@vinumcms/core

Pure schemas, sanitizers and registries. No I/O, no React, no imports from other Vinum packages — everything here is a pure function or a type, which is what makes it cheap to test and safe to import anywhere.

import { CORE_BLOCKS, createBlockRegistry, sanitizeBlocks, safeHref, isLive } from "@vinumcms/core";

const registry = createBlockRegistry(CORE_BLOCKS);
const blocks = sanitizeBlocks(untrustedJson, registry);  // unknown types dropped

What's here: the Page, Block, FormField, PageType and NavConfig models · every sanitize* function · the block registry · safeHref/safeSrc · isLive and the scheduling helpers · buildMeta and JSON-LD builders · the Store, MediaStore and Mailer interfaces.

Forms are one flat array of fields. Layout (width), structure (section, divider, pageBreak), conditions and validation rules are all properties of a field rather than containers around it, which is why a form stored before any of them existed still fits the type. fieldRows() packs fields into rows, visibleFields() resolves conditions, formPages() splits on page breaks and validateSubmission() decides — the browser and the server call the same four, so they cannot disagree. isInputField() is what keeps a section heading out of a submission. The builder and the full field reference are documented under Forms in @vinumcms/admin.

This package is the trust boundary. Anything arriving from an editor, a form post or an import file passes through a sanitizer here before it is stored or rendered.

Setup and theming live in @vinumcms/admin, which carries the getting-started guide for all of Vinum.