@velastack/cms 0.2.0 → 0.2.1

package/dist/backend/factory.js

@@ -55,11 +55,22 @@ export const createCmsBackend = (options = {}) => {
         const suffix = `/${restPath}`;
         return pathname.endsWith(suffix) ? pathname.slice(0, -suffix.length) : pathname;
     };
-    const mediaUrlFor = (event, mountPath) => {
+    /**
+     * The base for URLs written into `media_items.url` and embedded in content.
+     *
+     * Root-relative by default, and deliberately so: content outlives the origin
+     * it was authored on. An absolute default would bake `http://localhost:5173`
+     * into every image a developer added before deploying, and those URLs would
+     * still point at localhost in production. A root-relative `/uploads/<file>`
+     * resolves correctly wherever the site is served, and the client resolves it
+     * against the CMS endpoint when the two are on different origins.
+     *
+     * A cross-origin deployment — where the CMS and the site are genuinely
+     * different hosts — passes an absolute `mediaBaseUrl` explicitly.
+     */
+    const mediaUrlFor = (event) => {
         const base = options.mediaBaseUrl;
-        const resolved = typeof base === 'function'
-            ? base(event)
-            : (base ?? `${new URL(mountPath, event.url).origin}/uploads`);
+        const resolved = typeof base === 'function' ? base(event) : (base ?? '/uploads');
         const trimmed = resolved.replace(/\/$/, '');
         return (filename) => `${trimmed}/${filename}`;
     };
@@ -157,7 +168,7 @@ export const createCmsBackend = (options = {}) => {
             storage,
             auth,
             authCtx,
-            mediaUrl: mediaUrlFor(event, mountPath),
+            mediaUrl: mediaUrlFor(event),
             mountPath,
             frameAncestors,
             setSessionCookie: (token, expiresAt) => {

package/dist/backend/types.d.ts

@@ -69,9 +69,13 @@ export type CmsBackendOptions = {
     uploadDir?: string;
     /**
      * Base URL for media, written into `media_items.url` and embedded in
-     * content. Defaults to a root-relative `/uploads`, which keeps the origin
-     * out of stored content. Pass an absolute base when the CMS is on a
-     * different origin than the site — or to preserve an existing wire format.
+     * content.
+     *
+     * Defaults to a root-relative `/uploads`, which keeps the origin out of
+     * stored content — an absolute default would bake the authoring origin
+     * (`http://localhost:5173`) into every image added before deploy. Pass an
+     * absolute base when the CMS is served from a different origin than the
+     * site, or to preserve an existing wire format.
      */
     mediaBaseUrl?: string | ((event: RequestEvent) => string);
     /** Which tenant this request is for. Returning `null` is a 404. Defaults to

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@velastack/cms",
-	"version": "0.2.0",
+	"version": "0.2.1",
 	"description": "A scope-aware CMS for SvelteKit, for static or dynamic sites.",
 	"keywords": [
 		"svelte",