cms.config.ts — its fields, their types, which are required, which are unique — and the admin SPA renders the list view, the editor form, and the validation for it at build time.

Field types cover the things real content needs: text, rich text, slug (auto-derived from another field), number, boolean, date, select, media, JSON, and relations to other collections. The same definition drives the database schema, the REST and GraphQL APIs, and the TypeScript types — so a field you add in config is immediately queryable, editable, and typed.

Changing the schema is a migration, not a hot reload: kalayaan migrate --dry-run shows you the DDL before anything touches your data.

kalayaan deploy provisions a D1 database for you — Cloudflare's SQLite at the edge, on the free tier, with no connection string to manage. For the overwhelming majority of content sites that is the end of the story.

If you already run Postgres or MySQL, point config at it instead and Kalayaan provisions a Hyperdrive binding so the Worker gets pooled, low-latency connections rather than a cold TCP handshake per request. The query builder and migration engine target both — your collections, API, and admin UI don't change.

Three AI features run on Workers AI with no separate API key and no third-party account: alt-text generation for anything you upload to the media library, translation into your configured locales (flagged as machine-translated until a human reviews it), and editorial assist for titles, summaries, and rewrites inside the editor.

All three sit inside Workers AI's free daily neuron allowance, so the default AI configuration adds nothing to your bill. Semantic search is the one exception — it needs Vectorize, which requires a paid Workers plan, and Kalayaan says so before you enable it rather than after.

Every collection gets a REST API — list, filter, sort, paginate, and fetch by slug or id — with drafts hidden from anonymous callers unless you grant otherwise. A GraphQL schema is generated from the same config, so relations resolve in one round trip.

There's also an MCP server endpoint. Point Claude, or any MCP client, at your site and it can read and edit content under a scoped API token with exactly the permissions you grant it — the same Ability model that gates a human editor.

Access is an Ability: a set of grants of the shape { subjects, actions }, where actions are read, create, update, delete, publish, and manage, and subjects are your collection names plus system subjects like media, users, and settings. Every request — logged-in editor, API key, or anonymous visitor — resolves to one.

Roles are defined in config, so "editors can publish posts but not touch users" is a reviewable diff rather than a checkbox someone toggled once. Invite teammates by email, issue API tokens scoped to a subset of that role with an expiry date, revoke any of them instantly, and read the audit log of who changed what.

Media uploads land in R2 by default — free egress, free storage inside the monthly allowance — or in any S3-compatible bucket you already pay for. Images get derived sizes and, if AI is on, alt-text.

Turn on versioning for a collection and every save writes a revision you can diff and roll back to, with draft and published states kept separate so an in-progress edit never leaks to the public API.

Localization is per-field: mark which fields vary by locale, and the editor shows them side by side across your configured languages, with machine translations visibly flagged for review.

Open a collection to anonymous writes and submissions arrive as pending entries rather than published content. Cloudflare Turnstile — free, no CAPTCHA puzzle for your users — sits in front of the endpoint, so you're moderating real people instead of bots.

Approve, edit, or reject from a queue in the admin UI. The same permission model applies, so you can hand moderation to a role without handing over the rest of the CMS.

Put a domain in config, or pass --domain, and kalayaan deploy creates the DNS record and provisions the TLS certificate for you. The domain needs to be a zone on your Cloudflare account; everything after that is automatic.

Until you attach one you're on a free *.workers.dev URL, so nothing blocks you from shipping today and buying the domain later.