@velastack/cms 0.1.0 → 0.2.0

package/dist/backend/store/sqlite.d.ts

@@ -0,0 +1,22 @@
+export interface SqliteStatement<Params extends unknown[] = unknown[], Row = unknown> {
+    run(...params: Params): {
+        changes: number;
+        lastInsertRowid: number | bigint;
+    };
+    get(...params: Params): Row | undefined;
+    all(...params: Params): Row[];
+}
+export interface SqliteDb {
+    prepare<Params extends unknown[] = unknown[], Row = unknown>(sql: string): SqliteStatement<Params, Row>;
+    exec(sql: string): void;
+    transaction<Fn extends (...args: never[]) => unknown>(fn: Fn): Fn;
+    pragma(source: string): unknown;
+    close(): void;
+}
+export type SqliteDriver = new (path: string) => SqliteDb;
+/**
+ * Resolve `better-sqlite3` at call time. It is an optional peer dependency, so
+ * a project that only uses the components and the SSR read path never installs
+ * it — and never compiles a native module.
+ */
+export declare const loadDriver: () => SqliteDriver;

package/dist/backend/store/sqlite.js

@@ -0,0 +1,29 @@
+/**
+ * A structural view of the slice of `better-sqlite3` this backend uses.
+ *
+ * Declaring the shape here rather than importing `@types/better-sqlite3` has
+ * three payoffs. The driver stays out of the emitted `dist/backend/*.d.ts`, so
+ * a consumer type-checking against `@velastack/cms/backend` needs neither the
+ * package nor its types. `createRequire` is opaque to bundlers, which is what a
+ * native `.node` binding needs anyway. And a host can hand in an already-open
+ * connection through `db`, which is also how tests get an isolated `:memory:`
+ * database per file.
+ *
+ * The generic `prepare<Params, Row>` signature matches how the store already
+ * calls it, so the call sites are unchanged from the original.
+ */
+import { createRequire } from 'node:module';
+/**
+ * Resolve `better-sqlite3` at call time. It is an optional peer dependency, so
+ * a project that only uses the components and the SSR read path never installs
+ * it — and never compiles a native module.
+ */
+export const loadDriver = () => {
+    try {
+        return createRequire(import.meta.url)('better-sqlite3');
+    }
+    catch (cause) {
+        throw new Error("@velastack/cms/backend requires 'better-sqlite3', which is an optional peer " +
+            'dependency. Install it with `npm i better-sqlite3`.', { cause });
+    }
+};

package/dist/backend/testing/fixtures.d.ts

@@ -0,0 +1,39 @@
+import { type CmsBackend } from '../factory.js';
+import { type CmsTestClient } from './harness.js';
+import type { CmsBackendOptions, CmsEditor } from '../types.js';
+/** Cheap on purpose: fast enough to run per test, real enough to exercise the
+ * same code path as production. */
+export declare const TEST_SCRYPT: {
+    N: number;
+    r: number;
+    p: number;
+};
+export type TestFixture = {
+    backend: CmsBackend;
+    /** Unauthenticated client for the default project. */
+    anon: CmsTestClient;
+    /** Signed in as alice, who can reach `p1` and `p_alice`. */
+    alice: CmsTestClient;
+    /** Signed in as bob, who can reach `p1` and `p_bob`. */
+    bob: CmsTestClient;
+    users: {
+        alice: CmsEditor;
+        bob: CmsEditor;
+    };
+    /** A client for another project, optionally carrying a session. */
+    at: (projectId: string, as?: CmsTestClient) => CmsTestClient;
+    uploadDir: string;
+};
+export type TestFixtureOptions = {
+    /** Defaults to `p1`. */
+    projectId?: string;
+    /** Mount path. Defaults to the multi-tenant shape so params are exercised. */
+    basePath?: (projectId: string) => string;
+    backend?: Partial<CmsBackendOptions>;
+};
+/**
+ * Two accounts sharing one project and each holding a private one — enough to
+ * exercise collaboration (same publish queue, conflicting drafts) and
+ * cross-project denial without a third.
+ */
+export declare const createTestFixture: (options?: TestFixtureOptions) => Promise<TestFixture>;

package/dist/backend/testing/fixtures.js

@@ -0,0 +1,61 @@
+/**
+ * Setup for tests that drive the backend over its HTTP surface.
+ *
+ * Each call builds an isolated `':memory:'` backend with two editors, so test
+ * files hold no shared state and run in parallel. Password hashing is dialled
+ * right down — these tests are about routing and content, and real scrypt
+ * parameters would dominate the run.
+ *
+ * Exported from `@velastack/cms/backend` because a host integrating its own
+ * auth adapter wants the same harness for its own tests.
+ */
+import { mkdtempSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createCmsBackend } from '../factory.js';
+import { localEditors } from '../auth/local-editors.js';
+import { createCmsTestClient } from './harness.js';
+/** Cheap on purpose: fast enough to run per test, real enough to exercise the
+ * same code path as production. */
+export const TEST_SCRYPT = { N: 1024, r: 8, p: 1 };
+/**
+ * Two accounts sharing one project and each holding a private one — enough to
+ * exercise collaboration (same publish queue, conflicting drafts) and
+ * cross-project denial without a third.
+ */
+export const createTestFixture = async (options = {}) => {
+    const projectId = options.projectId ?? 'p1';
+    const basePath = options.basePath ?? ((p) => `/v1/projects/${p}/cms`);
+    const uploadDir = mkdtempSync(join(tmpdir(), 'vela-cms-test-'));
+    const backend = createCmsBackend({
+        dbPath: ':memory:',
+        uploadDir,
+        testReset: true,
+        auth: localEditors({ scrypt: TEST_SCRYPT }),
+        resolveProject: (event) => event.params.project_id ?? projectId,
+        ...options.backend
+    });
+    const alice = await backend.editors.create({
+        email: 'alice@example.com',
+        password: 'password',
+        name: 'Alice',
+        projects: [projectId, 'p_alice']
+    });
+    const bob = await backend.editors.create({
+        email: 'bob@example.com',
+        password: 'password',
+        name: 'Bob',
+        projects: [projectId, 'p_bob']
+    });
+    const clientFor = (p) => createCmsTestClient(backend, { basePath: basePath(p), params: { project_id: p } });
+    const anon = clientFor(projectId);
+    return {
+        backend,
+        anon,
+        alice: anon.as(`cms_session=${backend.editors.createSession(alice.id).token}`),
+        bob: anon.as(`cms_session=${backend.editors.createSession(bob.id).token}`),
+        users: { alice, bob },
+        at: (p, as) => (as ?? anon).at(basePath(p), { project_id: p }),
+        uploadDir
+    };
+};

package/dist/backend/testing/harness.d.ts

@@ -0,0 +1,35 @@
+import type { CmsBackend } from '../factory.js';
+export type TestResponse = {
+    status: number;
+    headers: Headers;
+    text: string;
+    json<T = unknown>(): T;
+};
+export type RequestInitLike = {
+    body?: unknown;
+    formData?: FormData;
+    headers?: Record<string, string>;
+    cookie?: string;
+};
+export type CmsTestClient = {
+    get(path: string, init?: RequestInitLike): Promise<TestResponse>;
+    post(path: string, init?: RequestInitLike): Promise<TestResponse>;
+    del(path: string, init?: RequestInitLike): Promise<TestResponse>;
+    request(method: string, path: string, init?: RequestInitLike): Promise<TestResponse>;
+    /** A client that sends this cookie on every request. */
+    as(cookie: string): CmsTestClient;
+    /** A client mounted at a different base path / route params. */
+    at(basePath: string, params?: Record<string, string>): CmsTestClient;
+    /** The cookie jar accumulated from `set-cookie` responses. */
+    cookies: Map<string, string>;
+};
+export type TestClientOptions = {
+    /** Where the backend is mounted, e.g. `/v1/projects/p1/cms`. */
+    basePath: string;
+    /** Route params other than the rest parameter, e.g. `{ project_id: 'p1' }`. */
+    params?: Record<string, string>;
+    /** Name of the rest parameter. Must match the backend's `restParam`. */
+    restParam?: string;
+    origin?: string;
+};
+export declare const createCmsTestClient: (backend: CmsBackend, options: TestClientOptions) => CmsTestClient;

package/dist/backend/testing/harness.js

@@ -0,0 +1,149 @@
+const parseCookieHeader = (header) => {
+    const out = new Map();
+    if (!header)
+        return out;
+    for (const part of header.split(';')) {
+        const eq = part.indexOf('=');
+        if (eq === -1)
+            continue;
+        out.set(part.slice(0, eq).trim(), part.slice(eq + 1).trim());
+    }
+    return out;
+};
+const serializeCookie = (name, value, opts) => {
+    const bits = [`${name}=${encodeURIComponent(value)}`];
+    if (opts.path)
+        bits.push(`Path=${opts.path}`);
+    if (typeof opts.maxAge === 'number')
+        bits.push(`Max-Age=${opts.maxAge}`);
+    if (opts.httpOnly)
+        bits.push('HttpOnly');
+    if (opts.secure)
+        bits.push('Secure');
+    if (opts.partitioned)
+        bits.push('Partitioned');
+    if (opts.sameSite) {
+        const v = String(opts.sameSite);
+        bits.push(`SameSite=${v.charAt(0).toUpperCase()}${v.slice(1)}`);
+    }
+    return bits.join('; ');
+};
+export const createCmsTestClient = (backend, options) => {
+    const restParam = options.restParam ?? 'path';
+    const origin = options.origin ?? 'http://localhost';
+    const basePath = options.basePath.replace(/\/$/, '');
+    const jar = new Map();
+    const run = async (method, path, init = {}) => {
+        const url = new URL(`${basePath}${path.startsWith('/') ? path : `/${path}`}`, origin);
+        const rest = url.pathname.slice(basePath.length).replace(/^\//, '');
+        const headers = new Headers(init.headers ?? {});
+        const cookieHeader = init.cookie ?? (jar.size > 0 ? [...jar].map(([k, v]) => `${k}=${v}`).join('; ') : undefined);
+        if (cookieHeader)
+            headers.set('cookie', cookieHeader);
+        let body;
+        if (init.formData) {
+            body = init.formData;
+        }
+        else if (init.body !== undefined) {
+            body = JSON.stringify(init.body);
+            if (!headers.has('content-type'))
+                headers.set('content-type', 'application/json');
+        }
+        const request = new Request(url, { method, headers, body });
+        const requestCookies = parseCookieHeader(headers.get('cookie') ?? undefined);
+        // Mirrors SvelteKit: lowercase keys, duplicates throw, set-cookie throws.
+        const accumulated = {};
+        const setHeaders = (newHeaders) => {
+            for (const key in newHeaders) {
+                const lower = key.toLowerCase();
+                if (lower === 'set-cookie') {
+                    throw new Error('Use `event.cookies.set` instead of `event.setHeaders` to set cookies');
+                }
+                if (lower in accumulated) {
+                    throw new Error(`"${key}" header is already set`);
+                }
+                accumulated[lower] = newHeaders[key];
+            }
+        };
+        const pending = [];
+        const cookies = {
+            get: (name) => requestCookies.get(name),
+            getAll: () => [...requestCookies].map(([name, value]) => ({ name, value })),
+            set: (name, value, opts) => {
+                requestCookies.set(name, value);
+                pending.push(serializeCookie(name, value, opts));
+            },
+            delete: (name, opts) => {
+                requestCookies.delete(name);
+                pending.push(serializeCookie(name, '', { ...opts, maxAge: 0 }));
+            },
+            serialize: serializeCookie
+        };
+        const event = {
+            request,
+            url,
+            params: { ...(options.params ?? {}), [restParam]: rest },
+            locals: {},
+            cookies,
+            setHeaders,
+            route: { id: `${basePath}/[...${restParam}]` },
+            isDataRequest: false,
+            isSubRequest: false,
+            isRemoteRequest: false,
+            platform: undefined,
+            getClientAddress: () => '127.0.0.1',
+            fetch: globalThis.fetch
+        };
+        const response = await backend.handle(event);
+        // SvelteKit applies accumulated headers over the response, then appends
+        // cookies. Order matters: setHeaders wins.
+        for (const [k, v] of Object.entries(accumulated))
+            response.headers.set(k, v);
+        for (const c of pending)
+            response.headers.append('set-cookie', c);
+        for (const c of pending) {
+            const [pair] = c.split(';');
+            const eq = pair.indexOf('=');
+            const name = pair.slice(0, eq);
+            const value = decodeURIComponent(pair.slice(eq + 1));
+            if (/Max-Age=0/.test(c))
+                jar.delete(name);
+            else
+                jar.set(name, value);
+        }
+        const text = await response.text();
+        return {
+            status: response.status,
+            headers: response.headers,
+            text,
+            json: () => JSON.parse(text)
+        };
+    };
+    const client = {
+        request: run,
+        get: (path, init) => run('GET', path, init),
+        post: (path, init) => run('POST', path, init),
+        del: (path, init) => run('DELETE', path, init),
+        as: (cookie) => {
+            const scoped = createCmsTestClient(backend, options);
+            const [name, ...rest] = cookie.split('=');
+            scoped.cookies.set(name.trim(), rest.join('='));
+            return scoped;
+        },
+        // Carries the cookie jar across, so `client.as(session).at(otherProject)`
+        // is the same browser visiting a different mount — which is exactly the
+        // cross-project authorization case.
+        at: (nextBasePath, params) => {
+            const scoped = createCmsTestClient(backend, {
+                ...options,
+                basePath: nextBasePath,
+                params
+            });
+            for (const [k, v] of jar)
+                scoped.cookies.set(k, v);
+            return scoped;
+        },
+        cookies: jar
+    };
+    return client;
+};

package/dist/backend/types.d.ts

@@ -0,0 +1,102 @@
+import type { RequestEvent } from '@sveltejs/kit';
+import type { SqliteDb } from './store/sqlite.js';
+/** An authenticated content editor. */
+export type CmsEditor = {
+    id: string;
+    email: string;
+    name: string;
+};
+/** What a successful login produces: the editor, and the raw session token to
+ * put in the cookie. */
+export type CmsSessionGrant = {
+    user: CmsEditor;
+    token: string;
+    expiresAt: Date;
+};
+/** Handed to every adapter method so an implementation can reach the database
+ * and know which tenant the request is for without closing over the factory. */
+export type CmsAuthContext = {
+    db: SqliteDb;
+    projectId: string;
+    cookieName: string;
+};
+/**
+ * The seam between the CMS and whatever owns identity.
+ *
+ * `localEditors()` is the built-in implementation, backed by the CMS's own
+ * `cms_editors` table. A host that already has accounts — velastack's
+ * PocketBase users, say — supplies its own and the router is none the wiser.
+ */
+export type CmsAuthAdapter = {
+    /** Resolve the request's editor, or `null` for anonymous. Must not throw on
+     * a malformed or stale cookie: anonymous is a valid outcome, not an error. */
+    resolve(event: RequestEvent, ctx: CmsAuthContext): Promise<CmsEditor | null>;
+    /** May this editor act on this project? A `false` here is a 403 before any
+     * handler runs. */
+    authorize(user: CmsEditor, projectId: string, ctx: CmsAuthContext): Promise<boolean>;
+    /** Backs the built-in login page. Omit it and `/iframe/login` 404s, leaving
+     * login entirely to the host. */
+    login?(email: string, password: string, ctx: CmsAuthContext): Promise<CmsSessionGrant | null>;
+    /** Invalidate server-side session state on logout. The cookie is cleared
+     * regardless. */
+    logout?(event: RequestEvent, ctx: CmsAuthContext): Promise<void>;
+};
+export type CmsCookieOptions = {
+    name?: string;
+    path?: string;
+    sameSite?: 'lax' | 'strict' | 'none';
+    secure?: boolean;
+    /** CHIPS. Pairs with `sameSite: 'none'` to survive third-party cookie
+     * deprecation in the embedded-iframe login flow. */
+    partitioned?: boolean;
+    maxAge?: number;
+};
+export type CmsCorsOptions = {
+    /** Called with the request's `Origin`. Return true to allow it. */
+    origin: (origin: string, event: RequestEvent) => boolean;
+    methods?: string[];
+    headers?: string[];
+    credentials?: boolean;
+};
+export type CmsBackendOptions = {
+    /** SQLite file path. `':memory:'` is supported. Ignored when `db` is given.
+     * Defaults to `$VELA_DATA_DIR/cms.sqlite`, else `./data/cms.sqlite`. */
+    dbPath?: string;
+    /** An already-open connection. Migrations still run against it. */
+    db?: SqliteDb;
+    /** Where uploaded bytes are written. Defaults to a sibling `uploads/`
+     * directory next to the database. */
+    uploadDir?: string;
+    /**
+     * Base URL for media, written into `media_items.url` and embedded in
+     * content. Defaults to a root-relative `/uploads`, which keeps the origin
+     * out of stored content. Pass an absolute base when the CMS is on a
+     * different origin than the site — or to preserve an existing wire format.
+     */
+    mediaBaseUrl?: string | ((event: RequestEvent) => string);
+    /** Which tenant this request is for. Returning `null` is a 404. Defaults to
+     * the constant `'default'`, which is the single-tenant case. */
+    resolveProject?: (event: RequestEvent) => string | null;
+    /** Name of the catch-all rest parameter the handlers are mounted under. */
+    restParam?: string;
+    /** Identity and authorization. Defaults to `localEditors()`. */
+    auth?: CmsAuthAdapter;
+    cookie?: CmsCookieOptions;
+    /**
+     * Cross-origin access. `false` (the default) emits no CORS headers, which is
+     * correct for a same-origin mount.
+     *
+     * Enabling this is a security decision, not a convenience one: the session
+     * cookie is credentialed and the JSON mutation endpoints are not covered by
+     * SvelteKit's CSRF check (it only guards form content types). An `origin`
+     * predicate that returns `true` unconditionally lets any site on the
+     * internet drive those endpoints with a signed-in editor's cookie. Allowlist
+     * the origins you actually serve.
+     */
+    cors?: false | CmsCorsOptions;
+    /** `frame-ancestors` for the login pages. Defaults to `'self'`; the
+     * cross-origin admin bar needs the embedding site (or `*`). */
+    frameAncestors?: string;
+    /** Expose `POST /__test_reset__`. Never enable in production. */
+    testReset?: boolean;
+};

package/dist/cms.d.ts

@@ -1,6 +1,6 @@
 export declare const loadCms: (event: import("@sveltejs/kit").ServerLoadEvent, { locale }: {
     locale: string;
-}) => Promise<import("./srv/index.js").LoadCmsResult>, generateEntries: {
-    (): Promise<import("./srv/index.js").CmsEntry<import("$app/types").RouteParams<import("$app/types").RouteId>>[]>;
-    <R extends import("$app/types").RouteId>(routeId: R): Promise<import("./srv/index.js").CmsEntry<import("$app/types").RouteParams<R>>[]>;
+}) => Promise<import("./server/index.js").LoadCmsResult>, generateEntries: {
+    (): Promise<import("./server/index.js").CmsEntry<import("$app/types").RouteParams<import("$app/types").RouteId>>[]>;
+    <R extends import("$app/types").RouteId>(routeId: R): Promise<import("./server/index.js").CmsEntry<import("$app/types").RouteParams<R>>[]>;
 };

package/dist/cms.js

@@ -1,4 +1,4 @@
-import { createCms, apiAdapter } from './srv/index.js';
+import { createCms, apiAdapter } from './server/index.js';
 import { locales } from '../locales/data.js';
 export const { load: loadCms, generateEntries } = createCms({
     adapter: apiAdapter({ endpoint: 'https://velastack.dev/v1/projects/velastack-cms/cms' }),

package/dist/components/admin-bar/publish-dialog.svelte

@@ -2,7 +2,7 @@
 	import { page } from '$app/state';
 	import type { ReleaseItem } from '../cms/cms-store.svelte.js';
 	import type { CmsPayload } from '../cms/scope.js';
-	import { diffPaths, type Tree } from '../cms/path.js';
+	import { diffPaths, type Tree } from '../../core/path.js';
 	import { resolveRouteOnlyParams, resolveRouteUrl } from './resolve-route.js';
 	import { Badge, type BadgeVariant } from './ui/badge/index.js';
 	import { Button } from './ui/button/index.js';

package/dist/components/cms/cms-image-editable.svelte

@@ -2,7 +2,7 @@
 	import { tick as svelteTick } from 'svelte';
 	import { page } from '$app/state';
 	import { cmsStore, type CmsScopeRef, type MediaItem } from './cms-store.svelte.js';
-	import { get as pathGet } from './path.js';
+	import { get as pathGet } from '../../core/path.js';
 	import type { CmsImageValue } from './cms-image.svelte';
 	import { Button } from '../admin-bar/ui/button/index.js';
 	import { Input } from '../admin-bar/ui/input/index.js';

package/dist/components/cms/cms-store.svelte.d.ts

@@ -1,5 +1,7 @@
-import { type Tree } from './path.js';
+import { type Tree } from '../../core/path.js';
+import type { MediaItem, OpenRelease, PageDeleteOutcome, ReleaseItem } from '../../core/wire.js';
 import type { CmsEntry, CmsPagePointer, CmsScopeEntry } from './scope.js';
+export type { MediaItem, OpenRelease, PageDeleteOutcome, ReleaseItem };
 export type CmsScopeRef = {
     scopeId: string;
     routeId: string;
@@ -10,72 +12,6 @@ type DraftBucket = {
     locale: string;
     tree: Tree;
 };
-/**
- * Outcome of a page-delete release item: omit for hard-delete (404 after
- * publish), set to `gone` for permanent removal (410), or `redirect` to a
- * target URL for a permanent redirect (308). The CMS server keeps the
- * outcome on the published tombstone after the release is published.
- */
-export type PageDeleteOutcome = {
-    kind: 'gone';
-} | {
-    kind: 'redirect';
-    to: string;
-};
-export type ReleaseItem = {
-    kind: 'page';
-    routeId: string;
-    params: Record<string, string>;
-    locale: string;
-    tree: Tree;
-    addedAt: string;
-} | {
-    kind: 'layout';
-    routeId: string;
-    locale: string;
-    tree: Tree;
-    addedAt: string;
-} | {
-    kind: 'site';
-    tree: Tree;
-    addedAt: string;
-} | {
-    kind: 'page-delete';
-    routeId: string;
-    params: Record<string, string>;
-    locale: string;
-    outcome?: PageDeleteOutcome;
-    addedAt: string;
-};
-export type OpenRelease = {
-    userId: string;
-    name?: string;
-    createdAt: string;
-    preview_key: string;
-    items: ReleaseItem[];
-};
-/**
- * Wire shape of a media library item, mirroring the server's `MediaItem`.
- * `url` is the public path served by the static handler (e.g. `/uploads/abc.png`).
- */
-export type MediaItem = {
-    id: string;
-    filename: string;
-    originalName: string;
-    mime: string;
-    size: number;
-    url: string;
-    uploadedAt: string;
-    uploadedBy: string;
-};
-/**
- * Origin where uploaded media files are served. The backend writes files to
- * `static/uploads/` and returns relative paths like `/uploads/<slug>.png`; the
- * frontend lives on a different origin in dev, so we prefix each URL here at
- * the wire boundary so display components and persisted field values both get
- * a fully-qualified URL.
- */
-export declare const MEDIA_URL_PREFIX = "https://velastack.dev";
 declare class CmsStore {
     isEditing: boolean;
     drafts: Record<string, DraftBucket>;
@@ -291,4 +227,3 @@ declare class Cms {
     get site(): Record<string, unknown>;
 }
 export declare const cms: Cms;
-export {};

package/dist/components/cms/cms-store.svelte.js

@@ -27,20 +27,35 @@
  * Locales panel passes an explicit locale to inspect other locales'
  * working-copy state without switching the page.
  */
+import { browser } from '$app/environment';
 import { page } from '$app/state';
 import { mergeLocaleDocs, mergeLocaleEntries } from './locale-merge.js';
 import { composeKey } from './overlay-sync.js';
-import { get, has, mergeTree, set } from './path.js';
+import { get, has, mergeTree, set } from '../../core/path.js';
 const scopeKindFromId = (scopeId) => scopeId.startsWith('layout:') ? 'layout' : 'page';
 /**
- * Origin where uploaded media files are served. The backend writes files to
- * `static/uploads/` and returns relative paths like `/uploads/<slug>.png`; the
- * frontend lives on a different origin in dev, so we prefix each URL here at
- * the wire boundary so display components and persisted field values both get
- * a fully-qualified URL.
+ * Fully qualify a media URL against the CMS endpoint.
+ *
+ * The backend may return a root-relative path (`/uploads/<slug>.png`) — that is
+ * the default for a same-origin mount, and it keeps the origin out of persisted
+ * content. When the CMS lives on a different origin than the site, resolving
+ * that path against `location.href` would point at the site, so it is resolved
+ * against the endpoint instead. Absolute URLs are returned untouched.
+ *
+ * This used to be a hardcoded `https://velastack.dev`, which was silently wrong
+ * for every other deployment.
  */
-export const MEDIA_URL_PREFIX = 'https://velastack.dev';
-const resolveMediaItem = (item) => item.url.startsWith('/') ? { ...item, url: `${MEDIA_URL_PREFIX}${item.url}` } : item;
+const resolveMediaItem = (item, endpoint) => {
+    if (!item.url.startsWith('/'))
+        return item;
+    try {
+        const base = new URL(endpoint, browser ? location.href : 'http://localhost');
+        return { ...item, url: new URL(item.url, base).toString() };
+    }
+    catch {
+        return item;
+    }
+};
 const treeHasAnyLeaf = (tree) => {
     for (const v of Object.values(tree)) {
         if (v === undefined)
@@ -475,7 +490,7 @@ class CmsStore {
         if (typeof item?.url !== 'string') {
             throw new Error('Upload response missing url');
         }
-        return resolveMediaItem(item);
+        return resolveMediaItem(item, endpoint);
     }
     /** Back-compat wrapper around `uploadMedia` that returns just the URL. */
     async uploadImage(endpoint, file) {
@@ -491,7 +506,7 @@ class CmsStore {
         if (!res.ok)
             throw new Error(`List failed (${res.status})`);
         const data = (await res.json());
-        return { ...data, items: data.items.map(resolveMediaItem) };
+        return { ...data, items: data.items.map((i) => resolveMediaItem(i, endpoint)) };
     }
     async deleteMedia(endpoint, id) {
         const res = await fetch(`${endpoint}/media/${id}`, {

package/dist/components/cms/locale-merge.d.ts

@@ -12,7 +12,7 @@
  * precedence (requested wins outright) before passing trees in.
  */
 import type { CmsEntry } from './scope.js';
-import { type Tree } from './path.js';
+import { type Tree } from '../../core/path.js';
 /**
  * Merge requested-locale doc trees over default-locale doc trees, per scope.
  *

package/dist/components/cms/locale-merge.js

@@ -11,7 +11,7 @@
  * Tombstones are not handled here — callers should resolve tombstone
  * precedence (requested wins outright) before passing trees in.
  */
-import { mergeTree } from './path.js';
+import { mergeTree } from '../../core/path.js';
 /**
  * Merge requested-locale doc trees over default-locale doc trees, per scope.
  *

package/dist/components/cms/scope.d.ts

@@ -48,7 +48,7 @@ export type CmsPagePointer = {
     params: Record<string, string>;
 };
 /**
- * One publishable page-kind entry. Mirrored from `srv/types.ts` so client-only
+ * One publishable page-kind entry. Mirrored from `server/types.ts` so client-only
  * code (`<CmsEntries>`, the merged `cms` view) can read entries without
  * importing server modules. The server type re-exports this one.
  *