@actuate-media/cms-core 0.15.0 → 0.17.0

package/dist/api/handlers.js

@@ -4710,6 +4710,7 @@ export function registerCMSRoutes(router) {
                 return modelNotAvailable('PageTemplate');
             const url = new URL(request.url, 'http://localhost');
             const category = url.searchParams.get('category');
+            const collection = url.searchParams.get('collection');
             const builtInCount = await safeCount(d.pageTemplate, { builtIn: true });
             if (builtInCount === 0) {
                 await seedBuiltInTemplates(d);
@@ -4721,6 +4722,37 @@ export function registerCMSRoutes(router) {
                 where,
                 orderBy: [{ builtIn: 'desc' }, { updatedAt: 'desc' }],
             });
+            // When a `collection` filter is supplied, reorder the response so the
+            // suggested templates for that collection bubble to the top. The admin
+            // "Create new" picker uses this so blog posts default to `blog-post`,
+            // case studies to `case-study`, etc., without forcing the user to scan
+            // every template alphabetically.
+            if (collection) {
+                const { getTemplatesForCollection } = await import('../collections/presets.js');
+                const { primary, alternates } = getTemplatesForCollection(collection);
+                const suggestionOrder = new Map();
+                if (primary)
+                    suggestionOrder.set(`builtin-${primary}`, 0);
+                alternates.forEach((alt, i) => suggestionOrder.set(`builtin-${alt}`, i + 1));
+                templates.sort((a, b) => {
+                    const ai = suggestionOrder.has(a.id) ? suggestionOrder.get(a.id) : 100;
+                    const bi = suggestionOrder.has(b.id) ? suggestionOrder.get(b.id) : 100;
+                    return ai - bi;
+                });
+                const annotated = templates.map((t) => ({
+                    ...t,
+                    suggested: suggestionOrder.has(t.id),
+                    suggestionRank: suggestionOrder.get(t.id) ?? null,
+                }));
+                return json({
+                    data: annotated,
+                    suggestion: {
+                        collection,
+                        primary: primary ? `builtin-${primary}` : null,
+                        alternates: alternates.map((a) => `builtin-${a}`),
+                    },
+                });
+            }
             return json({ data: templates });
         }
         catch (err) {
@@ -5301,6 +5333,148 @@ export function registerCMSRoutes(router) {
             return internalError(err, 'page-builder create');
         }
     });
+    /**
+     * Generic AI content authoring for ANY collection.
+     *
+     * `POST /collections/:slug/ai-create` is the non-page counterpart to
+     * `/page-builder/create`. It takes a free-form prompt, looks up the
+     * collection's field schema from the running config, asks the AI provider
+     * to produce structured JSON matching that schema, validates / coerces the
+     * output, and persists the result as a draft (or published) document.
+     *
+     * Used by:
+     *   - the admin "Generate from prompt" affordance on the collection list
+     *   - the MCP server's `create_in_collection` / `create_blog_post` / etc.
+     *   - AI agents calling the REST API directly
+     */
+    router.post('/collections/:slug/ai-create', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const targetCollection = params.slug;
+            const scopeErr = requireCollectionScope(auth.session, targetCollection, 'create');
+            if (scopeErr)
+                return scopeErr;
+            if (!(await checkRateLimitAsync(aiGenerateLimiter, `ai-gen:${auth.session.userId}`))) {
+                return errorResponse('AI generation rate limit reached. Try again in an hour.', 429);
+            }
+            const body = (await request.json());
+            if (!body.prompt || typeof body.prompt !== 'string') {
+                return errorResponse('prompt is required', 400);
+            }
+            if (body.prompt.length > AI_PROMPT_MAX_CHARS) {
+                return errorResponse(`prompt exceeds ${AI_PROMPT_MAX_CHARS} character limit`, 400);
+            }
+            if (body.context && body.context.length > AI_CONTEXT_MAX_CHARS) {
+                return errorResponse(`context exceeds ${AI_CONTEXT_MAX_CHARS} character limit`, 400);
+            }
+            const cfg = getActuateConfig();
+            const collection = cfg?.collections?.[targetCollection];
+            if (!collection) {
+                return errorResponse(`Collection "${targetCollection}" not found`, 404);
+            }
+            // Refuse page-builder-driven collections — those have a layout tree
+            // (not flat field data) and should use `/page-builder/create` instead.
+            const hasLayoutField = Object.values(collection.fields).some((f) => f.type === 'blocks');
+            if (hasLayoutField) {
+                return errorResponse(`Collection "${targetCollection}" uses the page builder. Use POST /api/cms/page-builder/create instead.`, 400);
+            }
+            let generateDocumentContent = null;
+            try {
+                const aiModule = await importAIPlugin();
+                generateDocumentContent = aiModule.generateDocumentContent;
+            }
+            catch {
+                return errorResponse('AI plugin is not installed. Install @actuate-media/plugin-ai to use content authoring.', 501);
+            }
+            if (!generateDocumentContent) {
+                return errorResponse('AI plugin missing `generateDocumentContent`. Upgrade @actuate-media/plugin-ai to >= 0.2.0.', 501);
+            }
+            const result = await generateDocumentContent({
+                prompt: body.prompt,
+                collection: {
+                    slug: collection.slug,
+                    labels: collection.labels,
+                    type: collection.type,
+                    fields: collection.fields,
+                    seo: collection.seo,
+                },
+                context: { existingContent: body.context, targetAudience: body.targetAudience },
+                tone: body.tone,
+                ...(typeof body.maxTokens === 'number' ? { maxTokens: body.maxTokens } : {}),
+                ...(typeof body.temperature === 'number' ? { temperature: body.temperature } : {}),
+            });
+            const shouldPublish = body.status === 'PUBLISHED' || body.publish === true;
+            const finalTitle = body.title ?? result.title;
+            const finalSlug = body.slug ?? result.slug;
+            // Spread AI data FIRST so explicit caller overrides (title, slug) win.
+            // We don't use `pageSettings` here — that's a page-builder-specific
+            // wire shape. For non-page collections SEO copy lives on regular
+            // fields (metaTitle / metaDescription) declared via the seoFields
+            // preset, and the AI generator already populates those inside
+            // result.data when they exist on the schema.
+            const docPayload = {
+                ...result.data,
+                title: finalTitle,
+                slug: finalSlug,
+            };
+            const ctx = buildActionContext(auth.session, db());
+            let doc = await createDocument(targetCollection, docPayload, ctx);
+            // Optional publish: createDocument intentionally always returns DRAFT
+            // (only EDITOR+ can publish). If the caller asked for an immediate
+            // publish we do a follow-up updateDocument that runs through the
+            // standard publish access check. Callers without `update` scope on the
+            // collection will get a 403 here even though the create succeeded —
+            // they end up with a draft, which is the safest fallback.
+            if (shouldPublish && doc?.id) {
+                try {
+                    doc = await updateDocument(targetCollection, doc.id, { status: 'PUBLISHED' }, ctx);
+                }
+                catch (publishErr) {
+                    // Surface a 207-style partial success: the draft was created but
+                    // publish was denied. We return 201 with a `warning` field so the
+                    // agent knows the doc landed but needs human publishing.
+                    return json({
+                        data: {
+                            document: doc,
+                            generation: {
+                                usage: result.usage,
+                                durationMs: result.durationMs,
+                                seo: result.seo,
+                            },
+                        },
+                        warning: `Document created as DRAFT — publish failed: ${publishErr instanceof Error ? publishErr.message : 'unknown'}`,
+                    }, 201);
+                }
+            }
+            await logEvent({
+                event: 'settings_changed',
+                userId: auth.session.userId,
+                details: {
+                    action: 'collection_ai_create',
+                    collection: targetCollection,
+                    documentId: doc?.id,
+                    prompt: redactSecrets(body.prompt).slice(0, 500),
+                    tokensUsed: result.usage,
+                    durationMs: result.durationMs,
+                },
+            });
+            return json({
+                data: {
+                    document: doc,
+                    generation: {
+                        usage: result.usage,
+                        durationMs: result.durationMs,
+                        seo: result.seo,
+                    },
+                },
+            }, 201);
+        }
+        catch (err) {
+            return internalError(err, 'collections/:slug/ai-create');
+        }
+    });
     router.post('/page-builder/audit-a11y', async (request) => {
         try {
             const auth = await requireAuth(request);