@xleddyl/nuxt-cms 0.9.4 → 0.10.0

package/dist/runtime/shared/redirects.d.ts

@@ -0,0 +1,75 @@
+import type { CmsContentRouteItem, CmsLocalePath } from './content-routes.js';
+import type { CmsEntry } from './index.js';
+export declare const REDIRECT_STATUSES: readonly [301, 302, 307, 308];
+export type CmsRedirectStatus = (typeof REDIRECT_STATUSES)[number];
+export type CmsRedirectSource = 'manual' | 'auto';
+export declare const DEFAULT_REDIRECT_STATUS: CmsRedirectStatus;
+export declare const REDIRECT_FROM_MAX_LENGTH = 1024;
+export declare const REDIRECT_TO_MAX_LENGTH = 2048;
+export declare const REDIRECT_IMPORT_MAX_ROWS = 5000;
+export declare const REDIRECT_CSV_COLUMNS: readonly ["from", "to", "status", "keepQuery"];
+export interface CmsRedirectInput {
+    from: string;
+    to: string;
+    status?: CmsRedirectStatus;
+    keepQuery?: boolean;
+}
+export interface CmsRedirectDraft {
+    from: string;
+    to: string;
+    status: CmsRedirectStatus;
+    keepQuery: boolean;
+}
+export interface CmsRedirect extends CmsRedirectDraft {
+    id: string;
+    source: CmsRedirectSource;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface CmsRedirectTarget {
+    to: string;
+    status: CmsRedirectStatus;
+    keepQuery: boolean;
+}
+export interface CmsRedirectMove {
+    from: string;
+    to: string;
+}
+export interface CmsRedirectLink {
+    id: string;
+    from: string;
+    to: string;
+}
+export interface CmsRedirectPlan {
+    upserts: CmsRedirectMove[];
+    retargets: {
+        id: string;
+        to: string;
+    }[];
+    deletes: string[];
+}
+export declare function normalizeRedirectPath(path: string): string;
+export declare function isExternalRedirectTarget(to: string): boolean;
+export declare function redirectTargetPath(to: string): string | null;
+export declare function redirectApplies(path: string): boolean;
+export declare function redirectFromErrors(from: unknown): string[];
+export declare function redirectToErrors(to: unknown): string[];
+export declare function isRedirectStatus(value: unknown): value is CmsRedirectStatus;
+export declare function normalizeRedirectInput(input: CmsRedirectInput): CmsRedirectDraft;
+export declare function redirectTargetMap(redirects: readonly Pick<CmsRedirectDraft, 'from' | 'to'>[]): Map<string, string | null>;
+export declare function findRedirectLoop(targets: ReadonlyMap<string, string | null>, from: string, to: string): string[] | null;
+export declare function redirectErrors(input: CmsRedirectInput, others: ReadonlyMap<string, string | null>): string[];
+export declare function retargetRedirect(to: string, path: string): string;
+export declare function redirectLocation(to: string, search: string, keepQuery: boolean): string;
+export declare function isContentItemLive(item: CmsContentRouteItem, now?: Date): boolean;
+export interface CmsContentMoves {
+    moves: CmsRedirectMove[];
+    livePaths: string[];
+}
+export declare function contentPathMoves(oldPaths: readonly CmsLocalePath[], newPaths: readonly CmsLocalePath[]): CmsContentMoves;
+export declare function rowAfterUpdate<T extends Record<string, unknown>>(existing: T, set: Record<string, unknown>): T;
+export declare function contentItemMoves(entry: Pick<CmsEntry, 'kind' | 'route'>, before: CmsContentRouteItem, after: CmsContentRouteItem, locales: readonly string[], now?: Date): CmsContentMoves;
+export declare function mergeContentMoves(list: readonly CmsContentMoves[]): CmsContentMoves;
+export declare function planRedirectMoves(existing: readonly CmsRedirectLink[], moves: readonly CmsRedirectMove[], livePaths: readonly string[]): CmsRedirectPlan;
+export declare function redirectRowsFromTable(rows: string[][]): CmsRedirectInput[];
+export declare function redirectsToTable(redirects: readonly CmsRedirectDraft[]): string[][];

package/dist/runtime/shared/redirects.js

@@ -0,0 +1,230 @@
+import { contentItemPaths, isRoutedContent } from "./content-routes.js";
+import { normalizeTimestamp } from "./timestamps.js";
+export const REDIRECT_STATUSES = [301, 302, 307, 308];
+export const DEFAULT_REDIRECT_STATUS = 301;
+export const REDIRECT_FROM_MAX_LENGTH = 1024;
+export const REDIRECT_TO_MAX_LENGTH = 2048;
+export const REDIRECT_IMPORT_MAX_ROWS = 5e3;
+export const REDIRECT_CSV_COLUMNS = ["from", "to", "status", "keepQuery"];
+const RESERVED_SEGMENTS = ["cms", "api", "_nuxt"];
+const SKIPPED_PREFIXES = ["/__nuxt"];
+const UNSAFE_CHARACTERS = /[\s\\\u0000-\u001f\u007f]/;
+const ABSOLUTE_URL = /^https?:\/\//i;
+function canonicalSegment(segment) {
+  try {
+    return encodeURIComponent(decodeURIComponent(segment));
+  } catch {
+    return segment;
+  }
+}
+export function normalizeRedirectPath(path) {
+  const bare = path.replace(/[?#].*$/, "");
+  const segments = bare.split("/").filter(Boolean).map(canonicalSegment);
+  return `/${segments.join("/")}`;
+}
+export function isExternalRedirectTarget(to) {
+  return ABSOLUTE_URL.test(to);
+}
+export function redirectTargetPath(to) {
+  if (isExternalRedirectTarget(to) || !to.startsWith("/") || to.startsWith("//")) return null;
+  return normalizeRedirectPath(to);
+}
+function reservedSegment(path) {
+  const first = path.split("/")[1] ?? "";
+  return RESERVED_SEGMENTS.find((segment) => segment === first);
+}
+export function redirectApplies(path) {
+  const bare = path.replace(/[?#].*$/, "");
+  return !reservedSegment(normalizeRedirectPath(bare)) && !SKIPPED_PREFIXES.some((prefix) => bare.startsWith(prefix));
+}
+export function redirectFromErrors(from) {
+  if (typeof from !== "string" || !from.trim()) return ["From is required"];
+  if (from.length > REDIRECT_FROM_MAX_LENGTH)
+    return [`From is longer than ${REDIRECT_FROM_MAX_LENGTH} characters`];
+  if (!from.startsWith("/") || from.startsWith("//"))
+    return ["From must be a path starting with /, without a host"];
+  if (UNSAFE_CHARACTERS.test(from)) return ["From cannot hold spaces or backslashes"];
+  if (/[?#]/.test(from)) return ["From cannot hold a query or a hash"];
+  const reserved = reservedSegment(normalizeRedirectPath(from));
+  if (reserved) return [`From cannot be under /${reserved}`];
+  return [];
+}
+export function redirectToErrors(to) {
+  if (typeof to !== "string" || !to.trim()) return ["To is required"];
+  if (to.length > REDIRECT_TO_MAX_LENGTH)
+    return [`To is longer than ${REDIRECT_TO_MAX_LENGTH} characters`];
+  if (UNSAFE_CHARACTERS.test(to)) return ["To cannot hold spaces or backslashes"];
+  if (isExternalRedirectTarget(to)) {
+    try {
+      const url = new URL(to);
+      if (!url.hostname) return ["To must be a valid URL"];
+      if (url.username || url.password) return ["To cannot hold credentials"];
+      return [];
+    } catch {
+      return ["To must be a valid URL"];
+    }
+  }
+  if (!to.startsWith("/") || to.startsWith("//"))
+    return ["To must be a path starting with / or an absolute http(s) URL"];
+  return [];
+}
+export function isRedirectStatus(value) {
+  return REDIRECT_STATUSES.includes(value);
+}
+export function normalizeRedirectInput(input) {
+  return {
+    from: normalizeRedirectPath(input.from.trim()),
+    to: input.to.trim(),
+    status: input.status ?? DEFAULT_REDIRECT_STATUS,
+    keepQuery: input.keepQuery ?? true
+  };
+}
+export function redirectTargetMap(redirects) {
+  return new Map(redirects.map((redirect) => [redirect.from, redirectTargetPath(redirect.to)]));
+}
+export function findRedirectLoop(targets, from, to) {
+  const chain = [from];
+  const seen = /* @__PURE__ */ new Set([from]);
+  let current = redirectTargetPath(to);
+  while (current !== null) {
+    chain.push(current);
+    if (current === from) return chain;
+    if (seen.has(current)) return null;
+    seen.add(current);
+    const next = targets.get(current);
+    if (next === void 0) return null;
+    current = next;
+  }
+  return null;
+}
+export function redirectErrors(input, others) {
+  const errors = [...redirectFromErrors(input.from), ...redirectToErrors(input.to)];
+  if (input.status !== void 0 && !isRedirectStatus(input.status))
+    errors.push(`Status must be one of ${REDIRECT_STATUSES.join(", ")}`);
+  if (errors.length) return errors;
+  const draft = normalizeRedirectInput(input);
+  if (redirectTargetPath(draft.to) === draft.from) return ["A redirect cannot point to itself"];
+  if (others.has(draft.from)) return [`A redirect from ${draft.from} already exists`];
+  const loop = findRedirectLoop(others, draft.from, draft.to);
+  if (loop) return [`This redirect makes a loop: ${loop.join(" \u2192 ")}`];
+  return [];
+}
+function targetSuffix(to) {
+  const index = to.search(/[?#]/);
+  return index === -1 ? "" : to.slice(index);
+}
+export function retargetRedirect(to, path) {
+  return `${path}${targetSuffix(to)}`;
+}
+export function redirectLocation(to, search, keepQuery) {
+  const query = search.replace(/^\?/, "");
+  if (!keepQuery || !query) return to;
+  const hashIndex = to.indexOf("#");
+  const base = hashIndex === -1 ? to : to.slice(0, hashIndex);
+  const hash = hashIndex === -1 ? "" : to.slice(hashIndex);
+  const joiner = !base.includes("?") ? "?" : /[?&]$/.test(base) ? "" : "&";
+  return `${base}${joiner}${query}${hash}`;
+}
+export function isContentItemLive(item, now = /* @__PURE__ */ new Date()) {
+  if (item.status !== "published") return false;
+  const publishedAt = normalizeTimestamp(item.publishedAt);
+  if (typeof publishedAt !== "string" || !publishedAt) return false;
+  const date = new Date(publishedAt);
+  return !Number.isNaN(date.getTime()) && date.getTime() <= now.getTime();
+}
+export function contentPathMoves(oldPaths, newPaths) {
+  const livePaths = [...new Set(newPaths.map((entry) => normalizeRedirectPath(entry.path)))];
+  const live = new Set(livePaths);
+  const moves = /* @__PURE__ */ new Map();
+  for (const old of oldPaths) {
+    const next = newPaths.find((entry) => entry.locale === old.locale);
+    if (!next) continue;
+    const from = normalizeRedirectPath(old.path);
+    if (from === normalizeRedirectPath(next.path) || live.has(from) || moves.has(from)) continue;
+    moves.set(from, next.path);
+  }
+  return { moves: [...moves].map(([from, to]) => ({ from, to })), livePaths };
+}
+export function rowAfterUpdate(existing, set) {
+  const next = { ...existing };
+  for (const [key, value] of Object.entries(set)) if (value !== void 0) next[key] = value;
+  if (Object.hasOwn(existing, "status") && next.status == null) next.status = existing.status;
+  return next;
+}
+export function contentItemMoves(entry, before, after, locales, now = /* @__PURE__ */ new Date()) {
+  if (!isRoutedContent(entry) || !isContentItemLive(before, now) || !isContentItemLive(after, now))
+    return { moves: [], livePaths: [] };
+  return contentPathMoves(
+    contentItemPaths(entry, before, locales),
+    contentItemPaths(entry, after, locales)
+  );
+}
+export function mergeContentMoves(list) {
+  const livePaths = [...new Set(list.flatMap((moves2) => moves2.livePaths))];
+  const live = new Set(livePaths.map(normalizeRedirectPath));
+  const moves = list.flatMap((item) => item.moves).filter((move) => !live.has(normalizeRedirectPath(move.from)));
+  return { moves, livePaths };
+}
+export function planRedirectMoves(existing, moves, livePaths) {
+  const live = new Set(livePaths.map(normalizeRedirectPath));
+  const moved = new Map(moves.map((move) => [normalizeRedirectPath(move.from), move.to]));
+  const deletes = /* @__PURE__ */ new Set();
+  const retargets = [];
+  for (const redirect of existing) {
+    if (live.has(redirect.from)) {
+      deletes.add(redirect.id);
+      continue;
+    }
+    if (moved.has(redirect.from)) continue;
+    const target = redirectTargetPath(redirect.to);
+    const next = target === null ? void 0 : moved.get(target);
+    if (next === void 0) continue;
+    const to = retargetRedirect(redirect.to, next);
+    if (redirectTargetPath(to) === redirect.from) deletes.add(redirect.id);
+    else retargets.push({ id: redirect.id, to });
+  }
+  return {
+    upserts: [...moved].map(([from, to]) => ({ from, to })),
+    retargets,
+    deletes: [...deletes]
+  };
+}
+function csvBoolean(value) {
+  const text = (value ?? "").trim().toLowerCase();
+  if (!text) return void 0;
+  if (["true", "1", "yes"].includes(text)) return true;
+  if (["false", "0", "no"].includes(text)) return false;
+  return void 0;
+}
+export function redirectRowsFromTable(rows) {
+  const [header, ...body] = rows;
+  if (!header) return [];
+  const columns = header.map((cell) => cell.trim().toLowerCase());
+  const index = (name) => columns.indexOf(name.toLowerCase());
+  const fromIndex = index("from");
+  const toIndex = index("to");
+  if (fromIndex === -1 || toIndex === -1) throw new Error("The CSV needs a from and a to column");
+  const statusIndex = index("status");
+  const keepIndex = index("keepQuery");
+  return body.map((cells) => {
+    const status = statusIndex === -1 ? "" : (cells[statusIndex] ?? "").trim();
+    const keepQuery = keepIndex === -1 ? void 0 : csvBoolean(cells[keepIndex]);
+    return {
+      from: cells[fromIndex] ?? "",
+      to: cells[toIndex] ?? "",
+      ...status ? { status: Number(status) } : {},
+      ...keepQuery === void 0 ? {} : { keepQuery }
+    };
+  });
+}
+export function redirectsToTable(redirects) {
+  return [
+    [...REDIRECT_CSV_COLUMNS],
+    ...redirects.map((redirect) => [
+      redirect.from,
+      redirect.to,
+      String(redirect.status),
+      redirect.keepQuery ? "true" : "false"
+    ])
+  ];
+}

package/dist/runtime/shared/roles.d.ts

@@ -0,0 +1,57 @@
+import type { CmsConfig, CmsEntry } from './index.js';
+export declare const CMS_ADMIN_ROLE = "admin";
+export declare const CMS_SUPERADMIN_ROLE = "superadmin";
+export declare const CMS_RESERVED_ROLES: readonly ["admin", "superadmin"];
+export declare const CMS_ENTRY_PERMISSION_ACTIONS: readonly ["read", "create", "update", "delete", "publish", "import", "export"];
+export declare const CMS_MEDIA_PERMISSION_ACTIONS: readonly ["read", "write", "delete"];
+export declare const CMS_SYSTEM_SCOPES: {
+    readonly media: readonly ["read", "write", "delete"];
+    readonly users: readonly ["manage"];
+    readonly settings: readonly ["manage"];
+    readonly redirects: readonly ["manage"];
+};
+export type CmsEntryPermissionAction = (typeof CMS_ENTRY_PERMISSION_ACTIONS)[number];
+export type CmsSystemScope = keyof typeof CMS_SYSTEM_SCOPES;
+export interface CmsRoleInput {
+    label?: string;
+    description?: string;
+    can: string[];
+}
+export type CmsRolesInput = Record<string, CmsRoleInput>;
+export interface CmsRole {
+    label: string;
+    description: string | null;
+    can: string[];
+}
+export type CmsRoles = Record<string, CmsRole>;
+export interface CmsRoleOption {
+    key: string;
+    label: string;
+    description: string | null;
+}
+export interface CmsAccess {
+    role: string;
+    known: boolean;
+    full: boolean;
+    permissions: string[];
+}
+export declare function roleLabel(key: string): string;
+export declare function entryPermissionActions(entry: Pick<CmsEntry, 'kind' | 'drafts'>): CmsEntryPermissionAction[];
+export declare function cmsPermissions(config: CmsConfig): string[];
+export declare function matchesPermission(pattern: string, permission: string): boolean;
+export declare function expandPermissions(patterns: readonly string[], config: CmsConfig): string[];
+export declare function resolveCmsAccess(role: string | null | undefined, roles: CmsRoles, config: CmsConfig): CmsAccess;
+export declare function can(access: CmsAccess | null | undefined, permission: string): boolean;
+export declare function canAny(access: CmsAccess | null | undefined, permissions: string[]): boolean;
+export declare function publishPermissionError(access: CmsAccess, name: string, entry: Pick<CmsEntry, 'drafts'>, previous: unknown, next: unknown): string | null;
+export declare function deletePermissionError(access: CmsAccess, name: string, entry: Pick<CmsEntry, 'drafts'>, status: unknown): string | null;
+export declare function canGrantRole(access: CmsAccess | null | undefined, role: string, roles: CmsRoles, config: CmsConfig): boolean;
+export declare function canManageAccount(access: CmsAccess | null | undefined, role: string, roles: CmsRoles, config: CmsConfig): boolean;
+export declare function cmsRoleOptions(roles: CmsRoles): CmsRoleOption[];
+export declare function cmsRoleLabel(role: string | null | undefined, roles: CmsRoles): string;
+export declare function resolveRoles(input: CmsRolesInput | undefined): CmsRoles;
+export declare function validateRoles(input: unknown, config: CmsConfig): {
+    roles: CmsRoles;
+    errors: string[];
+    warnings: string[];
+};

package/dist/runtime/shared/roles.js

@@ -0,0 +1,293 @@
+import { declaredLinkTargets, entryFieldsFor, isCollectionKind, relationTarget } from "./index.js";
+export const CMS_ADMIN_ROLE = "admin";
+export const CMS_SUPERADMIN_ROLE = "superadmin";
+export const CMS_RESERVED_ROLES = [CMS_ADMIN_ROLE, CMS_SUPERADMIN_ROLE];
+export const CMS_ENTRY_PERMISSION_ACTIONS = [
+  "read",
+  "create",
+  "update",
+  "delete",
+  "publish",
+  "import",
+  "export"
+];
+export const CMS_MEDIA_PERMISSION_ACTIONS = ["read", "write", "delete"];
+export const CMS_SYSTEM_SCOPES = {
+  media: CMS_MEDIA_PERMISSION_ACTIONS,
+  users: ["manage"],
+  settings: ["manage"],
+  redirects: ["manage"]
+};
+const ROLE_KEY_PATTERN = /^[a-z][a-zA-Z0-9_-]*$/;
+const ROLE_KEYS = /* @__PURE__ */ new Set(["label", "description", "can"]);
+const SYSTEM_SCOPES = Object.keys(CMS_SYSTEM_SCOPES);
+function isSystemScope(scope) {
+  return Object.hasOwn(CMS_SYSTEM_SCOPES, scope);
+}
+function isRecord(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+export function roleLabel(key) {
+  const words = key.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[_-]+/g, " ").trim().toLowerCase();
+  return words.charAt(0).toUpperCase() + words.slice(1);
+}
+export function entryPermissionActions(entry) {
+  if (!isCollectionKind(entry)) return ["read", "update"];
+  return CMS_ENTRY_PERMISSION_ACTIONS.filter((action) => action !== "publish" || !!entry.drafts);
+}
+export function cmsPermissions(config) {
+  return [
+    ...Object.entries(config).flatMap(
+      ([name, entry]) => entryPermissionActions(entry).map((action) => `${name}.${action}`)
+    ),
+    ...SYSTEM_SCOPES.flatMap(
+      (scope) => CMS_SYSTEM_SCOPES[scope].map((action) => `${scope}.${action}`)
+    )
+  ];
+}
+function splitPermission(value) {
+  const dot = value.indexOf(".");
+  return dot === -1 ? [value, ""] : [value.slice(0, dot), value.slice(dot + 1)];
+}
+export function matchesPermission(pattern, permission) {
+  if (pattern === "*") return true;
+  const [patternScope, patternAction] = splitPermission(pattern);
+  const [scope, action] = splitPermission(permission);
+  return (patternScope === "*" || patternScope === scope) && (patternAction === "*" || patternAction === action);
+}
+export function expandPermissions(patterns, config) {
+  const universe = cmsPermissions(config);
+  const granted = new Set(
+    universe.filter(
+      (permission) => patterns.some((pattern) => matchesPermission(pattern, permission))
+    )
+  );
+  for (const permission of [...granted]) {
+    const [scope, action] = splitPermission(permission);
+    if (action === "manage") continue;
+    const read = `${scope}.read`;
+    if (universe.includes(read)) granted.add(read);
+  }
+  return universe.filter((permission) => granted.has(permission));
+}
+export function resolveCmsAccess(role, roles, config) {
+  const key = role || CMS_ADMIN_ROLE;
+  if (key === CMS_SUPERADMIN_ROLE) {
+    return { role: key, known: true, full: true, permissions: cmsPermissions(config) };
+  }
+  if (key === CMS_ADMIN_ROLE) {
+    return {
+      role: key,
+      known: true,
+      full: false,
+      permissions: cmsPermissions(config).filter((permission) => permission !== "users.manage")
+    };
+  }
+  const definition = Object.hasOwn(roles, key) ? roles[key] : void 0;
+  if (!definition) return { role: key, known: false, full: false, permissions: [] };
+  return {
+    role: key,
+    known: true,
+    full: false,
+    permissions: expandPermissions(definition.can, config)
+  };
+}
+export function can(access, permission) {
+  if (!access?.known) return false;
+  return access.full || access.permissions.includes(permission);
+}
+export function canAny(access, permissions) {
+  return permissions.some((permission) => can(access, permission));
+}
+export function publishPermissionError(access, name, entry, previous, next) {
+  if (!entry.drafts || can(access, `${name}.publish`)) return null;
+  if (previous === "published") {
+    return `Editing a published item needs the ${name}.publish permission`;
+  }
+  if (next === "published") return `Publishing needs the ${name}.publish permission`;
+  return null;
+}
+export function deletePermissionError(access, name, entry, status) {
+  if (!entry.drafts || status !== "published" || can(access, `${name}.publish`)) return null;
+  return `Deleting a published or scheduled item needs the ${name}.publish permission`;
+}
+export function canGrantRole(access, role, roles, config) {
+  if (!access?.known || role === CMS_SUPERADMIN_ROLE) return false;
+  const target = resolveCmsAccess(role, roles, config);
+  if (!target.known) return false;
+  if (access.full) return true;
+  if (target.full) return false;
+  return target.permissions.every((permission) => access.permissions.includes(permission));
+}
+export function canManageAccount(access, role, roles, config) {
+  if (!can(access, "users.manage") || role === CMS_SUPERADMIN_ROLE) return false;
+  if (!resolveCmsAccess(role, roles, config).known) return true;
+  return canGrantRole(access, role, roles, config);
+}
+export function cmsRoleOptions(roles) {
+  return [
+    {
+      key: CMS_ADMIN_ROLE,
+      label: "Admin",
+      description: "Everything in the panel except managing users."
+    },
+    ...Object.entries(roles).map(([key, role]) => ({
+      key,
+      label: role.label,
+      description: role.description
+    }))
+  ];
+}
+export function cmsRoleLabel(role, roles) {
+  const key = role || CMS_ADMIN_ROLE;
+  if (key === CMS_SUPERADMIN_ROLE) return "Super admin";
+  if (key === CMS_ADMIN_ROLE) return "Admin";
+  return Object.hasOwn(roles, key) ? roles[key].label : key;
+}
+export function resolveRoles(input) {
+  return Object.fromEntries(
+    Object.entries(input ?? {}).map(([key, role]) => [
+      key,
+      {
+        label: role.label?.trim() || roleLabel(key),
+        description: role.description?.trim() || null,
+        can: [...new Set(role.can)]
+      }
+    ])
+  );
+}
+function permissionError(permission, config, allActions) {
+  if (permission === "*") return null;
+  const parts = permission.split(".");
+  if (parts.length !== 2 || parts.some((part) => !part)) {
+    return `'${permission}' must be '*' or '<scope>.<action>' (for example 'news.update' or 'media.write')`;
+  }
+  const [scope, action] = parts;
+  if (scope === "*") {
+    if (action === "*" || allActions.has(action)) return null;
+    return `'${permission}': unknown action '${action}' (expected one of ${[...allActions].join(
+      ", "
+    )})`;
+  }
+  const entry = Object.hasOwn(config, scope) ? config[scope] : void 0;
+  if (entry && isSystemScope(scope)) {
+    const systemActions = CMS_SYSTEM_SCOPES[scope];
+    if (action === "*") {
+      return `'${permission}' is ambiguous: '${scope}' is both an entry and a built-in scope, list the actions instead`;
+    }
+    if (systemActions.includes(action)) return null;
+  }
+  if (entry) {
+    if (action === "*") return null;
+    const actions = entryPermissionActions(entry);
+    if (actions.includes(action)) return null;
+    if (action === "publish" && isCollectionKind(entry)) {
+      return `'${permission}': entry '${scope}' has no drafts, so there is nothing to publish`;
+    }
+    return `'${permission}': ${entry.kind} entry '${scope}' supports ${actions.join(", ")}`;
+  }
+  if (isSystemScope(scope)) {
+    const actions = CMS_SYSTEM_SCOPES[scope];
+    if (action === "*" || actions.includes(action)) return null;
+    return `'${permission}': '${scope}' supports ${actions.join(", ")}`;
+  }
+  return `'${permission}': unknown entry or scope '${scope}' (expected an entry key, ${SYSTEM_SCOPES.join(
+    ", "
+  )} or '*')`;
+}
+function collectFields(fields) {
+  return Object.values(fields).flatMap((field) => [
+    field,
+    ...Object.values(field.blocks ?? {}).flatMap((block) => collectFields(block.fields))
+  ]);
+}
+function accessWarnings(key, permissions, config) {
+  const warnings = [];
+  const granted = new Set(permissions);
+  const relationTargets = /* @__PURE__ */ new Set();
+  let needsMedia = false;
+  for (const [name, entry] of Object.entries(config)) {
+    if (!granted.has(`${name}.create`) && !granted.has(`${name}.update`)) continue;
+    for (const field of collectFields(entryFieldsFor(entry))) {
+      if (field.type === "media") needsMedia = true;
+      if (field.type === "relation" && relationTarget(field))
+        relationTargets.add(relationTarget(field));
+      if (field.type === "link")
+        for (const target of declaredLinkTargets(field) ?? []) relationTargets.add(target);
+    }
+  }
+  if (needsMedia && !granted.has("media.read")) {
+    warnings.push(
+      `cms.roles.${key} edits entries with media fields but cannot pick media: add 'media.read'`
+    );
+  }
+  for (const target of relationTargets) {
+    if (!granted.has(`${target}.read`)) {
+      warnings.push(
+        `cms.roles.${key} edits entries that link to '${target}' but cannot list it: add '${target}.read'`
+      );
+    }
+  }
+  return warnings;
+}
+export function validateRoles(input, config) {
+  const errors = [];
+  const warnings = [];
+  if (input === void 0) return { roles: {}, errors, warnings };
+  if (!isRecord(input)) {
+    return {
+      roles: {},
+      errors: ["cms.roles must be an object like { editor: { label, can: ['news.*'] } }"],
+      warnings
+    };
+  }
+  const allActions = /* @__PURE__ */ new Set([
+    ...CMS_ENTRY_PERMISSION_ACTIONS,
+    ...SYSTEM_SCOPES.flatMap((scope) => CMS_SYSTEM_SCOPES[scope])
+  ]);
+  const valid = {};
+  for (const [key, role] of Object.entries(input)) {
+    const at = `cms.roles.${key}`;
+    const before = errors.length;
+    if (CMS_RESERVED_ROLES.includes(key)) {
+      errors.push(`${at}: '${key}' is a built-in role and always has full access`);
+      continue;
+    }
+    if (!ROLE_KEY_PATTERN.test(key)) {
+      errors.push(
+        `${at}: role key must start with a lowercase letter and use letters, digits, '-' or '_'`
+      );
+    }
+    if (!isRecord(role)) {
+      errors.push(`${at} must be an object like { label, can: [...] }`);
+      continue;
+    }
+    for (const name of Object.keys(role)) {
+      if (!ROLE_KEYS.has(name)) errors.push(`${at} has an unknown key '${name}'`);
+    }
+    if (role.label !== void 0 && (typeof role.label !== "string" || !role.label.trim())) {
+      errors.push(`${at}.label must be a non-empty string`);
+    }
+    if (role.description !== void 0 && typeof role.description !== "string") {
+      errors.push(`${at}.description must be a string`);
+    }
+    if (!Array.isArray(role.can)) {
+      errors.push(`${at}.can must be an array of permissions`);
+      continue;
+    }
+    for (const permission of role.can) {
+      if (typeof permission !== "string") {
+        errors.push(`${at}.can must only hold strings`);
+        continue;
+      }
+      const error = permissionError(permission, config, allActions);
+      if (error) errors.push(`${at}.can: ${error}`);
+    }
+    if (errors.length === before) valid[key] = role;
+  }
+  const roles = resolveRoles(valid);
+  for (const [key, role] of Object.entries(roles)) {
+    warnings.push(...accessWarnings(key, expandPermissions(role.can, config), config));
+  }
+  return { roles, errors, warnings };
+}

package/dist/runtime/shared/save-state.d.ts

@@ -0,0 +1,8 @@
+type State = Record<string, unknown>;
+export declare function cloneState<T extends State>(state: T): T;
+export interface CmsSavedState {
+    state: State;
+    clean: boolean;
+}
+export declare function mergeSavedState(submitted: State, current: State, saved: State): CmsSavedState;
+export {};

package/dist/runtime/shared/save-state.js

@@ -0,0 +1,15 @@
+function sameValue(a, b) {
+  return JSON.stringify(a ?? null) === JSON.stringify(b ?? null);
+}
+export function cloneState(state) {
+  return JSON.parse(JSON.stringify(state));
+}
+export function mergeSavedState(submitted, current, saved) {
+  if (sameValue(current, submitted)) return { state: { ...saved }, clean: true };
+  const state = {};
+  for (const key of /* @__PURE__ */ new Set([...Object.keys(saved), ...Object.keys(current)])) {
+    const edited = Object.hasOwn(current, key) && !sameValue(current[key], submitted[key]);
+    state[key] = edited || !Object.hasOwn(saved, key) ? current[key] : saved[key];
+  }
+  return { state, clean: sameValue(state, saved) };
+}