@minamocms/framework 0.10.1 → 0.10.2

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to this package are documented here. Format loosely follows
 
 ## [Unreleased]
 
+## [0.10.2] - 2026-11-04
+
+### Fixed
+
+- **A site with no `media/` folder serves and stores media normally.** `media/` is git-ignored, so a site deployed by a host that builds from its repository (Railway, for one) starts without it. Until now every request for a media file there answered 500 instead of 404, and the first upload failed the same way. A missing folder now reads as an empty one, and the first upload creates it.
+
 ## [0.10.1] - 2026-10-15
 
 ### Changed

package/README.md

@@ -54,7 +54,7 @@ npm install
 npm start
 ```
 
-Visit `http://localhost:3000`. `create-site` prints a real API token to
+Visit `http://localhost:3000`. `create-site` prints a real access token to
 your terminal when it scaffolds the site - that's what the Minamo admin
 (or a plain `curl`) uses to authenticate against the site's
 `/v1/` API. Lost it, or need a second one? See the `mint-token` command in

package/dist/create-site/cli.js

@@ -11,7 +11,7 @@ try {
     const { raw } = scaffoldSite(targetDir);
     console.log(`Created a new site at ${targetDir}`);
     console.log('');
-    console.log('Your API token (save this now - it will not be shown again):');
+    console.log('Your access token (save this now - it will not be shown again):');
     console.log(`  ${raw}`);
     console.log('');
     console.log('Next steps:');

package/dist/create-site/mint-token-cli.js

@@ -12,7 +12,7 @@ try {
     const scopes = parseScopes(scopesArg);
     const siteDir = resolve(process.cwd(), targetArg);
     const { raw } = mintToken(siteDir, scopes);
-    console.log('New API token (save this now - it will not be shown again):');
+    console.log('New access token (save this now - it will not be shown again):');
     console.log(`  ${raw}`);
     console.log('');
     console.log(`Scopes: ${scopes.join(', ')}`);

package/dist/create-site/mint-token.js

@@ -44,6 +44,6 @@ export function mintToken(siteDir, scopes) {
     tokens.push({ hash: token.hash, scopes });
     config.tokens = tokens;
     writeFileSync(configPath, JSON.stringify(config, null, 2));
-    commitPaths(siteDir, ['vhost/site.config.json'], 'chore: mint a new API token', CHECKPOINT_AUTHOR);
+    commitPaths(siteDir, ['vhost/site.config.json'], 'chore: mint a new access token', CHECKPOINT_AUTHOR);
     return { raw: token.raw };
 }

package/dist/create-site/template/AGENTS.md

@@ -452,7 +452,7 @@ npm run dev         # same, plus auto-restart whenever a theme/ file changes - u
 npm run stop        # stops a site started by any of the above, from any terminal
 ```
 
-A site is deployed once; after that, `npm run pull` and `npm run push` move changes between this copy and the live site. `npm run pull` makes this copy match the live site for whatever is chosen - content (pages, menus, redirects, site settings, images), theme, or both - asking for the address and API token (or `npm run pull -- <its URL>` with `CMS_TOKEN` set). It refuses while the parts it would overwrite have uncommitted changes, and commits nothing. `npm run push` sends back only what changed here since the last pull: anything an editor changed on the live site since then stops the push and is listed instead of overwritten, it shows everything it will change, and it asks for the site's address to be typed first. After `npm run upgrade` it can also upgrade the live site's CMS. Never run push on a user's behalf without them confirming.
+A site is deployed once; after that, `npm run pull` and `npm run push` move changes between this copy and the live site. `npm run pull` makes this copy match the live site for whatever is chosen - content (pages, menus, redirects, site settings, images), theme, or both - asking for the address and access token (or `npm run pull -- <its URL>` with `CMS_TOKEN` set). It refuses while the parts it would overwrite have uncommitted changes, and commits nothing. `npm run push` sends back only what changed here since the last pull: anything an editor changed on the live site since then stops the push and is listed instead of overwritten, it shows everything it will change, and it asks for the site's address to be typed first. After `npm run upgrade` it can also upgrade the live site's CMS. Never run push on a user's behalf without them confirming.
 
 `npm run dev` only watches `theme/` - content changes (via the API) already show up on the next request with no restart needed, so there's nothing to gain watching `content/` too.
 

package/dist/media/drivers/local-fs-driver.js

@@ -31,6 +31,11 @@ export function openLocalFsMediaDriver(root) {
             });
         },
         async put(filename, bytes) {
+            // The root first: sanitisePath resolves the root's real path, which
+            // fails outright on a fresh deploy whose media folder was never
+            // created (media/ is git-ignored, so a host building from the
+            // repository has none).
+            mkdirSync(root, { recursive: true });
             const resolved = sanitisePath(root, filename);
             // Harmless no-op for a flat, content-addressed namespace (media
             // filenames never contain subdirectories) - matches
@@ -45,6 +50,11 @@ export function openLocalFsMediaDriver(root) {
             writeFileSync(resolved, bytes);
         },
         async get(filename) {
+            // No media folder yet is no media yet: nothing to find, and a read
+            // has no business creating the folder.
+            if (!existsSync(root)) {
+                return null;
+            }
             let resolved;
             try {
                 resolved = sanitisePath(root, filename);
@@ -70,6 +80,9 @@ export function openLocalFsMediaDriver(root) {
             // reading as "already didn't exist", matching
             // manage-redirects.ts's own not-found-is-a-distinct-reason
             // precedent.
+            if (!existsSync(root)) {
+                return false;
+            }
             const resolved = sanitisePath(root, filename);
             if (!existsSync(resolved)) {
                 return false;

package/dist/server.js

@@ -219,7 +219,7 @@ export async function startServer(siteRoot, options = {}) {
         try {
             tunnel = await (options.startTunnel ?? startDevTunnel)(serverConfig.port);
             console.log(`Tunnel open: ${tunnel.url}`);
-            console.log('This URL is publicly reachable for as long as this process runs - anyone with it (and a valid API token) can reach this site. Do not leave it running unattended.');
+            console.log('This URL is publicly reachable for as long as this process runs - anyone with it (and a valid access token) can reach this site. Do not leave it running unattended.');
         }
         catch (error) {
             // The site itself is already up and correctly serving locally -

package/dist/site-sync/cli-helpers.d.ts

@@ -5,7 +5,7 @@ export interface SyncArgs {
 }
 export declare function parseSyncArgs(argv: string[]): SyncArgs;
 export declare function ask(question: string, hidden?: boolean): Promise<string>;
-export declare const TOKEN_HELP = "The token is the live site's API token (the same one the admin uses), with the \"content\" and \"media\" scopes.";
+export declare const TOKEN_HELP = "The token is the live site's access token (the same one the admin uses), with the \"content\" and \"media\" scopes.";
 export declare function resolveToken(args: SyncArgs, siteUrl: string): Promise<string>;
 export interface PartOption {
     available: boolean;

package/dist/site-sync/cli-helpers.js

@@ -23,11 +23,11 @@ export async function ask(question, hidden = false) {
         throw error;
     }
 }
-export const TOKEN_HELP = 'The token is the live site\'s API token (the same one the admin uses), with the "content" and "media" scopes.';
+export const TOKEN_HELP = 'The token is the live site\'s access token (the same one the admin uses), with the "content" and "media" scopes.';
 // CMS_TOKEN and --token still work for scripts, but either leaves the
 // token in shell history; asked for, it goes nowhere.
 export async function resolveToken(args, siteUrl) {
-    const token = args.token ?? process.env.CMS_TOKEN ?? (await ask(`API token for ${siteUrl} (hidden): `, true));
+    const token = args.token ?? process.env.CMS_TOKEN ?? (await ask(`Access token for ${siteUrl} (hidden): `, true));
     if (!token) {
         console.error('No token entered.');
         console.error(TOKEN_HELP);

package/dist/site-sync/prompts.js

@@ -1,5 +1,5 @@
 // Asks questions on the terminal - the live site's address, then its
-// API token without showing it. A token typed on the command line (or
+// access token without showing it. A token typed on the command line (or
 // in CMS_TOKEN=... before it) ends up in shell history; typed here, it
 // goes nowhere but this process.
 export class PromptCancelledError extends Error {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@minamocms/framework",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "type": "module",
   "publishConfig": {
     "access": "public"