@actuate-media/cms-core 0.11.0 → 0.11.2

package/dist/api/handlers.js

@@ -16,7 +16,7 @@ import { verifyCaptcha, getCaptchaConfig } from '../security/captcha.js';
 import { checkForUpdates } from '../upgrade/version-check.js';
 import { createUpgradePR } from '../upgrade/upgrade-pr.js';
 import { encryptField, decryptField } from '../security/encrypted-fields.js';
-import { encryptSecret, decryptSecret, encryptStringArray } from '../security/secret-storage.js';
+import { encryptSecret, decryptSecret, encryptStringArray, } from '../security/secret-storage.js';
 import { createRateLimiter } from '../security/rate-limit.js';
 import { generateOpenAPISpec } from './openapi.js';
 import { createSSEPresenceAdapter } from '../presence/index.js';
@@ -71,7 +71,9 @@ function mediaUrl(storageKey) {
     const value = String(storageKey ?? '');
     if (!value)
         return '';
-    return value.startsWith('http://') || value.startsWith('https://') || value.startsWith('/') ? value : '';
+    return value.startsWith('http://') || value.startsWith('https://') || value.startsWith('/')
+        ? value
+        : '';
 }
 function normalizeMediaItem(media) {
     const width = typeof media.width === 'number' ? media.width : null;
@@ -167,9 +169,9 @@ function hasModel(d, name) {
     }
 }
 function modelNotAvailable(name) {
-    return errorResponse(`The "${name}" model is not available in your Prisma schema. `
-        + 'Run `actuate db:init` for new schemas, or carefully update the existing Actuate block, create/apply a Prisma migration, then regenerate Prisma Client. '
-        + 'See https://actuatecms.dev/docs/database-setup for required models.', 501);
+    return errorResponse(`The "${name}" model is not available in your Prisma schema. ` +
+        'Run `actuate db:init` for new schemas, or carefully update the existing Actuate block, create/apply a Prisma migration, then regenerate Prisma Client. ' +
+        'See https://actuatecms.dev/docs/database-setup for required models.', 501);
 }
 async function safeCount(model, where) {
     try {
@@ -232,28 +234,34 @@ function isAllowedStorageUrl(url) {
     }
 }
 const ALLOWED_SORT_FIELDS = new Set([
-    'createdAt', 'updatedAt', 'publishedAt', 'status', 'collection',
+    'createdAt',
+    'updatedAt',
+    'publishedAt',
+    'status',
+    'collection',
 ]);
 let _secretMissing = false;
 let _secretWarningLogged = false;
 function getSessionSecret() {
-    const secret = process.env.CMS_SECRET
-        ?? process.env.CMS_SESSION_SECRET
-        ?? globalThis.__actuateConfig?.secret;
+    const secret = process.env.CMS_SECRET ??
+        process.env.CMS_SESSION_SECRET ??
+        globalThis.__actuateConfig?.secret;
     if (!secret) {
         _secretMissing = true;
         if (!_secretWarningLogged) {
             _secretWarningLogged = true;
-            console.error('[Actuate CMS] Missing CMS secret. Set the CMS_SECRET environment variable (min 32 characters) '
-                + 'or pass `secret` in your actuate.config.ts. '
-                + 'Generate one with: node -e "console.log(require(\'crypto\').randomBytes(32).toString(\'hex\'))" '
-                + '-- All authenticated API routes will return 503 until this is configured.');
+            console.error('[Actuate CMS] Missing CMS secret. Set the CMS_SECRET environment variable (min 32 characters) ' +
+                'or pass `secret` in your actuate.config.ts. ' +
+                "Generate one with: node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\" " +
+                '-- All authenticated API routes will return 503 until this is configured.');
         }
         throw new Error('CMS secret not configured');
     }
     if (secret.length < 32) {
-        throw new Error('[Actuate CMS] CMS secret must be at least 32 characters (got ' + secret.length + '). '
-            + 'Generate a secure value with: node -e "console.log(require(\'crypto\').randomBytes(32).toString(\'hex\'))"');
+        throw new Error('[Actuate CMS] CMS secret must be at least 32 characters (got ' +
+            secret.length +
+            '). ' +
+            "Generate a secure value with: node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\"");
     }
     _secretMissing = false;
     return secret;
@@ -378,6 +386,14 @@ const formLimiterGlobal = createRateLimiter({ maxRequests: 10, windowMs: 60_000
 const aiGenerateLimiter = createRateLimiter({ maxRequests: 20, windowMs: 60 * 60 * 1000 });
 const linkHealthLimiter = createRateLimiter({ maxRequests: 4, windowMs: 60 * 60 * 1000 });
 async function checkRateLimitAsync(limiter, key) {
+    // Explicit, environment-gated bypass for test harnesses. Production never
+    // sets this — Vercel + the deploy guide both omit it. We deliberately do
+    // NOT key off `NODE_ENV === 'test'` because Next.js builds run with
+    // NODE_ENV=test in some CI configurations and we want rate limiting
+    // exercised by unit tests that explicitly opt in.
+    if (process.env.ACTUATE_DISABLE_RATE_LIMIT === '1') {
+        return true;
+    }
     const result = await limiter.check(key);
     return result.allowed;
 }
@@ -417,9 +433,7 @@ async function enforceSessionLimitsForUser(d, userId) {
     }
 }
 function getAdminPath() {
-    return process.env.ACTUATE_ADMIN_PATH
-        ?? globalThis.__actuateConfig?.admin?.path
-        ?? '/admin';
+    return (process.env.ACTUATE_ADMIN_PATH ?? globalThis.__actuateConfig?.admin?.path ?? '/admin');
 }
 class ModelNotAvailableError extends Error {
     model;
@@ -442,7 +456,9 @@ export function registerCMSRoutes(router) {
                     if (typeof prop !== 'string' || prop.startsWith('$') || prop === 'then')
                         return undefined;
                     return new Proxy({}, {
-                        get() { throw new ModelNotAvailableError(String(prop)); },
+                        get() {
+                            throw new ModelNotAvailableError(String(prop));
+                        },
                     });
                 },
             });
@@ -463,7 +479,9 @@ export function registerCMSRoutes(router) {
                 if (val !== undefined && val !== null)
                     return val;
                 return new Proxy({}, {
-                    get() { throw new ModelNotAvailableError(String(prop)); },
+                    get() {
+                        throw new ModelNotAvailableError(String(prop));
+                    },
                 });
             },
         });
@@ -475,12 +493,7 @@ export function registerCMSRoutes(router) {
     router.get('/auth/csrf', async () => {
         const token = await generateCsrfToken();
         const isProduction = process.env.NODE_ENV === 'production';
-        const cookieFlags = [
-            `actuate_csrf=${token}`,
-            'Path=/',
-            'SameSite=Lax',
-            'Max-Age=86400',
-        ];
+        const cookieFlags = [`actuate_csrf=${token}`, 'Path=/', 'SameSite=Lax', 'Max-Age=86400'];
         if (isProduction)
             cookieFlags.push('Secure');
         const response = json({ data: { token } });
@@ -523,7 +536,7 @@ export function registerCMSRoutes(router) {
     // ---------------------------------------------------------------------------
     router.post('/auth/login', async (request) => {
         try {
-            const body = await request.json();
+            const body = (await request.json());
             const { email, password } = body;
             if (!email || !password) {
                 return errorResponse('Email and password are required', 400);
@@ -607,12 +620,7 @@ export function registerCMSRoutes(router) {
             if (isProduction)
                 sessionCookie.push('Secure');
             const csrfToken = await generateCsrfToken();
-            const csrfCookie = [
-                `actuate_csrf=${csrfToken}`,
-                'Path=/',
-                'SameSite=Lax',
-                'Max-Age=86400',
-            ];
+            const csrfCookie = [`actuate_csrf=${csrfToken}`, 'Path=/', 'SameSite=Lax', 'Max-Age=86400'];
             if (isProduction)
                 csrfCookie.push('Secure');
             response.headers.append('Set-Cookie', sessionCookie.join('; '));
@@ -651,7 +659,7 @@ export function registerCMSRoutes(router) {
     });
     router.post('/auth/forgot-password', async (request) => {
         try {
-            const body = await request.json();
+            const body = (await request.json());
             const { email } = body;
             if (!email) {
                 return errorResponse('Email is required', 400);
@@ -684,7 +692,7 @@ export function registerCMSRoutes(router) {
     });
     router.post('/auth/reset-password', async (request) => {
         try {
-            const body = await request.json();
+            const body = (await request.json());
             const { token, password } = body;
             if (!token || !password) {
                 return errorResponse('Token and new password are required', 400);
@@ -764,7 +772,10 @@ export function registerCMSRoutes(router) {
             if (reauthErr)
                 return reauthErr;
             const { generateTOTPSecret, generateTOTPUri, generateBackupCodes } = await import('../auth/totp.js');
-            const user = await db().user.findUnique({ where: { id: auth.session.userId }, select: { email: true, totpEnabled: true } });
+            const user = await db().user.findUnique({
+                where: { id: auth.session.userId },
+                select: { email: true, totpEnabled: true },
+            });
             if (!user)
                 return errorResponse('User not found', 404);
             if (user.totpEnabled)
@@ -791,11 +802,14 @@ export function registerCMSRoutes(router) {
             const auth = await requireAuth(request);
             if (auth.error)
                 return auth.error;
-            const body = await request.json();
+            const body = (await request.json());
             if (!body.code)
                 return errorResponse('Code is required', 400);
             const { verifyTOTP } = await import('../auth/totp.js');
-            const user = await db().user.findUnique({ where: { id: auth.session.userId }, select: { totpSecret: true } });
+            const user = await db().user.findUnique({
+                where: { id: auth.session.userId },
+                select: { totpSecret: true },
+            });
             if (!user?.totpSecret)
                 return errorResponse('TOTP not set up', 400);
             const secret = await decryptSecret(user.totpSecret);
@@ -845,7 +859,7 @@ export function registerCMSRoutes(router) {
     });
     router.post('/auth/totp/login', async (request) => {
         try {
-            const body = await request.json();
+            const body = (await request.json());
             if (!body.mfaPendingToken || !body.code) {
                 return errorResponse('mfaPendingToken and code are required', 400);
             }
@@ -883,7 +897,15 @@ export function registerCMSRoutes(router) {
             const { verifyTOTP } = await import('../auth/totp.js');
             const user = await db().user.findUnique({
                 where: { id: pending.userId },
-                select: { id: true, email: true, name: true, role: true, totpSecret: true, totpEnabled: true, isActive: true },
+                select: {
+                    id: true,
+                    email: true,
+                    name: true,
+                    role: true,
+                    totpSecret: true,
+                    totpEnabled: true,
+                    isActive: true,
+                },
             });
             if (!user || !user.isActive || !user.totpEnabled || !user.totpSecret) {
                 return errorResponse('Invalid request', 400);
@@ -1133,7 +1155,7 @@ export function registerCMSRoutes(router) {
             const roleErr = requireRole(auth.session.role, WRITE_ROLES);
             if (roleErr)
                 return roleErr;
-            const body = await request.json();
+            const body = (await request.json());
             const ctx = buildActionContext(auth.session, db());
             const doc = await createDocument(params.slug, body, ctx);
             await logEvent({
@@ -1155,7 +1177,7 @@ export function registerCMSRoutes(router) {
             const roleErr = requireRole(auth.session.role, WRITE_ROLES);
             if (roleErr)
                 return roleErr;
-            const body = await request.json();
+            const body = (await request.json());
             const ctx = buildActionContext(auth.session, db());
             const doc = await updateDocument(params.slug, params.id, body, ctx);
             await logEvent({
@@ -1241,7 +1263,7 @@ export function registerCMSRoutes(router) {
             const auth = await requireAuth(request);
             if (auth.error)
                 return auth.error;
-            const body = await request.json();
+            const body = (await request.json());
             if (!body.filename || !body.contentType) {
                 return errorResponse('filename and contentType are required', 400);
             }
@@ -1328,8 +1350,96 @@ export function registerCMSRoutes(router) {
                 // Strip <script>, on*, javascript: URLs, foreignObject, etc.
                 const xml = new TextDecoder('utf-8', { fatal: false }).decode(arrayBuffer);
                 const sanitized = sanitizeHtml(xml, {
-                    allowedTags: ['svg', 'g', 'path', 'circle', 'ellipse', 'line', 'polygon', 'polyline', 'rect', 'text', 'tspan', 'defs', 'use', 'symbol', 'title', 'desc', 'style', 'linearGradient', 'radialGradient', 'stop', 'mask', 'clipPath', 'pattern', 'filter', 'feGaussianBlur', 'feColorMatrix', 'feOffset', 'feBlend', 'feFlood', 'feComposite', 'feMerge', 'feMergeNode'],
-                    allowedAttributes: { '*': ['id', 'class', 'fill', 'stroke', 'stroke-width', 'stroke-linecap', 'stroke-linejoin', 'opacity', 'transform', 'd', 'cx', 'cy', 'r', 'rx', 'ry', 'x', 'y', 'x1', 'y1', 'x2', 'y2', 'width', 'height', 'viewBox', 'xmlns', 'xmlns:xlink', 'preserveAspectRatio', 'points', 'points', 'offset', 'stop-color', 'stop-opacity', 'gradientUnits', 'gradientTransform', 'href', 'xlink:href', 'fill-rule', 'clip-rule', 'mask', 'clip-path', 'filter', 'patternUnits', 'patternContentUnits', 'in', 'in2', 'result', 'mode', 'values', 'type', 'stdDeviation', 'dx', 'dy'] },
+                    allowedTags: [
+                        'svg',
+                        'g',
+                        'path',
+                        'circle',
+                        'ellipse',
+                        'line',
+                        'polygon',
+                        'polyline',
+                        'rect',
+                        'text',
+                        'tspan',
+                        'defs',
+                        'use',
+                        'symbol',
+                        'title',
+                        'desc',
+                        'style',
+                        'linearGradient',
+                        'radialGradient',
+                        'stop',
+                        'mask',
+                        'clipPath',
+                        'pattern',
+                        'filter',
+                        'feGaussianBlur',
+                        'feColorMatrix',
+                        'feOffset',
+                        'feBlend',
+                        'feFlood',
+                        'feComposite',
+                        'feMerge',
+                        'feMergeNode',
+                    ],
+                    allowedAttributes: {
+                        '*': [
+                            'id',
+                            'class',
+                            'fill',
+                            'stroke',
+                            'stroke-width',
+                            'stroke-linecap',
+                            'stroke-linejoin',
+                            'opacity',
+                            'transform',
+                            'd',
+                            'cx',
+                            'cy',
+                            'r',
+                            'rx',
+                            'ry',
+                            'x',
+                            'y',
+                            'x1',
+                            'y1',
+                            'x2',
+                            'y2',
+                            'width',
+                            'height',
+                            'viewBox',
+                            'xmlns',
+                            'xmlns:xlink',
+                            'preserveAspectRatio',
+                            'points',
+                            'points',
+                            'offset',
+                            'stop-color',
+                            'stop-opacity',
+                            'gradientUnits',
+                            'gradientTransform',
+                            'href',
+                            'xlink:href',
+                            'fill-rule',
+                            'clip-rule',
+                            'mask',
+                            'clip-path',
+                            'filter',
+                            'patternUnits',
+                            'patternContentUnits',
+                            'in',
+                            'in2',
+                            'result',
+                            'mode',
+                            'values',
+                            'type',
+                            'stdDeviation',
+                            'dx',
+                            'dy',
+                        ],
+                    },
                 });
                 uploadBuffer = Buffer.from(sanitized, 'utf-8');
                 finalSize = uploadBuffer.byteLength;
@@ -1467,7 +1577,9 @@ export function registerCMSRoutes(router) {
                 try {
                     await blob.del(media.storageKey);
                 }
-                catch { /* best-effort */ }
+                catch {
+                    /* best-effort */
+                }
             }
             catch {
                 newPublicUrl = `/api/cms/media/file/${newStorageKey}`;
@@ -1511,7 +1623,7 @@ export function registerCMSRoutes(router) {
             const roleErr = requireRole(auth.session.role, WRITE_ROLES);
             if (roleErr)
                 return roleErr;
-            const body = await request.json();
+            const body = (await request.json());
             const updated = await db().media.update({
                 where: { id: params.id },
                 data: {
@@ -1636,7 +1748,7 @@ export function registerCMSRoutes(router) {
             if (!encKey) {
                 return errorResponse('CMS_ENCRYPTION_KEY is required to store encrypted credentials.', 400);
             }
-            const body = await request.json();
+            const body = (await request.json());
             if (body.githubRepo && !/^[a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+$/.test(body.githubRepo)) {
                 return errorResponse('Invalid repository format. Use owner/repo.', 400);
             }
@@ -1678,7 +1790,7 @@ export function registerCMSRoutes(router) {
             if (!session || session.role !== 'admin') {
                 return errorResponse('Unauthorized — admin only', 403);
             }
-            const body = await request.json();
+            const body = (await request.json());
             if (!body.targetVersion) {
                 return errorResponse('targetVersion is required', 400);
             }
@@ -1743,7 +1855,7 @@ export function registerCMSRoutes(router) {
             if (!(await checkRateLimitAsync(loginLimiter, `setup:${clientIp}`))) {
                 return errorResponse('Too many setup attempts', 429);
             }
-            const body = await request.json();
+            const body = (await request.json());
             if (!body.name || !body.email || !body.password) {
                 return errorResponse('Name, email, and password are required', 400);
             }
@@ -1768,9 +1880,17 @@ export function registerCMSRoutes(router) {
     // Health endpoint -- reports available models and CMS version
     // ---------------------------------------------------------------------------
     const CMS_EXPECTED_MODELS = [
-        'document', 'media', 'user', 'session', 'version',
-        'folder', 'redirect', 'formSubmission', 'auditLog',
-        'webhookEndpoint', 'webhookDeliveryLog',
+        'document',
+        'media',
+        'user',
+        'session',
+        'version',
+        'folder',
+        'redirect',
+        'formSubmission',
+        'auditLog',
+        'webhookEndpoint',
+        'webhookDeliveryLog',
     ];
     router.get('/health', async () => {
         const cmsVersion = globalThis.__actuateCoreVersion ?? '0.0.0';
@@ -1889,8 +2009,12 @@ export function registerCMSRoutes(router) {
                     orderBy: { updatedAt: 'desc' },
                     take: 20,
                     select: {
-                        id: true, title: true, status: true, collection: true,
-                        updatedAt: true, createdById: true,
+                        id: true,
+                        title: true,
+                        status: true,
+                        collection: true,
+                        updatedAt: true,
+                        createdById: true,
                         createdBy: { select: { name: true, email: true } },
                     },
                 }),
@@ -1965,13 +2089,31 @@ export function registerCMSRoutes(router) {
             const canSeeUserDirectory = auth.session.role === 'ADMIN' || auth.session.role === 'EDITOR';
             const [documents, media, users] = await Promise.all([
                 safeFindMany(d.document, {
-                    where: { deletedAt: null, OR: [{ title: { contains: q, mode: 'insensitive' } }, { plainText: { contains: q, mode: 'insensitive' } }] },
+                    where: {
+                        deletedAt: null,
+                        OR: [
+                            { title: { contains: q, mode: 'insensitive' } },
+                            { plainText: { contains: q, mode: 'insensitive' } },
+                        ],
+                    },
                     take: 10,
                     orderBy: { updatedAt: 'desc' },
-                    select: { id: true, title: true, slug: true, collection: true, status: true, updatedAt: true },
+                    select: {
+                        id: true,
+                        title: true,
+                        slug: true,
+                        collection: true,
+                        status: true,
+                        updatedAt: true,
+                    },
                 }),
                 safeFindMany(d.media, {
-                    where: { OR: [{ filename: { contains: q, mode: 'insensitive' } }, { altText: { contains: q, mode: 'insensitive' } }] },
+                    where: {
+                        OR: [
+                            { filename: { contains: q, mode: 'insensitive' } },
+                            { altText: { contains: q, mode: 'insensitive' } },
+                        ],
+                    },
                     take: 5,
                     orderBy: { createdAt: 'desc' },
                     select: { id: true, filename: true, altText: true, mimeType: true, storageKey: true },
@@ -2143,7 +2285,7 @@ export function registerCMSRoutes(router) {
                 return errorResponse('Form not found', 404);
             }
             const formData = (form.data ?? {});
-            const body = await request.json();
+            const body = (await request.json());
             if (!body.fields || typeof body.fields !== 'object') {
                 return errorResponse('Missing or invalid "fields" in request body', 400);
             }
@@ -2163,14 +2305,10 @@ export function registerCMSRoutes(router) {
                     submittedAt: new Date(),
                 },
             });
-            // Fire form hooks asynchronously (email notification, webhooks)
             (async () => {
                 try {
                     const config = globalThis.__actuateConfig;
-                    const hooks = [
-                        ...(config?.plugins?.forms?.hooks ?? []),
-                        ...(config?._pluginHooks ?? []),
-                    ];
+                    const hooks = [...(config?.plugins?.forms?.hooks ?? []), ...(config?._pluginHooks ?? [])];
                     const formHooks = hooks.filter((h) => h.event === 'afterCreate:form-submissions');
                     for (const hook of formHooks) {
                         await hook.handler({ formId, data: body.fields });
@@ -2220,7 +2358,7 @@ export function registerCMSRoutes(router) {
                 return auth.error;
             if (auth.session.role !== 'ADMIN')
                 return errorResponse('Admin access required', 403);
-            const body = await request.json();
+            const body = (await request.json());
             const source = String(body.source ?? body.from ?? '').trim();
             const destination = String(body.destination ?? body.to ?? '').trim();
             const requestedStatus = Number(body.statusCode ?? body.type);
@@ -2255,7 +2393,9 @@ export function registerCMSRoutes(router) {
                     try {
                         allowed.add(new URL(siteUrl).hostname.toLowerCase());
                     }
-                    catch { /* noop */ }
+                    catch {
+                        /* noop */
+                    }
                 }
                 if (!allowed.has(destUrl.hostname.toLowerCase())) {
                     return errorResponse('External redirect destinations must be to an allowlisted host. Add the host to `redirects.allowedExternalHosts` in your CMS config.', 400);
@@ -2389,7 +2529,9 @@ export function registerCMSRoutes(router) {
                         try {
                             await resp.body?.cancel();
                         }
-                        catch { /* noop */ }
+                        catch {
+                            /* noop */
+                        }
                     }
                     catch (err) {
                         status = err instanceof SsrfBlockedError ? -1 : 0;
@@ -2428,7 +2570,14 @@ export function registerCMSRoutes(router) {
                 return roleErr;
             const documents = await db().document.findMany({
                 where: { status: 'PUBLISHED', deletedAt: null },
-                select: { id: true, title: true, slug: true, collection: true, data: true, plainText: true },
+                select: {
+                    id: true,
+                    title: true,
+                    slug: true,
+                    collection: true,
+                    data: true,
+                    plainText: true,
+                },
             });
             const issues = [];
             for (const doc of documents) {
@@ -2445,7 +2594,11 @@ export function registerCMSRoutes(router) {
                 const plainText = (doc.plainText ?? '');
                 if (plainText.length > 0 && plainText.length < 300)
                     problems.push('Content is too short (< 300 characters)');
-                const content = typeof data.body === 'string' ? data.body : typeof data.content === 'string' ? data.content : '';
+                const content = typeof data.body === 'string'
+                    ? data.body
+                    : typeof data.content === 'string'
+                        ? data.content
+                        : '';
                 if (content) {
                     const imgMatches = content.match(/<img\b[^>]*>/gi) ?? [];
                     const missingAlt = imgMatches.filter((img) => !img.includes('alt=')).length;
@@ -2455,7 +2608,12 @@ export function registerCMSRoutes(router) {
                         problems.push('No H1 heading found in content');
                 }
                 if (problems.length > 0) {
-                    issues.push({ documentId: doc.id, title: doc.title ?? 'Untitled', slug: doc.slug ?? '', problems });
+                    issues.push({
+                        documentId: doc.id,
+                        title: doc.title ?? 'Untitled',
+                        slug: doc.slug ?? '',
+                        problems,
+                    });
                 }
             }
             const total = documents.length;
@@ -2539,7 +2697,10 @@ export function registerCMSRoutes(router) {
                 return errorResponse('Not found', 404);
             const data = doc.data || {};
             const title = doc.title || data.title || '';
-            const keywords = title.split(/\s+/).filter((w) => w.length > 3).slice(0, 5);
+            const keywords = title
+                .split(/\s+/)
+                .filter((w) => w.length > 3)
+                .slice(0, 5);
             if (keywords.length === 0) {
                 return new Response(JSON.stringify({ suggestions: [] }), {
                     status: 200,
@@ -2702,12 +2863,12 @@ export function registerCMSRoutes(router) {
             const auth = await requireAuth(request);
             if (auth.error)
                 return auth.error;
-            const docs = await safeFindMany(db().document, {
+            const docs = (await safeFindMany(db().document, {
                 where: { deletedAt: null, status: 'PUBLISHED' },
                 select: { id: true, title: true, collection: true, data: true, plainText: true },
                 orderBy: { updatedAt: 'desc' },
                 take: 50,
-            });
+            }));
             let missingMetaDescriptions = 0;
             let missingAltText = 0;
             const topContent = [];
@@ -2715,7 +2876,11 @@ export function registerCMSRoutes(router) {
                 const data = doc.data ?? {};
                 if (!data.metaDescription && !data.seoDescription)
                     missingMetaDescriptions++;
-                const content = typeof data.body === 'string' ? data.body : typeof data.content === 'string' ? data.content : '';
+                const content = typeof data.body === 'string'
+                    ? data.body
+                    : typeof data.content === 'string'
+                        ? data.content
+                        : '';
                 if (content) {
                     const imgMatches = content.match(/<img\b[^>]*>/gi) ?? [];
                     const noAlt = imgMatches.filter((img) => !img.includes('alt=')).length;
@@ -2745,7 +2910,11 @@ export function registerCMSRoutes(router) {
                             continue;
                         seen.add(clean);
                         try {
-                            const resp = await fetch(clean, { method: 'HEAD', redirect: 'manual', signal: AbortSignal.timeout(3000) });
+                            const resp = await fetch(clean, {
+                                method: 'HEAD',
+                                redirect: 'manual',
+                                signal: AbortSignal.timeout(3000),
+                            });
                             if (resp.status >= 400)
                                 brokenInternalLinks++;
                         }
@@ -2755,7 +2924,9 @@ export function registerCMSRoutes(router) {
                     }
                 }
             }
-            catch { /* best effort */ }
+            catch {
+                /* best effort */
+            }
             return json({
                 data: {
                     totalPages: docs.length,
@@ -2796,7 +2967,10 @@ export function registerCMSRoutes(router) {
             }
         }
         if (unresolved.size > 0 && layoutConfig.inherit !== false) {
-            const segments = path.replace(/^\/|\/$/g, '').split('/').filter(Boolean);
+            const segments = path
+                .replace(/^\/|\/$/g, '')
+                .split('/')
+                .filter(Boolean);
             const walkDepth = Math.min(segments.length - 1, MAX_RESOLVE_DEPTH);
             for (let i = walkDepth; i > 0 && unresolved.size > 0; i--) {
                 const parentSlug = segments.slice(0, i).join('/');
@@ -2805,10 +2979,7 @@ export function registerCMSRoutes(router) {
                         collection: matchedCollection,
                         deletedAt: null,
                         status: 'PUBLISHED',
-                        OR: [
-                            { data: { path: ['slug'], equals: parentSlug } },
-                            { slug: parentSlug },
-                        ],
+                        OR: [{ data: { path: ['slug'], equals: parentSlug } }, { slug: parentSlug }],
                     },
                     select: { data: true },
                 });
@@ -2865,14 +3036,17 @@ export function registerCMSRoutes(router) {
             if (!pathParam) {
                 return errorResponse('Missing required "path" query parameter', 400);
             }
-            const segments = pathParam.replace(/^\/|\/$/g, '').split('/').filter(Boolean);
+            const segments = pathParam
+                .replace(/^\/|\/$/g, '')
+                .split('/')
+                .filter(Boolean);
             const configCollections = globalThis.__actuateConfig?.collections ?? {};
             const collectionDefs = Object.values(configCollections);
             let matchedCollection = null;
             let docSlug = null;
             if (segments.length === 0) {
                 // Root path — find a page-type collection and look for "home" or "index"
-                const pageCol = collectionDefs.find((c) => c.type === 'page' && !((c.urlPrefix ?? '').replace(/^\/|\/$/g, '')));
+                const pageCol = collectionDefs.find((c) => c.type === 'page' && !(c.urlPrefix ?? '').replace(/^\/|\/$/g, ''));
                 matchedCollection = pageCol?.slug ?? 'pages';
                 docSlug = 'home';
             }
@@ -2918,16 +3092,13 @@ export function registerCMSRoutes(router) {
                             { slug: 'home' },
                             { slug: 'index' },
                         ]
-                        : [
-                            { data: { path: ['slug'], equals: docSlug } },
-                            { slug: docSlug },
-                        ],
+                        : [{ data: { path: ['slug'], equals: docSlug } }, { slug: docSlug }],
                 },
             });
             if (!doc) {
                 return errorResponse('Document not found', 404);
             }
-            const docData = (doc.data && typeof doc.data === 'object') ? doc.data : {};
+            const docData = doc.data && typeof doc.data === 'object' ? doc.data : {};
             const layout = await resolveLayout(pathParam, docData, matchedCollection);
             const { _layout: _omit, ...cleanData } = docData;
             return json({
@@ -2979,7 +3150,7 @@ export function registerCMSRoutes(router) {
             const roleErr = requireRole(auth.session.role, WRITE_ROLES);
             if (roleErr)
                 return roleErr;
-            const body = await request.json();
+            const body = (await request.json());
             if (!body.name || !body.scope)
                 return errorResponse('name and scope are required', 400);
             // A child folder MUST live in the same scope as its parent — without
@@ -3014,7 +3185,7 @@ export function registerCMSRoutes(router) {
             const roleErr = requireRole(auth.session.role, WRITE_ROLES);
             if (roleErr)
                 return roleErr;
-            const body = await request.json();
+            const body = (await request.json());
             const existing = await db().folder.findUnique({ where: { id: params.id } });
             if (!existing)
                 return errorResponse('Folder not found', 404);
@@ -3064,7 +3235,9 @@ export function registerCMSRoutes(router) {
             if (!folder)
                 return errorResponse('Folder not found', 404);
             const [docCount, mediaCount, childCount] = await Promise.all([
-                hasModel(d, 'document') ? d.document.count({ where: { folderId: params.id, deletedAt: null } }) : 0,
+                hasModel(d, 'document')
+                    ? d.document.count({ where: { folderId: params.id, deletedAt: null } })
+                    : 0,
                 hasModel(d, 'media') ? d.media.count({ where: { folderId: params.id } }) : 0,
                 d.folder.count({ where: { parentId: params.id } }),
             ]);
@@ -3086,7 +3259,7 @@ export function registerCMSRoutes(router) {
             const roleErr = requireRole(auth.session.role, WRITE_ROLES);
             if (roleErr)
                 return roleErr;
-            const body = await request.json();
+            const body = (await request.json());
             // Confirm the target folder is in the documents scope before moving in.
             if (body.folderId) {
                 const target = await db().folder.findUnique({ where: { id: body.folderId } });
@@ -3114,7 +3287,7 @@ export function registerCMSRoutes(router) {
             const roleErr = requireRole(auth.session.role, WRITE_ROLES);
             if (roleErr)
                 return roleErr;
-            const body = await request.json();
+            const body = (await request.json());
             if (body.folderId) {
                 const target = await db().folder.findUnique({ where: { id: body.folderId } });
                 if (!target)
@@ -3141,7 +3314,7 @@ export function registerCMSRoutes(router) {
             const auth = await requireAuth(request);
             if (auth.error)
                 return auth.error;
-            const body = await request.json();
+            const body = (await request.json());
             if (!body.collection || !body.documentId) {
                 return errorResponse('collection and documentId are required', 400);
             }
@@ -3183,7 +3356,7 @@ export function registerCMSRoutes(router) {
             const auth = await requireAuth(request);
             if (auth.error)
                 return auth.error;
-            const body = await request.json();
+            const body = (await request.json());
             if (!body.stage)
                 return errorResponse('Stage is required', 400);
             const { transitionDocument } = await import('../workflow/index.js');
@@ -3210,7 +3383,9 @@ export function registerCMSRoutes(router) {
                 return errorResponse('Document not found', 404);
             const stage = (doc.workflowStage ?? 'DRAFT');
             const transitions = getAvailableTransitions(stage, auth.session.role);
-            return json({ data: { stage, transitions, reviewerId: doc.reviewerId, reviewNote: doc.reviewNote } });
+            return json({
+                data: { stage, transitions, reviewerId: doc.reviewerId, reviewNote: doc.reviewNote },
+            });
         }
         catch (err) {
             return internalError(err);
@@ -3336,16 +3511,12 @@ export function registerCMSRoutes(router) {
             // allowed. Integrators that want to gate a global must set
             // `access.read` explicitly (returning `false` for public).
             const readAccess = globalConfig.access?.read;
-            const allowed = readAccess
-                ? await readAccess({ user: null, doc })
-                : true;
+            const allowed = readAccess ? await readAccess({ user: null, doc }) : true;
             if (!allowed) {
                 return errorResponse('Forbidden', 403);
             }
             return json({
-                data: doc.data && typeof doc.data === 'object'
-                    ? doc.data
-                    : {},
+                data: doc.data && typeof doc.data === 'object' ? doc.data : {},
             });
         }
         catch (err) {
@@ -3376,7 +3547,7 @@ export function registerCMSRoutes(router) {
             const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
             if (roleErr)
                 return roleErr;
-            const body = await request.json();
+            const body = (await request.json());
             const ctx = buildActionContext(auth.session, db());
             const global = await updateGlobal(params.slug, body, ctx);
             return json({ data: global });
@@ -3412,7 +3583,7 @@ export function registerCMSRoutes(router) {
             const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
             if (roleErr)
                 return roleErr;
-            const body = await request.json();
+            const body = (await request.json());
             if (!body.url || !body.events?.length) {
                 return errorResponse('url and events are required', 400);
             }
@@ -3444,7 +3615,7 @@ export function registerCMSRoutes(router) {
             const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
             if (roleErr)
                 return roleErr;
-            const body = await request.json();
+            const body = (await request.json());
             const { updateEndpoint } = await import('../webhooks/index.js');
             const updated = await updateEndpoint(params.id, body);
             return json({ data: updated });
@@ -3599,7 +3770,7 @@ export function registerCMSRoutes(router) {
             const d = db();
             if (!hasModel(d, 'scriptTag'))
                 return modelNotAvailable('ScriptTag');
-            const body = await request.json();
+            const body = (await request.json());
             if (!body.name || !body.code || !body.placement) {
                 return errorResponse('name, code, and placement are required', 400);
             }
@@ -3648,7 +3819,7 @@ export function registerCMSRoutes(router) {
             const existing = await d.scriptTag.findUnique({ where: { id: params.id } });
             if (!existing)
                 return errorResponse('Script tag not found', 404);
-            const body = await request.json();
+            const body = (await request.json());
             const update = {};
             if (body.name !== undefined)
                 update.name = body.name;
@@ -3830,7 +4001,7 @@ export function registerCMSRoutes(router) {
             const d = db();
             if (!hasModel(d, 'pageTemplate'))
                 return modelNotAvailable('PageTemplate');
-            const body = await request.json();
+            const body = (await request.json());
             if (!body.name)
                 return errorResponse('name is required', 400);
             if (!body.tree)
@@ -3881,7 +4052,7 @@ export function registerCMSRoutes(router) {
                 return errorResponse('Template not found', 404);
             if (existing.builtIn)
                 return errorResponse('Cannot update built-in templates', 403);
-            const body = await request.json();
+            const body = (await request.json());
             const update = {};
             if (body.name !== undefined)
                 update.name = body.name;
@@ -4029,7 +4200,7 @@ export function registerCMSRoutes(router) {
             const d = db();
             if (!hasModel(d, 'savedSection'))
                 return modelNotAvailable('SavedSection');
-            const body = await request.json();
+            const body = (await request.json());
             if (!body.name)
                 return errorResponse('name is required', 400);
             if (!body.tree)
@@ -4078,7 +4249,7 @@ export function registerCMSRoutes(router) {
             const existing = await d.savedSection.findUnique({ where: { id: params.id } });
             if (!existing)
                 return errorResponse('Saved section not found', 404);
-            const body = await request.json();
+            const body = (await request.json());
             const update = {};
             if (body.name !== undefined)
                 update.name = body.name;
@@ -4295,7 +4466,11 @@ export function registerCMSRoutes(router) {
             await logEvent({
                 event: 'settings_changed',
                 userId: auth.session.userId,
-                details: { action: 'a11y_auto_fix', fixedCount: result.report.fixedCount, remainingCount: result.report.remainingCount },
+                details: {
+                    action: 'a11y_auto_fix',
+                    fixedCount: result.report.fixedCount,
+                    remainingCount: result.report.remainingCount,
+                },
             });
             return json({ data: result });
         }