@actuate-media/cms-core 0.1.0

package/dist/api/handlers.js

@@ -0,0 +1,2119 @@
+import { listDocuments, getDocument, createDocument, updateDocument, deleteDocument, getGlobal, updateGlobal, } from '../actions';
+import { verifyPassword } from '../auth/password';
+import { createSession, verifySession, revokeSession } from '../auth/session';
+import { checkSetupRequired, createInitialAdmin } from '../setup/index';
+import { getDB } from '../db';
+import { generateCodeVerifier, generateCodeChallenge, generateState, getAuthorizationUrl, handleOAuthCallback, } from '../auth/oauth';
+import { optimizeImage, formatBytes } from '../media/optimize';
+import { generateToken as generateCsrfToken } from '../security/csrf';
+import { logEvent } from '../security/audit';
+import { applyFieldAccess } from '../security/access';
+import { createPreviewAdapter } from '../preview/index';
+import { schedulingCronHandler } from '../scheduling/index';
+import { createRateLimiter } from '../security/rate-limit';
+import { generateOpenAPISpec } from './openapi';
+import { createSSEPresenceAdapter } from '../presence/index';
+const SECURITY_HEADERS = {
+    'Content-Type': 'application/json',
+    'X-Content-Type-Options': 'nosniff',
+    'X-Frame-Options': 'DENY',
+    'Referrer-Policy': 'strict-origin-when-cross-origin',
+};
+function json(data, status = 200) {
+    return new Response(JSON.stringify(data), {
+        status,
+        headers: { ...SECURITY_HEADERS },
+    });
+}
+function errorResponse(message, status) {
+    return json({ error: message }, status);
+}
+function internalError(err, context) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(`[actuate][api]${context ? ` ${context}:` : ''} ${msg}`);
+    return errorResponse('Internal server error', 500);
+}
+function clampPageSize(raw, max = 100, fallback = 20) {
+    const n = Number(raw) || fallback;
+    return Math.min(Math.max(1, n), max);
+}
+function isAllowedStorageUrl(url) {
+    try {
+        const parsed = new URL(url);
+        if (!['https:', 'http:'].includes(parsed.protocol))
+            return false;
+        const h = parsed.hostname;
+        if (h === 'localhost' || h === '127.0.0.1' || h === '::1')
+            return false;
+        if (h.startsWith('10.') || h.startsWith('192.168.'))
+            return false;
+        if (/^172\.(1[6-9]|2\d|3[01])\./.test(h))
+            return false;
+        if (h === '169.254.169.254')
+            return false;
+        if (h.endsWith('.internal') || h.endsWith('.local'))
+            return false;
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+const ALLOWED_SORT_FIELDS = new Set([
+    'createdAt', 'updatedAt', 'publishedAt', 'status', 'collection',
+]);
+function getSessionSecret() {
+    const secret = process.env.CMS_SECRET;
+    if (!secret)
+        throw new Error('CMS_SECRET environment variable is not set');
+    if (secret.length < 32)
+        throw new Error('CMS_SECRET must be at least 32 characters');
+    return secret;
+}
+async function extractSession(request) {
+    let token;
+    const authHeader = request.headers.get('Authorization');
+    if (authHeader?.startsWith('Bearer ')) {
+        token = authHeader.slice(7);
+    }
+    if (!token) {
+        const cookieHeader = request.headers.get('cookie') ?? '';
+        const cookies = parseCookieHeader(cookieHeader);
+        token = cookies['actuate_session'];
+    }
+    if (!token)
+        return null;
+    try {
+        const payload = await verifySession(token, { secret: getSessionSecret() });
+        // Verify session is not revoked in DB
+        const dbSession = await getDB().session.findUnique({
+            where: { id: payload.sessionId },
+            select: { revokedAt: true },
+        });
+        if (!dbSession || dbSession.revokedAt)
+            return null;
+        return payload;
+    }
+    catch {
+        return null;
+    }
+}
+export function parseCookieHeader(cookieHeader) {
+    const cookies = {};
+    for (const pair of cookieHeader.split(';')) {
+        const [key, ...rest] = pair.split('=');
+        if (key) {
+            cookies[key.trim()] = rest.join('=').trim();
+        }
+    }
+    return cookies;
+}
+async function requireAuth(request) {
+    const session = await extractSession(request);
+    if (!session) {
+        return { error: errorResponse('Unauthorized', 401) };
+    }
+    return { session };
+}
+function buildActionContext(session, db, locale) {
+    return {
+        userId: session.userId,
+        role: session.role,
+        locale,
+        db,
+    };
+}
+const WRITE_ROLES = new Set(['ADMIN', 'EDITOR', 'AUTHOR']);
+const ADMIN_ROLES = new Set(['ADMIN']);
+function requireRole(role, allowedRoles) {
+    if (!allowedRoles.has(role)) {
+        return errorResponse('Insufficient permissions', 403);
+    }
+    return null;
+}
+const loginLimiter = createRateLimiter({ maxRequests: 5, windowMs: 15 * 60 * 1000 });
+const formLimiterGlobal = createRateLimiter({ maxRequests: 10, windowMs: 60_000 });
+async function checkRateLimitAsync(limiter, key) {
+    const result = await limiter.check(key);
+    return result.allowed;
+}
+export function registerCMSRoutes(router) {
+    const db = () => getDB();
+    const presenceAdapter = createSSEPresenceAdapter();
+    // ---------------------------------------------------------------------------
+    // CSRF token endpoint
+    // ---------------------------------------------------------------------------
+    router.get('/auth/csrf', async () => {
+        const token = await generateCsrfToken();
+        const isProduction = process.env.NODE_ENV === 'production';
+        const cookieFlags = [
+            `actuate_csrf=${token}`,
+            'Path=/',
+            'SameSite=Lax',
+            'Max-Age=86400',
+        ];
+        if (isProduction)
+            cookieFlags.push('Secure');
+        const response = json({ data: { token } });
+        response.headers.set('Set-Cookie', cookieFlags.join('; '));
+        return response;
+    });
+    // ---------------------------------------------------------------------------
+    // OpenAPI spec
+    // ---------------------------------------------------------------------------
+    router.get('/openapi.json', async () => {
+        const config = globalThis.__actuateConfig;
+        if (!config)
+            return errorResponse('CMS not configured', 500);
+        const spec = generateOpenAPISpec(config);
+        return new Response(JSON.stringify(spec, null, 2), {
+            status: 200,
+            headers: { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': '*' },
+        });
+    });
+    router.get('/docs', async () => {
+        const html = `<!DOCTYPE html>
+<html>
+<head>
+  <title>Actuate CMS API Reference</title>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+</head>
+<body>
+  <script id="api-reference" data-url="/api/cms/openapi.json"></script>
+  <script src="https://cdn.jsdelivr.net/npm/@scalar/api-reference"></script>
+</body>
+</html>`;
+        return new Response(html, {
+            status: 200,
+            headers: { 'Content-Type': 'text/html; charset=utf-8' },
+        });
+    });
+    // ---------------------------------------------------------------------------
+    // Auth routes
+    // ---------------------------------------------------------------------------
+    router.post('/auth/login', async (request) => {
+        try {
+            const body = await request.json();
+            const { email, password } = body;
+            if (!email || !password) {
+                return errorResponse('Email and password are required', 400);
+            }
+            const clientIp = request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ?? 'unknown';
+            if (!(await checkRateLimitAsync(loginLimiter, `login:${clientIp}`))) {
+                return errorResponse('Too many login attempts. Please try again later.', 429);
+            }
+            const user = await db().user.findFirst({
+                where: { email: email.toLowerCase().trim() },
+            });
+            if (!user) {
+                return errorResponse('Invalid email or password', 401);
+            }
+            if (!user.passwordHash) {
+                return errorResponse('This account uses social login. Please sign in with your OAuth provider.', 400);
+            }
+            const passwordValid = await verifyPassword(password, user.passwordHash);
+            if (!passwordValid) {
+                await logEvent({
+                    event: 'login_failed',
+                    userId: user.id,
+                    ipAddress: request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ?? undefined,
+                    userAgent: request.headers.get('user-agent') ?? undefined,
+                });
+                return errorResponse('Invalid email or password', 401);
+            }
+            if (!user.isActive) {
+                return errorResponse('Account is deactivated', 403);
+            }
+            if (user.totpEnabled) {
+                return json({ data: { requiresTOTP: true, userId: user.id } });
+            }
+            const tempSessionId = crypto.randomUUID();
+            const token = await createSession({ userId: user.id, role: user.role, sessionId: tempSessionId }, { secret: getSessionSecret() });
+            await db().session.create({
+                data: {
+                    id: tempSessionId,
+                    userId: user.id,
+                    token,
+                    expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000),
+                    ipAddress: request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ?? null,
+                    userAgent: request.headers.get('user-agent') ?? null,
+                },
+            });
+            const response = json({
+                data: {
+                    token,
+                    user: { id: user.id, email: user.email, name: user.name, role: user.role },
+                },
+            });
+            const isProduction = process.env.NODE_ENV === 'production';
+            const sessionCookie = [
+                `actuate_session=${token}`,
+                'Path=/',
+                'HttpOnly',
+                'SameSite=Lax',
+                'Max-Age=604800',
+            ];
+            if (isProduction)
+                sessionCookie.push('Secure');
+            const csrfToken = await generateCsrfToken();
+            const csrfCookie = [
+                `actuate_csrf=${csrfToken}`,
+                'Path=/',
+                'SameSite=Lax',
+                'Max-Age=86400',
+            ];
+            if (isProduction)
+                csrfCookie.push('Secure');
+            response.headers.append('Set-Cookie', sessionCookie.join('; '));
+            response.headers.append('Set-Cookie', csrfCookie.join('; '));
+            await logEvent({
+                event: 'login_success',
+                userId: user.id,
+                ipAddress: request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ?? undefined,
+                userAgent: request.headers.get('user-agent') ?? undefined,
+            });
+            return response;
+        }
+        catch (err) {
+            return errorResponse('Login failed', 500);
+        }
+    });
+    router.post('/auth/logout', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            await revokeSession(auth.session.sessionId, db());
+            await logEvent({
+                event: 'logout',
+                userId: auth.session.userId,
+                ipAddress: request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ?? undefined,
+            });
+            const response = json({ data: { success: true } });
+            response.headers.set('Set-Cookie', 'actuate_session=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0');
+            return response;
+        }
+        catch (err) {
+            return errorResponse('Logout failed', 500);
+        }
+    });
+    router.get('/auth/me', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const user = await db().user.findUnique({
+                where: { id: auth.session.userId },
+                select: { id: true, email: true, name: true, role: true, isActive: true },
+            });
+            if (!user) {
+                return errorResponse('User not found', 404);
+            }
+            return json({ data: user });
+        }
+        catch (err) {
+            return errorResponse('Failed to fetch user', 500);
+        }
+    });
+    // ---------------------------------------------------------------------------
+    // TOTP routes
+    // ---------------------------------------------------------------------------
+    router.post('/auth/totp/setup', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const { generateTOTPSecret, generateTOTPUri, generateBackupCodes } = await import('../auth/totp');
+            const user = await db().user.findUnique({ where: { id: auth.session.userId }, select: { email: true, totpEnabled: true } });
+            if (!user)
+                return errorResponse('User not found', 404);
+            if (user.totpEnabled)
+                return errorResponse('TOTP already enabled', 400);
+            const secret = generateTOTPSecret();
+            const uri = generateTOTPUri(secret, user.email);
+            const backups = generateBackupCodes();
+            await db().user.update({ where: { id: auth.session.userId }, data: { totpSecret: secret, backupCodes: backups } });
+            return json({ data: { secret, uri, backupCodes: backups } });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.post('/auth/totp/verify', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const body = await request.json();
+            if (!body.code)
+                return errorResponse('Code is required', 400);
+            const { verifyTOTP } = await import('../auth/totp');
+            const user = await db().user.findUnique({ where: { id: auth.session.userId }, select: { totpSecret: true } });
+            if (!user?.totpSecret)
+                return errorResponse('TOTP not set up', 400);
+            const valid = verifyTOTP(body.code, user.totpSecret);
+            if (!valid)
+                return errorResponse('Invalid code', 400);
+            await db().user.update({ where: { id: auth.session.userId }, data: { totpEnabled: true } });
+            return json({ data: { enabled: true } });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.post('/auth/totp/disable', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            await db().user.update({ where: { id: auth.session.userId }, data: { totpEnabled: false, totpSecret: null, backupCodes: null } });
+            return json({ data: { enabled: false } });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.post('/auth/totp/login', async (request) => {
+        try {
+            const body = await request.json();
+            if (!body.userId || !body.code)
+                return errorResponse('userId and code are required', 400);
+            const { verifyTOTP } = await import('../auth/totp');
+            const user = await db().user.findUnique({ where: { id: body.userId }, select: { id: true, email: true, role: true, totpSecret: true, totpEnabled: true, isActive: true } });
+            if (!user || !user.isActive || !user.totpEnabled || !user.totpSecret)
+                return errorResponse('Invalid request', 400);
+            const valid = verifyTOTP(body.code, user.totpSecret);
+            if (!valid)
+                return errorResponse('Invalid code', 401);
+            const tempSessionId = crypto.randomUUID();
+            const token = await createSession({ userId: user.id, role: user.role, sessionId: tempSessionId }, { secret: getSessionSecret() });
+            await db().session.create({ data: { id: tempSessionId, userId: user.id, token, expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000) } });
+            const isProduction = process.env.NODE_ENV === 'production';
+            const sessionCookie = [`actuate_session=${token}`, 'Path=/', 'HttpOnly', 'SameSite=Lax', `Max-Age=${7 * 24 * 3600}`, ...(isProduction ? ['Secure'] : [])].join('; ');
+            return new Response(JSON.stringify({ data: { token, user: { id: user.id, email: user.email, role: user.role } } }), { status: 200, headers: { ...SECURITY_HEADERS, 'Set-Cookie': sessionCookie } });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    // ---------------------------------------------------------------------------
+    // OAuth routes
+    // ---------------------------------------------------------------------------
+    router.get('/auth/oauth/:provider', async (request, params) => {
+        try {
+            const provider = params.provider;
+            if (!['google', 'github', 'microsoft'].includes(provider)) {
+                return errorResponse('Unsupported OAuth provider', 400);
+            }
+            const secret = getSessionSecret();
+            const siteUrl = process.env.NEXT_PUBLIC_SITE_URL ?? new URL(request.url).origin;
+            const oauthProviders = {};
+            const envPrefix = provider.toUpperCase();
+            const clientId = process.env[`OAUTH_${envPrefix}_CLIENT_ID`] ?? '';
+            const clientSecret = process.env[`OAUTH_${envPrefix}_CLIENT_SECRET`] ?? '';
+            if (!clientId || !clientSecret) {
+                return errorResponse(`OAuth provider "${provider}" is not configured`, 400);
+            }
+            oauthProviders[provider] = {
+                clientId,
+                clientSecret,
+                redirectUri: `${siteUrl}/api/cms/auth/oauth/${provider}/callback`,
+            };
+            const codeVerifier = generateCodeVerifier();
+            const codeChallenge = await generateCodeChallenge(codeVerifier);
+            const state = await generateState(provider, codeVerifier, '/admin', secret);
+            const url = getAuthorizationUrl(provider, oauthProviders[provider], state, codeChallenge);
+            return json({ data: { url } });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.get('/auth/oauth/:provider/callback', async (request, params) => {
+        try {
+            const provider = params.provider;
+            if (!['google', 'github', 'microsoft'].includes(provider)) {
+                return errorResponse('Unsupported OAuth provider', 400);
+            }
+            const url = new URL(request.url);
+            const code = url.searchParams.get('code');
+            const stateToken = url.searchParams.get('state');
+            const errorParam = url.searchParams.get('error');
+            if (errorParam) {
+                const desc = url.searchParams.get('error_description') ?? errorParam;
+                return new Response(null, {
+                    status: 302,
+                    headers: { Location: `/admin/login?error=${encodeURIComponent(desc)}` },
+                });
+            }
+            if (!code || !stateToken) {
+                return errorResponse('Missing code or state parameter', 400);
+            }
+            const secret = getSessionSecret();
+            const siteUrl = process.env.NEXT_PUBLIC_SITE_URL ?? url.origin;
+            const oauthProviders = {};
+            const envPrefix = provider.toUpperCase();
+            oauthProviders[provider] = {
+                clientId: process.env[`OAUTH_${envPrefix}_CLIENT_ID`] ?? '',
+                clientSecret: process.env[`OAUTH_${envPrefix}_CLIENT_SECRET`] ?? '',
+                redirectUri: `${siteUrl}/api/cms/auth/oauth/${provider}/callback`,
+            };
+            const result = await handleOAuthCallback(provider, code, stateToken, oauthProviders, secret, db());
+            const cookieFlags = [
+                `actuate_session=${result.token}`,
+                'Path=/',
+                'HttpOnly',
+                'SameSite=Lax',
+                'Max-Age=604800',
+            ];
+            if (siteUrl.startsWith('https')) {
+                cookieFlags.push('Secure');
+            }
+            return new Response(null, {
+                status: 302,
+                headers: {
+                    Location: '/admin',
+                    'Set-Cookie': cookieFlags.join('; '),
+                },
+            });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : 'OAuth callback failed';
+            return new Response(null, {
+                status: 302,
+                headers: { Location: `/admin/login?error=${encodeURIComponent(message)}` },
+            });
+        }
+    });
+    // ---------------------------------------------------------------------------
+    // Document routes
+    // ---------------------------------------------------------------------------
+    router.get('/collections/:slug', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const url = new URL(request.url);
+            const ctx = buildActionContext(auth.session, db(), url.searchParams.get('locale') ?? undefined);
+            const result = await listDocuments({
+                collection: params.slug,
+                page: Number(url.searchParams.get('page')) || 1,
+                pageSize: clampPageSize(url.searchParams.get('pageSize')),
+                sort: url.searchParams.get('sort') ?? undefined,
+                order: url.searchParams.get('order') ?? undefined,
+                status: url.searchParams.get('status') ?? undefined,
+                locale: url.searchParams.get('locale') ?? undefined,
+                folderId: url.searchParams.get('folderId') ?? undefined,
+            }, ctx);
+            const collectionConfig = globalThis.__actuateConfig?.collections?.[params.slug];
+            const fields = collectionConfig?.fields;
+            if (fields && result.docs.length > 0) {
+                const user = { id: auth.session.userId, role: auth.session.role };
+                result.docs = await Promise.all(result.docs.map(async (doc) => {
+                    if (doc.data && typeof doc.data === 'object') {
+                        return {
+                            ...doc,
+                            data: await applyFieldAccess('read', fields, doc.data, user),
+                        };
+                    }
+                    return doc;
+                }));
+            }
+            return json({ data: result });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.get('/collections/:slug/:id', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const ctx = buildActionContext(auth.session, db());
+            const doc = await getDocument(params.slug, params.id, ctx);
+            if (!doc) {
+                return errorResponse('Document not found', 404);
+            }
+            const collectionConfig = globalThis.__actuateConfig?.collections?.[params.slug];
+            const fields = collectionConfig?.fields;
+            if (fields && doc.data && typeof doc.data === 'object') {
+                const user = { id: auth.session.userId, role: auth.session.role };
+                return json({
+                    data: {
+                        ...doc,
+                        data: await applyFieldAccess('read', fields, doc.data, user),
+                    },
+                });
+            }
+            return json({ data: doc });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.post('/collections/:slug', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = await request.json();
+            const ctx = buildActionContext(auth.session, db());
+            const doc = await createDocument(params.slug, body, ctx);
+            await logEvent({
+                event: 'document_created',
+                userId: auth.session.userId,
+                details: { collection: params.slug, documentId: doc?.id },
+            });
+            return json({ data: doc }, 201);
+        }
+        catch (err) {
+            return errorResponse('Failed to create document', 500);
+        }
+    });
+    router.put('/collections/:slug/:id', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = await request.json();
+            const ctx = buildActionContext(auth.session, db());
+            const doc = await updateDocument(params.slug, params.id, body, ctx);
+            await logEvent({
+                event: 'document_updated',
+                userId: auth.session.userId,
+                details: { collection: params.slug, documentId: params.id },
+            });
+            return json({ data: doc });
+        }
+        catch (err) {
+            return errorResponse('Failed to update document', 500);
+        }
+    });
+    router.delete('/collections/:slug/:id', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const ctx = buildActionContext(auth.session, db());
+            await deleteDocument(params.slug, params.id, ctx);
+            await logEvent({
+                event: 'document_deleted',
+                userId: auth.session.userId,
+                details: { collection: params.slug, documentId: params.id },
+            });
+            return json({ data: { success: true } });
+        }
+        catch (err) {
+            return errorResponse('Failed to delete document', 500);
+        }
+    });
+    // ---------------------------------------------------------------------------
+    // Media routes
+    // ---------------------------------------------------------------------------
+    router.get('/media', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const url = new URL(request.url);
+            const page = Number(url.searchParams.get('page')) || 1;
+            const pageSize = clampPageSize(url.searchParams.get('pageSize'));
+            const skip = (page - 1) * pageSize;
+            const folderParam = url.searchParams.get('folderId');
+            const where = {};
+            if (folderParam === 'none') {
+                where.folderId = null;
+            }
+            else if (folderParam) {
+                where.folderId = folderParam;
+            }
+            const [items, total] = await Promise.all([
+                db().media.findMany({ where, skip, take: pageSize, orderBy: { createdAt: 'desc' } }),
+                db().media.count({ where }),
+            ]);
+            return json({
+                data: { items, total, page, pageSize, totalPages: Math.ceil(total / pageSize) },
+            });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.post('/media/presign', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const body = await request.json();
+            if (!body.filename || !body.contentType) {
+                return errorResponse('filename and contentType are required', 400);
+            }
+            const storageKey = `actuate/media/${Date.now()}-${body.filename.replace(/[^a-zA-Z0-9._-]/g, '_')}`;
+            return json({
+                data: {
+                    storageKey,
+                    uploadUrl: `/api/cms/media/upload`,
+                    fields: { storageKey, contentType: body.contentType },
+                },
+            });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    const MAX_UPLOAD_BYTES = 50 * 1024 * 1024; // 50 MB
+    router.post('/media/upload', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const contentLength = parseInt(request.headers.get('content-length') ?? '0', 10);
+            if (contentLength > MAX_UPLOAD_BYTES) {
+                return errorResponse('File exceeds maximum size of 50MB', 413);
+            }
+            const formData = await request.formData();
+            const file = formData.get('file');
+            const skipOptimize = formData.get('skipOptimize') === 'true';
+            if (!file) {
+                return errorResponse('No file provided', 400);
+            }
+            const originalFilename = file.name;
+            const contentType = file.type;
+            const originalSize = file.size;
+            if (originalSize > 50 * 1024 * 1024) {
+                return errorResponse('File exceeds maximum size of 50MB', 413);
+            }
+            const arrayBuffer = await file.arrayBuffer();
+            let uploadBuffer;
+            let finalFilename = originalFilename;
+            let finalMimeType = contentType;
+            let finalSize = originalSize;
+            let width = null;
+            let height = null;
+            let blurHash = null;
+            let savings = 0;
+            if (!skipOptimize && contentType.startsWith('image/')) {
+                const result = await optimizeImage(arrayBuffer, originalFilename, contentType);
+                uploadBuffer = result.buffer;
+                finalFilename = result.filename;
+                finalMimeType = result.mimeType;
+                finalSize = result.optimizedSize;
+                width = result.width || null;
+                height = result.height || null;
+                blurHash = result.blurHash ?? null;
+                savings = result.savings;
+            }
+            else {
+                uploadBuffer = Buffer.from(arrayBuffer);
+            }
+            const sanitizedName = finalFilename.replace(/[^a-zA-Z0-9._-]/g, '_');
+            const storageKey = `actuate/media/${Date.now()}-${sanitizedName}`;
+            let publicUrl = '';
+            try {
+                // @ts-ignore -- @vercel/blob is an optional peer dependency
+                const blob = await import('@vercel/blob');
+                const result = await blob.put(storageKey, uploadBuffer, {
+                    access: 'public',
+                    contentType: finalMimeType,
+                });
+                publicUrl = result.url;
+            }
+            catch {
+                publicUrl = `/api/cms/media/file/${storageKey}`;
+            }
+            const media = await db().media.create({
+                data: {
+                    filename: finalFilename,
+                    storageKey: publicUrl || storageKey,
+                    mimeType: finalMimeType,
+                    fileSize: finalSize,
+                    width,
+                    height,
+                    blurHash,
+                    uploadedById: auth.session.userId,
+                },
+            });
+            await logEvent({
+                event: 'media_uploaded',
+                userId: auth.session.userId,
+                details: { mediaId: media.id, filename: finalFilename },
+            });
+            return json({
+                data: {
+                    ...media,
+                    optimization: {
+                        originalSize,
+                        optimizedSize: finalSize,
+                        savings,
+                        originalFormat: contentType,
+                        outputFormat: finalMimeType,
+                        originalSizeFormatted: formatBytes(originalSize),
+                        optimizedSizeFormatted: formatBytes(finalSize),
+                    },
+                },
+            }, 201);
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.post('/media/:id/optimize', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const media = await db().media.findUnique({ where: { id: params.id } });
+            if (!media)
+                return errorResponse('Media not found', 404);
+            if (!media.mimeType.startsWith('image/')) {
+                return errorResponse('Only images can be optimized', 400);
+            }
+            if (media.mimeType === 'image/webp') {
+                return json({
+                    data: { ...media, optimization: { alreadyOptimized: true, savings: 0 } },
+                });
+            }
+            if (!isAllowedStorageUrl(media.storageKey)) {
+                return errorResponse('Invalid media storage URL', 400);
+            }
+            let fileBuffer;
+            try {
+                const response = await fetch(media.storageKey);
+                if (!response.ok)
+                    throw new Error('Failed to fetch media file');
+                fileBuffer = Buffer.from(await response.arrayBuffer());
+            }
+            catch {
+                return errorResponse('Could not retrieve the original file for optimization', 500);
+            }
+            const result = await optimizeImage(fileBuffer, media.filename, media.mimeType);
+            if (result.savings <= 0) {
+                return json({
+                    data: { ...media, optimization: { alreadyOptimized: true, savings: 0 } },
+                });
+            }
+            // Upload the optimized version
+            const sanitizedName = result.filename.replace(/[^a-zA-Z0-9._-]/g, '_');
+            const newStorageKey = `actuate/media/${Date.now()}-${sanitizedName}`;
+            let newPublicUrl = '';
+            try {
+                // @ts-ignore -- @vercel/blob is an optional peer dependency
+                const blob = await import('@vercel/blob');
+                const uploadResult = await blob.put(newStorageKey, result.buffer, {
+                    access: 'public',
+                    contentType: result.mimeType,
+                });
+                newPublicUrl = uploadResult.url;
+                // Delete the old blob
+                try {
+                    await blob.del(media.storageKey);
+                }
+                catch { /* best-effort */ }
+            }
+            catch {
+                newPublicUrl = `/api/cms/media/file/${newStorageKey}`;
+            }
+            const updated = await db().media.update({
+                where: { id: params.id },
+                data: {
+                    filename: result.filename,
+                    storageKey: newPublicUrl || newStorageKey,
+                    mimeType: result.mimeType,
+                    fileSize: result.optimizedSize,
+                    width: result.width || undefined,
+                    height: result.height || undefined,
+                    blurHash: result.blurHash ?? undefined,
+                },
+            });
+            return json({
+                data: {
+                    ...updated,
+                    optimization: {
+                        originalSize: result.originalSize,
+                        optimizedSize: result.optimizedSize,
+                        savings: result.savings,
+                        originalFormat: media.mimeType,
+                        outputFormat: result.mimeType,
+                        originalSizeFormatted: formatBytes(result.originalSize),
+                        optimizedSizeFormatted: formatBytes(result.optimizedSize),
+                    },
+                },
+            });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.put('/media/:id', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = await request.json();
+            const updated = await db().media.update({
+                where: { id: params.id },
+                data: {
+                    ...(body.alt !== undefined ? { altText: body.alt } : {}),
+                    ...(body.title !== undefined ? { title: body.title } : {}),
+                    ...(body.filename !== undefined ? { filename: body.filename } : {}),
+                    ...(body.focalX !== undefined ? { focalPointX: body.focalX } : {}),
+                    ...(body.focalY !== undefined ? { focalPointY: body.focalY } : {}),
+                },
+            });
+            return json({ data: updated });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.delete('/media/:id', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const media = await db().media.findUnique({ where: { id: params.id } });
+            if (!media) {
+                return errorResponse('Media not found', 404);
+            }
+            try {
+                // @ts-ignore -- @vercel/blob is an optional peer dependency
+                const blob = await import('@vercel/blob');
+                await blob.del(media.storageKey);
+            }
+            catch {
+                // Storage delete failed or not available
+            }
+            await db().media.delete({ where: { id: params.id } });
+            await logEvent({
+                event: 'media_deleted',
+                userId: auth.session.userId,
+                details: { mediaId: params.id, filename: media.filename },
+            });
+            return json({ data: { success: true } });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    // ---------------------------------------------------------------------------
+    // Setup routes
+    // ---------------------------------------------------------------------------
+    router.get('/setup/status', async () => {
+        try {
+            const status = await checkSetupRequired(db());
+            return json({ data: status });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.post('/setup/create-admin', async (request) => {
+        try {
+            const clientIp = request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ?? 'unknown';
+            if (!(await checkRateLimitAsync(loginLimiter, `setup:${clientIp}`))) {
+                return errorResponse('Too many setup attempts', 429);
+            }
+            const body = await request.json();
+            if (!body.name || !body.email || !body.password) {
+                return errorResponse('Name, email, and password are required', 400);
+            }
+            const result = await createInitialAdmin(db(), {
+                name: body.name,
+                email: body.email,
+                password: body.password,
+            });
+            if (!result.success) {
+                return errorResponse(result.error ?? 'Setup failed', 400);
+            }
+            return json({ data: result }, 201);
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    // ---------------------------------------------------------------------------
+    // Stats route
+    // ---------------------------------------------------------------------------
+    router.get('/stats', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const [totalDocuments, totalMedia, totalUsers, recentDocuments] = await Promise.all([
+                db().document.count({ where: { deletedAt: null } }),
+                db().media.count(),
+                db().user.count(),
+                db().document.findMany({
+                    where: { deletedAt: null },
+                    orderBy: { updatedAt: 'desc' },
+                    take: 10,
+                }),
+            ]);
+            return json({ data: { totalDocuments, totalMedia, totalUsers, recentDocuments } });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    // ---------------------------------------------------------------------------
+    // Global search
+    // ---------------------------------------------------------------------------
+    router.get('/search/global', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const url = new URL(request.url, 'http://localhost');
+            const q = (url.searchParams.get('q') ?? '').trim();
+            if (!q)
+                return json({ data: { documents: [], media: [], users: [] } });
+            const [documents, media, users] = await Promise.all([
+                db().document.findMany({
+                    where: { deletedAt: null, OR: [{ title: { contains: q, mode: 'insensitive' } }, { plainText: { contains: q, mode: 'insensitive' } }] },
+                    take: 10,
+                    orderBy: { updatedAt: 'desc' },
+                    select: { id: true, title: true, slug: true, collection: true, status: true, updatedAt: true },
+                }),
+                db().media.findMany({
+                    where: { OR: [{ filename: { contains: q, mode: 'insensitive' } }, { altText: { contains: q, mode: 'insensitive' } }] },
+                    take: 5,
+                    orderBy: { createdAt: 'desc' },
+                    select: { id: true, filename: true, altText: true, mimeType: true, storageKey: true },
+                }),
+                db().user.findMany({
+                    where: { isActive: true, OR: [{ name: { contains: q, mode: 'insensitive' } }, { email: { contains: q, mode: 'insensitive' } }] },
+                    take: 5,
+                    select: { id: true, name: true, email: true, role: true },
+                }),
+            ]);
+            return json({ data: { documents, media, users } });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    // ---------------------------------------------------------------------------
+    // Users route
+    // ---------------------------------------------------------------------------
+    router.get('/users', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            if (auth.session.role !== 'ADMIN') {
+                return errorResponse('Forbidden', 403);
+            }
+            const users = await db().user.findMany({
+                select: { id: true, email: true, name: true, role: true, isActive: true, createdAt: true },
+            });
+            return json({ data: users });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.delete('/users/:id', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            if (auth.session.userId === params.id) {
+                return errorResponse('Cannot delete your own account', 400);
+            }
+            const user = await db().user.findUnique({ where: { id: params.id } });
+            if (!user)
+                return errorResponse('User not found', 404);
+            await db().user.update({
+                where: { id: params.id },
+                data: { isActive: false },
+            });
+            await db().session.updateMany({
+                where: { userId: params.id },
+                data: { revokedAt: new Date() },
+            });
+            await logEvent({
+                event: 'user_deactivated',
+                userId: auth.session.userId,
+                details: { targetUserId: params.id, targetEmail: user.email },
+            });
+            return json({ data: { success: true } });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    // ---------------------------------------------------------------------------
+    // Forms routes
+    // ---------------------------------------------------------------------------
+    router.get('/forms', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const forms = await db().document.findMany({
+                where: { collection: 'forms', deletedAt: null },
+                orderBy: { createdAt: 'desc' },
+            });
+            return json({ data: forms });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.get('/forms/:id/submissions', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const url = new URL(request.url);
+            const page = Number(url.searchParams.get('page')) || 1;
+            const pageSize = clampPageSize(url.searchParams.get('pageSize'));
+            const skip = (page - 1) * pageSize;
+            const [submissions, total] = await Promise.all([
+                db().formSubmission.findMany({
+                    where: { formId: params.id },
+                    skip,
+                    take: pageSize,
+                    orderBy: { createdAt: 'desc' },
+                }),
+                db().formSubmission.count({ where: { formId: params.id } }),
+            ]);
+            return json({
+                data: { submissions, total, page, pageSize, totalPages: Math.ceil(total / pageSize) },
+            });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.post('/forms/:id/submit', async (request, params) => {
+        try {
+            const clientIp = request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ?? 'unknown';
+            if (!(await checkRateLimitAsync(formLimiterGlobal, `form:${clientIp}`))) {
+                return errorResponse('Too many submissions. Please try again later.', 429);
+            }
+            const formId = params.id;
+            const form = await db().document.findFirst({
+                where: { id: formId, collection: 'forms', deletedAt: null },
+            });
+            if (!form) {
+                return errorResponse('Form not found', 404);
+            }
+            const formData = (form.data ?? {});
+            const body = await request.json();
+            if (!body.fields || typeof body.fields !== 'object') {
+                return errorResponse('Missing or invalid "fields" in request body', 400);
+            }
+            const submission = await db().formSubmission.create({
+                data: {
+                    formId,
+                    data: body.fields,
+                    attribution: body.attribution ?? null,
+                    submittedAt: new Date(),
+                },
+            });
+            // Fire form hooks asynchronously (email notification, webhooks)
+            (async () => {
+                try {
+                    const config = globalThis.__actuateConfig;
+                    const hooks = [
+                        ...(config?.plugins?.forms?.hooks ?? []),
+                        ...(config?._pluginHooks ?? []),
+                    ];
+                    const formHooks = hooks.filter((h) => h.event === 'afterCreate:form-submissions');
+                    for (const hook of formHooks) {
+                        await hook.handler({ formId, data: body.fields });
+                    }
+                }
+                catch (hookErr) {
+                    console.error('[cms] Form hook error:', hookErr);
+                }
+            })();
+            const confirmation = formData.confirmation ?? {
+                type: 'message',
+                message: 'Thank you! Your submission has been received.',
+            };
+            const analytics = formData.analytics ?? null;
+            return json({
+                data: {
+                    success: true,
+                    submissionId: submission.id,
+                    confirmation,
+                    analytics,
+                },
+            }, 201);
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    // ---------------------------------------------------------------------------
+    // Redirects routes
+    // ---------------------------------------------------------------------------
+    router.get('/redirects', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const redirects = await db().redirect.findMany({ orderBy: { createdAt: 'desc' } });
+            return json({ data: redirects });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.post('/redirects', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            if (auth.session.role !== 'ADMIN')
+                return errorResponse('Admin access required', 403);
+            const body = await request.json();
+            const source = String(body.source ?? '').trim();
+            const destination = String(body.destination ?? '').trim();
+            if (!source || !destination) {
+                return errorResponse('source and destination are required', 400);
+            }
+            if (destination.startsWith('http') && !destination.startsWith(process.env.NEXT_PUBLIC_SITE_URL ?? 'https://')) {
+                try {
+                    const destUrl = new URL(destination);
+                    if (!['http:', 'https:'].includes(destUrl.protocol)) {
+                        return errorResponse('Invalid destination URL', 400);
+                    }
+                }
+                catch {
+                    return errorResponse('Invalid destination URL', 400);
+                }
+            }
+            const redirect = await db().redirect.create({
+                data: {
+                    source,
+                    destination,
+                    statusCode: [301, 302, 307, 308].includes(Number(body.statusCode)) ? Number(body.statusCode) : 301,
+                    isRegex: body.isRegex === true,
+                    notes: typeof body.notes === 'string' ? body.notes : null,
+                },
+            });
+            return json({ data: redirect }, 201);
+        }
+        catch (err) {
+            return errorResponse('Failed to create redirect', 500);
+        }
+    });
+    router.delete('/redirects/:id', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            if (auth.session.role !== 'ADMIN')
+                return errorResponse('Admin access required', 403);
+            await db().redirect.delete({ where: { id: params.id } });
+            return json({ data: { success: true } });
+        }
+        catch (err) {
+            return errorResponse('Failed to delete redirect', 500);
+        }
+    });
+    // ---------------------------------------------------------------------------
+    // SEO routes
+    // ---------------------------------------------------------------------------
+    router.get('/seo/pages', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const pages = await db().document.findMany({
+                where: { deletedAt: null, status: 'PUBLISHED' },
+                select: {
+                    id: true,
+                    collection: true,
+                    data: true,
+                    updatedAt: true,
+                    structuredData: true,
+                },
+                orderBy: { updatedAt: 'desc' },
+            });
+            return json({ data: pages });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.get('/seo/link-health', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const docs = await db().document.findMany({
+                where: { deletedAt: null, status: 'PUBLISHED' },
+                select: { id: true, title: true, data: true, collection: true },
+            });
+            const linkResults = [];
+            const urlRegex = /https?:\/\/[^\s"'<>]+/g;
+            const siteUrl = process.env.NEXT_PUBLIC_SITE_URL ?? '';
+            for (const doc of docs) {
+                const pageTitle = doc.title ?? doc.data?.title ?? doc.id;
+                const content = JSON.stringify(doc.data ?? {});
+                const urls = content.match(urlRegex) ?? [];
+                const seen = new Set();
+                for (const url of urls) {
+                    const clean = url.replace(/[",;)}\]]+$/, '');
+                    if (seen.has(clean))
+                        continue;
+                    seen.add(clean);
+                    const isInternal = siteUrl && clean.startsWith(siteUrl);
+                    try {
+                        const resp = await fetch(clean, { method: 'HEAD', redirect: 'manual', signal: AbortSignal.timeout(5000) });
+                        if (resp.status >= 400 || (resp.status >= 300 && resp.status < 400)) {
+                            linkResults.push({
+                                id: `${doc.id}-${linkResults.length}`,
+                                page: pageTitle,
+                                url: clean,
+                                status: resp.status,
+                                type: isInternal ? 'internal' : 'external',
+                            });
+                        }
+                    }
+                    catch {
+                        linkResults.push({
+                            id: `${doc.id}-${linkResults.length}`,
+                            page: pageTitle,
+                            url: clean,
+                            status: 0,
+                            type: isInternal ? 'internal' : 'external',
+                        });
+                    }
+                }
+            }
+            return json({ data: linkResults });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.post('/seo/scan', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const documents = await db().document.findMany({
+                where: { status: 'PUBLISHED', deletedAt: null },
+                select: { id: true, title: true, slug: true, collection: true, data: true, plainText: true },
+            });
+            const issues = [];
+            for (const doc of documents) {
+                const data = (doc.data ?? {});
+                const problems = [];
+                if (!data.metaTitle && !data.seoTitle)
+                    problems.push('Missing meta title');
+                if (!data.metaDescription && !data.seoDescription)
+                    problems.push('Missing meta description');
+                if (!data.canonical)
+                    problems.push('No canonical URL set');
+                if (!data.schemaType)
+                    problems.push('No Schema.org type');
+                const plainText = (doc.plainText ?? '');
+                if (plainText.length > 0 && plainText.length < 300)
+                    problems.push('Content is too short (< 300 characters)');
+                const content = typeof data.body === 'string' ? data.body : typeof data.content === 'string' ? data.content : '';
+                if (content) {
+                    const imgMatches = content.match(/<img\b[^>]*>/gi) ?? [];
+                    const missingAlt = imgMatches.filter((img) => !img.includes('alt=')).length;
+                    if (missingAlt > 0)
+                        problems.push(`${missingAlt} image(s) missing alt text`);
+                    if (!content.includes('<h1') && !content.includes('<h1>'))
+                        problems.push('No H1 heading found in content');
+                }
+                if (problems.length > 0) {
+                    issues.push({ documentId: doc.id, title: doc.title ?? 'Untitled', slug: doc.slug ?? '', problems });
+                }
+            }
+            const total = documents.length;
+            const pagesWithIssues = issues.length;
+            const totalProblems = issues.reduce((sum, i) => sum + i.problems.length, 0);
+            return json({ data: { total, pagesWithIssues, totalProblems, issues } });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    // ---------------------------------------------------------------------------
+    // SEO analysis, readability, internal links, schema, meta
+    // ---------------------------------------------------------------------------
+    router.get('/seo/analysis/:documentId', async (request, params) => {
+        try {
+            const doc = await db().document.findUnique({ where: { id: params.documentId } });
+            if (!doc)
+                return errorResponse('Not found', 404);
+            const { analyzeContent } = await import('../seo/analysis');
+            const data = doc.data || {};
+            const result = analyzeContent({
+                title: doc.title || data.title || '',
+                slug: doc.slug || data.slug || '',
+                content: data.content || data.body || '',
+                metaTitle: data.metaTitle || data.seoTitle,
+                metaDescription: data.metaDescription || data.seoDescription,
+                focusKeyphrase: data.focusKeyphrase,
+                canonical: data.canonical,
+                ogTitle: data.ogTitle,
+                ogDescription: data.ogDescription,
+                ogImage: data.ogImage,
+                isCornerstone: data.isCornerstone,
+            });
+            return new Response(JSON.stringify(result), {
+                status: 200,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        catch (err) {
+            return internalError(err, 'seo/analysis');
+        }
+    });
+    router.get('/seo/readability/:documentId', async (request, params) => {
+        try {
+            const doc = await db().document.findUnique({ where: { id: params.documentId } });
+            if (!doc)
+                return errorResponse('Not found', 404);
+            const { calculateReadability, stripHtmlTags } = await import('../seo/analysis');
+            const data = doc.data || {};
+            const text = stripHtmlTags(data.content || data.body || '');
+            const result = calculateReadability(text);
+            return new Response(JSON.stringify(result), {
+                status: 200,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        catch (err) {
+            return internalError(err, 'seo/readability');
+        }
+    });
+    router.get('/seo/internal-links/:documentId', async (request, params) => {
+        try {
+            const doc = await db().document.findUnique({ where: { id: params.documentId } });
+            if (!doc)
+                return errorResponse('Not found', 404);
+            const data = doc.data || {};
+            const title = doc.title || data.title || '';
+            const keywords = title.split(/\s+/).filter((w) => w.length > 3).slice(0, 5);
+            if (keywords.length === 0) {
+                return new Response(JSON.stringify({ suggestions: [] }), {
+                    status: 200,
+                    headers: { 'Content-Type': 'application/json' },
+                });
+            }
+            const suggestions = await db().document.findMany({
+                where: {
+                    id: { not: params.documentId },
+                    status: 'PUBLISHED',
+                    OR: keywords.map((kw) => ({
+                        title: { contains: kw, mode: 'insensitive' },
+                    })),
+                },
+                select: { id: true, title: true, slug: true, collection: true },
+                take: 10,
+                orderBy: { updatedAt: 'desc' },
+            });
+            return new Response(JSON.stringify({ suggestions }), {
+                status: 200,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        catch (err) {
+            return internalError(err, 'seo/internal-links');
+        }
+    });
+    router.get('/llms.txt', async () => {
+        try {
+            const docs = await db().document.findMany({
+                where: { status: 'PUBLISHED' },
+                select: { title: true, slug: true, collection: true, updatedAt: true, data: true },
+                orderBy: { updatedAt: 'desc' },
+                take: 50,
+            });
+            const { generateLlmsTxt } = await import('../seo/llms-txt');
+            const pages = docs.map((d) => {
+                const data = d.data || {};
+                return {
+                    title: d.title || data.title || 'Untitled',
+                    url: `/${d.collection}/${d.slug || d.title?.toLowerCase().replace(/\s+/g, '-')}`,
+                    description: data.metaDescription || data.seoDescription || '',
+                    collection: d.collection,
+                    updatedAt: d.updatedAt?.toISOString(),
+                    isCornerstone: data.isCornerstone === true,
+                };
+            });
+            const siteUrl = '';
+            const txt = generateLlmsTxt({
+                siteName: 'Actuate CMS',
+                siteUrl,
+                siteDescription: 'Content managed by Actuate CMS',
+                maxPages: 50,
+            }, pages);
+            return new Response(txt, {
+                status: 200,
+                headers: { 'Content-Type': 'text/plain; charset=utf-8' },
+            });
+        }
+        catch (err) {
+            return internalError(err, 'llms.txt');
+        }
+    });
+    router.get('/seo/schema/:documentId', async (request, params) => {
+        try {
+            const doc = await db().document.findUnique({ where: { id: params.documentId } });
+            if (!doc)
+                return errorResponse('Not found', 404);
+            const { buildSchemaGraph } = await import('../content/structured-data');
+            const data = doc.data || {};
+            const graph = buildSchemaGraph({
+                siteName: 'Actuate CMS',
+                siteUrl: '',
+            }, {
+                url: `/${doc.collection}/${doc.slug || ''}`,
+                title: doc.title || data.title || '',
+                description: data.metaDescription || data.seoDescription || '',
+                datePublished: doc.createdAt?.toISOString(),
+                dateModified: doc.updatedAt?.toISOString(),
+                type: doc.collection === 'posts' ? 'post' : 'page',
+                keywords: data.tags || data.keywords,
+                featuredImage: data.featuredImage ? { url: data.featuredImage } : undefined,
+            });
+            return new Response(JSON.stringify(graph), {
+                status: 200,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        catch (err) {
+            return internalError(err, 'seo/schema');
+        }
+    });
+    router.get('/seo/meta/:documentId', async (request, params) => {
+        try {
+            const doc = await db().document.findUnique({ where: { id: params.documentId } });
+            if (!doc)
+                return errorResponse('Not found', 404);
+            const { generateMetaTags } = await import('../seo/meta-tags');
+            const data = doc.data || {};
+            const tags = generateMetaTags({
+                title: data.metaTitle || doc.title || data.title || '',
+                description: data.metaDescription || data.seoDescription || '',
+                url: `/${doc.collection}/${doc.slug || ''}`,
+                siteName: 'Actuate CMS',
+                type: doc.collection === 'posts' ? 'article' : 'website',
+                ogTitle: data.ogTitle,
+                ogDescription: data.ogDescription,
+                ogImage: data.ogImage ? { url: data.ogImage } : undefined,
+                twitterTitle: data.twitterTitle,
+                twitterDescription: data.twitterDescription,
+                twitterImage: data.twitterImage,
+                publishedTime: doc.createdAt?.toISOString(),
+                modifiedTime: doc.updatedAt?.toISOString(),
+                noIndex: data.noIndex,
+                noFollow: data.noFollow,
+                canonical: data.canonical,
+            });
+            return new Response(JSON.stringify(tags), {
+                status: 200,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        catch (err) {
+            return internalError(err, 'seo/meta');
+        }
+    });
+    // ---------------------------------------------------------------------------
+    // URL Resolution — maps a public URL path to its document
+    // ---------------------------------------------------------------------------
+    router.get('/resolve', async (request) => {
+        try {
+            const url = new URL(request.url);
+            const pathParam = url.searchParams.get('path');
+            if (!pathParam) {
+                return errorResponse('Missing required "path" query parameter', 400);
+            }
+            const segments = pathParam.replace(/^\/|\/$/g, '').split('/').filter(Boolean);
+            if (segments.length === 0) {
+                return errorResponse('Empty path', 400);
+            }
+            const configCollections = globalThis.__actuateConfig?.collections ?? {};
+            const collectionDefs = Object.values(configCollections);
+            let matchedCollection = null;
+            let docSlug = null;
+            for (const col of collectionDefs) {
+                const prefix = (col.urlPrefix ?? col.slug ?? '').replace(/^\/|\/$/g, '');
+                if (prefix && segments.length >= 2) {
+                    const prefixParts = prefix.split('/');
+                    const pathPrefix = segments.slice(0, prefixParts.length).join('/');
+                    if (pathPrefix === prefix) {
+                        matchedCollection = col.slug;
+                        docSlug = segments.slice(prefixParts.length).join('/');
+                        break;
+                    }
+                }
+                else if (!prefix && col.type === 'page') {
+                    matchedCollection = col.slug;
+                    docSlug = segments.join('/');
+                }
+            }
+            if (!matchedCollection && segments.length === 1) {
+                matchedCollection = 'pages';
+                docSlug = segments[0];
+            }
+            if (!matchedCollection && segments.length >= 2) {
+                matchedCollection = segments[0];
+                docSlug = segments.slice(1).join('/');
+            }
+            if (!matchedCollection || !docSlug) {
+                return errorResponse('Could not resolve path', 404);
+            }
+            const doc = await db().document.findFirst({
+                where: {
+                    collection: matchedCollection,
+                    deletedAt: null,
+                    status: 'PUBLISHED',
+                    OR: [
+                        { data: { path: ['slug'], equals: docSlug } },
+                        { plainText: { contains: docSlug } },
+                    ],
+                },
+            });
+            if (!doc) {
+                return errorResponse('Document not found', 404);
+            }
+            return json({
+                data: {
+                    id: doc.id,
+                    collection: doc.collection,
+                    data: doc.data,
+                    status: doc.status,
+                    publishedAt: doc.publishedAt,
+                    structuredData: doc.structuredData,
+                },
+            });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    // ---------------------------------------------------------------------------
+    // Folder routes
+    // ---------------------------------------------------------------------------
+    router.get('/folders', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const url = new URL(request.url);
+            const scope = url.searchParams.get('scope');
+            if (!scope)
+                return errorResponse('scope query parameter is required', 400);
+            const folders = await db().folder.findMany({
+                where: { scope },
+                orderBy: [{ position: 'asc' }, { name: 'asc' }],
+            });
+            const buildTree = (parentId) => folders
+                .filter((f) => f.parentId === parentId)
+                .map((f) => ({ ...f, children: buildTree(f.id) }));
+            return json({ data: buildTree(null) });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.post('/folders', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = await request.json();
+            if (!body.name || !body.scope)
+                return errorResponse('name and scope are required', 400);
+            const folder = await db().folder.create({
+                data: {
+                    name: body.name,
+                    scope: body.scope,
+                    parentId: body.parentId ?? null,
+                },
+            });
+            return json({ data: folder }, 201);
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.put('/folders/:id', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = await request.json();
+            const data = {};
+            if (body.name !== undefined)
+                data.name = body.name;
+            if (body.parentId !== undefined)
+                data.parentId = body.parentId;
+            if (body.position !== undefined)
+                data.position = body.position;
+            const folder = await db().folder.update({
+                where: { id: params.id },
+                data,
+            });
+            return json({ data: folder });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.delete('/folders/:id', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            await db().folder.delete({ where: { id: params.id } });
+            return json({ data: { success: true } });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.put('/documents/:id/folder', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = await request.json();
+            await db().document.update({
+                where: { id: params.id },
+                data: { folderId: body.folderId ?? null },
+            });
+            return json({ data: { success: true } });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.put('/media/:id/folder', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = await request.json();
+            await db().media.update({
+                where: { id: params.id },
+                data: { folderId: body.folderId ?? null },
+            });
+            return json({ data: { success: true } });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    // ---------------------------------------------------------------------------
+    // Preview routes
+    // ---------------------------------------------------------------------------
+    router.post('/preview/token', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const body = await request.json();
+            if (!body.collection || !body.documentId) {
+                return errorResponse('collection and documentId are required', 400);
+            }
+            const preview = createPreviewAdapter(getSessionSecret(), db());
+            const session = await preview.createPreviewSession(body.collection, body.documentId);
+            return json({ data: { token: session.token, expiresAt: session.expiresAt } });
+        }
+        catch (err) {
+            return errorResponse('Failed to create preview token', 500);
+        }
+    });
+    router.get('/preview/:collection/:id', async (request, params) => {
+        try {
+            const url = new URL(request.url);
+            const token = url.searchParams.get('token');
+            if (!token)
+                return errorResponse('Preview token required', 401);
+            const preview = createPreviewAdapter(getSessionSecret(), db());
+            const session = await preview.validatePreviewToken(token);
+            if (!session)
+                return errorResponse('Invalid or expired preview token', 401);
+            if (session.collection !== params.collection || session.documentId !== params.id) {
+                return errorResponse('Token does not match requested resource', 403);
+            }
+            const data = await preview.getPreviewData(session);
+            if (!data)
+                return errorResponse('Document not found', 404);
+            return json({ data });
+        }
+        catch (err) {
+            return errorResponse('Failed to fetch preview data', 500);
+        }
+    });
+    // ---------------------------------------------------------------------------
+    // Workflow routes
+    // ---------------------------------------------------------------------------
+    router.post('/collections/:slug/:id/workflow', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const body = await request.json();
+            if (!body.stage)
+                return errorResponse('Stage is required', 400);
+            const { transitionDocument } = await import('../workflow/index');
+            const result = await transitionDocument(params.id, body.stage, auth.session.userId, auth.session.role, body.note);
+            if (!result.success)
+                return errorResponse(result.error ?? 'Transition failed', 400);
+            return json({ data: { success: true } });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.get('/collections/:slug/:id/workflow', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const { getAvailableTransitions } = await import('../workflow/index');
+            const doc = await db().document.findFirst({
+                where: { id: params.id, deletedAt: null },
+                select: { workflowStage: true, reviewerId: true, reviewNote: true },
+            });
+            if (!doc)
+                return errorResponse('Document not found', 404);
+            const stage = (doc.workflowStage ?? 'DRAFT');
+            const transitions = getAvailableTransitions(stage, auth.session.role);
+            return json({ data: { stage, transitions, reviewerId: doc.reviewerId, reviewNote: doc.reviewNote } });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    // ---------------------------------------------------------------------------
+    // Version history routes
+    // ---------------------------------------------------------------------------
+    router.get('/collections/:slug/:id/versions', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const url = new URL(request.url);
+            const page = Number(url.searchParams.get('page')) || 1;
+            const pageSize = clampPageSize(url.searchParams.get('pageSize'), 50, 20);
+            const skip = (page - 1) * pageSize;
+            const doc = await db().document.findFirst({
+                where: { id: params.id, collection: params.slug },
+            });
+            if (!doc)
+                return errorResponse('Document not found', 404);
+            const [versions, total] = await Promise.all([
+                db().version.findMany({
+                    where: { documentId: params.id },
+                    orderBy: { createdAt: 'desc' },
+                    skip,
+                    take: pageSize,
+                    include: {
+                        changedBy: { select: { id: true, name: true, email: true } },
+                    },
+                }),
+                db().version.count({ where: { documentId: params.id } }),
+            ]);
+            return json({
+                data: { versions, total, page, pageSize, totalPages: Math.ceil(total / pageSize) },
+            });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.post('/collections/:slug/:id/versions/:versionId/restore', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const version = await db().version.findFirst({
+                where: { id: params.versionId, documentId: params.id },
+            });
+            if (!version)
+                return errorResponse('Version not found', 404);
+            const ctx = buildActionContext(auth.session, db());
+            const doc = await updateDocument(params.slug, params.id, version.data, ctx);
+            await logEvent({
+                event: 'version_restored',
+                userId: auth.session.userId,
+                details: { collection: params.slug, documentId: params.id, versionId: params.versionId },
+            });
+            return json({ data: doc });
+        }
+        catch (err) {
+            return errorResponse('Failed to restore version', 500);
+        }
+    });
+    // ---------------------------------------------------------------------------
+    // Scheduling routes
+    // ---------------------------------------------------------------------------
+    router.post('/scheduling/run', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const result = await schedulingCronHandler(db());
+            return json({ data: result });
+        }
+        catch (err) {
+            return errorResponse('Scheduling run failed', 500);
+        }
+    });
+    router.get('/scheduling/calendar', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const url = new URL(request.url);
+            const fromStr = url.searchParams.get('from');
+            const toStr = url.searchParams.get('to');
+            const from = fromStr ? new Date(fromStr) : new Date(Date.now() - 30 * 24 * 60 * 60 * 1000);
+            const to = toStr ? new Date(toStr) : new Date(Date.now() + 90 * 24 * 60 * 60 * 1000);
+            const { getScheduleCalendar } = await import('../scheduling/index');
+            const entries = await getScheduleCalendar(from, to, db());
+            return json({ data: entries });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    // ---------------------------------------------------------------------------
+    // Globals routes
+    // ---------------------------------------------------------------------------
+    router.get('/globals/:slug', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const ctx = buildActionContext(auth.session, db());
+            const global = await getGlobal(params.slug, ctx);
+            if (!global) {
+                return errorResponse('Global not found', 404);
+            }
+            return json({ data: global });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.put('/globals/:slug', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = await request.json();
+            const ctx = buildActionContext(auth.session, db());
+            const global = await updateGlobal(params.slug, body, ctx);
+            return json({ data: global });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    // ---------------------------------------------------------------------------
+    // Webhook management routes
+    // ---------------------------------------------------------------------------
+    router.get('/webhooks', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const { listEndpoints } = await import('../webhooks/index');
+            const endpoints = await listEndpoints();
+            return json({ data: endpoints });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.post('/webhooks', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = await request.json();
+            if (!body.url || !body.events?.length) {
+                return errorResponse('url and events are required', 400);
+            }
+            const { createEndpoint } = await import('../webhooks/index');
+            const secret = body.secret || crypto.randomUUID();
+            const endpoint = await createEndpoint({
+                url: body.url,
+                events: body.events,
+                secret,
+                name: body.name,
+                active: body.active ?? true,
+            });
+            await logEvent({
+                event: 'settings_changed',
+                userId: auth.session.userId,
+                details: { action: 'webhook_created', endpointId: endpoint.id, url: body.url },
+            });
+            return json({ data: endpoint }, 201);
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.put('/webhooks/:id', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = await request.json();
+            const { updateEndpoint } = await import('../webhooks/index');
+            const updated = await updateEndpoint(params.id, body);
+            return json({ data: updated });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.delete('/webhooks/:id', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const { deleteEndpoint } = await import('../webhooks/index');
+            await deleteEndpoint(params.id);
+            await logEvent({
+                event: 'settings_changed',
+                userId: auth.session.userId,
+                details: { action: 'webhook_deleted', endpointId: params.id },
+            });
+            return json({ data: { success: true } });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.get('/webhooks/:id/deliveries', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const { getDeliveries } = await import('../webhooks/index');
+            const deliveries = await getDeliveries(params.id);
+            return json({ data: deliveries });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.post('/webhooks/retry', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const { processRetries } = await import('../webhooks/index');
+            const result = await processRetries();
+            return json({ data: result });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    // ---------------------------------------------------------------------------
+    // Presence SSE
+    // ---------------------------------------------------------------------------
+    router.get('/presence/:documentId', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            return presenceAdapter.handleSSE(request, params.documentId, {
+                userId: auth.session.userId,
+                name: auth.session.role,
+            });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.post('/presence/:documentId/heartbeat', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            await presenceAdapter.provider.heartbeat(params.documentId, auth.session.userId);
+            return json({ data: { ok: true } });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+}
+//# sourceMappingURL=handlers.js.map