@xleddyl/nuxt-cms 0.2.0 → 0.2.2

package/dist/runtime/server/api/media.delete.js

@@ -3,6 +3,7 @@ import { createError, defineEventHandler, getValidatedQuery } from "h3";
 import { z } from "zod";
 import { useDb } from "#cms-db";
 import { cms_media } from "#cms-tables";
+import { isMediaFolderMarker } from "../../shared/index.js";
 import { objectKeySchema } from "../../shared/validation.js";
 import { useMediaStorage } from "../utils/media.js";
 import { requireAdmin } from "../utils/require-admin.js";
@@ -13,10 +14,10 @@ export default defineEventHandler(async (event) => {
   const { key } = await getValidatedQuery(event, querySchema.parse);
   const db = useDb();
   const [row] = await db.select().from(cms_media).where(eq(cms_media.key, key)).limit(1);
-  if (!row) {
+  if (!row || isMediaFolderMarker(key)) {
     throw createError({ statusCode: 404, statusMessage: "Media not found" });
   }
-  await store.remove(key);
   await db.delete(cms_media).where(eq(cms_media.key, key));
+  await store.remove(key);
   return { ok: true };
 });

package/dist/runtime/server/api/media.post.js

@@ -4,11 +4,13 @@ import { z } from "zod";
 import { useDb } from "#cms-db";
 import { cms_media } from "#cms-tables";
 import { normalizeMediaFolder } from "../../shared/index.js";
+import { nowTimestamp } from "../../shared/timestamps.js";
 import { objectKeySchema } from "../../shared/validation.js";
 import { requireMediaFilePath } from "../utils/media-fs.js";
 import {
   assertMediaWritable,
   assertUploadContentType,
+  baseContentType,
   toMediaItem,
   useMediaConfig
 } from "../utils/media.js";
@@ -33,13 +35,13 @@ export default defineEventHandler(async (event) => {
   }
   const values = {
     key: body.key,
-    mime: body.mime ?? null,
+    mime: body.mime ? baseContentType(body.mime) : null,
     size: body.size ?? null,
     width: body.width ?? null,
     height: body.height ?? null,
     alt: body.alt ?? null,
     folder: normalizeMediaFolder(body.folder)
   };
-  const [row] = await useDb().insert(cms_media).values(values).onConflictDoUpdate({ target: cms_media.key, set: values }).returning();
+  const [row] = await useDb().insert(cms_media).values({ ...values, createdAt: nowTimestamp() }).onConflictDoUpdate({ target: cms_media.key, set: values }).returning();
   return toMediaItem(row, publicUrl);
 });

package/dist/runtime/server/api/media.put.js

@@ -4,11 +4,13 @@ import { z } from "zod";
 import { useDb } from "#cms-db";
 import { cms_media } from "#cms-tables";
 import { normalizeMediaFolder } from "../../shared/index.js";
+import { nowTimestamp } from "../../shared/timestamps.js";
+import { objectKeySchema } from "../../shared/validation.js";
 import { useMediaIndex } from "../utils/media-index.js";
 import { assertMediaWritable, toMediaItem, useMediaConfig } from "../utils/media.js";
 import { requireAdmin } from "../utils/require-admin.js";
 const bodySchema = z.object({
-  key: z.string().min(1).max(1024),
+  key: objectKeySchema,
   alt: z.string().max(1024).nullish(),
   folder: z.string().max(255).nullish()
 });
@@ -28,7 +30,7 @@ export default defineEventHandler(async (event) => {
       throw createError({ statusCode: 404, statusMessage: "Media not found" });
     }
     const alt = body.alt ?? null;
-    await useDb().insert(cms_media).values({ key: body.key, alt }).onConflictDoUpdate({ target: cms_media.key, set: { alt } });
+    await useDb().insert(cms_media).values({ key: body.key, alt, createdAt: nowTimestamp() }).onConflictDoUpdate({ target: cms_media.key, set: { alt } });
     return toMediaItem({ ...file, alt, createdAt: null }, publicUrl);
   }
   assertMediaWritable(media);

package/dist/runtime/server/api/users.post.js

@@ -4,6 +4,7 @@ import { useDb } from "#cms-db";
 import { cms_users } from "#cms-tables";
 import { MIN_PASSWORD_LENGTH } from "../../shared/index.js";
 import { customId } from "../utils/custom-id.js";
+import { mapConstraintErrors } from "../utils/db-errors.js";
 import { hashPassword } from "../utils/password.js";
 import { isSuperAdminEmail, requireSuperAdmin } from "../utils/require-admin.js";
 import { findUserByEmail, toAccount } from "../utils/users.js";
@@ -19,14 +20,17 @@ export default defineEventHandler(async (event) => {
     throw createError({ statusCode: 409, statusMessage: "A user with this email already exists" });
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const [row] = await useDb().insert(cms_users).values({
-    id: customId("usr"),
-    email: body.email,
-    name: body.name || null,
-    role: "admin",
-    passwordHash: await hashPassword(body.password),
-    createdAt: now,
-    updatedAt: now
-  }).returning();
+  const passwordHash = await hashPassword(body.password);
+  const [row] = await mapConstraintErrors(
+    () => useDb().insert(cms_users).values({
+      id: customId("usr"),
+      email: body.email,
+      name: body.name || null,
+      role: "admin",
+      passwordHash,
+      createdAt: now,
+      updatedAt: now
+    }).returning()
+  );
   return toAccount(row);
 });

package/dist/runtime/server/plugins/migrate-sqlite.js

@@ -1,5 +1,5 @@
 import { useDb } from "../utils/db-sqlite.js";
-import { runCmsMigrations } from "../utils/migrate.js";
+import { runSqliteMigrations } from "../utils/migrate.js";
 export default async () => {
-  await runCmsMigrations(useDb());
+  await runSqliteMigrations(useDb());
 };

package/dist/runtime/server/routes/auth/login.post.js

@@ -9,28 +9,30 @@ import { verifyNothing, verifyPassword } from "../../utils/password.js";
 import { assertSameOrigin } from "../../utils/same-origin.js";
 import { findUserByEmail, sessionUserFor } from "../../utils/users.js";
 const credentialsSchema = z.object({
-  email: z.string().trim().min(1),
-  password: z.string().min(1)
+  email: z.string().trim().min(1).max(254),
+  password: z.string().min(1).max(256)
 });
-const RATE_WINDOW_MS = 15 * 6e4;
-const RATE_MAX_FAILURES = 10;
-const RATE_GLOBAL_MAX_FAILURES = 100;
+const RATE_LOCK_MS = 5 * 6e4;
+const RATE_MAX_FAILURES = 5;
 const RATE_PRUNE_EVERY = 200;
-const GLOBAL_KEY = "global";
 let writesSincePrune = 0;
 function rateStorage() {
   return useStorage("cms:login-rate");
 }
-function rateKey(ip) {
-  return ip.replace(/[^a-z0-9]/gi, "-");
+function rateKey(kind, value) {
+  return `${kind}:${value.replace(/[^a-z0-9]/gi, "-")}`;
 }
 async function readEntry(key, now) {
   const entry = await rateStorage().getItem(key);
   return entry && entry.resetAt > now ? entry : null;
 }
-async function recordFailure(key, now) {
-  const current = await readEntry(key, now) ?? { count: 0, resetAt: now + RATE_WINDOW_MS };
+function isLocked(entry) {
+  return !!entry && entry.count >= RATE_MAX_FAILURES;
+}
+async function recordAttempt(key, now) {
+  const current = await readEntry(key, now) ?? { count: 0, resetAt: now + RATE_LOCK_MS };
   current.count++;
+  if (current.count >= RATE_MAX_FAILURES) current.resetAt = now + RATE_LOCK_MS;
   await rateStorage().setItem(key, current, {
     ttl: Math.ceil((current.resetAt - now) / 1e3)
   });
@@ -47,6 +49,15 @@ async function prune(now) {
     })
   );
 }
+async function clearAttempts(keys) {
+  await Promise.all(keys.map((key) => rateStorage().removeItem(key)));
+}
+function tooManyAttempts() {
+  return createError({
+    statusCode: 429,
+    statusMessage: "Too many failed attempts, try again in 5 minutes"
+  });
+}
 function safeEqual(a, b) {
   const hashA = createHash("sha256").update(a).digest();
   const hashB = createHash("sha256").update(b).digest();
@@ -54,34 +65,29 @@ function safeEqual(a, b) {
 }
 export default defineEventHandler(async (event) => {
   assertSameOrigin(event);
-  const ip = rateKey(getRequestIP(event, { xForwardedFor: true }) ?? "unknown");
   const now = Date.now();
-  const [attempts, globalFailures] = await Promise.all([
-    readEntry(ip, now),
-    readEntry(GLOBAL_KEY, now)
-  ]);
-  if (globalFailures && globalFailures.count >= RATE_GLOBAL_MAX_FAILURES || attempts && attempts.count >= RATE_MAX_FAILURES) {
-    throw createError({
-      statusCode: 429,
-      statusMessage: "Too many failed attempts, try again later"
-    });
-  }
   const body = await readValidatedBody(event, credentialsSchema.parse);
   const email = body.email.toLowerCase();
+  const keys = [
+    rateKey("ip", getRequestIP(event, { xForwardedFor: true }) ?? "unknown"),
+    rateKey("email", email)
+  ];
+  const entries = await Promise.all(keys.map((key) => readEntry(key, now)));
+  if (entries.some(isLocked)) throw tooManyAttempts();
+  await Promise.all([...keys.map((key) => recordAttempt(key, now)), prune(now)]);
   const { adminEmail, adminPassword } = useRuntimeConfig(event).cms;
   const superAdmin = !!adminEmail && !!adminPassword && safeEqual(email, adminEmail.toLowerCase()) && safeEqual(body.password, adminPassword);
   if (superAdmin) {
-    await rateStorage().removeItem(ip);
+    await clearAttempts(keys);
     await replaceUserSession(event, { user: { email, role: "superadmin" } });
     return { loggedIn: true };
   }
   const row = await findUserByEmail(email);
   const passwordOk = row ? await verifyPassword(row.passwordHash, body.password) : await verifyNothing(body.password);
   if (!row || !passwordOk) {
-    await Promise.all([recordFailure(ip, now), recordFailure(GLOBAL_KEY, now), prune(now)]);
     throw createError({ statusCode: 401, statusMessage: "Invalid credentials" });
   }
-  await rateStorage().removeItem(ip);
+  await clearAttempts(keys);
   await useDb().update(cms_users).set({ lastLoginAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq(cms_users.id, row.id));
   await replaceUserSession(event, { user: sessionUserFor(row) });
   return { loggedIn: true };

package/dist/runtime/server/utils/db-d1.d.ts

@@ -8,6 +8,5 @@ export declare function useDb(): import("drizzle-orm/d1").DrizzleD1Database<Reco
 type Db = ReturnType<typeof useDb>;
 export type CmsDb = Db;
 export declare const cmsDialect: 'sqlite' | 'postgres';
-export declare function withTransaction<T>(fn: (db: CmsDb) => Promise<T>): Promise<T>;
 export declare function runBatch(build: (db: CmsDb) => PromiseLike<unknown>[]): Promise<unknown[]>;
 export {};

package/dist/runtime/server/utils/db-d1.js

@@ -22,10 +22,9 @@ export function useDb() {
   return _db;
 }
 export const cmsDialect = "sqlite";
-export function withTransaction(fn) {
-  return fn(useDb());
-}
 export function runBatch(build) {
   const db = useDb();
-  return db.batch(build(db));
+  const statements = build(db);
+  if (!statements.length) return Promise.resolve([]);
+  return db.batch(statements);
 }

package/dist/runtime/server/utils/db-libsql.d.ts

@@ -4,6 +4,5 @@ export declare function useDb(): import("drizzle-orm/libsql").LibSQLDatabase<Rec
 type Db = ReturnType<typeof useDb>;
 export type CmsDb = Db | Parameters<Parameters<Db['transaction']>[0]>[0];
 export declare const cmsDialect: 'sqlite' | 'postgres';
-export declare function withTransaction<T>(fn: (db: CmsDb) => Promise<T>): Promise<T>;
 export declare function runBatch(build: (db: CmsDb) => PromiseLike<unknown>[]): Promise<unknown[]>;
 export {};

package/dist/runtime/server/utils/db-libsql.js

@@ -21,10 +21,9 @@ export function useDb() {
   return _db;
 }
 export const cmsDialect = "sqlite";
-export function withTransaction(fn) {
-  return useDb().transaction((tx) => fn(tx));
-}
 export function runBatch(build) {
   const db = useDb();
-  return db.batch(build(db));
+  const statements = build(db);
+  if (!statements.length) return Promise.resolve([]);
+  return db.batch(statements);
 }

package/dist/runtime/server/utils/db-postgres.d.ts

@@ -4,6 +4,5 @@ export declare function useDb(): import("drizzle-orm/node-postgres").NodePgDatab
 type Db = ReturnType<typeof useDb>;
 export type CmsDb = Db | Parameters<Parameters<Db['transaction']>[0]>[0];
 export declare const cmsDialect: 'sqlite' | 'postgres';
-export declare function withTransaction<T>(fn: (db: CmsDb) => Promise<T>): Promise<T>;
 export declare function runBatch(build: (db: CmsDb) => PromiseLike<unknown>[]): Promise<unknown[]>;
 export {};

package/dist/runtime/server/utils/db-postgres.js

@@ -17,11 +17,8 @@ export function useDb() {
   return _db;
 }
 export const cmsDialect = "postgres";
-export function withTransaction(fn) {
-  return useDb().transaction((tx) => fn(tx));
-}
 export function runBatch(build) {
-  return withTransaction(async (db) => {
+  return useDb().transaction(async (db) => {
     const results = [];
     for (const statement of build(db)) results.push(await statement);
     return results;

package/dist/runtime/server/utils/db-sqlite.d.ts

@@ -4,5 +4,4 @@ export declare function useDb(): import("drizzle-orm/better-sqlite3").BetterSQLi
 };
 export type CmsDb = ReturnType<typeof useDb>;
 export declare const cmsDialect: 'sqlite' | 'postgres';
-export declare function withTransaction<T>(fn: (db: CmsDb) => Promise<T>): Promise<T>;
 export declare function runBatch(build: (db: CmsDb) => PromiseLike<unknown>[]): Promise<unknown[]>;

package/dist/runtime/server/utils/db-sqlite.js

@@ -18,14 +18,15 @@ export function useDb() {
 }
 export const cmsDialect = "sqlite";
 let txQueue = Promise.resolve();
-export function withTransaction(fn) {
+export function runBatch(build) {
   const db = useDb();
   const run = txQueue.then(async () => {
     await db.run(sql`begin immediate`);
     try {
-      const result = await fn(db);
+      const results = [];
+      for (const statement of build(db)) results.push(await statement);
       await db.run(sql`commit`);
-      return result;
+      return results;
     } catch (error) {
       await db.run(sql`rollback`);
       throw error;
@@ -35,10 +36,3 @@ export function withTransaction(fn) {
   });
   return run;
 }
-export function runBatch(build) {
-  return withTransaction(async (db) => {
-    const results = [];
-    for (const statement of build(db)) results.push(await statement);
-    return results;
-  });
-}

package/dist/runtime/server/utils/graphql-depth.js

@@ -1,24 +1,31 @@
 import { GraphQLError, Kind } from "graphql";
 const DEFAULT_MAX_DEPTH = 8;
 const DEFAULT_MAX_FIELDS = 500;
-function measure(selectionSet, fragments, visited) {
+function measure(selectionSet, fragments, visited, fragmentDepths) {
   let max = 0;
   for (const selection of selectionSet.selections) {
     if (selection.kind === Kind.FIELD) {
       if (selection.name.value.startsWith("__")) continue;
-      const depth = selection.selectionSet ? 1 + measure(selection.selectionSet, fragments, visited) : 1;
+      const depth = selection.selectionSet ? 1 + measure(selection.selectionSet, fragments, visited, fragmentDepths) : 1;
       max = Math.max(max, depth);
     } else if (selection.kind === Kind.FRAGMENT_SPREAD) {
       const name = selection.name.value;
       if (visited.has(name)) continue;
+      const known = fragmentDepths.get(name);
+      if (known !== void 0) {
+        max = Math.max(max, known);
+        continue;
+      }
       const fragment = fragments.get(name);
       if (fragment) {
         visited.add(name);
-        max = Math.max(max, measure(fragment.selectionSet, fragments, visited));
+        const depth = measure(fragment.selectionSet, fragments, visited, fragmentDepths);
         visited.delete(name);
+        fragmentDepths.set(name, depth);
+        max = Math.max(max, depth);
       }
     } else if (selection.kind === Kind.INLINE_FRAGMENT) {
-      max = Math.max(max, measure(selection.selectionSet, fragments, visited));
+      max = Math.max(max, measure(selection.selectionSet, fragments, visited, fragmentDepths));
     }
   }
   return max;
@@ -32,7 +39,7 @@ export function createDepthRule(maxDepth) {
         if (definition.kind === Kind.FRAGMENT_DEFINITION)
           fragments.set(definition.name.value, definition);
       }
-      const depth = measure(node.selectionSet, fragments, /* @__PURE__ */ new Set());
+      const depth = measure(node.selectionSet, fragments, /* @__PURE__ */ new Set(), /* @__PURE__ */ new Map());
       if (depth > limit) {
         context.reportError(
           new GraphQLError(`Query is too deep: depth ${depth} exceeds the maximum of ${limit}`)

package/dist/runtime/server/utils/graphql.js

@@ -16,7 +16,7 @@ import {
 import { GraphQLError, GraphQLScalarType, valueFromASTUntyped } from "graphql";
 import { createSchema } from "graphql-yoga";
 import cmsConfig from "#cms-config";
-import { useDb } from "#cms-db";
+import { cmsDialect, useDb } from "#cms-db";
 import * as cmsTables from "#cms-tables";
 import { useRuntimeConfig } from "#imports";
 import {
@@ -37,6 +37,7 @@ import {
   renderGraphqlSdl,
   typeName
 } from "../../shared/graphql-sdl.js";
+import { normalizeTimestampFields } from "../../shared/timestamps.js";
 import { useMediaIndex } from "./media-index.js";
 import { readPages } from "./page-storage.js";
 import { getContentI18n, resolveTable, tableColumns } from "./registry.js";
@@ -103,7 +104,7 @@ function resolveLocaleArg(locale) {
 }
 function localizeRow(entry, row, locale) {
   const { defaultLocale } = getContentI18n();
-  const result = { ...row, [LOCALE]: locale };
+  const result = normalizeTimestampFields({ ...row, [LOCALE]: locale });
   const fields = entryFieldsFor(entry);
   for (const key of translatableFieldKeys(entry)) {
     if (isTranslatableMediaField(fields[key])) {
@@ -129,7 +130,7 @@ const OPERATORS = {
   lte: (column, value) => lte(column, value),
   like: (column, value) => {
     const pattern = String(value).replaceAll("\\", "\\\\").replaceAll("%", "\\%").replaceAll("_", "\\_").replaceAll("*", "%");
-    return sql`${column} like ${pattern} escape '\\'`;
+    return cmsDialect === "postgres" ? sql`cast(${column} as text) ilike ${pattern} escape '\\'` : sql`${column} like ${pattern} escape '\\'`;
   },
   in: (column, value) => inArray(column, value)
 };

package/dist/runtime/server/utils/libsql-migrations.d.ts

@@ -12,5 +12,6 @@ export interface LibsqlMigrationClient {
         rows: ArrayLike<unknown>[];
     }>;
     batch: (statements: LibsqlStatement[], mode: 'write') => Promise<unknown>;
+    migrate: (statements: LibsqlStatement[]) => Promise<unknown>;
 }
 export declare function applyLibsqlMigrations(client: LibsqlMigrationClient, migrations: LibsqlMigration[]): Promise<number>;

package/dist/runtime/server/utils/libsql-migrations.js

@@ -24,7 +24,7 @@ export async function applyLibsqlMigrations(client, migrations) {
     }
   ]);
   try {
-    await client.batch(statements, "write");
+    await client.migrate(statements);
   } catch (error) {
     const latest = Math.max(...migrations.map((migration) => migration.folderMillis));
     const appliedNow = await lastAppliedMillis(client).catch(() => null);

package/dist/runtime/server/utils/media-folders.js

@@ -1,37 +1,36 @@
-import { inArray, like, or } from "drizzle-orm";
-import { useDb } from "#cms-db";
+import { eq, or, sql } from "drizzle-orm";
+import { runBatch, useDb } from "#cms-db";
 import { cms_media } from "#cms-tables";
 import { mediaFolderMarkerKey } from "../../shared/index.js";
-const KEY_CHUNK = 90;
+import { nowTimestamp } from "../../shared/timestamps.js";
+import {
+  chunks,
+  KEY_CHUNK,
+  mediaDeleteStatements,
+  mediaFolderMarkerValues
+} from "./write-statements.js";
+function escapeLike(value) {
+  return value.replaceAll("\\", "\\\\").replaceAll("%", "\\%").replaceAll("_", "\\_");
+}
 export async function writeMediaFolderMarker(store, folder) {
-  const key = mediaFolderMarkerKey(folder);
-  await store.write(key, new Uint8Array(), "application/x-empty");
-  const values = {
-    key,
-    mime: "application/x-empty",
-    size: 0,
-    width: null,
-    height: null,
-    alt: null,
-    folder
-  };
-  await useDb().insert(cms_media).values(values).onConflictDoUpdate({ target: cms_media.key, set: values });
+  await store.write(mediaFolderMarkerKey(folder), new Uint8Array(), "application/x-empty");
+  const values = mediaFolderMarkerValues(folder);
+  await useDb().insert(cms_media).values({ ...values, createdAt: nowTimestamp() }).onConflictDoUpdate({ target: cms_media.key, set: values });
 }
 export function mediaRowsInFolder(folder) {
-  return useDb().select({ key: cms_media.key, folder: cms_media.folder }).from(cms_media).where(or(like(cms_media.folder, `${folder}/%`), like(cms_media.folder, folder)));
+  return useDb().select({ key: cms_media.key, folder: cms_media.folder }).from(cms_media).where(
+    or(
+      sql`${cms_media.folder} like ${`${escapeLike(folder)}/%`} escape '\\'`,
+      eq(cms_media.folder, folder)
+    )
+  );
 }
 export async function deleteMediaRows(store, keys) {
+  await runBatch((db) => mediaDeleteStatements(db, cms_media, keys));
   for (const key of keys) {
     await store.remove(key);
   }
-  for (const chunk of keyChunks(keys)) {
-    await useDb().delete(cms_media).where(inArray(cms_media.key, chunk));
-  }
 }
 export function keyChunks(keys) {
-  const chunks = [];
-  for (let index = 0; index < keys.length; index += KEY_CHUNK) {
-    chunks.push(keys.slice(index, index + KEY_CHUNK));
-  }
-  return chunks;
+  return chunks(keys, KEY_CHUNK);
 }

package/dist/runtime/server/utils/media.d.ts

@@ -20,6 +20,7 @@ export interface MediaStore {
     write: (key: string, body: Uint8Array<ArrayBuffer>, contentType: string) => Promise<void>;
     remove: (key: string) => Promise<void>;
 }
+export declare function baseContentType(contentType: string): string;
 export declare function isAllowedUploadType(contentType: string): boolean;
 export declare function assertUploadContentType(contentType: string): void;
 export declare function assertUploadSize(size: number, maxFileSize: number): void;

package/dist/runtime/server/utils/media.js

@@ -2,6 +2,7 @@ import { AwsClient } from "aws4fetch";
 import { createError } from "h3";
 import { useRuntimeConfig } from "#imports";
 import { formatFileSize, mediaPublicUrl, mediaTypeFor } from "../../shared/index.js";
+import { normalizeTimestamp } from "../../shared/timestamps.js";
 import { removeMediaFile, writeMediaFile } from "./media-fs.js";
 const UPLOAD_TYPE_PREFIXES = ["image/", "video/", "audio/", "font/"];
 const UPLOAD_TYPE_BLOCKLIST = /* @__PURE__ */ new Set(["image/svg+xml"]);
@@ -20,8 +21,11 @@ const UPLOAD_TYPES = /* @__PURE__ */ new Set([
   "application/vnd.ms-powerpoint",
   "application/vnd.openxmlformats-officedocument.presentationml.presentation"
 ]);
+export function baseContentType(contentType) {
+  return contentType.split(";")[0].trim().toLowerCase();
+}
 export function isAllowedUploadType(contentType) {
-  const type = contentType.toLowerCase();
+  const type = baseContentType(contentType);
   return !UPLOAD_TYPE_BLOCKLIST.has(type) && (UPLOAD_TYPES.has(type) || UPLOAD_TYPE_PREFIXES.some((prefix) => type.startsWith(prefix)));
 }
 export function assertUploadContentType(contentType) {
@@ -144,6 +148,7 @@ export function useMediaStorage(event) {
 export function toMediaItem(row, publicUrl) {
   return {
     ...row,
+    createdAt: normalizeTimestamp(row.createdAt),
     type: mediaTypeFor(row.mime, row.key),
     url: publicUrl(row.key)
   };

package/dist/runtime/server/utils/migrate.d.ts

@@ -5,5 +5,6 @@ export interface CmsMigration {
     hash: string;
 }
 export declare function runCmsMigrations(db: unknown): Promise<void>;
+export declare function runSqliteMigrations(db: unknown): Promise<void>;
 export declare function runLibsqlMigrations(db: unknown): Promise<void>;
 export declare function runD1Migrations(binding: unknown): Promise<void>;

package/dist/runtime/server/utils/migrate.js

@@ -1,7 +1,10 @@
+import { sql } from "drizzle-orm";
 import cmsConfig from "#cms-config";
 import { migrations as bundledMigrations } from "#cms-migrations";
+import * as cmsTables from "#cms-tables";
 import { useRuntimeConfig } from "#imports";
 import { applyLibsqlMigrations } from "./libsql-migrations.js";
+import { backfillTimestamps } from "./timestamps.js";
 const MIGRATIONS_TABLE = "__drizzle_migrations";
 async function readMigrations(migrationsDir) {
   if (import.meta.dev) {
@@ -18,7 +21,7 @@ async function pendingMigrations() {
   const migrations = await readMigrations(migrationsDir);
   if (!migrations.length && Object.keys(cmsConfig).length) {
     console.error(
-      `[nuxt-cms] No migrations were found for this build (expected in ${migrationsDir}). CMS tables may be missing \u2014 run the dev server once to generate them, commit server/db/migrations, and rebuild.`
+      `[nuxt-cms] No migrations were found for this build (expected in ${migrationsDir}). CMS tables may be missing. Run the dev server once to generate them, commit server/db/migrations, and rebuild.`
     );
   }
   return migrations;
@@ -29,11 +32,36 @@ export async function runCmsMigrations(db) {
   const { dialect, session } = db;
   await dialect.migrate(migrations, session, {});
 }
+export async function runSqliteMigrations(db) {
+  const migrations = await pendingMigrations();
+  if (!migrations.length) return;
+  const { dialect, session, $client } = db;
+  $client.pragma("foreign_keys = OFF");
+  try {
+    await dialect.migrate(migrations, session, {});
+  } finally {
+    $client.pragma("foreign_keys = ON");
+  }
+  const sqlite = db;
+  await backfillTimestamps(cmsTables, {
+    select: async (query) => sqlite.all(sql.raw(query)),
+    write: async (statements) => {
+      for (const statement of statements) sqlite.run(sql.raw(statement));
+    }
+  });
+}
 export async function runLibsqlMigrations(db) {
   const migrations = await pendingMigrations();
   if (!migrations.length) return;
   const { $client } = db;
   await applyLibsqlMigrations($client, migrations);
+  await backfillTimestamps(cmsTables, {
+    select: async (query) => Array.from((await $client.execute(query)).rows),
+    write: (statements) => $client.batch(
+      statements.map((statement) => ({ sql: statement, args: [] })),
+      "write"
+    )
+  });
 }
 export async function runD1Migrations(binding) {
   const migrations = await pendingMigrations();
@@ -55,4 +83,8 @@ export async function runD1Migrations(binding) {
     );
   }
   if (batch.length) await d1.batch(batch);
+  await backfillTimestamps(cmsTables, {
+    select: async (query) => (await d1.prepare(query).all()).results,
+    write: (statements) => d1.batch(statements.map((statement) => d1.prepare(statement)))
+  });
 }

package/dist/runtime/server/utils/registry.d.ts

@@ -9,6 +9,9 @@ export declare function idColumn(table: SQLiteTable): AnySQLiteColumn;
 export declare function withUpdatedAt(table: SQLiteTable, values: Record<string, unknown>): {
     [x: string]: unknown;
 };
+export declare function withTimestamps(table: SQLiteTable, values: Record<string, unknown>): {
+    [x: string]: unknown;
+};
 export declare function getRegistryEntry(event: H3Event): {
     name: string;
     entry: CmsEntry;

package/dist/runtime/server/utils/registry.js

@@ -9,6 +9,7 @@ import {
   pageFields,
   pageRouteOf
 } from "../../shared/index.js";
+import { normalizeTimestampFields, nowTimestamp } from "../../shared/timestamps.js";
 import { buildEntrySchema } from "../../shared/validation.js";
 let contentI18n;
 export function getContentI18n() {
@@ -30,9 +31,16 @@ export function idColumn(table) {
 }
 export function withUpdatedAt(table, values) {
   const set = { ...values };
-  if ("updatedAt" in table) set.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  if ("updatedAt" in table) set.updatedAt = nowTimestamp();
   return set;
 }
+export function withTimestamps(table, values) {
+  const now = nowTimestamp();
+  const stamped = { ...values };
+  if ("createdAt" in table) stamped.createdAt ??= now;
+  if ("updatedAt" in table) stamped.updatedAt ??= now;
+  return stamped;
+}
 export function getRegistryEntry(event) {
   const name = getRouterParam(event, "collection");
   const config = cmsConfig;
@@ -58,6 +66,7 @@ export function encodeColumnValues(entry, values) {
   return encodeEntryTranslatableMedia(entry, values);
 }
 export function decodeRows(entry, rows) {
+  for (const row of rows) normalizeTimestampFields(row);
   return decodeEntryTranslatableMedia(entry, rows, getContentI18n().defaultLocale);
 }
 export function parseId(event) {