@xleddyl/nuxt-cms 0.1.61 → 0.2.1

package/dist/runtime/server/api/users.post.js

@@ -0,0 +1,36 @@
+import { createError, defineEventHandler, readValidatedBody } from "h3";
+import { z } from "zod";
+import { useDb } from "#cms-db";
+import { cms_users } from "#cms-tables";
+import { MIN_PASSWORD_LENGTH } from "../../shared/index.js";
+import { customId } from "../utils/custom-id.js";
+import { mapConstraintErrors } from "../utils/db-errors.js";
+import { hashPassword } from "../utils/password.js";
+import { isSuperAdminEmail, requireSuperAdmin } from "../utils/require-admin.js";
+import { findUserByEmail, toAccount } from "../utils/users.js";
+const bodySchema = z.object({
+  email: z.string().trim().toLowerCase().email().max(254),
+  name: z.string().trim().max(120).nullish(),
+  password: z.string().min(MIN_PASSWORD_LENGTH).max(256)
+});
+export default defineEventHandler(async (event) => {
+  await requireSuperAdmin(event);
+  const body = await readValidatedBody(event, bodySchema.parse);
+  if (isSuperAdminEmail(event, body.email) || await findUserByEmail(body.email)) {
+    throw createError({ statusCode: 409, statusMessage: "A user with this email already exists" });
+  }
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const passwordHash = await hashPassword(body.password);
+  const [row] = await mapConstraintErrors(
+    () => useDb().insert(cms_users).values({
+      id: customId("usr"),
+      email: body.email,
+      name: body.name || null,
+      role: "admin",
+      passwordHash,
+      createdAt: now,
+      updatedAt: now
+    }).returning()
+  );
+  return toAccount(row);
+});

package/dist/runtime/server/plugins/session-validate.d.ts

@@ -0,0 +1,2 @@
+declare const _default: () => void;
+export default _default;

package/dist/runtime/server/plugins/session-validate.js

@@ -0,0 +1,13 @@
+import { createError } from "h3";
+import { clearUserSession, sessionHooks } from "#imports";
+import { findUserById, passwordStamp } from "../utils/users.js";
+export default () => {
+  sessionHooks.hook("fetch", async (session, event) => {
+    const user = session.user;
+    if (!user?.id) return;
+    const row = await findUserById(user.id);
+    if (row && user.passwordStamp === passwordStamp(row.passwordHash)) return;
+    await clearUserSession(event);
+    throw createError({ statusCode: 401, statusMessage: "Session expired" });
+  });
+};

package/dist/runtime/server/routes/auth/login.post.js

@@ -1,11 +1,16 @@
 import { createHash, timingSafeEqual } from "node:crypto";
 import { createError, defineEventHandler, getRequestIP, readValidatedBody } from "h3";
 import { z } from "zod";
-import { setUserSession, useRuntimeConfig, useStorage } from "#imports";
-import { assertSameOrigin } from "../../utils/require-admin.js";
+import { replaceUserSession, useRuntimeConfig, useStorage } from "#imports";
+import { eq } from "drizzle-orm";
+import { useDb } from "#cms-db";
+import { cms_users } from "#cms-tables";
+import { verifyNothing, verifyPassword } from "../../utils/password.js";
+import { assertSameOrigin } from "../../utils/same-origin.js";
+import { findUserByEmail, sessionUserFor } from "../../utils/users.js";
 const credentialsSchema = z.object({
-  email: z.string().trim().min(1),
-  password: z.string().min(1)
+  email: z.string().trim().min(1).max(254),
+  password: z.string().min(1).max(256)
 });
 const RATE_WINDOW_MS = 15 * 6e4;
 const RATE_MAX_FAILURES = 10;
@@ -62,17 +67,22 @@ export default defineEventHandler(async (event) => {
     });
   }
   const body = await readValidatedBody(event, credentialsSchema.parse);
+  const email = body.email.toLowerCase();
   const { adminEmail, adminPassword } = useRuntimeConfig(event).cms;
-  if (!adminEmail || !adminPassword) {
-    throw createError({ statusCode: 403, statusMessage: "Admin credentials are not configured" });
+  const superAdmin = !!adminEmail && !!adminPassword && safeEqual(email, adminEmail.toLowerCase()) && safeEqual(body.password, adminPassword);
+  if (superAdmin) {
+    await rateStorage().removeItem(ip);
+    await replaceUserSession(event, { user: { email, role: "superadmin" } });
+    return { loggedIn: true };
   }
-  const emailOk = safeEqual(body.email.toLowerCase(), adminEmail.toLowerCase());
-  const passwordOk = safeEqual(body.password, adminPassword);
-  if (!emailOk || !passwordOk) {
+  const row = await findUserByEmail(email);
+  const passwordOk = row ? await verifyPassword(row.passwordHash, body.password) : await verifyNothing(body.password);
+  if (!row || !passwordOk) {
     await Promise.all([recordFailure(ip, now), recordFailure(GLOBAL_KEY, now), prune(now)]);
     throw createError({ statusCode: 401, statusMessage: "Invalid credentials" });
   }
   await rateStorage().removeItem(ip);
-  await setUserSession(event, { user: { email: adminEmail.toLowerCase() } });
+  await useDb().update(cms_users).set({ lastLoginAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq(cms_users.id, row.id));
+  await replaceUserSession(event, { user: sessionUserFor(row) });
   return { loggedIn: true };
 });

package/dist/runtime/server/utils/graphql-depth.js

@@ -1,24 +1,31 @@
 import { GraphQLError, Kind } from "graphql";
 const DEFAULT_MAX_DEPTH = 8;
 const DEFAULT_MAX_FIELDS = 500;
-function measure(selectionSet, fragments, visited) {
+function measure(selectionSet, fragments, visited, fragmentDepths) {
   let max = 0;
   for (const selection of selectionSet.selections) {
     if (selection.kind === Kind.FIELD) {
       if (selection.name.value.startsWith("__")) continue;
-      const depth = selection.selectionSet ? 1 + measure(selection.selectionSet, fragments, visited) : 1;
+      const depth = selection.selectionSet ? 1 + measure(selection.selectionSet, fragments, visited, fragmentDepths) : 1;
       max = Math.max(max, depth);
     } else if (selection.kind === Kind.FRAGMENT_SPREAD) {
       const name = selection.name.value;
       if (visited.has(name)) continue;
+      const known = fragmentDepths.get(name);
+      if (known !== void 0) {
+        max = Math.max(max, known);
+        continue;
+      }
       const fragment = fragments.get(name);
       if (fragment) {
         visited.add(name);
-        max = Math.max(max, measure(fragment.selectionSet, fragments, visited));
+        const depth = measure(fragment.selectionSet, fragments, visited, fragmentDepths);
         visited.delete(name);
+        fragmentDepths.set(name, depth);
+        max = Math.max(max, depth);
       }
     } else if (selection.kind === Kind.INLINE_FRAGMENT) {
-      max = Math.max(max, measure(selection.selectionSet, fragments, visited));
+      max = Math.max(max, measure(selection.selectionSet, fragments, visited, fragmentDepths));
     }
   }
   return max;
@@ -32,7 +39,7 @@ export function createDepthRule(maxDepth) {
         if (definition.kind === Kind.FRAGMENT_DEFINITION)
           fragments.set(definition.name.value, definition);
       }
-      const depth = measure(node.selectionSet, fragments, /* @__PURE__ */ new Set());
+      const depth = measure(node.selectionSet, fragments, /* @__PURE__ */ new Set(), /* @__PURE__ */ new Map());
       if (depth > limit) {
         context.reportError(
           new GraphQLError(`Query is too deep: depth ${depth} exceeds the maximum of ${limit}`)

package/dist/runtime/server/utils/graphql.js

@@ -16,7 +16,7 @@ import {
 import { GraphQLError, GraphQLScalarType, valueFromASTUntyped } from "graphql";
 import { createSchema } from "graphql-yoga";
 import cmsConfig from "#cms-config";
-import { useDb } from "#cms-db";
+import { cmsDialect, useDb } from "#cms-db";
 import * as cmsTables from "#cms-tables";
 import { useRuntimeConfig } from "#imports";
 import {
@@ -129,7 +129,7 @@ const OPERATORS = {
   lte: (column, value) => lte(column, value),
   like: (column, value) => {
     const pattern = String(value).replaceAll("\\", "\\\\").replaceAll("%", "\\%").replaceAll("_", "\\_").replaceAll("*", "%");
-    return sql`${column} like ${pattern} escape '\\'`;
+    return cmsDialect === "postgres" ? sql`cast(${column} as text) ilike ${pattern} escape '\\'` : sql`${column} like ${pattern} escape '\\'`;
   },
   in: (column, value) => inArray(column, value)
 };

package/dist/runtime/server/utils/media-folders.js

@@ -1,8 +1,11 @@
-import { inArray, like, or } from "drizzle-orm";
+import { eq, inArray, or, sql } from "drizzle-orm";
 import { useDb } from "#cms-db";
 import { cms_media } from "#cms-tables";
 import { mediaFolderMarkerKey } from "../../shared/index.js";
 const KEY_CHUNK = 90;
+function escapeLike(value) {
+  return value.replaceAll("\\", "\\\\").replaceAll("%", "\\%").replaceAll("_", "\\_");
+}
 export async function writeMediaFolderMarker(store, folder) {
   const key = mediaFolderMarkerKey(folder);
   await store.write(key, new Uint8Array(), "application/x-empty");
@@ -18,7 +21,12 @@ export async function writeMediaFolderMarker(store, folder) {
   await useDb().insert(cms_media).values(values).onConflictDoUpdate({ target: cms_media.key, set: values });
 }
 export function mediaRowsInFolder(folder) {
-  return useDb().select({ key: cms_media.key, folder: cms_media.folder }).from(cms_media).where(or(like(cms_media.folder, `${folder}/%`), like(cms_media.folder, folder)));
+  return useDb().select({ key: cms_media.key, folder: cms_media.folder }).from(cms_media).where(
+    or(
+      sql`${cms_media.folder} like ${`${escapeLike(folder)}/%`} escape '\\'`,
+      eq(cms_media.folder, folder)
+    )
+  );
 }
 export async function deleteMediaRows(store, keys) {
   for (const key of keys) {

package/dist/runtime/server/utils/media.d.ts

@@ -20,6 +20,7 @@ export interface MediaStore {
     write: (key: string, body: Uint8Array<ArrayBuffer>, contentType: string) => Promise<void>;
     remove: (key: string) => Promise<void>;
 }
+export declare function baseContentType(contentType: string): string;
 export declare function isAllowedUploadType(contentType: string): boolean;
 export declare function assertUploadContentType(contentType: string): void;
 export declare function assertUploadSize(size: number, maxFileSize: number): void;

package/dist/runtime/server/utils/media.js

@@ -20,8 +20,11 @@ const UPLOAD_TYPES = /* @__PURE__ */ new Set([
   "application/vnd.ms-powerpoint",
   "application/vnd.openxmlformats-officedocument.presentationml.presentation"
 ]);
+export function baseContentType(contentType) {
+  return contentType.split(";")[0].trim().toLowerCase();
+}
 export function isAllowedUploadType(contentType) {
-  const type = contentType.toLowerCase();
+  const type = baseContentType(contentType);
   return !UPLOAD_TYPE_BLOCKLIST.has(type) && (UPLOAD_TYPES.has(type) || UPLOAD_TYPE_PREFIXES.some((prefix) => type.startsWith(prefix)));
 }
 export function assertUploadContentType(contentType) {

package/dist/runtime/server/utils/migrate.js

@@ -18,7 +18,7 @@ async function pendingMigrations() {
   const migrations = await readMigrations(migrationsDir);
   if (!migrations.length && Object.keys(cmsConfig).length) {
     console.error(
-      `[nuxt-cms] No migrations were found for this build (expected in ${migrationsDir}). CMS tables may be missing \u2014 run the dev server once to generate them, commit server/db/migrations, and rebuild.`
+      `[nuxt-cms] No migrations were found for this build (expected in ${migrationsDir}). CMS tables may be missing. Run the dev server once to generate them, commit server/db/migrations, and rebuild.`
     );
   }
   return migrations;

package/dist/runtime/server/utils/password.d.ts

@@ -0,0 +1,3 @@
+export declare function hashPassword(password: string): Promise<string>;
+export declare function verifyPassword(stored: string, password: string): Promise<boolean>;
+export declare function verifyNothing(password: string): Promise<false>;

package/dist/runtime/server/utils/password.js

@@ -0,0 +1,31 @@
+import { randomBytes, scrypt, timingSafeEqual } from "node:crypto";
+const KEY_LENGTH = 64;
+const COST = 16384;
+function derive(password, salt, cost) {
+  return new Promise((resolve, reject) => {
+    scrypt(
+      password,
+      salt,
+      KEY_LENGTH,
+      { N: cost, r: 8, p: 1 },
+      (error, key) => error ? reject(error) : resolve(key)
+    );
+  });
+}
+export async function hashPassword(password) {
+  const salt = randomBytes(16);
+  const key = await derive(password, salt, COST);
+  return `scrypt$${COST}$${salt.toString("base64")}$${key.toString("base64")}`;
+}
+export async function verifyPassword(stored, password) {
+  const [scheme, cost, salt, key] = stored.split("$");
+  if (scheme !== "scrypt" || !cost || !salt || !key) return false;
+  const expected = Buffer.from(key, "base64");
+  const actual = await derive(password, Buffer.from(salt, "base64"), Number(cost));
+  return actual.length === expected.length && timingSafeEqual(actual, expected);
+}
+const DUMMY_HASH = "scrypt$16384$AAAAAAAAAAAAAAAAAAAAAA==$AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
+export async function verifyNothing(password) {
+  await verifyPassword(DUMMY_HASH, password);
+  return false;
+}

package/dist/runtime/server/utils/require-admin.d.ts

@@ -1,3 +1,5 @@
 import type { H3Event } from 'h3';
-export declare function assertSameOrigin(event: H3Event): void;
-export declare function requireAdmin(event: H3Event): Promise<void>;
+import type { CmsSessionUser } from '../../shared/index.js';
+export declare function isSuperAdminEmail(event: H3Event, email: string): boolean;
+export declare function requireAdmin(event: H3Event): Promise<CmsSessionUser>;
+export declare function requireSuperAdmin(event: H3Event): Promise<CmsSessionUser>;

package/dist/runtime/server/utils/require-admin.js

@@ -1,37 +1,41 @@
-import { createError, getRequestHeader, getRequestHost } from "h3";
+import { createError } from "h3";
 import { getUserSession, useRuntimeConfig } from "#imports";
-const ORIGINLESS_SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
-function hostOfUrl(value) {
-  if (!value) return void 0;
-  try {
-    const url = new URL(value);
-    return url.protocol === "http:" || url.protocol === "https:" ? url.host : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function rejectCrossOrigin() {
-  throw createError({ statusCode: 403, statusMessage: "Cross-origin request rejected" });
-}
-export function assertSameOrigin(event) {
-  const expectedHost = getRequestHost(event);
-  const origin = getRequestHeader(event, "origin");
-  if (origin) {
-    if (hostOfUrl(origin) !== expectedHost) rejectCrossOrigin();
-    return;
-  }
-  if (ORIGINLESS_SAFE_METHODS.has(event.method)) return;
-  if (hostOfUrl(getRequestHeader(event, "referer")) !== expectedHost) rejectCrossOrigin();
+import { assertSameOrigin } from "./same-origin.js";
+import { findUserById, passwordStamp } from "./users.js";
+export function isSuperAdminEmail(event, email) {
+  const { adminEmail } = useRuntimeConfig(event).cms;
+  return !!adminEmail && email.toLowerCase() === adminEmail.toLowerCase();
 }
 export async function requireAdmin(event) {
   assertSameOrigin(event);
   const session = await getUserSession(event);
-  const email = session.user?.email;
-  if (!email) {
+  const user = session.user;
+  if (!user?.email) {
     throw createError({ statusCode: 401, statusMessage: "Authentication required" });
   }
-  const { adminEmail } = useRuntimeConfig(event).cms;
-  if (!adminEmail || email.toLowerCase() !== adminEmail.toLowerCase()) {
-    throw createError({ statusCode: 403, statusMessage: "Not authorized" });
+  if (!user.id) {
+    if (!isSuperAdminEmail(event, user.email)) {
+      throw createError({ statusCode: 403, statusMessage: "Not authorized" });
+    }
+    return { email: user.email.toLowerCase(), name: null, role: "superadmin" };
+  }
+  const row = await findUserById(user.id);
+  if (!row || user.passwordStamp !== passwordStamp(row.passwordHash)) {
+    throw createError({ statusCode: 401, statusMessage: "Authentication required" });
+  }
+  return {
+    id: row.id,
+    email: row.email,
+    name: row.name ?? null,
+    role: "admin",
+    firstLogin: !!row.mustChangePassword,
+    passwordStamp: user.passwordStamp
+  };
+}
+export async function requireSuperAdmin(event) {
+  const user = await requireAdmin(event);
+  if (user.role !== "superadmin") {
+    throw createError({ statusCode: 403, statusMessage: "Only the super admin can manage users" });
   }
+  return user;
 }

package/dist/runtime/server/utils/same-origin.d.ts

@@ -0,0 +1,2 @@
+import type { H3Event } from 'h3';
+export declare function assertSameOrigin(event: H3Event): void;

package/dist/runtime/server/utils/same-origin.js

@@ -0,0 +1,24 @@
+import { createError, getRequestHeader, getRequestHost } from "h3";
+const ORIGINLESS_SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+function hostOfUrl(value) {
+  if (!value) return void 0;
+  try {
+    const url = new URL(value);
+    return url.protocol === "http:" || url.protocol === "https:" ? url.host : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function rejectCrossOrigin() {
+  throw createError({ statusCode: 403, statusMessage: "Cross-origin request rejected" });
+}
+export function assertSameOrigin(event) {
+  const expectedHost = getRequestHost(event);
+  const origin = getRequestHeader(event, "origin");
+  if (origin) {
+    if (hostOfUrl(origin) !== expectedHost) rejectCrossOrigin();
+    return;
+  }
+  if (ORIGINLESS_SAFE_METHODS.has(event.method)) return;
+  if (hostOfUrl(getRequestHeader(event, "referer")) !== expectedHost) rejectCrossOrigin();
+}

package/dist/runtime/server/utils/settings.d.ts

@@ -0,0 +1,16 @@
+import type { H3Event } from 'h3';
+import { z } from 'zod';
+import type { CmsEntrySettings } from '../../shared/index.js';
+export declare const entrySettingsSchema: z.ZodObject<{
+    columns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    layout: z.ZodOptional<z.ZodObject<{
+        main: z.ZodArray<z.ZodObject<{
+            title: z.ZodOptional<z.ZodString>;
+            description: z.ZodOptional<z.ZodString>;
+            collapsed: z.ZodOptional<z.ZodBoolean>;
+            rows: z.ZodArray<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$strict>;
+export declare function requireSettingsKey(event: H3Event): string;
+export declare function parseSettingsValue(raw: string): CmsEntrySettings | null;

package/dist/runtime/server/utils/settings.js

@@ -0,0 +1,31 @@
+import { createError, getRouterParam } from "h3";
+import { z } from "zod";
+import cmsConfig from "#cms-config";
+const fieldKey = z.string().min(1).max(128);
+const sectionSchema = z.object({
+  title: z.string().max(200).optional(),
+  description: z.string().max(1e3).optional(),
+  collapsed: z.boolean().optional(),
+  rows: z.array(z.array(fieldKey).max(4)).max(500)
+});
+export const entrySettingsSchema = z.object({
+  columns: z.array(fieldKey).max(200).optional(),
+  layout: z.object({
+    main: z.array(sectionSchema).max(100)
+  }).optional()
+}).strict();
+export function requireSettingsKey(event) {
+  const key = getRouterParam(event, "key") ?? "";
+  if (!Object.hasOwn(cmsConfig, key)) {
+    throw createError({ statusCode: 404, statusMessage: `Unknown entry: ${key}` });
+  }
+  return key;
+}
+export function parseSettingsValue(raw) {
+  try {
+    const parsed = entrySettingsSchema.safeParse(JSON.parse(raw));
+    return parsed.success ? parsed.data : null;
+  } catch {
+    return null;
+  }
+}

package/dist/runtime/server/utils/users.d.ts

@@ -0,0 +1,15 @@
+import { cms_users } from '#cms-tables';
+import type { CmsAccount } from '../../shared/index.js';
+export type CmsUserRow = typeof cms_users.$inferSelect;
+export declare function findUserByEmail(email: string): Promise<CmsUserRow | undefined>;
+export declare function findUserById(id: string): Promise<CmsUserRow | undefined>;
+export declare function passwordStamp(passwordHash: string): string;
+export declare function sessionUserFor(row: CmsUserRow): {
+    id: string;
+    email: string;
+    name: string | null;
+    role: "admin";
+    firstLogin: boolean;
+    passwordStamp: string;
+};
+export declare function toAccount(row: CmsUserRow): CmsAccount;

package/dist/runtime/server/utils/users.js

@@ -0,0 +1,34 @@
+import { eq } from "drizzle-orm";
+import { useDb } from "#cms-db";
+import { cms_users } from "#cms-tables";
+export async function findUserByEmail(email) {
+  const [row] = await useDb().select().from(cms_users).where(eq(cms_users.email, email.toLowerCase()));
+  return row;
+}
+export async function findUserById(id) {
+  const [row] = await useDb().select().from(cms_users).where(eq(cms_users.id, id));
+  return row;
+}
+export function passwordStamp(passwordHash) {
+  return passwordHash.slice(-16);
+}
+export function sessionUserFor(row) {
+  return {
+    id: row.id,
+    email: row.email,
+    name: row.name ?? null,
+    role: "admin",
+    firstLogin: !!row.mustChangePassword,
+    passwordStamp: passwordStamp(row.passwordHash)
+  };
+}
+export function toAccount(row) {
+  return {
+    id: row.id,
+    email: row.email,
+    name: row.name ?? null,
+    role: row.role,
+    lastLoginAt: row.lastLoginAt ?? null,
+    createdAt: String(row.createdAt)
+  };
+}

package/dist/runtime/shared/index.d.ts

@@ -1,5 +1,6 @@
 import type { PgTable } from 'drizzle-orm/pg-core';
 import type { SQLiteTable } from 'drizzle-orm/sqlite-core';
+import type { CmsLayoutBlock, CmsListInput } from './layout.js';
 export type CmsTable = SQLiteTable | PgTable;
 export type FieldType = 'text' | 'richtext' | 'number' | 'boolean' | 'date' | 'email' | 'slug' | 'select' | 'json' | 'media' | 'relation' | 'blocks';
 export interface CmsI18n {
@@ -76,6 +77,8 @@ export interface CmsTab {
 export interface FieldConfig {
     label: string;
     type: FieldType;
+    description?: string;
+    placeholder?: string;
     tab?: string;
     required?: boolean;
     private?: boolean;
@@ -138,6 +141,9 @@ export interface CmsEntry {
     columns?: string[];
     tabs?: CmsTab[];
     table?: CmsTable;
+    icon?: string;
+    layout?: CmsLayoutBlock[];
+    list?: CmsListInput;
 }
 export declare const MOBILE_MEDIA_SUFFIX = "Mobile";
 export declare function mobileMediaKey(key: string): string;
@@ -168,6 +174,8 @@ export declare function blocksFieldTypeName(entryName: string, fieldKey: string)
 export declare function blockTypeName(entryName: string, fieldKey: string, blockName: string): string;
 interface FieldInputBase {
     label: string;
+    description?: string;
+    placeholder?: string;
     required?: boolean;
     private?: boolean;
     tab?: string;
@@ -234,6 +242,9 @@ export type CmsFieldInput = TextFieldInput | RichtextFieldInput | NumberFieldInp
 interface CmsEntryInputBase {
     id: string;
     label: string;
+    icon?: string;
+    layout?: CmsLayoutBlock[];
+    list?: CmsListInput;
     drafts?: boolean;
     tabs?: CmsTab[];
     fields: Record<string, CmsFieldInput>;
@@ -261,4 +272,5 @@ export interface CmsPageInput extends CmsEntryInputBase {
 export type CmsEntryInput = CmsCollectionInput | CmsSingleInput | CmsPageInput;
 export type CmsConfigInput = Record<string, CmsEntryInput>;
 export declare function defineCmsConfig<T extends CmsConfigInput>(config: T): T;
-export {};
+export * from './layout.js';
+export * from './users.js';

package/dist/runtime/shared/index.js

@@ -379,3 +379,5 @@ export function blockTypeName(entryName, fieldKey, blockName) {
 export function defineCmsConfig(config) {
   return config;
 }
+export * from "./layout.js";
+export * from "./users.js";

package/dist/runtime/shared/layout.d.ts

@@ -0,0 +1,33 @@
+import type { FieldConfig } from './index.js';
+export declare const MAX_LAYOUT_ROW_FIELDS = 4;
+export type CmsLayoutRow = string | string[];
+export interface CmsLayoutSectionInput {
+    title: string;
+    description?: string;
+    collapsed?: boolean;
+    rows: CmsLayoutRow[];
+}
+export type CmsLayoutBlock = CmsLayoutRow | CmsLayoutSectionInput;
+export interface CmsLayoutSection {
+    title?: string;
+    description?: string;
+    collapsed?: boolean;
+    rows: string[][];
+}
+export interface CmsFormLayout {
+    main: CmsLayoutSection[];
+}
+export interface CmsListInput {
+    columns?: string[];
+}
+export interface CmsEntrySettings {
+    columns?: string[];
+    layout?: CmsFormLayout;
+}
+export type CmsSettingsMap = Record<string, CmsEntrySettings>;
+export declare function layoutFromConfig(input: CmsLayoutBlock[] | undefined): CmsFormLayout;
+export declare function resolveFormLayout(fields: Record<string, FieldConfig>, layout: CmsFormLayout | undefined): CmsFormLayout;
+export declare function defaultListColumns(fields: Record<string, FieldConfig>, list: CmsListInput | undefined, extra?: string[]): string[];
+export declare function resolveListColumns(fields: Record<string, FieldConfig>, saved: string[] | undefined, list: CmsListInput | undefined, extra?: string[]): string[];
+export declare function layoutErrors(at: string, fields: Record<string, FieldConfig>, input: CmsLayoutBlock[] | undefined): string[];
+export declare function listErrors(at: string, fields: Record<string, FieldConfig>, list: CmsListInput | undefined, extra?: string[]): string[];