@xleddyl/nuxt-cms 0.1.36 → 0.1.38

package/README.md

@@ -10,7 +10,8 @@ nuxt-cms is a Nuxt module that leverages the Nitro server to ship a lightweight
 - **Content types in code**: a `cms.config.ts` with `defineCmsConfig()` declares collections, single documents, relations, blocks and translatable fields; database schema, migrations and TypeScript types are generated from it.
 - **Admin panel at `/cms`**: entry editing with validation, drafts, media library (S3-compatible storage, or a local mode backed directly by your `public/` folder), single-admin auth from env credentials.
 - **Public GraphQL API**: read-only, typed end-to-end via gql.tada, with filtering, sorting and pagination; fields marked `private` stay out of it.
-- **SQLite, Postgres or libSQL/Turso**: a local file database by default, one config line to switch (including remote SQLite over the network).
+- **SQLite, Postgres, libSQL/Turso or Cloudflare D1**: a local file database by default, one config line to switch (including remote SQLite over the network).
+- **Runs on serverless too**: migrations are baked into the server bundle, uploads are presigned straight to your bucket, sessions are sealed cookies. Nothing on the request path needs a local disk or sticky instances.
 
 ## Screenshots
 
@@ -41,9 +42,15 @@ export default defineNuxtConfig({
 ```
 
 `database` defaults to SQLite (`{ driver: 'sqlite', path: 'data/cms.db' }`) and can be omitted
-entirely. Switch it to `{ driver: 'postgres', url: '...' }` or
-`{ driver: 'libsql', url: '...', authToken: '...' }` (Turso/remote); see
-[Configuration](docs/configuration.md) for every option.
+entirely. Switch it to `{ driver: 'postgres', url: '...' }`,
+`{ driver: 'libsql', url: '...', authToken: '...' }` (Turso/remote) or
+`{ driver: 'd1', binding: 'DB' }` (Cloudflare Workers); see
+[Configuration](docs/configuration.md) for every option and
+[Deployment](docs/deployment.md) for which driver each host supports.
+
+Each driver brings its own client, and only the one you use has to be installed: SQLite works out of
+the box, `postgres` needs `pg`, `libsql` needs `@libsql/client`, and `d1` needs nothing extra. The
+build stops with an explicit message if the client for the configured driver is missing.
 
 Then declare your content types in a `cms.config.ts` at the project root with `defineCmsConfig()`.
 
@@ -74,6 +81,7 @@ Every secret maps to runtime config, so it can be set as an env var instead of i
 | `NUXT_SESSION_PASSWORD` | in production | session encryption key (32+ chars) |
 | `NUXT_CMS_DATABASE_URL` | with `postgres` / remote `libsql` | Postgres connection string or libSQL URL |
 | `NUXT_CMS_DATABASE_AUTH_TOKEN` | with remote `libsql` | libSQL/Turso auth token |
+| `NUXT_CMS_MIGRATE_ON_BOOT` | no | `false` to apply migrations in CI instead of on boot |
 | `NUXT_CMS_MEDIA_ENDPOINT` | for media | S3-compatible endpoint |
 | `NUXT_CMS_MEDIA_REGION` | for media | S3 region (default `auto`) |
 | `NUXT_CMS_MEDIA_BUCKET` | for media | bucket name |
@@ -87,11 +95,12 @@ Full documentation lives in [`docs/`](docs/README.md):
 
 - [Getting started](docs/getting-started.md) — install, configure, first content type, run.
 - [Configuration](docs/configuration.md) — every `cms.*` option and the `NUXT_CMS_*` env vars.
-- [Database](docs/database.md) — SQLite, Postgres and libSQL/Turso drivers, migrations, studio.
+- [Database](docs/database.md) — SQLite, Postgres, libSQL/Turso and D1 drivers, migrations, studio.
 - [Schema](docs/schema.md) — `defineCmsConfig`, entries, field types, relations, blocks, i18n.
 - [Querying content](docs/querying.md) — GraphQL API, `useCms` / `$cmsQuery`, filters, sorting, pagination.
 - [Admin panel & security](docs/admin.md) — pages, authentication, sessions, admin REST API.
 - [Media](docs/media.md) — S3-compatible storage or local mode backed by your `public/` folder, upload flow, allowed file types.
+- [Deployment](docs/deployment.md) — host/driver matrix, migrations on serverless, horizontal scaling, Cloudflare Workers.
 
 ## LLM guide
 

package/dist/module.d.mts

@@ -1,16 +1,22 @@
 import * as _nuxt_schema from '@nuxt/schema';
 
 type ModuleOptionsDatabase = {
+    migrateOnBoot?: boolean;
+} & ({
     driver?: 'sqlite';
     path?: string;
 } | {
     driver: 'postgres';
     url?: string;
+    poolMax?: number;
 } | {
     driver: 'libsql';
     url?: string;
     authToken?: string;
-};
+} | {
+    driver: 'd1';
+    binding?: string;
+});
 type ModuleOptionsMedia = {
     storage?: 's3';
     endpoint?: string;

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@xleddyl/nuxt-cms",
   "configKey": "cms",
-  "version": "0.1.36",
+  "version": "0.1.38",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "unknown"

package/dist/module.mjs

@@ -1,7 +1,7 @@
 import { spawn } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { createRequire } from 'node:module';
-import { isAbsolute, resolve, relative, join, dirname } from 'node:path';
+import { join, isAbsolute, resolve, relative, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { defineNuxtModule, createResolver, useLogger, addImports, resolvePath, addTemplate, addServerPlugin, addTypeTemplate, addVitePlugin, addComponentsDir, addRouteMiddleware, extendPages, addServerHandler } from '@nuxt/kit';
 import tailwindcss from '@tailwindcss/vite';
@@ -12,6 +12,8 @@ import { createJiti } from 'jiti';
 import { typeName, blockTypeName, blockUnionName, renderGraphqlSdl } from '../dist/runtime/shared/graphql-sdl.js';
 import { isMultiSelect, fieldConditions, isTranslatableField, isTranslatableMediaField, isRequiredField, isPrivateField, DEFAULT_MEDIA_MAX_FILE_SIZE } from '../dist/runtime/shared/index.js';
 import { scanMediaDirectory, readMediaFileMeta } from '../dist/runtime/server/utils/media-sync.js';
+import { createHash } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
 
 async function collectMediaManifest(root) {
   const files = await scanMediaDirectory(root);
@@ -40,6 +42,41 @@ function renderMediaManifestTypes(typesPath) {
   ].join("\n");
 }
 
+async function collectMigrations(migrationsDir) {
+  const journalPath = join(migrationsDir, "meta", "_journal.json");
+  if (!existsSync(journalPath)) return null;
+  const journal = JSON.parse(await readFile(journalPath, "utf8"));
+  const migrations = [];
+  for (const entry of journal.entries ?? []) {
+    const query = await readFile(join(migrationsDir, `${entry.tag}.sql`), "utf8");
+    migrations.push({
+      sql: query.split("--> statement-breakpoint"),
+      bps: entry.breakpoints,
+      folderMillis: entry.when,
+      hash: createHash("sha256").update(query).digest("hex")
+    });
+  }
+  return migrations;
+}
+function renderMigrationsFile(migrations) {
+  return [
+    `export const generated = ${migrations !== null}`,
+    ``,
+    `export const migrations = ${JSON.stringify(migrations ?? [], null, 3)}`,
+    ``
+  ].join("\n");
+}
+function renderMigrationsTypes(typesPath) {
+  return [
+    `import type { CmsMigration } from '${typesPath}'`,
+    ``,
+    `export declare const generated: boolean`,
+    ``,
+    `export declare const migrations: CmsMigration[]`,
+    ``
+  ].join("\n");
+}
+
 const IDENTIFIER = /^[a-z_]\w*$/i;
 const RESERVED_ENTRY_KEYS = ["admin", "auth", "login", "media", "graphql", "cms_media"];
 const RESERVED_COLUMNS = ["id", "status", "created_at", "updated_at"];
@@ -517,18 +554,34 @@ function resolveCmsEnabled(explicit, envValue) {
 }
 
 function resolveDatabaseOptions(database) {
+  const shared = {
+    migrateOnBoot: database?.migrateOnBoot ?? true,
+    poolMax: 0,
+    binding: "",
+    path: "data/cms.db",
+    url: "",
+    authToken: ""
+  };
   if (database?.driver === "postgres") {
-    return { driver: "postgres", path: "data/cms.db", url: database.url ?? "", authToken: "" };
+    return {
+      ...shared,
+      driver: "postgres",
+      url: database.url ?? "",
+      poolMax: database.poolMax ?? 0
+    };
   }
   if (database?.driver === "libsql") {
     return {
+      ...shared,
       driver: "libsql",
-      path: "data/cms.db",
       url: database.url ?? "",
       authToken: database.authToken ?? ""
     };
   }
-  return { driver: "sqlite", path: database?.path ?? "data/cms.db", url: "", authToken: "" };
+  if (database?.driver === "d1") {
+    return { ...shared, driver: "d1", binding: database.binding ?? "DB" };
+  }
+  return { ...shared, driver: "sqlite", path: database?.path ?? "data/cms.db" };
 }
 function resolveMediaOptions(media) {
   if (media?.storage === "local") {
@@ -591,7 +644,8 @@ const module$1 = defineNuxtModule({
     },
     database: {
       driver: "sqlite",
-      path: "data/cms.db"
+      path: "data/cms.db",
+      migrateOnBoot: true
     },
     media: {
       storage: "s3",
@@ -759,11 +813,24 @@ const module$1 = defineNuxtModule({
       driver,
       path: dbPath,
       url: databaseUrl,
-      authToken: databaseAuthToken
+      authToken: databaseAuthToken,
+      binding: d1Binding,
+      migrateOnBoot,
+      poolMax
     } = resolved.database;
     nuxt.options.alias["#cms-db"] = resolver.resolve(
-      driver === "postgres" ? "./runtime/server/utils/db-postgres" : driver === "libsql" ? "./runtime/server/utils/db-libsql" : "./runtime/server/utils/db-sqlite"
+      driver === "postgres" ? "./runtime/server/utils/db-postgres" : driver === "libsql" ? "./runtime/server/utils/db-libsql" : driver === "d1" ? "./runtime/server/utils/db-d1" : "./runtime/server/utils/db-sqlite"
     );
+    const driverPackage = driver === "postgres" ? "pg" : driver === "libsql" ? "@libsql/client" : "better-sqlite3";
+    if (driver !== "d1") {
+      try {
+        resolveImport(driverPackage);
+      } catch {
+        throw new Error(
+          `[nuxt-cms] database.driver is '${driver}' but '${driverPackage}' is not installed. Install it in your app (e.g. pnpm add ${driverPackage}); only the client for the driver you use is required.`
+        );
+      }
+    }
     const dialect = driver === "postgres" ? "postgresql" : driver === "libsql" ? "turso" : "sqlite";
     const resolvedDbPath = isAbsolute(dbPath) ? dbPath : resolve(nuxt.options.rootDir, dbPath);
     const migrationsDir = resolve(nuxt.options.rootDir, `server/db/migrations/${driver}`);
@@ -778,11 +845,32 @@ const module$1 = defineNuxtModule({
         `  dialect: '${dialect}',`,
         `  schema: '${toPosix(schemaTemplate.dst)}',`,
         `  out: '${toPosix(relativeMigrationsDir)}',`,
-        driver === "postgres" ? `  dbCredentials: { url: process.env.NUXT_CMS_DATABASE_URL ?? '${databaseUrl}' },` : driver === "libsql" ? `  dbCredentials: { url: process.env.NUXT_CMS_DATABASE_URL ?? '${databaseUrl || `file:${toPosix(resolvedDbPath)}`}', authToken: (process.env.NUXT_CMS_DATABASE_AUTH_TOKEN ?? '${databaseAuthToken}') || undefined },` : `  dbCredentials: { url: '${toPosix(resolvedDbPath)}' },`,
+        driver === "postgres" ? `  dbCredentials: { url: process.env.NUXT_CMS_DATABASE_URL ?? '${databaseUrl}' },` : driver === "libsql" ? `  dbCredentials: { url: process.env.NUXT_CMS_DATABASE_URL ?? '${databaseUrl || `file:${toPosix(resolvedDbPath)}`}', authToken: (process.env.NUXT_CMS_DATABASE_AUTH_TOKEN ?? '${databaseAuthToken}') || undefined },` : driver === "d1" ? `` : `  dbCredentials: { url: '${toPosix(resolvedDbPath)}' },`,
         `}`,
         ``
       ].join("\n")
     });
+    addTemplate({
+      filename: "cms/migrations.d.ts",
+      write: true,
+      getContents: () => renderMigrationsTypes(toPosix(resolver.resolve("./runtime/server/utils/migrate")))
+    });
+    const migrationsTemplate = addTemplate({
+      filename: "cms/migrations.js",
+      write: true,
+      getContents: async () => {
+        const migrations = await collectMigrations(migrationsDir);
+        if (!migrations && !nuxt.options.dev && Object.keys(cmsConfig).length) {
+          logger.warn(
+            `[nuxt-cms] No migrations found at ${migrationsDir}. The CMS tables will not be created \u2014 run the dev server once to generate them and commit ${toPosix(
+              relativeMigrationsDir
+            )}.`
+          );
+        }
+        return renderMigrationsFile(migrations);
+      }
+    });
+    nuxt.options.alias["#cms-migrations"] = migrationsTemplate.dst;
     const publicDir = resolve(nuxt.options.rootDir, nuxt.options.dir?.public ?? "public");
     const mediaLocalRoot = resolved.media.storage === "local" && resolved.media.publicBaseUrl.startsWith("/") ? join(publicDir, ...resolved.media.publicBaseUrl.split("/").filter(Boolean)) : "";
     if (resolved.media.storage === "local" && !mediaLocalRoot) {
@@ -817,7 +905,7 @@ const module$1 = defineNuxtModule({
     nuxt.options.alias["#cms-media-manifest"] = mediaManifestTemplate.dst;
     addServerPlugin(
       resolver.resolve(
-        driver === "postgres" ? "./runtime/server/plugins/migrate-postgres" : driver === "libsql" ? "./runtime/server/plugins/migrate-libsql" : "./runtime/server/plugins/migrate-sqlite"
+        driver === "postgres" ? "./runtime/server/plugins/migrate-postgres" : driver === "libsql" ? "./runtime/server/plugins/migrate-libsql" : driver === "d1" ? "./runtime/server/plugins/d1-binding" : "./runtime/server/plugins/migrate-sqlite"
       )
     );
     if (!nuxt.options.dev) {
@@ -851,6 +939,9 @@ const module$1 = defineNuxtModule({
       databaseAuthToken,
       dbPath: resolvedDbPath,
       migrationsDir,
+      migrateOnBoot,
+      poolMax,
+      d1Binding,
       ...existingConfig,
       graphql: {
         graphiql: nuxt.options.dev,
@@ -891,6 +982,12 @@ const module$1 = defineNuxtModule({
           "declare module '#imports' {",
           "  function getUserSession(event: H3Event): Promise<{ user?: import('#auth-utils').User }>",
           "  function setUserSession(event: H3Event, session: { user: import('#auth-utils').User }): Promise<unknown>",
+          "  function useStorage(base?: string): {",
+          "    getItem<T>(key: string): Promise<T | null>",
+          "    setItem<T>(key: string, value: T, options?: { ttl?: number }): Promise<void>",
+          "    removeItem(key: string): Promise<void>",
+          "    getKeys(base?: string): Promise<string[]>",
+          "  }",
           "}",
           "",
           "export {}",

package/dist/runtime/server/plugins/d1-binding.d.ts

@@ -0,0 +1,3 @@
+import type { NitroApp } from 'nitropack/types';
+declare const _default: (nitroApp: NitroApp) => void;
+export default _default;

package/dist/runtime/server/plugins/d1-binding.js

@@ -0,0 +1,15 @@
+import { setD1Env, useD1Binding } from "../utils/db-d1.js";
+import { runD1Migrations } from "../utils/migrate.js";
+let migrated = null;
+export default (nitroApp) => {
+  nitroApp.hooks.hook("request", async (event) => {
+    const env = event.context?.cloudflare?.env;
+    if (!env) return;
+    setD1Env(env);
+    migrated ??= runD1Migrations(useD1Binding()).catch((error) => {
+      migrated = null;
+      throw error;
+    });
+    await migrated;
+  });
+};

package/dist/runtime/server/plugins/migrate-libsql.js

@@ -1,17 +1,5 @@
-import { existsSync } from "node:fs";
-import { migrate } from "drizzle-orm/libsql/migrator";
-import cmsConfig from "#cms-config";
-import { useRuntimeConfig } from "#imports";
 import { useDb } from "../utils/db-libsql.js";
+import { runCmsMigrations } from "../utils/migrate.js";
 export default async () => {
-  const { migrationsDir } = useRuntimeConfig().cms;
-  if (!existsSync(migrationsDir)) {
-    if (Object.keys(cmsConfig).length) {
-      console.error(
-        `[nuxt-cms] Migrations folder not found: ${migrationsDir}. CMS tables may be missing \u2014 run the dev server once and deploy the generated server/db/migrations folder.`
-      );
-    }
-    return;
-  }
-  await migrate(useDb(), { migrationsFolder: migrationsDir });
+  await runCmsMigrations(useDb());
 };

package/dist/runtime/server/plugins/migrate-postgres.js

@@ -1,17 +1,5 @@
-import { existsSync } from "node:fs";
-import { migrate } from "drizzle-orm/node-postgres/migrator";
-import cmsConfig from "#cms-config";
-import { useRuntimeConfig } from "#imports";
 import { useDb } from "../utils/db-postgres.js";
+import { runCmsMigrations } from "../utils/migrate.js";
 export default async () => {
-  const { migrationsDir } = useRuntimeConfig().cms;
-  if (!existsSync(migrationsDir)) {
-    if (Object.keys(cmsConfig).length) {
-      console.error(
-        `[nuxt-cms] Migrations folder not found: ${migrationsDir}. CMS tables may be missing \u2014 run the dev server once and deploy the generated server/db/migrations folder.`
-      );
-    }
-    return;
-  }
-  await migrate(useDb(), { migrationsFolder: migrationsDir });
+  await runCmsMigrations(useDb());
 };

package/dist/runtime/server/plugins/migrate-sqlite.d.ts

@@ -1,2 +1,2 @@
-declare const _default: () => void;
+declare const _default: () => Promise<void>;
 export default _default;

package/dist/runtime/server/plugins/migrate-sqlite.js

@@ -1,17 +1,5 @@
-import { existsSync } from "node:fs";
-import { migrate } from "drizzle-orm/better-sqlite3/migrator";
-import cmsConfig from "#cms-config";
-import { useRuntimeConfig } from "#imports";
 import { useDb } from "../utils/db-sqlite.js";
-export default () => {
-  const { migrationsDir } = useRuntimeConfig().cms;
-  if (!existsSync(migrationsDir)) {
-    if (Object.keys(cmsConfig).length) {
-      console.error(
-        `[nuxt-cms] Migrations folder not found: ${migrationsDir}. CMS tables may be missing \u2014 run the dev server once and deploy the generated server/db/migrations folder.`
-      );
-    }
-    return;
-  }
-  migrate(useDb(), { migrationsFolder: migrationsDir });
+import { runCmsMigrations } from "../utils/migrate.js";
+export default async () => {
+  await runCmsMigrations(useDb());
 };

package/dist/runtime/server/routes/auth/login.post.js

@@ -1,7 +1,8 @@
 import { createHash, timingSafeEqual } from "node:crypto";
 import { createError, defineEventHandler, getRequestIP, readValidatedBody } from "h3";
 import { z } from "zod";
-import { setUserSession, useRuntimeConfig } from "#imports";
+import { setUserSession, useRuntimeConfig, useStorage } from "#imports";
+import { assertSameOrigin } from "../../utils/require-admin.js";
 const credentialsSchema = z.object({
   email: z.string().trim().min(1),
   password: z.string().min(1)
@@ -9,14 +10,37 @@ const credentialsSchema = z.object({
 const RATE_WINDOW_MS = 15 * 6e4;
 const RATE_MAX_FAILURES = 10;
 const RATE_GLOBAL_MAX_FAILURES = 100;
-const RATE_PRUNE_THRESHOLD = 1e3;
-const failures = /* @__PURE__ */ new Map();
-let globalFailures = { count: 0, resetAt: 0 };
-function pruneFailures(now) {
-  if (failures.size < RATE_PRUNE_THRESHOLD) return;
-  for (const [ip, entry] of failures) {
-    if (entry.resetAt <= now) failures.delete(ip);
-  }
+const RATE_PRUNE_EVERY = 200;
+const GLOBAL_KEY = "global";
+let writesSincePrune = 0;
+function rateStorage() {
+  return useStorage("cms:login-rate");
+}
+function rateKey(ip) {
+  return ip.replace(/[^a-z0-9]/gi, "-");
+}
+async function readEntry(key, now) {
+  const entry = await rateStorage().getItem(key);
+  return entry && entry.resetAt > now ? entry : null;
+}
+async function recordFailure(key, now) {
+  const current = await readEntry(key, now) ?? { count: 0, resetAt: now + RATE_WINDOW_MS };
+  current.count++;
+  await rateStorage().setItem(key, current, {
+    ttl: Math.ceil((current.resetAt - now) / 1e3)
+  });
+}
+async function prune(now) {
+  if (++writesSincePrune < RATE_PRUNE_EVERY) return;
+  writesSincePrune = 0;
+  const storage = rateStorage();
+  const keys = await storage.getKeys();
+  await Promise.all(
+    keys.map(async (key) => {
+      const entry = await storage.getItem(key);
+      if (!entry || entry.resetAt <= now) await storage.removeItem(key);
+    })
+  );
 }
 function safeEqual(a, b) {
   const hashA = createHash("sha256").update(a).digest();
@@ -24,17 +48,14 @@ function safeEqual(a, b) {
   return timingSafeEqual(hashA, hashB);
 }
 export default defineEventHandler(async (event) => {
-  const ip = getRequestIP(event, { xForwardedFor: true }) ?? "unknown";
+  assertSameOrigin(event);
+  const ip = rateKey(getRequestIP(event, { xForwardedFor: true }) ?? "unknown");
   const now = Date.now();
-  pruneFailures(now);
-  if (globalFailures.resetAt > now && globalFailures.count >= RATE_GLOBAL_MAX_FAILURES) {
-    throw createError({
-      statusCode: 429,
-      statusMessage: "Too many failed attempts, try again later"
-    });
-  }
-  const attempts = failures.get(ip);
-  if (attempts && attempts.resetAt > now && attempts.count >= RATE_MAX_FAILURES) {
+  const [attempts, globalFailures] = await Promise.all([
+    readEntry(ip, now),
+    readEntry(GLOBAL_KEY, now)
+  ]);
+  if (globalFailures && globalFailures.count >= RATE_GLOBAL_MAX_FAILURES || attempts && attempts.count >= RATE_MAX_FAILURES) {
     throw createError({
       statusCode: 429,
       statusMessage: "Too many failed attempts, try again later"
@@ -48,15 +69,10 @@ export default defineEventHandler(async (event) => {
   const emailOk = safeEqual(body.email.toLowerCase(), adminEmail.toLowerCase());
   const passwordOk = safeEqual(body.password, adminPassword);
   if (!emailOk || !passwordOk) {
-    const current = attempts && attempts.resetAt > now ? attempts : { count: 0, resetAt: now + RATE_WINDOW_MS };
-    current.count++;
-    failures.set(ip, current);
-    if (globalFailures.resetAt <= now)
-      globalFailures = { count: 0, resetAt: now + RATE_WINDOW_MS };
-    globalFailures.count++;
+    await Promise.all([recordFailure(ip, now), recordFailure(GLOBAL_KEY, now), prune(now)]);
     throw createError({ statusCode: 401, statusMessage: "Invalid credentials" });
   }
-  failures.delete(ip);
+  await rateStorage().removeItem(ip);
   await setUserSession(event, { user: { email: adminEmail.toLowerCase() } });
   return { loggedIn: true };
 });

package/dist/runtime/server/utils/db-d1.d.ts

@@ -0,0 +1,11 @@
+import { drizzle } from 'drizzle-orm/d1';
+export type D1Binding = Parameters<typeof drizzle>[0];
+export declare function setD1Env(env: Record<string, unknown>): void;
+export declare function useD1Binding(): D1Binding;
+export declare function useDb(): import("drizzle-orm/d1").DrizzleD1Database<Record<string, unknown>> & {
+    $client: MiniflareD1Database;
+};
+type Db = ReturnType<typeof useDb>;
+export type CmsDb = Db;
+export declare function withTransaction<T>(fn: (db: CmsDb) => Promise<T>): Promise<T>;
+export {};

package/dist/runtime/server/utils/db-d1.js

@@ -0,0 +1,26 @@
+import { drizzle } from "drizzle-orm/d1";
+import { useRuntimeConfig } from "#imports";
+let _env = null;
+let _db = null;
+export function setD1Env(env) {
+  if (_env === env) return;
+  _env = env;
+  _db = null;
+}
+export function useD1Binding() {
+  const { d1Binding } = useRuntimeConfig().cms;
+  const binding = _env?.[d1Binding];
+  if (!binding) {
+    throw new Error(
+      `[nuxt-cms] D1 binding '${d1Binding}' was not found on the Cloudflare environment. Declare it in wrangler.toml (or set cms.database.binding to the name you used).`
+    );
+  }
+  return binding;
+}
+export function useDb() {
+  if (!_db) _db = drizzle(useD1Binding());
+  return _db;
+}
+export function withTransaction(fn) {
+  return fn(useDb());
+}

package/dist/runtime/server/utils/db-libsql.js

@@ -1,23 +1,22 @@
-import { mkdirSync } from "node:fs";
 import { createRequire } from "node:module";
-import { dirname } from "node:path";
 import { createClient } from "@libsql/client/web";
 import { drizzle } from "drizzle-orm/libsql/web";
 import { useRuntimeConfig } from "#imports";
 let _db = null;
+function createFileDb(url, dbPath, authToken) {
+  const require = createRequire(import.meta.url);
+  const { mkdirSync } = require("node:fs");
+  const { dirname } = require("node:path");
+  mkdirSync(dirname(dbPath), { recursive: true });
+  const { createClient: createNativeClient } = require("@libsql/client");
+  const { drizzle: drizzleNative } = require("drizzle-orm/libsql");
+  return drizzleNative(createNativeClient({ url, authToken: authToken || void 0 }));
+}
 export function useDb() {
   if (!_db) {
     const { databaseUrl, databaseAuthToken, dbPath } = useRuntimeConfig().cms;
     const url = databaseUrl || `file:${dbPath}`;
-    if (url.startsWith("file:")) {
-      mkdirSync(dirname(dbPath), { recursive: true });
-      const require = createRequire(import.meta.url);
-      const { createClient: createNativeClient } = require("@libsql/client");
-      const { drizzle: drizzleNative } = require("drizzle-orm/libsql");
-      _db = drizzleNative(createNativeClient({ url, authToken: databaseAuthToken || void 0 }));
-    } else {
-      _db = drizzle(createClient({ url, authToken: databaseAuthToken || void 0 }));
-    }
+    _db = url.startsWith("file:") ? createFileDb(url, dbPath, databaseAuthToken) : drizzle(createClient({ url, authToken: databaseAuthToken || void 0 }));
   }
   return _db;
 }

package/dist/runtime/server/utils/db-postgres.js

@@ -4,13 +4,15 @@ import { useRuntimeConfig } from "#imports";
 let _db = null;
 export function useDb() {
   if (!_db) {
-    const { databaseUrl } = useRuntimeConfig().cms;
+    const { databaseUrl, poolMax } = useRuntimeConfig().cms;
     if (!databaseUrl) {
       throw new Error(
         "[nuxt-cms] Missing Postgres connection string: set NUXT_CMS_DATABASE_URL or cms.database.url"
       );
     }
-    _db = drizzle(new pg.Pool({ connectionString: databaseUrl }));
+    _db = drizzle(
+      new pg.Pool({ connectionString: databaseUrl, ...poolMax > 0 ? { max: poolMax } : {} })
+    );
   }
   return _db;
 }

package/dist/runtime/server/utils/migrate.d.ts

@@ -0,0 +1,8 @@
+export interface CmsMigration {
+    sql: string[];
+    bps: boolean;
+    folderMillis: number;
+    hash: string;
+}
+export declare function runCmsMigrations(db: unknown): Promise<void>;
+export declare function runD1Migrations(binding: unknown): Promise<void>;

package/dist/runtime/server/utils/migrate.js

@@ -0,0 +1,51 @@
+import cmsConfig from "#cms-config";
+import { migrations as bundledMigrations } from "#cms-migrations";
+import { useRuntimeConfig } from "#imports";
+const MIGRATIONS_TABLE = "__drizzle_migrations";
+async function readMigrations(migrationsDir) {
+  if (import.meta.dev) {
+    const { existsSync } = await import("node:fs");
+    if (!existsSync(`${migrationsDir}/meta/_journal.json`)) return [];
+    const { readMigrationFiles } = await import("drizzle-orm/migrator");
+    return readMigrationFiles({ migrationsFolder: migrationsDir });
+  }
+  return bundledMigrations;
+}
+async function pendingMigrations() {
+  const { migrationsDir, migrateOnBoot } = useRuntimeConfig().cms;
+  if (!migrateOnBoot) return [];
+  const migrations = await readMigrations(migrationsDir);
+  if (!migrations.length && Object.keys(cmsConfig).length) {
+    console.error(
+      `[nuxt-cms] No migrations were found for this build (expected in ${migrationsDir}). CMS tables may be missing \u2014 run the dev server once to generate them, commit server/db/migrations, and rebuild.`
+    );
+  }
+  return migrations;
+}
+export async function runCmsMigrations(db) {
+  const migrations = await pendingMigrations();
+  if (!migrations.length) return;
+  const { dialect, session } = db;
+  await dialect.migrate(migrations, session, {});
+}
+export async function runD1Migrations(binding) {
+  const migrations = await pendingMigrations();
+  if (!migrations.length) return;
+  const d1 = binding;
+  await d1.prepare(
+    `CREATE TABLE IF NOT EXISTS ${MIGRATIONS_TABLE} (id INTEGER PRIMARY KEY AUTOINCREMENT, hash text NOT NULL, created_at numeric)`
+  ).run();
+  const { results } = await d1.prepare(`SELECT created_at FROM ${MIGRATIONS_TABLE} ORDER BY created_at DESC LIMIT 1`).all();
+  const lastApplied = results[0]?.created_at;
+  const batch = [];
+  for (const migration of migrations) {
+    if (lastApplied != null && Number(lastApplied) >= migration.folderMillis) continue;
+    for (const statement of migration.sql) {
+      if (statement.trim()) batch.push(d1.prepare(statement));
+    }
+    batch.push(
+      d1.prepare(`INSERT INTO ${MIGRATIONS_TABLE} ("hash", "created_at") VALUES (?, ?)`).bind(migration.hash, migration.folderMillis)
+    );
+  }
+  if (batch.length) await d1.batch(batch);
+}

package/dist/runtime/server/utils/require-admin.d.ts

@@ -1,2 +1,3 @@
 import type { H3Event } from 'h3';
+export declare function assertSameOrigin(event: H3Event): void;
 export declare function requireAdmin(event: H3Event): Promise<void>;

package/dist/runtime/server/utils/require-admin.js

@@ -1,17 +1,27 @@
 import { createError, getRequestHeader, getRequestHost } from "h3";
 import { getUserSession, useRuntimeConfig } from "#imports";
-function assertSameOrigin(event) {
-  const origin = getRequestHeader(event, "origin");
-  if (!origin) return;
-  let originHost;
+const ORIGINLESS_SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+function hostOfUrl(value) {
+  if (!value) return void 0;
   try {
-    originHost = new URL(origin).host;
+    const url = new URL(value);
+    return url.protocol === "http:" || url.protocol === "https:" ? url.host : void 0;
   } catch {
-    originHost = void 0;
+    return void 0;
   }
-  if (!originHost || originHost !== getRequestHost(event, { xForwardedHost: true })) {
-    throw createError({ statusCode: 403, statusMessage: "Cross-origin request rejected" });
+}
+function rejectCrossOrigin() {
+  throw createError({ statusCode: 403, statusMessage: "Cross-origin request rejected" });
+}
+export function assertSameOrigin(event) {
+  const expectedHost = getRequestHost(event);
+  const origin = getRequestHeader(event, "origin");
+  if (origin) {
+    if (hostOfUrl(origin) !== expectedHost) rejectCrossOrigin();
+    return;
   }
+  if (ORIGINLESS_SAFE_METHODS.has(event.method)) return;
+  if (hostOfUrl(getRequestHeader(event, "referer")) !== expectedHost) rejectCrossOrigin();
 }
 export async function requireAdmin(event) {
   assertSameOrigin(event);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xleddyl/nuxt-cms",
-  "version": "0.1.36",
+  "version": "0.1.38",
   "description": "Lightweight CMS that ships with your Nuxt app: runs on the Nitro server, content types defined in code, /cms admin panel, GraphQL API, SQLite or Postgres. No external CMS needed!",
   "license": "MIT",
   "author": "Edoardo Alberti (https://github.com/xleddyl)",
@@ -62,13 +62,11 @@
   "dependencies": {
     "@fontsource-variable/hanken-grotesk": "^5.3.0",
     "@fontsource/fragment-mono": "^5.3.0",
-    "@libsql/client": "^0.17.4",
     "@nuxt/kit": "^4.4.8",
     "@tailwindcss/vite": "^4.3.2",
     "@tiptap/starter-kit": "^3.0.0",
     "@tiptap/vue-3": "^3.0.0",
     "aws4fetch": "^1.0.20",
-    "better-sqlite3": "^12.2.0",
     "drizzle-kit": "^0.31.0",
     "drizzle-orm": "^0.44.0",
     "gql.tada": "^1.11.2",
@@ -76,18 +74,38 @@
     "graphql-yoga": "^5.10.0",
     "jiti": "^2.7.0",
     "nuxt-auth-utils": "^0.5.29",
-    "pg": "^8.16.0",
     "tailwindcss": "^4.3.2",
     "vite-svg-loader": "^5.1.0",
     "zod": "^4.0.0"
   },
+  "optionalDependencies": {
+    "better-sqlite3": "^12.2.0"
+  },
+  "peerDependencies": {
+    "@libsql/client": "^0.17.4",
+    "better-sqlite3": "^12.2.0",
+    "pg": "^8.16.0"
+  },
+  "peerDependenciesMeta": {
+    "@libsql/client": {
+      "optional": true
+    },
+    "better-sqlite3": {
+      "optional": true
+    },
+    "pg": {
+      "optional": true
+    }
+  },
   "devDependencies": {
+    "@libsql/client": "^0.17.4",
     "@nuxt/devtools": "^3.2.4",
     "@nuxt/module-builder": "^1.0.2",
     "@nuxt/schema": "^4.4.8",
     "@types/better-sqlite3": "^7.6.13",
     "@types/node": "latest",
     "@types/pg": "^8.11.0",
+    "pg": "^8.16.0",
     "changelogen": "^0.6.0",
     "h3": "^1.15.11",
     "nuxt": "^4.4.8",