@revealui/core 0.10.0 → 0.10.1

package/dist/client/admin/components/AdminDashboard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AdminDashboard.d.ts","sourceRoot":"","sources":["../../../../src/client/admin/components/AdminDashboard.tsx"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAEV,YAAY,EAGb,MAAM,yBAAyB,CAAC;AAUjC,UAAU,mBAAmB;IAC3B,MAAM,EAAE,YAAY,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA8YD,wBAAgB,cAAc,CAAC,EAAE,MAAM,EAAE,QAAqB,EAAE,EAAE,mBAAmB,+BAmVpF"}
+{"version":3,"file":"AdminDashboard.d.ts","sourceRoot":"","sources":["../../../../src/client/admin/components/AdminDashboard.tsx"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAEV,YAAY,EAGb,MAAM,yBAAyB,CAAC;AAUjC,UAAU,mBAAmB;IAC3B,MAAM,EAAE,YAAY,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA2YD,wBAAgB,cAAc,CAAC,EAAE,MAAM,EAAE,QAAqB,EAAE,EAAE,mBAAmB,+BAmVpF"}

package/dist/client/admin/components/AdminDashboard.js

@@ -2,7 +2,7 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { logger } from '@revealui/core/utils/logger';
 import { useCallback, useEffect, useReducer, useState } from 'react';
-import { APIError, APIErrorType, apiClient } from '../utils/index.js';
+import { APIError, APIErrorType, apiClient, postSignOut } from '../utils/index.js';
 import { CollectionList } from './CollectionList.js';
 import { DocumentForm } from './DocumentForm.js';
 import { GlobalForm } from './GlobalForm.js';
@@ -66,10 +66,7 @@ function SignOutButton() {
     const handleSignOut = useCallback(async () => {
         setLoading(true);
         try {
-            await fetch('/api/auth/sign-out', {
-                method: 'POST',
-                credentials: 'include',
-            });
+            await postSignOut();
         }
         catch {
             // Sign out even if the API call fails  -  clear client state regardless

package/dist/client/admin/utils/apiClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apiClient.d.ts","sourceRoot":"","sources":["../../../../src/client/admin/utils/apiClient.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAE9D,MAAM,WAAW,WAAW,CAAC,CAAC,GAAG,cAAc;IAC7C,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;IACX,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED,oBAAY,YAAY;IACtB,OAAO,YAAY;IACnB,cAAc,mBAAmB;IACjC,aAAa,kBAAkB;IAC/B,UAAU,eAAe;IACzB,QAAQ,cAAc;IACtB,MAAM,WAAW;CAClB;AAED,qBAAa,QAAS,SAAQ,KAAK;IAExB,IAAI,EAAE,YAAY;IAElB,MAAM,CAAC,EAAE,MAAM;IACf,KAAK,CAAC,EAAE,MAAM;gBAHd,IAAI,EAAE,YAAY,EACzB,OAAO,EAAE,MAAM,EACR,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,KAAK,CAAC,EAAE,MAAM,YAAA;CAKxB;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA+BD;;GAEG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,OAAO,CAAS;gBAEZ,OAAO,GAAE,gBAAqB;IAW1C;;OAEG;YACW,OAAO;IAoGrB;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAuBtD;;OAEG;IACG,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAUvE;;OAEG;IACG,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAY7D;;OAEG;IACG,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAY7D;;OAEG;IACG,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IASnD;;OAEG;IACG,WAAW,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAUhF;;OAEG;IACG,WAAW,CAAC,OAAO,EAAE;QACzB,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KACxD,GAAG,OAAO,CAAC,IAAI,CAAC;IAUjB;;OAEG;IACG,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;IAerE;;OAEG;IACG,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;CAe1E;AAGD,eAAO,MAAM,SAAS,WAAkB,CAAC"}
+{"version":3,"file":"apiClient.d.ts","sourceRoot":"","sources":["../../../../src/client/admin/utils/apiClient.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAG9D,MAAM,WAAW,WAAW,CAAC,CAAC,GAAG,cAAc;IAC7C,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;IACX,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED,oBAAY,YAAY;IACtB,OAAO,YAAY;IACnB,cAAc,mBAAmB;IACjC,aAAa,kBAAkB;IAC/B,UAAU,eAAe;IACzB,QAAQ,cAAc;IACtB,MAAM,WAAW;CAClB;AAED,qBAAa,QAAS,SAAQ,KAAK;IAExB,IAAI,EAAE,YAAY;IAElB,MAAM,CAAC,EAAE,MAAM;IACf,KAAK,CAAC,EAAE,MAAM;gBAHd,IAAI,EAAE,YAAY,EACzB,OAAO,EAAE,MAAM,EACR,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,KAAK,CAAC,EAAE,MAAM,YAAA;CAKxB;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA+BD;;GAEG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,OAAO,CAAS;gBAEZ,OAAO,GAAE,gBAAqB;IAW1C;;OAEG;YACW,OAAO;IA0FrB;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAuBtD;;OAEG;IACG,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAUvE;;OAEG;IACG,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAY7D;;OAEG;IACG,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAY7D;;OAEG;IACG,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IASnD;;OAEG;IACG,WAAW,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAUhF;;OAEG;IACG,WAAW,CAAC,OAAO,EAAE;QACzB,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KACxD,GAAG,OAAO,CAAC,IAAI,CAAC;IAUjB;;OAEG;IACG,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;IAerE;;OAEG;IACG,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;CAe1E;AAGD,eAAO,MAAM,SAAS,WAAkB,CAAC"}

package/dist/client/admin/utils/apiClient.js

@@ -2,6 +2,7 @@
  * API Client for RevealUI Admin Dashboard
  * Handles all API communication with authentication and error handling
  */
+import { readCsrfToken } from './csrf.js';
 export var APIErrorType;
 (function (APIErrorType) {
     APIErrorType["Network"] = "network";
@@ -65,18 +66,7 @@ export class APIClient {
     async request(endpoint, options = {}) {
         const Unsafe = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
         const method = (options.method ?? 'GET').toUpperCase();
-        let csrfToken;
-        if (Unsafe.has(method) && typeof document !== 'undefined') {
-            for (const part of document.cookie.split(';')) {
-                const eqIdx = part.indexOf('=');
-                if (eqIdx === -1)
-                    continue;
-                if (part.slice(0, eqIdx).trim() === 'revealui-csrf') {
-                    csrfToken = part.slice(eqIdx + 1).trim() || undefined;
-                    break;
-                }
-            }
-        }
+        const csrfToken = Unsafe.has(method) ? readCsrfToken() : undefined;
         const headers = {
             'Content-Type': 'application/json',
             ...(csrfToken ? { 'X-CSRF-Token': csrfToken } : {}),

package/dist/client/admin/utils/csrf.d.ts

@@ -0,0 +1,25 @@
+/**
+ * CSRF helpers for the admin client.
+ *
+ * The admin proxy and the api server's csrfMiddleware require any unsafe
+ * request carrying a `revealui-session` cookie to echo the JS-readable
+ * `revealui-csrf` cookie as an `X-CSRF-Token` header. The token is re-read
+ * immediately before each request because the proxy re-issues the cookie
+ * whenever it no longer validates against the current session (e.g. after
+ * re-login or session rotation).
+ */
+/**
+ * Read the `revealui-csrf` cookie value. Returns `undefined` outside the
+ * browser, when the cookie is absent, or when its value is empty.
+ */
+export declare function readCsrfToken(): string | undefined;
+/**
+ * POST `/api/auth/sign-out`, echoing the CSRF cookie as `X-CSRF-Token` when
+ * one is readable. Sign-out always runs with a session cookie, so without the
+ * header the admin proxy rejects the request with 403 "CSRF token missing"
+ * and the server-side session is never revoked. When no cookie is readable
+ * the request stays byte-identical to the historical bare fetch (no `headers`
+ * key at all).
+ */
+export declare function postSignOut(): Promise<Response>;
+//# sourceMappingURL=csrf.d.ts.map

package/dist/client/admin/utils/csrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../../../src/client/admin/utils/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;GAGG;AACH,wBAAgB,aAAa,IAAI,MAAM,GAAG,SAAS,CAgBlD;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC,QAAQ,CAAC,CAOrD"}

package/dist/client/admin/utils/csrf.js

@@ -0,0 +1,51 @@
+/**
+ * CSRF helpers for the admin client.
+ *
+ * The admin proxy and the api server's csrfMiddleware require any unsafe
+ * request carrying a `revealui-session` cookie to echo the JS-readable
+ * `revealui-csrf` cookie as an `X-CSRF-Token` header. The token is re-read
+ * immediately before each request because the proxy re-issues the cookie
+ * whenever it no longer validates against the current session (e.g. after
+ * re-login or session rotation).
+ */
+/**
+ * Read the `revealui-csrf` cookie value. Returns `undefined` outside the
+ * browser, when the cookie is absent, or when its value is empty.
+ */
+export function readCsrfToken() {
+    if (typeof document === 'undefined')
+        return undefined;
+    for (const part of document.cookie.split(';')) {
+        const eqIdx = part.indexOf('=');
+        if (eqIdx === -1)
+            continue;
+        if (part.slice(0, eqIdx).trim() === 'revealui-csrf') {
+            const raw = part.slice(eqIdx + 1).trim();
+            if (!raw)
+                return undefined;
+            try {
+                return decodeURIComponent(raw);
+            }
+            catch {
+                return raw;
+            }
+        }
+    }
+    return undefined;
+}
+/**
+ * POST `/api/auth/sign-out`, echoing the CSRF cookie as `X-CSRF-Token` when
+ * one is readable. Sign-out always runs with a session cookie, so without the
+ * header the admin proxy rejects the request with 403 "CSRF token missing"
+ * and the server-side session is never revoked. When no cookie is readable
+ * the request stays byte-identical to the historical bare fetch (no `headers`
+ * key at all).
+ */
+export async function postSignOut() {
+    const csrfToken = readCsrfToken();
+    return fetch('/api/auth/sign-out', {
+        method: 'POST',
+        credentials: 'include',
+        ...(csrfToken ? { headers: { 'X-CSRF-Token': csrfToken } } : {}),
+    });
+}

package/dist/client/admin/utils/index.d.ts

@@ -2,4 +2,5 @@
  * Admin utilities exports
  */
 export * from './apiClient.js';
+export * from './csrf.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/client/admin/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/client/admin/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/client/admin/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC"}

package/dist/client/admin/utils/index.js

@@ -2,3 +2,4 @@
  * Admin utilities exports
  */
 export * from './apiClient.js';
+export * from './csrf.js';

package/dist/client/richtext/components/ImageUploadButton.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ImageUploadButton.d.ts","sourceRoot":"","sources":["../../../../src/client/richtext/components/ImageUploadButton.tsx"],"names":[],"mappings":"AAUA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAO/B,UAAU,sBAAsB;IAC9B,aAAa,CAAC,EAAE,MAAM,IAAI,CAAC;IAC3B,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,0DAA0D;IAC1D,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAqBD,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,EAAE,CAAC,sBAAsB,CA0I9D,CAAC"}
+{"version":3,"file":"ImageUploadButton.d.ts","sourceRoot":"","sources":["../../../../src/client/richtext/components/ImageUploadButton.tsx"],"names":[],"mappings":"AAUA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAQ/B,UAAU,sBAAsB;IAC9B,aAAa,CAAC,EAAE,MAAM,IAAI,CAAC;IAC3B,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,0DAA0D;IAC1D,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAqBD,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAsI9D,CAAC"}

package/dist/client/richtext/components/ImageUploadButton.js

@@ -9,6 +9,7 @@ import { useLexicalComposerContext } from '@lexical/react/LexicalComposerContext
 import { logger } from '@revealui/core/utils/logger';
 import { useCallback, useRef, useState } from 'react';
 import { INSERT_IMAGE_COMMAND } from '../nodes/ImageNode.js';
+import { postMediaUpload } from './upload.js';
 /** Default maximum file size: 10 MB */
 const DEFAULT_MAX_FILE_SIZE_BYTES = 10 * 1024 * 1024;
 const getUploadUrl = (payload) => {
@@ -64,11 +65,7 @@ export const ImageUploadButton = ({ onUploadStart, onUploadComplete, onUploadErr
             const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
             let response;
             try {
-                response = await fetch(uploadEndpoint, {
-                    method: 'POST',
-                    body: formData,
-                    signal: controller.signal,
-                });
+                response = await postMediaUpload(uploadEndpoint, formData, controller.signal);
             }
             finally {
                 clearTimeout(timeoutId);

package/dist/client/richtext/components/upload.d.ts

@@ -0,0 +1,21 @@
+/**
+ * RevealUI Rich Text Editor - media upload POST
+ *
+ * The admin proxy and the api server's csrfMiddleware require any unsafe
+ * request carrying a `revealui-session` cookie to echo the JS-readable
+ * `revealui-csrf` cookie as an `X-CSRF-Token` header. The editor's default
+ * `/api/media` endpoint is not CSRF-exempt, so the historical bare upload
+ * POST was rejected with 403 "CSRF token missing" in the admin app. The
+ * token is re-read immediately before each request because the proxy
+ * re-issues the cookie whenever it no longer validates against the current
+ * session (e.g. after re-login or session rotation).
+ */
+/**
+ * POST `body` to `uploadEndpoint`, echoing the CSRF cookie as `X-CSRF-Token`
+ * when one is readable. `Content-Type` is never set here - `fetch` derives
+ * the multipart boundary from the FormData body, and an explicit value would
+ * break it. When no cookie is readable the request stays byte-identical to
+ * the historical bare fetch (no `headers` key at all).
+ */
+export declare function postMediaUpload(uploadEndpoint: string, body: FormData, signal: AbortSignal): Promise<Response>;
+//# sourceMappingURL=upload.d.ts.map

package/dist/client/richtext/components/upload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../../../../src/client/richtext/components/upload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,QAAQ,CAAC,CAQnB"}

package/dist/client/richtext/components/upload.js

@@ -0,0 +1,29 @@
+/**
+ * RevealUI Rich Text Editor - media upload POST
+ *
+ * The admin proxy and the api server's csrfMiddleware require any unsafe
+ * request carrying a `revealui-session` cookie to echo the JS-readable
+ * `revealui-csrf` cookie as an `X-CSRF-Token` header. The editor's default
+ * `/api/media` endpoint is not CSRF-exempt, so the historical bare upload
+ * POST was rejected with 403 "CSRF token missing" in the admin app. The
+ * token is re-read immediately before each request because the proxy
+ * re-issues the cookie whenever it no longer validates against the current
+ * session (e.g. after re-login or session rotation).
+ */
+import { readCsrfToken } from '../../admin/utils/csrf.js';
+/**
+ * POST `body` to `uploadEndpoint`, echoing the CSRF cookie as `X-CSRF-Token`
+ * when one is readable. `Content-Type` is never set here - `fetch` derives
+ * the multipart boundary from the FormData body, and an explicit value would
+ * break it. When no cookie is readable the request stays byte-identical to
+ * the historical bare fetch (no `headers` key at all).
+ */
+export async function postMediaUpload(uploadEndpoint, body, signal) {
+    const csrfToken = readCsrfToken();
+    return fetch(uploadEndpoint, {
+        method: 'POST',
+        body,
+        signal,
+        ...(csrfToken ? { headers: { 'X-CSRF-Token': csrfToken } } : {}),
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@revealui/core",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "description": "RevealUI's runtime engine — admin UI, REST API, auth, rich text, plugin system, and access control. The heart of the open-source platform.",
   "license": "MIT",
   "dependencies": {