@velastack/cms 0.2.6 → 0.3.1

package/README.md

@@ -161,7 +161,7 @@ That's it — the plugin handles scope and the loader handles data fetching.
 
 ## Production builds: prerender + media download
 
-`loadCms` is **server-only** — call it from `+layout.server.ts` (or `+page.server.ts`), never from a `+page.svelte` or universal `+page.ts`. Calling it in the browser throws. Editing/preview happens through `cmsStore` from `@velastack/cms`, which is gated by your `cms_session` cookie and opaque preview/version keys.
+`loadCms` is **server-only** — call it from `+layout.server.ts` (or `+page.server.ts`), never from a `+page.svelte` or universal `+page.ts`. Calling it in the browser throws. Editing/preview happens through `cmsStore` from `@velastack/cms`, which is gated by your `cms_session` cookie (scoped to the CMS mount path, so sites sharing an origin hold independent sessions) and opaque preview/version keys.
 
 The recommended production shape is **prerender by default**:
 

package/dist/backend/auth/local-editors.js

@@ -1,4 +1,27 @@
 import { createEditorStore } from './editors.js';
+/**
+ * Every value sent under `name` in a `Cookie` header, in the order the browser
+ * listed them. SvelteKit's `cookies.get` collapses duplicates to the first,
+ * which is right for resolving a session and wrong for ending them all.
+ */
+const cookieValues = (header, name) => {
+    if (!header)
+        return [];
+    const out = [];
+    for (const part of header.split(';')) {
+        const eq = part.indexOf('=');
+        if (eq === -1 || part.slice(0, eq).trim() !== name)
+            continue;
+        const raw = part.slice(eq + 1).trim();
+        try {
+            out.push(decodeURIComponent(raw));
+        }
+        catch {
+            out.push(raw);
+        }
+    }
+    return out;
+};
 /**
  * The adapter caches one editor store per database. `resolve` runs on every
  * request, and re-preparing a dozen statements each time would be wasteful; the
@@ -36,9 +59,15 @@ export const localEditors = (options = {}) => {
             return { user, token, expiresAt };
         },
         async logout(event, ctx) {
-            const token = event.cookies.get(ctx.cookieName);
-            if (token)
-                storeFor(ctx).destroySession(token);
+            // A browser can hold a root-scoped cookie from before 0.3.1 next to
+            // the mount-scoped one; logging out ends both sessions.
+            const store = storeFor(ctx);
+            for (const token of cookieValues(event.request.headers.get('cookie'), ctx.cookieName)) {
+                store.destroySession(token);
+            }
+        },
+        async discard(grant, ctx) {
+            storeFor(ctx).destroySession(grant.token);
         }
     };
 };

package/dist/backend/factory.js

@@ -37,6 +37,7 @@ export const createCmsBackend = (options = {}) => {
     const storage = createStorage(uploadDir);
     const editors = createEditorStore(db);
     const auth = options.auth ?? localEditors();
+    const deploy = options.deploy;
     const restParam = options.restParam ?? 'path';
     const cookieName = options.cookie?.name ?? 'cms_session';
     const resolveProject = options.resolveProject ?? (() => 'default');
@@ -78,13 +79,14 @@ export const createCmsBackend = (options = {}) => {
      * Cookie attributes. `sameSite: 'none'` is required for the cross-origin
      * iframe login and wrong for a same-origin mount on plain http, so the
      * default follows whether CORS is configured rather than being hardcoded
-     * one way.
+     * one way. `path` is decided per request in `handle`: the mount path unless
+     * the host set one, so projects sharing an origin hold independent sessions.
      */
-    const cookieOptionsFor = (event) => {
+    const cookieOptionsFor = (event, path) => {
         const crossOrigin = cors !== false;
         const isHttps = event.url.protocol === 'https:';
         return {
-            path: options.cookie?.path ?? '/',
+            path,
             httpOnly: true,
             sameSite: options.cookie?.sameSite ?? (crossOrigin ? 'none' : 'lax'),
             secure: options.cookie?.secure ?? (crossOrigin ? true : isHttps),
@@ -139,47 +141,60 @@ export const createCmsBackend = (options = {}) => {
         const projectId = resolveProject(event);
         if (projectId === null)
             return applyCors(event, notFound());
+        // Pure string work, so it can precede auth. A root mount yields ''.
+        const mountPath = mountPathFor(event, restPath);
+        const cookiePath = options.cookie?.path ?? (mountPath || '/');
+        // Versions before 0.3.1 set the cookie at '/'. While the default is in
+        // use, login and logout expire that one too — otherwise a stale root
+        // cookie keeps answering for this mount alongside the scoped one.
+        const legacyPath = options.cookie?.path === undefined && cookiePath !== '/' ? '/' : null;
         const authCtx = { db, projectId, cookieName };
-        // Resolve, then authorize, then dispatch. Both checks happen before any
-        // handler body runs, which is what keeps a cross-project write from
-        // touching the database at all.
-        let user = null;
+        // Resolve, then authorize, on every route class, before any handler body
+        // runs. A session with no grant on this project is anonymous on this
+        // project: `required` is a 403, `public` serves published content, and
+        // only the login page is told the session exists so it can explain the
+        // form. That is what keeps a cross-project write from touching the
+        // database at all, and what lets one browser edit several sites.
+        let sessionUser = null;
         try {
-            user = await auth.resolve(event, authCtx);
+            sessionUser = await auth.resolve(event, authCtx);
         }
         catch {
-            user = null;
-        }
-        if (user && route.auth !== 'exempt' && !(await auth.authorize(user, projectId, authCtx))) {
-            return applyCors(event, new Response(null, { status: 403 }));
+            sessionUser = null;
         }
+        const user = sessionUser && (await auth.authorize(sessionUser, projectId, authCtx)) ? sessionUser : null;
         if (route.auth === 'required' && !user) {
             return applyCors(event, new Response(null, { status: 403 }));
         }
-        const mountPath = mountPathFor(event, restPath);
+        const expire = (path) => event.cookies.set(cookieName, '', { ...cookieOptionsFor(event, path), maxAge: 0 });
         const ctx = {
             event,
             projectId,
             user,
+            sessionUser,
             params,
             store,
             cache,
             respond,
             storage,
             auth,
+            deploy,
             authCtx,
             mediaUrl: mediaUrlFor(event),
             mountPath,
             frameAncestors,
             setSessionCookie: (token, expiresAt) => {
-                const opts = cookieOptionsFor(event);
                 event.cookies.set(cookieName, token, {
-                    ...opts,
+                    ...cookieOptionsFor(event, cookiePath),
                     maxAge: Math.max(0, Math.floor((expiresAt.getTime() - Date.now()) / 1000))
                 });
+                if (legacyPath)
+                    expire(legacyPath);
             },
             clearSessionCookie: () => {
-                event.cookies.set(cookieName, '', { ...cookieOptionsFor(event), maxAge: 0 });
+                expire(cookiePath);
+                if (legacyPath)
+                    expire(legacyPath);
             }
         };
         return applyCors(event, await route.handler(ctx));

package/dist/backend/index.d.ts

@@ -29,14 +29,23 @@
  * so a cross-origin `POST /media` needs the site's origin in
  * `kit.csrf.trustedOrigins` — that check is production-only, so it will not
  * show up in `vela dev`.
+ *
+ * The session cookie is scoped to the mount path (`/cms`, or
+ * `/v1/projects/<id>/cms`), so several projects on one origin hold independent
+ * sessions and one browser can edit them all; `cookie.path` overrides it. The
+ * cookie only ever travels to the mount: the site's server-side reads
+ * (`loadCms`, prerender) carry preview and version keys instead, in a
+ * same-origin single-tenant mount as much as a cross-origin one.
  */
 export { createCmsBackend, type CmsBackend } from './factory.js';
+export { CmsDeployError } from './routes/deploy.js';
 export { localEditors, type LocalEditorsOptions } from './auth/local-editors.js';
 export { createEditorStore, type CmsEditorStore, type CreateEditorInput, type CmsSessionToken } from './auth/editors.js';
 export { hashPassword, verifyPassword, type ScryptParams } from './auth/scrypt.js';
-export { createCmsTestClient, type CmsTestClient, type TestResponse } from './testing/harness.js';
+export { createCmsTestClient, type CmsCookieJar, type CmsTestClient, type JarEntry, type TestResponse } from './testing/harness.js';
 export { createTestFixture, TEST_SCRYPT, type TestFixture, type TestFixtureOptions } from './testing/fixtures.js';
-export type { CmsAuthAdapter, CmsAuthContext, CmsBackendOptions, CmsCookieOptions, CmsCorsOptions, CmsEditor, CmsSessionGrant } from './types.js';
+export type { CmsAuthAdapter, CmsAuthContext, CmsBackendOptions, CmsCookieOptions, CmsCorsOptions, CmsDeployAdapter, CmsDeployContext, CmsDeployRun, CmsDeployState, CmsEditor, CmsSessionGrant } from './types.js';
+export type { CmsStore } from './store/queries.js';
 export type { SqliteDb, SqliteStatement } from './store/sqlite.js';
 export type { Migration } from './store/migrations/index.js';
 export { MIGRATIONS } from './store/migrations/index.js';

package/dist/backend/index.js

@@ -29,8 +29,16 @@
  * so a cross-origin `POST /media` needs the site's origin in
  * `kit.csrf.trustedOrigins` — that check is production-only, so it will not
  * show up in `vela dev`.
+ *
+ * The session cookie is scoped to the mount path (`/cms`, or
+ * `/v1/projects/<id>/cms`), so several projects on one origin hold independent
+ * sessions and one browser can edit them all; `cookie.path` overrides it. The
+ * cookie only ever travels to the mount: the site's server-side reads
+ * (`loadCms`, prerender) carry preview and version keys instead, in a
+ * same-origin single-tenant mount as much as a cross-origin one.
  */
 export { createCmsBackend } from './factory.js';
+export { CmsDeployError } from './routes/deploy.js';
 export { localEditors } from './auth/local-editors.js';
 export { createEditorStore } from './auth/editors.js';
 export { hashPassword, verifyPassword } from './auth/scrypt.js';

package/dist/backend/router.d.ts

@@ -9,11 +9,16 @@
 import type { RequestEvent } from '@sveltejs/kit';
 import type { RouteCtx, RouteHandler } from './routes/context.js';
 /**
- * `public`   — anonymous callers are served (published content only).
- * `required` — no editor is a 403.
- * `exempt`   — skips the cross-project check, so an editor holding a session
- *              for one project can still reach another's login form and log
- *              out. Reproduces `isAuthEndpoint` from the hook this replaces.
+ * A session with no grant on this project is anonymous on this project, on
+ * every class:
+ *
+ * `public`   — served to anyone; anonymous callers and foreign sessions get
+ *              published content only.
+ * `required` — no editor authorized for this project is a 403.
+ * `exempt`   — served regardless, so an editor holding a session for one
+ *              project can reach another's login form and log out. The
+ *              handler also sees `sessionUser`, so the login page can say why
+ *              it is showing a form. Login and logout only.
  */
 export type RouteAuth = 'public' | 'required' | 'exempt';
 export type Route = {

package/dist/backend/routes/context.d.ts

@@ -11,13 +11,18 @@ import type { CmsStore } from '../store/queries.js';
 import type { ReadCache } from '../store/cache.js';
 import type { CmsResponders } from '../http.js';
 import type { CmsStorage } from '../storage.js';
-import type { CmsAuthAdapter, CmsAuthContext, CmsEditor } from '../types.js';
+import type { CmsAuthAdapter, CmsAuthContext, CmsDeployAdapter, CmsEditor } from '../types.js';
 export type RouteCtx = {
     event: RequestEvent;
     /** The tenant this request is for. `'default'` in a single-tenant mount. */
     projectId: string;
-    /** The signed-in editor, or `null`. Routes declared `required` never see null. */
+    /** The editor whose session is authorized for this project, or `null` — on
+     * every route class. Routes declared `required` never see null. */
     user: CmsEditor | null;
+    /** The editor the session resolved to, whether or not they hold a grant
+     * here. Only the login page has a use for it: to say why the form is being
+     * shown instead of the signed-in screen. */
+    sessionUser: CmsEditor | null;
     /** Captured `:name` segments from the route pattern. */
     params: Record<string, string>;
     store: CmsStore;
@@ -25,6 +30,8 @@ export type RouteCtx = {
     respond: CmsResponders;
     storage: CmsStorage;
     auth: CmsAuthAdapter;
+    /** The host's deploy adapter, when configured. */
+    deploy?: CmsDeployAdapter;
     authCtx: CmsAuthContext;
     /** Absolute-or-root-relative URL for an uploaded file, per the host's
      * configured media base. */

package/dist/backend/routes/deploy.d.ts

@@ -0,0 +1,9 @@
+import { type RouteCtx } from './context.js';
+/** Thrown by an adapter to map a failure to a status: 409 while a run is in
+ * flight, 503 when the project has no pipeline to deploy through. */
+export declare class CmsDeployError extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+export declare const getDeploy: (ctx: RouteCtx) => Promise<Response>;
+export declare const postDeploy: (ctx: RouteCtx) => Promise<Response>;

package/dist/backend/routes/deploy.js

@@ -0,0 +1,46 @@
+import { requireUser } from './context.js';
+/** Thrown by an adapter to map a failure to a status: 409 while a run is in
+ * flight, 503 when the project has no pipeline to deploy through. */
+export class CmsDeployError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        this.name = 'CmsDeployError';
+    }
+}
+const deployContext = (ctx) => ({
+    event: ctx.event,
+    projectId: ctx.projectId,
+    user: requireUser(ctx),
+    store: ctx.store
+});
+/** Adapter errors carry their own status; anything else is a bare 500 so a
+ * host bug never reaches the bar as an HTML error page it would try to parse. */
+const respond = async (run, status) => {
+    try {
+        return Response.json(await run(), { status });
+    }
+    catch (err) {
+        if (err instanceof CmsDeployError) {
+            return new Response(err.message, {
+                status: err.status,
+                headers: { 'content-type': 'text/plain; charset=utf-8' }
+            });
+        }
+        return new Response(null, { status: 500 });
+    }
+};
+export const getDeploy = (ctx) => {
+    const { deploy } = ctx;
+    if (!deploy) {
+        return Promise.resolve(Response.json({ available: false }));
+    }
+    return respond(() => deploy.status(deployContext(ctx)), 200);
+};
+export const postDeploy = (ctx) => {
+    const { deploy } = ctx;
+    if (!deploy)
+        return Promise.resolve(new Response(null, { status: 404 }));
+    return respond(() => deploy.trigger(deployContext(ctx)), 202);
+};

package/dist/backend/routes/login.d.ts

@@ -10,10 +10,20 @@
  * The flow: the admin bar opens `<endpoint>/iframe/login` in an iframe, the
  * form posts back to the same URL, and on success the page tells the parent
  * window so the bar can re-fetch `/user` without a reload.
+ *
+ * Two identities matter here. `ctx.user` is an editor authorized for this
+ * project; `ctx.sessionUser` is whoever the cookie resolved to, grant or not.
+ * The signed-in screen may only render for `ctx.user`: the bar answers it by
+ * fetching `/user`, which is a 403 for anyone else, and a bar told "signed in"
+ * and then refused would reopen this page forever. A session that cannot edit
+ * this site gets the form instead, with a line saying why, so the editor can
+ * sign in as someone who can — without disturbing that other site's session,
+ * since the cookie is scoped to this mount.
  */
 import type { RouteCtx } from './context.js';
 export declare const getLogin: (ctx: RouteCtx) => Response;
 export declare const postLogin: (ctx: RouteCtx) => Promise<Response>;
 /** Kept so the admin bar's historical `/iframe/login/success` URL still
- * resolves; the POST above renders the same screen inline. */
+ * resolves; the POST above renders the same screen inline. `ctx.user` is only
+ * set for a session authorized here, so a foreign one is sent to the form. */
 export declare const getLoginSuccess: (ctx: RouteCtx) => Response;

package/dist/backend/routes/login.js

@@ -53,6 +53,13 @@ button:hover { background: #262626; }
 	background: #fef2f2;
 	color: #b91c1c;
 }
+.hint {
+	margin: 0 0 1rem;
+	padding: 0.5rem 0.75rem;
+	border-radius: 0.5rem;
+	background: #f5f5f5;
+	color: #525252;
+}
 @media (prefers-color-scheme: dark) {
 	body { background: #0a0a0a; color: #fafafa; }
 	.card { background: #0a0a0a; border-color: #262626; }
@@ -62,6 +69,7 @@ button:hover { background: #262626; }
 	button:hover { background: #e5e5e5; }
 	p.sub { color: #a3a3a3; }
 	.error { background: #2a1215; color: #fca5a5; }
+	.hint { background: #171717; color: #a3a3a3; }
 }
 `;
 const page = (title, body) => `<!doctype html>
@@ -79,8 +87,9 @@ ${body}
 </main>
 </body>
 </html>`;
-const loginForm = (error) => page('Sign in to edit', `<h1>Sign in to edit</h1>
+const loginForm = (error, hint) => page('Sign in to edit', `<h1>Sign in to edit</h1>
 <p class="sub">Use your email and password</p>
+${hint ? `<p class="hint">${escapeHtml(hint)}</p>` : ''}
 ${error ? `<p class="error" role="alert">${escapeHtml(error)}</p>` : ''}
 <form method="POST">
 	<div class="field">
@@ -110,15 +119,20 @@ const html = (body, ctx, status = 200) => new Response(body, {
         'cache-control': 'no-store'
     }
 });
+/** Why a signed-in browser is looking at a form: its session cannot edit
+ * this site. Nothing when there is no session at all. */
+const foreignSessionHint = (ctx) => ctx.sessionUser
+    ? `Signed in as ${ctx.sessionUser.email}, but that account can't edit this site. Sign in with one that can.`
+    : undefined;
 export const getLogin = (ctx) => {
     if (!ctx.auth.login)
         return new Response(null, { status: 404 });
-    // Already signed in and authorized for this project — skip straight to the
-    // success screen. A session bound to a project the caller can't reach leaves
-    // `user` null, so they land on the form and can sign in as someone else.
+    // Authorized for this project already — straight to the signed-in screen.
     if (ctx.user)
         return html(successPage(), ctx);
-    return html(loginForm(), ctx);
+    // Anonymous, or a session with no grant here: the form, never the
+    // signed-in screen (see the file header).
+    return html(loginForm(undefined, foreignSessionHint(ctx)), ctx);
 };
 export const postLogin = async (ctx) => {
     if (!ctx.auth.login)
@@ -139,11 +153,18 @@ export const postLogin = async (ctx) => {
     // One message either way — which half was wrong is not the caller's business.
     if (!grant)
         return html(loginForm('Invalid email or password.'), ctx, 400);
+    // Right password, wrong site. The session must not reach the browser: the
+    // bar would be told "signed in" and then refused by `/user`.
+    if (!(await ctx.auth.authorize(grant.user, ctx.projectId, ctx.authCtx))) {
+        await ctx.auth.discard?.(grant, ctx.authCtx);
+        return html(loginForm(`${grant.user.email} can't edit this site. Sign in with an account that can.`), ctx, 403);
+    }
     ctx.setSessionCookie(grant.token, grant.expiresAt);
     return html(successPage(), ctx);
 };
 /** Kept so the admin bar's historical `/iframe/login/success` URL still
- * resolves; the POST above renders the same screen inline. */
+ * resolves; the POST above renders the same screen inline. `ctx.user` is only
+ * set for a session authorized here, so a foreign one is sent to the form. */
 export const getLoginSuccess = (ctx) => {
     if (!ctx.user) {
         return new Response(null, {

package/dist/backend/routes/pages.js

@@ -63,6 +63,7 @@ const buildRoutes = (ctx, userId, locale) => {
 export const getPages = (ctx) => {
     const { event, projectId, store, respond } = ctx;
     const locale = event.url.searchParams.get('locale') ?? DEFAULT_LOCALE;
+    const previewKey = event.url.searchParams.get('preview');
     const versionKey = event.url.searchParams.get('version');
     if (versionKey) {
         const release = store.findPublishedReleaseByPreviewKey(projectId, versionKey);
@@ -102,6 +103,16 @@ export const getPages = (ctx) => {
         });
         return respond.serveImmutableJson(event, { routes });
     }
+    // Preview path: the key names an open release, overlaid exactly as its
+    // owner sees it, cache bypassed. `loadCms` asks this way on the editor's
+    // behalf because the server-side fetch carries no cookie — in a
+    // single-tenant mount as much as a cross-origin one, now that the cookie
+    // lives under the mount path. An unknown key falls through, as for /docs.
+    if (previewKey) {
+        const release = store.findOpenReleaseByPreviewKey(projectId, previewKey);
+        if (release)
+            return Response.json({ routes: buildRoutes(ctx, release.userId, locale) });
+    }
     const userId = ctx.user?.id ?? '';
     if (!userId) {
         const cacheCheck = respond.tryPublicCache(event, projectId, `pages:${locale}`);

package/dist/backend/routes/table.d.ts

@@ -1,11 +1,11 @@
 /**
  * The route table.
  *
- * `auth` semantics:
- * - `public`   anonymous callers are served published content
- * - `required` no editor is a 403
- * - `exempt`   skips the cross-project check, so an editor holding a session for
- *              one project can still reach another's login form and log out
+ * `auth` semantics (a session with no grant here counts as anonymous):
+ * - `public`   anyone is served published content
+ * - `required` no editor authorized for this project is a 403
+ * - `exempt`   served regardless, so an editor holding a session for one
+ *              project can still reach another's login form and log out
  */
 import type { Route } from '../router.js';
 export declare const ROUTES: Route[];

package/dist/backend/routes/table.js

@@ -5,6 +5,7 @@ import { getUser, postLogout } from './user.js';
 import { getLogin, getLoginSuccess, postLogin } from './login.js';
 import { deleteReleaseItems, getRelease, getReleaseHistory, postReleaseDiscard, postReleaseHistoryPreviewKey, postReleaseItems, postReleasePreviewKey, postReleasePublish, postReleaseRevert } from './release.js';
 import { deleteMediaItem, getMedia, getUpload, postMedia } from './media.js';
+import { getDeploy, postDeploy } from './deploy.js';
 import { postTestReset } from './test-reset.js';
 export const ROUTES = [
     { method: 'GET', segments: ['docs'], auth: 'public', handler: getDocs },
@@ -62,6 +63,8 @@ export const ROUTES = [
         auth: 'required',
         handler: postReleaseHistoryPreviewKey
     },
+    { method: 'GET', segments: ['deploy'], auth: 'required', handler: getDeploy },
+    { method: 'POST', segments: ['deploy'], auth: 'required', handler: postDeploy },
     { method: 'GET', segments: ['media'], auth: 'required', handler: getMedia },
     { method: 'POST', segments: ['media'], auth: 'required', handler: postMedia },
     { method: 'DELETE', segments: ['media', ':id'], auth: 'required', handler: deleteMediaItem },

package/dist/backend/routes/user.d.ts

@@ -8,7 +8,9 @@ import { type RouteCtx } from './context.js';
 export declare const getUser: (ctx: RouteCtx) => Response;
 /**
  * Idempotent — safe to call without being signed in. Clears the cookie with
- * the same attributes it was set with, so the browser accepts the expiry, and
- * lets the adapter drop server-side session state.
+ * the same attributes it was set with, so the browser accepts the expiry — and,
+ * while the default path is in use, the root-scoped cookie versions before
+ * 0.3.1 set — and lets the adapter drop server-side state for every session
+ * the request presented.
  */
 export declare const postLogout: (ctx: RouteCtx) => Promise<Response>;

package/dist/backend/routes/user.js

@@ -11,8 +11,10 @@ export const getUser = (ctx) => {
 };
 /**
  * Idempotent — safe to call without being signed in. Clears the cookie with
- * the same attributes it was set with, so the browser accepts the expiry, and
- * lets the adapter drop server-side session state.
+ * the same attributes it was set with, so the browser accepts the expiry — and,
+ * while the default path is in use, the root-scoped cookie versions before
+ * 0.3.1 set — and lets the adapter drop server-side state for every session
+ * the request presented.
  */
 export const postLogout = async (ctx) => {
     await ctx.auth.logout?.(ctx.event, ctx.authCtx);

package/dist/backend/testing/fixtures.d.ts

@@ -12,9 +12,11 @@ export type TestFixture = {
     backend: CmsBackend;
     /** Unauthenticated client for the default project. */
     anon: CmsTestClient;
-    /** Signed in as alice, who can reach `p1` and `p_alice`. */
+    /** Signed in as alice, who can reach `p1` and `p_alice`. Holds a root-scoped
+     * cookie, so `at()` carries it to any mount and cross-project tests
+     * exercise `authorize`. */
     alice: CmsTestClient;
-    /** Signed in as bob, who can reach `p1` and `p_bob`. */
+    /** Signed in as bob, who can reach `p1` and `p_bob`. Root-scoped like alice. */
     bob: CmsTestClient;
     users: {
         alice: CmsEditor;

package/dist/backend/testing/harness.d.ts

@@ -11,17 +11,36 @@ export type RequestInitLike = {
     headers?: Record<string, string>;
     cookie?: string;
 };
+export type JarEntry = {
+    name: string;
+    value: string;
+    path: string;
+};
+/** The client's cookies, kept by name and path the way a browser keeps them. */
+export type CmsCookieJar = {
+    /** The value the client would send to its own mount, or `undefined`. */
+    get(name: string): string | undefined;
+    set(name: string, value: string, path: string): void;
+    delete(name: string, path: string): void;
+    /** Every stored cookie with its path, for asserting on scoping. */
+    all(): readonly JarEntry[];
+    /** The `cookie` header a request to `pathname` would carry. */
+    headerFor(pathname: string): string | undefined;
+};
 export type CmsTestClient = {
     get(path: string, init?: RequestInitLike): Promise<TestResponse>;
     post(path: string, init?: RequestInitLike): Promise<TestResponse>;
     del(path: string, init?: RequestInitLike): Promise<TestResponse>;
     request(method: string, path: string, init?: RequestInitLike): Promise<TestResponse>;
-    /** A client that sends this cookie on every request. */
-    as(cookie: string): CmsTestClient;
+    /** A client that sends this cookie on every request. Root-scoped by
+     * default — what a login from before 0.3.1 left behind, and what lets
+     * `at()` carry it to another mount so cross-project authorization is
+     * exercised. Pass a path to model a mount-scoped cookie. */
+    as(cookie: string, path?: string): CmsTestClient;
     /** A client mounted at a different base path / route params. */
     at(basePath: string, params?: Record<string, string>): CmsTestClient;
     /** The cookie jar accumulated from `set-cookie` responses. */
-    cookies: Map<string, string>;
+    cookies: CmsCookieJar;
 };
 export type TestClientOptions = {
     /** Where the backend is mounted, e.g. `/v1/projects/p1/cms`. */

package/dist/backend/testing/harness.js

@@ -1,3 +1,31 @@
+/** RFC 6265 §5.1.4. */
+const pathMatches = (requestPath, cookiePath) => requestPath === cookiePath ||
+    (requestPath.startsWith(cookiePath) &&
+        (cookiePath.endsWith('/') || requestPath[cookiePath.length] === '/'));
+/** Longest path first, as RFC 6265 §5.4 asks of browsers; the sort is stable,
+ * so equal paths keep their order of arrival. */
+const byPathLength = (list) => list.sort((a, b) => b.path.length - a.path.length);
+const createJar = (basePath) => {
+    // Keyed the way SvelteKit keys cookies it sets: by path and name.
+    const entries = new Map();
+    const key = (name, path) => `${path}?${name}`;
+    const matching = (pathname) => byPathLength([...entries.values()].filter((e) => pathMatches(pathname, e.path)));
+    return {
+        get: (name) => matching(basePath).find((e) => e.name === name)?.value,
+        set: (name, value, path) => {
+            entries.set(key(name, path), { name, value, path });
+        },
+        delete: (name, path) => {
+            entries.delete(key(name, path));
+        },
+        all: () => [...entries.values()],
+        headerFor: (pathname) => {
+            const list = matching(pathname);
+            return list.length > 0 ? list.map((e) => `${e.name}=${e.value}`).join('; ') : undefined;
+        }
+    };
+};
+/** Like `cookie.parse`: the first of a duplicate name wins. */
 const parseCookieHeader = (header) => {
     const out = new Map();
     if (!header)
@@ -6,7 +34,9 @@ const parseCookieHeader = (header) => {
         const eq = part.indexOf('=');
         if (eq === -1)
             continue;
-        out.set(part.slice(0, eq).trim(), part.slice(eq + 1).trim());
+        const name = part.slice(0, eq).trim();
+        if (!out.has(name))
+            out.set(name, part.slice(eq + 1).trim());
     }
     return out;
 };
@@ -32,12 +62,12 @@ export const createCmsTestClient = (backend, options) => {
     const restParam = options.restParam ?? 'path';
     const origin = options.origin ?? 'http://localhost';
     const basePath = options.basePath.replace(/\/$/, '');
-    const jar = new Map();
+    const jar = createJar(basePath);
     const run = async (method, path, init = {}) => {
         const url = new URL(`${basePath}${path.startsWith('/') ? path : `/${path}`}`, origin);
         const rest = url.pathname.slice(basePath.length).replace(/^\//, '');
         const headers = new Headers(init.headers ?? {});
-        const cookieHeader = init.cookie ?? (jar.size > 0 ? [...jar].map(([k, v]) => `${k}=${v}`).join('; ') : undefined);
+        const cookieHeader = init.cookie ?? jar.headerFor(url.pathname);
         if (cookieHeader)
             headers.set('cookie', cookieHeader);
         let body;
@@ -65,18 +95,30 @@ export const createCmsTestClient = (backend, options) => {
                 accumulated[lower] = newHeaders[key];
             }
         };
+        // Mirrors SvelteKit: `set` insists on a path; a cookie set during this
+        // request shadows the one it carried, longest path first; one expired
+        // here reads as absent.
+        const newCookies = new Map();
         const pending = [];
+        const fresh = (name) => byPathLength([...newCookies.values()].filter((c) => c.name === name && pathMatches(url.pathname, c.path)))[0];
+        const set = (name, value, opts) => {
+            if (typeof opts.path !== 'string') {
+                throw new Error('You must specify a `path` when setting, deleting or serializing cookies');
+            }
+            const maxAge = typeof opts.maxAge === 'number' ? opts.maxAge : undefined;
+            newCookies.set(`${opts.path}?${name}`, { name, value, path: opts.path, maxAge });
+            pending.push(serializeCookie(name, value, opts));
+        };
         const cookies = {
-            get: (name) => requestCookies.get(name),
-            getAll: () => [...requestCookies].map(([name, value]) => ({ name, value })),
-            set: (name, value, opts) => {
-                requestCookies.set(name, value);
-                pending.push(serializeCookie(name, value, opts));
-            },
-            delete: (name, opts) => {
-                requestCookies.delete(name);
-                pending.push(serializeCookie(name, '', { ...opts, maxAge: 0 }));
+            get: (name) => {
+                const c = fresh(name);
+                if (c)
+                    return c.maxAge === 0 ? undefined : c.value;
+                return requestCookies.get(name);
             },
+            getAll: () => [...requestCookies].map(([name, value]) => ({ name, value })),
+            set,
+            delete: (name, opts) => set(name, '', { ...opts, maxAge: 0 }),
             serialize: serializeCookie
         };
         const event = {
@@ -101,15 +143,11 @@ export const createCmsTestClient = (backend, options) => {
             response.headers.set(k, v);
         for (const c of pending)
             response.headers.append('set-cookie', c);
-        for (const c of pending) {
-            const [pair] = c.split(';');
-            const eq = pair.indexOf('=');
-            const name = pair.slice(0, eq);
-            const value = decodeURIComponent(pair.slice(eq + 1));
-            if (/Max-Age=0/.test(c))
-                jar.delete(name);
+        for (const c of newCookies.values()) {
+            if (c.maxAge === 0)
+                jar.delete(c.name, c.path);
             else
-                jar.set(name, value);
+                jar.set(c.name, c.value, c.path);
         }
         const text = await response.text();
         return {
@@ -124,23 +162,25 @@ export const createCmsTestClient = (backend, options) => {
         get: (path, init) => run('GET', path, init),
         post: (path, init) => run('POST', path, init),
         del: (path, init) => run('DELETE', path, init),
-        as: (cookie) => {
+        as: (cookie, path = '/') => {
             const scoped = createCmsTestClient(backend, options);
             const [name, ...rest] = cookie.split('=');
-            scoped.cookies.set(name.trim(), rest.join('='));
+            scoped.cookies.set(name.trim(), rest.join('='), path);
             return scoped;
         },
-        // Carries the cookie jar across, so `client.as(session).at(otherProject)`
-        // is the same browser visiting a different mount — which is exactly the
-        // cross-project authorization case.
+        // Carries the cookie jar across, paths included, so
+        // `client.as(session).at(otherProject)` is the same browser visiting a
+        // different mount — which is exactly the cross-project authorization
+        // case — and a mount-scoped cookie stays behind the way it would in a
+        // browser.
         at: (nextBasePath, params) => {
             const scoped = createCmsTestClient(backend, {
                 ...options,
                 basePath: nextBasePath,
                 params
             });
-            for (const [k, v] of jar)
-                scoped.cookies.set(k, v);
+            for (const e of jar.all())
+                scoped.cookies.set(e.name, e.value, e.path);
             return scoped;
         },
         cookies: jar

package/dist/backend/types.d.ts

@@ -1,5 +1,8 @@
 import type { RequestEvent } from '@sveltejs/kit';
+import type { CmsDeployState } from '../core/wire.js';
+import type { CmsStore } from './store/queries.js';
 import type { SqliteDb } from './store/sqlite.js';
+export type { CmsDeployRun, CmsDeployState } from '../core/wire.js';
 /** An authenticated content editor. */
 export type CmsEditor = {
     id: string;
@@ -31,18 +34,57 @@ export type CmsAuthAdapter = {
     /** Resolve the request's editor, or `null` for anonymous. Must not throw on
      * a malformed or stale cookie: anonymous is a valid outcome, not an error. */
     resolve(event: RequestEvent, ctx: CmsAuthContext): Promise<CmsEditor | null>;
-    /** May this editor act on this project? A `false` here is a 403 before any
-     * handler runs. */
+    /** May this editor act on this project? A `false` makes the session
+     * anonymous on this project: `required` routes 403, `public` routes serve
+     * published content, and the login page shows its form. */
     authorize(user: CmsEditor, projectId: string, ctx: CmsAuthContext): Promise<boolean>;
     /** Backs the built-in login page. Omit it and `/iframe/login` 404s, leaving
-     * login entirely to the host. */
+     * login entirely to the host. The router runs `authorize` on the grant
+     * before issuing it, so an implementation need not check the project. */
     login?(email: string, password: string, ctx: CmsAuthContext): Promise<CmsSessionGrant | null>;
-    /** Invalidate server-side session state on logout. The cookie is cleared
-     * regardless. */
+    /** Throw away a grant `login` minted but the router refused to issue,
+     * because the account has no grant on this project. Optional: without it
+     * the session stays valid server-side, but its token never left the
+     * process. */
+    discard?(grant: CmsSessionGrant, ctx: CmsAuthContext): Promise<void>;
+    /** Invalidate server-side session state on logout — every session the
+     * request presented, not only the one `cookies.get` returns. The cookie is
+     * cleared regardless. */
     logout?(event: RequestEvent, ctx: CmsAuthContext): Promise<void>;
 };
+/** Handed to every deploy adapter method. `store` is the CMS store, so the
+ * host can read which release is current (`store.getReleaseHistory`). */
+export type CmsDeployContext = {
+    event: RequestEvent;
+    projectId: string;
+    user: CmsEditor;
+    store: CmsStore;
+};
+/**
+ * The seam between the CMS and whatever rebuilds the site.
+ *
+ * A static site bakes published content in at build time, so a publish only
+ * reaches visitors once the site is built again. The host owns that pipeline;
+ * the CMS only exposes it: `status()` backs the admin bar's menu and dialog,
+ * `trigger()` starts a run. Throw `CmsDeployError(409, …)` while a run is in
+ * flight and `CmsDeployError(503, …)` when the project has nothing to deploy to.
+ */
+export type CmsDeployAdapter = {
+    /** Can this project be deployed from the bar, and what happened last. */
+    status(ctx: CmsDeployContext): Promise<CmsDeployState>;
+    /** Start a deploy; resolves with the new state. */
+    trigger(ctx: CmsDeployContext): Promise<CmsDeployState>;
+};
 export type CmsCookieOptions = {
     name?: string;
+    /**
+     * Defaults to the mount path (`/cms`, `/v1/projects/<id>/cms`), so projects
+     * sharing an origin hold independent sessions: signing in on one site never
+     * touches another's. While unset, login and logout also expire a
+     * root-scoped cookie left by versions before 0.3.1. Nothing outside the
+     * mount needs it: the site's own server reads through preview and version
+     * keys, never the cookie. Set `'/'` to put it back at the origin root.
+     */
     path?: string;
     sameSite?: 'lax' | 'strict' | 'none';
     secure?: boolean;
@@ -85,6 +127,10 @@ export type CmsBackendOptions = {
     restParam?: string;
     /** Identity and authorization. Defaults to `localEditors()`. */
     auth?: CmsAuthAdapter;
+    /** Rebuilds and deploys the site from the admin bar. Omit it — the default —
+     * and the bar never shows the action, which is right for a same-origin
+     * mount where the site reads the CMS live. */
+    deploy?: CmsDeployAdapter;
     cookie?: CmsCookieOptions;
     /**
      * Cross-origin access. `false` (the default) emits no CORS headers, which is

package/dist/components/admin-bar/admin-bar-internal.svelte

@@ -13,10 +13,13 @@
 	import type { CmsPayload, CmsScopeEntry } from '../cms/scope.js';
 	import CssRoot from './css-root.svelte';
 	import { adminBarTheme, type AdminBarTheme } from './theme.svelte.js';
+	import type { CmsDeployState } from '../../core/wire.js';
 	import DeletePageDialog, {
 		type DeletePageMode,
 		type RedirectTarget
 	} from './delete-page-dialog.svelte';
+	import DeployDialog from './deploy-dialog.svelte';
+	import { isDeploying } from './deploy-state.js';
 	import HistoryPanel from './history-panel.svelte';
 	import KeyboardShortcutsDialog from './keyboard-shortcuts-dialog.svelte';
 	import MediaPanel from './media-panel.svelte';
@@ -83,6 +86,7 @@
 	let shareLinkOpen = $state(false);
 	let shortcutsOpen = $state(false);
 	let siteSettingsOpen = $state(false);
+	let deployOpen = $state(false);
 	const anyPanelOpen = $derived(
 		seoOpen ||
 			historyOpen ||
@@ -93,7 +97,8 @@
 			chooserOpen ||
 			shareLinkOpen ||
 			shortcutsOpen ||
-			siteSettingsOpen
+			siteSettingsOpen ||
+			deployOpen
 	);
 	let publishing = $state(false);
 	let publishError = $state<string | null>(null);
@@ -145,6 +150,7 @@
 		shareLinkOpen = false;
 		shortcutsOpen = false;
 		siteSettingsOpen = false;
+		deployOpen = false;
 		newDialog = null;
 		newPageError = null;
 		duplicateSource = null;
@@ -625,6 +631,71 @@
 		}
 	};
 
+	// Live-site deploy. A static site only shows visitors what was published
+	// when it was last built; the host's deploy adapter rebuilds it. The
+	// backend answers `available: false` unless the host configured one, so a
+	// same-origin mount never shows the item; an older backend 404s and the
+	// state simply stays null.
+	const DEPLOY_POLL_MS = 5000;
+	const DEPLOY_POLL_LIMIT = 120; // ~10 minutes, then leave it to the next mount
+	let deployState = $state<CmsDeployState | null>(null);
+	let deploying = $state(false);
+	let deployError = $state<string | null>(null);
+	const deployAvailable = $derived(deployState?.available === true);
+	const deployInFlight = $derived(isDeploying(deployState));
+
+	const fetchDeployState = async () => {
+		try {
+			const res = await fetch(`${endpoint}/deploy`, { credentials: 'include' });
+			if (!res.ok) return;
+			deployState = (await res.json()) as CmsDeployState;
+		} catch {
+			// Network failure: keep whatever we last knew.
+		}
+	};
+
+	$effect(() => {
+		void fetchDeployState();
+	});
+
+	// Poll while a run is in flight, dialog open or not; the interval is
+	// cleared when the run finishes or the bar unmounts.
+	$effect(() => {
+		if (!deployInFlight) return;
+		let ticks = 0;
+		const id = setInterval(() => {
+			if (++ticks > DEPLOY_POLL_LIMIT) {
+				clearInterval(id);
+				return;
+			}
+			void fetchDeployState();
+		}, DEPLOY_POLL_MS);
+		return () => clearInterval(id);
+	});
+
+	const onOpenDeploy = () => {
+		if (!deployAvailable || deployInFlight) return;
+		closeAllPanels();
+		deployError = null;
+		deployOpen = true;
+	};
+
+	const onConfirmDeploy = async () => {
+		deploying = true;
+		deployError = null;
+		try {
+			const res = await fetch(`${endpoint}/deploy`, { method: 'POST', credentials: 'include' });
+			if (!res.ok) {
+				deployError = (await res.text()) || 'Could not start the deploy.';
+				return;
+			}
+			deployState = (await res.json()) as CmsDeployState;
+			deployOpen = false;
+		} finally {
+			deploying = false;
+		}
+	};
+
 	const refreshAfterReleaseChange = async () => {
 		const key = cmsStore.openRelease?.preview_key ?? null;
 		await setPreviewParam(key, { replace: true });
@@ -1350,6 +1421,17 @@
 								Discard All Changes…
 							</Menubar.Item>
 
+							{#if deployAvailable}
+								<Menubar.Label class={menuLabelClass}>Live site</Menubar.Label>
+								<Menubar.Item
+									class={menuItemClass}
+									onSelect={onOpenDeploy}
+									disabled={deployInFlight}
+								>
+									{deployInFlight ? 'Deploying…' : 'Deploy Site…'}
+								</Menubar.Item>
+							{/if}
+
 							<Menubar.Label class={menuLabelClass}>History</Menubar.Label>
 							<Menubar.Item class={menuItemClass} onSelect={onOpenHistory}>
 								Recent Releases
@@ -1688,6 +1770,18 @@
 			onRegenerate={onRegeneratePreviewKey}
 		/>
 
+		{#if deployState?.available}
+			<DeployDialog
+				open={deployOpen}
+				onOpenChange={(next) => (deployOpen = next)}
+				deploy={deployState}
+				unpublishedCount={counts.total}
+				{deploying}
+				error={deployError}
+				onConfirm={onConfirmDeploy}
+			/>
+		{/if}
+
 		<KeyboardShortcutsDialog open={shortcutsOpen} onOpenChange={(next) => (shortcutsOpen = next)} />
 	</div>
 </CssRoot>

package/dist/components/admin-bar/deploy-dialog.svelte

@@ -0,0 +1,76 @@
+<script lang="ts">
+	import type { CmsDeployState } from '../../core/wire.js';
+	import { describeLatestRun, isDeploying } from './deploy-state.js';
+	import { Button } from './ui/button/index.js';
+	import * as Dialog from './ui/dialog/index.js';
+
+	type Props = {
+		open: boolean;
+		onOpenChange: (open: boolean) => void;
+		deploy: CmsDeployState;
+		/** Items in the working copy; they are not part of a deploy. */
+		unpublishedCount: number;
+		/** The POST is in flight. */
+		deploying: boolean;
+		error: string | null;
+		onConfirm: () => void;
+	};
+	let { open, onOpenChange, deploy, unpublishedCount, deploying, error, onConfirm }: Props =
+		$props();
+
+	const inFlight = $derived(isDeploying(deploy));
+	const status = $derived(describeLatestRun(deploy.latest));
+</script>
+
+<Dialog.Root
+	{open}
+	onOpenChange={(next) => {
+		if (!next && deploying) return;
+		onOpenChange(next);
+	}}
+>
+	<Dialog.Content class="vela:max-w-[28rem]">
+		<Dialog.Header>
+			<Dialog.Title>Deploy site</Dialog.Title>
+			<Dialog.Description>
+				Rebuilds the site with the latest published content and puts it live at
+				<span class="vela:font-mono vela:text-bar-text">{deploy.site?.url ?? 'the live site'}</span
+				>. Visitors only see published changes after a deploy.
+			</Dialog.Description>
+		</Dialog.Header>
+
+		<div class="vela:px-6 vela:pb-4 vela:flex vela:flex-col vela:gap-3">
+			<p class="vela:m-0 vela:text-[12px] vela:text-bar-text-secondary">{status}</p>
+
+			{#if unpublishedCount > 0}
+				<p
+					class="vela:m-0 vela:px-3 vela:py-2 vela:rounded-md vela:text-[12px]
+						vela:bg-[var(--cms-status-warn-bg)] vela:text-[var(--cms-status-warn-text)]"
+				>
+					{unpublishedCount}
+					{unpublishedCount === 1 ? 'unpublished change' : 'unpublished changes'} in your working copy
+					will not be included. Publish first to put them live.
+				</p>
+			{/if}
+
+			{#if error}
+				<p
+					role="alert"
+					class="vela:m-0 vela:px-3 vela:py-2 vela:rounded-md vela:text-[12px]
+						vela:bg-[var(--cms-status-error-bg)] vela:text-[var(--cms-status-error-text)]"
+				>
+					{error}
+				</p>
+			{/if}
+		</div>
+
+		<Dialog.Footer class="vela:justify-end vela:pt-2">
+			<Button variant="ghost" onclick={() => onOpenChange(false)} disabled={deploying}
+				>Cancel</Button
+			>
+			<Button variant="default" onclick={onConfirm} disabled={deploying || inFlight}>
+				{deploying ? 'Deploying…' : 'Deploy'}
+			</Button>
+		</Dialog.Footer>
+	</Dialog.Content>
+</Dialog.Root>

package/dist/components/admin-bar/deploy-dialog.svelte.d.ts

@@ -0,0 +1,15 @@
+import type { CmsDeployState } from '../../core/wire.js';
+type Props = {
+    open: boolean;
+    onOpenChange: (open: boolean) => void;
+    deploy: CmsDeployState;
+    /** Items in the working copy; they are not part of a deploy. */
+    unpublishedCount: number;
+    /** The POST is in flight. */
+    deploying: boolean;
+    error: string | null;
+    onConfirm: () => void;
+};
+declare const DeployDialog: import("svelte").Component<Props, {}, "">;
+type DeployDialog = ReturnType<typeof DeployDialog>;
+export default DeployDialog;

package/dist/components/admin-bar/deploy-state.d.ts

@@ -0,0 +1,7 @@
+/**
+ * What the bar shows for a site deploy, kept out of the component so it can be
+ * unit tested: whether a run is in flight, and the one-line status of the last.
+ */
+import type { CmsDeployRun, CmsDeployState } from '../../core/wire.js';
+export declare const isDeploying: (state: CmsDeployState | null) => boolean;
+export declare const describeLatestRun: (latest: CmsDeployRun | null | undefined, now?: number) => string;

package/dist/components/admin-bar/deploy-state.js

@@ -0,0 +1,13 @@
+import { formatRelative } from './format-relative.js';
+export const isDeploying = (state) => state?.latest?.status === 'pending' || state?.latest?.status === 'building';
+export const describeLatestRun = (latest, now = Date.now()) => {
+    if (!latest)
+        return 'Never deployed';
+    if (latest.status === 'pending' || latest.status === 'building')
+        return 'Deploying…';
+    const when = formatRelative(latest.finishedAt ?? latest.createdAt, now);
+    if (latest.status === 'failed') {
+        return latest.error ? `Deploy failed ${when}: ${latest.error}` : `Deploy failed ${when}`;
+    }
+    return `Deployed ${when}`;
+};

package/dist/components/admin-bar/format-relative.d.ts

@@ -0,0 +1,6 @@
+/**
+ * A timestamp as the bar speaks about it: "just now", "5 minutes ago", "this
+ * afternoon", "yesterday", then a short date. Shared by the publish and
+ * deploy dialogs; `now` is a parameter so tests can pin it.
+ */
+export declare const formatRelative: (iso: string, now?: number) => string;

package/dist/components/admin-bar/format-relative.js

@@ -0,0 +1,37 @@
+/**
+ * A timestamp as the bar speaks about it: "just now", "5 minutes ago", "this
+ * afternoon", "yesterday", then a short date. Shared by the publish and
+ * deploy dialogs; `now` is a parameter so tests can pin it.
+ */
+export const formatRelative = (iso, now = Date.now()) => {
+    const t = new Date(iso).getTime();
+    if (Number.isNaN(t))
+        return '';
+    const seconds = Math.max(0, Math.floor((now - t) / 1000));
+    if (seconds < 45)
+        return 'just now';
+    const minutes = Math.floor(seconds / 60);
+    if (minutes < 60)
+        return minutes <= 1 ? '1 minute ago' : `${minutes} minutes ago`;
+    const d = new Date(t);
+    const today = new Date(now);
+    const sameDay = d.getFullYear() === today.getFullYear() &&
+        d.getMonth() === today.getMonth() &&
+        d.getDate() === today.getDate();
+    if (sameDay) {
+        const h = d.getHours();
+        if (h < 12)
+            return 'this morning';
+        if (h < 17)
+            return 'this afternoon';
+        return 'this evening';
+    }
+    const yesterday = new Date(today);
+    yesterday.setDate(yesterday.getDate() - 1);
+    const isYesterday = d.getFullYear() === yesterday.getFullYear() &&
+        d.getMonth() === yesterday.getMonth() &&
+        d.getDate() === yesterday.getDate();
+    if (isYesterday)
+        return 'yesterday';
+    return d.toLocaleDateString(undefined, { month: 'short', day: 'numeric' });
+};

package/dist/components/admin-bar/publish-dialog.svelte

@@ -3,6 +3,7 @@
 	import type { ReleaseItem } from '../cms/cms-store.svelte.js';
 	import type { CmsPayload } from '../cms/scope.js';
 	import { diffPaths, type Tree } from '../../core/path.js';
+	import { formatRelative } from './format-relative.js';
 	import { resolveRouteOnlyParams, resolveRouteUrl } from './resolve-route.js';
 	import { Badge, type BadgeVariant } from './ui/badge/index.js';
 	import { Button } from './ui/button/index.js';
@@ -229,36 +230,6 @@
 		return summarizeNames(meta, 'Updated');
 	};
 
-	const formatRelative = (iso: string): string => {
-		const t = new Date(iso).getTime();
-		if (Number.isNaN(t)) return '';
-		const now = Date.now();
-		const seconds = Math.max(0, Math.floor((now - t) / 1000));
-		if (seconds < 45) return 'just now';
-		const minutes = Math.floor(seconds / 60);
-		if (minutes < 60) return minutes <= 1 ? '1 minute ago' : `${minutes} minutes ago`;
-		const d = new Date(t);
-		const today = new Date(now);
-		const sameDay =
-			d.getFullYear() === today.getFullYear() &&
-			d.getMonth() === today.getMonth() &&
-			d.getDate() === today.getDate();
-		if (sameDay) {
-			const h = d.getHours();
-			if (h < 12) return 'this morning';
-			if (h < 17) return 'this afternoon';
-			return 'this evening';
-		}
-		const yesterday = new Date(today);
-		yesterday.setDate(yesterday.getDate() - 1);
-		const isYesterday =
-			d.getFullYear() === yesterday.getFullYear() &&
-			d.getMonth() === yesterday.getMonth() &&
-			d.getDate() === yesterday.getDate();
-		if (isYesterday) return 'yesterday';
-		return d.toLocaleDateString(undefined, { month: 'short', day: 'numeric' });
-	};
-
 	/** Submit-disabled gate: nothing to publish when there are no items at all.
 	 *  (Group count is fine here too — no items → no groups.) */
 	const total = $derived(items.length);

package/dist/core/wire.d.ts

@@ -155,6 +155,23 @@ export type ListMediaResult = {
     items: MediaItem[];
     total: number;
 };
+/** One build-and-deploy of the site, as the host's deploy adapter reports it. */
+export type CmsDeployRun = {
+    id: string;
+    status: 'pending' | 'building' | 'deployed' | 'failed';
+    createdAt: string;
+    finishedAt?: string;
+    error?: string;
+};
+/** `GET /deploy` and `POST /deploy`. `available` is `false` when the backend
+ * has no deploy adapter, which is how a same-origin mount hides the action. */
+export type CmsDeployState = {
+    available: boolean;
+    site?: {
+        url: string;
+    };
+    latest?: CmsDeployRun | null;
+};
 export type DocsResponse = {
     contents: Tree;
 } | PageDeleteOutcome;

package/dist/server/api-adapter.js

@@ -129,7 +129,8 @@ export const apiAdapter = (options) => {
         },
         async fetchEntries(routeId, context) {
             // Without `previewKey`: `/pages` is read-public; the backend returns
-            // published entries only when no `cms_session` cookie is present.
+            // published entries only when the request carries no session
+            // authorized for this project.
             // For prerender we don't pass a cookie — we get published-only by
             // construction. We still filter `isDraft` / `isDeletePending` /
             // `gone` as a defensive belt-and-suspenders. Tombstoned entries

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@velastack/cms",
-	"version": "0.2.6",
+	"version": "0.3.1",
 	"description": "A scope-aware CMS for SvelteKit, for static or dynamic sites.",
 	"keywords": [
 		"svelte",