@actuate-media/cms-core 0.16.0 → 0.17.0

package/dist/__tests__/api/collections-ai-create.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=collections-ai-create.test.d.ts.map

package/dist/__tests__/api/collections-ai-create.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"collections-ai-create.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/api/collections-ai-create.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/api/collections-ai-create.test.js

@@ -0,0 +1,313 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+// IMPORTANT: vi.mock calls are hoisted. We mock `@actuate-media/plugin-ai`
+// so the dynamic import inside handlers.ts resolves to a deterministic
+// generator instead of trying to hit a real LLM provider.
+vi.mock('@actuate-media/plugin-ai', () => ({
+    generateDocumentContent: vi.fn(async (input) => ({
+        data: {
+            title: 'Five Spring Cleaning Tips',
+            slug: 'five-spring-cleaning-tips',
+            excerpt: 'A practical guide.',
+            body: 'When spring arrives, tackle these five tasks first.',
+        },
+        title: 'Five Spring Cleaning Tips',
+        slug: 'five-spring-cleaning-tips',
+        seo: {
+            metaTitle: 'Spring Cleaning Tips',
+            metaDescription: 'Five practical spring cleaning tips for busy households.',
+            schemaType: input?.collection?.seo?.defaultSchemaType ?? 'Article',
+        },
+        usage: { promptTokens: 100, completionTokens: 250 },
+        durationMs: 42,
+    })),
+}));
+import { handleActuateAPI } from '../../api/index.js';
+import { initDB } from '../../db.js';
+import { generateApiKey } from '../../security/api-key-enhanced.js';
+const VALID_SECRET = 'a'.repeat(48);
+function createMockDB(opts) {
+    const apiKey = opts.apiKey;
+    let lastCreatedDoc = null;
+    const dbMock = {
+        apiKey: {
+            findMany: async () => (apiKey ? [apiKey] : []),
+            findUnique: async ({ where }) => {
+                if (!apiKey)
+                    return null;
+                if (apiKey.keyHash !== where.keyHash)
+                    return null;
+                return apiKey;
+            },
+            update: async () => apiKey,
+        },
+        document: {
+            findMany: async () => [],
+            findUnique: async () => lastCreatedDoc,
+            findFirst: async ({ where }) => {
+                // Return the most recently created doc if its id matches; otherwise
+                // null. updateDocument calls findFirst({ id, collection, deletedAt: null }).
+                if (!lastCreatedDoc)
+                    return null;
+                if (where?.id && where.id !== lastCreatedDoc.id)
+                    return null;
+                return lastCreatedDoc;
+            },
+            count: async () => 0,
+            create: async ({ data }) => {
+                lastCreatedDoc = {
+                    ...data,
+                    id: 'doc-ai-1',
+                    createdAt: new Date(),
+                    updatedAt: new Date(),
+                };
+                return lastCreatedDoc;
+            },
+            update: async ({ data }) => {
+                lastCreatedDoc = { ...lastCreatedDoc, ...data, updatedAt: new Date() };
+                return lastCreatedDoc;
+            },
+        },
+        version: {
+            create: async ({ data }) => ({ ...data, id: 'ver-1' }),
+            findMany: async () => [],
+        },
+        documentRevision: {
+            create: async ({ data }) => ({ ...data, id: 'rev-1' }),
+        },
+        auditLog: { create: async () => ({}) },
+        webhook: { findMany: async () => [] },
+        webhookDelivery: { create: async () => ({}) },
+        user: {},
+        session: {},
+        media: {},
+    };
+    // createDocument may wrap the create in a transaction. Run the callback
+    // against the mock itself so the same model proxies fire.
+    dbMock.$transaction = async (arg) => {
+        if (typeof arg === 'function') {
+            return await arg(dbMock);
+        }
+        if (Array.isArray(arg)) {
+            return Promise.all(arg);
+        }
+        return arg;
+    };
+    return dbMock;
+}
+async function makeKey(scopes) {
+    const { key, keyHash, keyPrefix } = await generateApiKey({ prefix: 'act_sk', scopes });
+    return {
+        key,
+        record: {
+            id: 'apikey-ai',
+            keyHash,
+            keyPrefix,
+            userId: 'user-1',
+            scopes,
+            ipRestrictions: null,
+            expiresAt: null,
+            lastUsedAt: null,
+            revokedAt: null,
+        },
+    };
+}
+const postsCollection = {
+    slug: 'posts',
+    labels: { singular: 'Post', plural: 'Posts' },
+    type: 'post',
+    seo: { defaultSchemaType: 'BlogPosting' },
+    fields: {
+        title: { type: 'text', label: 'Title', required: true },
+        slug: { type: 'slug', label: 'Slug', required: true },
+        excerpt: { type: 'text', label: 'Excerpt' },
+        body: { type: 'richText', label: 'Body' },
+    },
+};
+const pagesCollection = {
+    slug: 'pages',
+    labels: { singular: 'Page', plural: 'Pages' },
+    type: 'page',
+    fields: {
+        title: { type: 'text', label: 'Title', required: true },
+        slug: { type: 'slug', label: 'Slug', required: true },
+        layout: { type: 'blocks', label: 'Layout' },
+    },
+};
+describe('POST /collections/:slug/ai-create', () => {
+    beforeEach(() => {
+        delete globalThis.__actuateConfig;
+        process.env.CMS_SECRET = VALID_SECRET;
+    });
+    it('creates a document via AI when caller has create scope on the collection', async () => {
+        const { key, record } = await makeKey({ collections: ['posts'], actions: ['create'] });
+        const db = createMockDB({ apiKey: record });
+        initDB(db);
+        const handler = handleActuateAPI({
+            prismaClient: db,
+            config: { collections: { posts: postsCollection } },
+        });
+        const response = await handler(new Request('https://example.com/api/cms/collections/posts/ai-create', {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${key}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({ prompt: 'Write a post about spring cleaning' }),
+        }));
+        const body = await response.json();
+        expect({ status: response.status, body }).toMatchObject({ status: 201 });
+        expect(body.data.document.id).toBe('doc-ai-1');
+        expect(body.data.document.title).toBe('Five Spring Cleaning Tips');
+        expect(body.data.document.slug).toBe('five-spring-cleaning-tips');
+        expect(body.data.document.status).toBe('DRAFT');
+        // SEO metadata flows back through the generation block (not pageSettings,
+        // which is a page-builder-only wire shape).
+        expect(body.data.generation.seo.schemaType).toBe('BlogPosting');
+        expect(body.data.generation.usage.completionTokens).toBe(250);
+    });
+    it('returns 400 when prompt is missing', async () => {
+        const { key, record } = await makeKey({ collections: ['posts'], actions: ['create'] });
+        const db = createMockDB({ apiKey: record });
+        initDB(db);
+        const handler = handleActuateAPI({
+            prismaClient: db,
+            config: { collections: { posts: postsCollection } },
+        });
+        const response = await handler(new Request('https://example.com/api/cms/collections/posts/ai-create', {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({}),
+        }));
+        expect(response.status).toBe(400);
+        const body = await response.json();
+        expect(body.error).toContain('prompt');
+    });
+    it('returns 404 when the collection is not configured', async () => {
+        const { key, record } = await makeKey({ admin: true });
+        const db = createMockDB({ apiKey: record });
+        initDB(db);
+        const handler = handleActuateAPI({
+            prismaClient: db,
+            config: { collections: { posts: postsCollection } },
+        });
+        const response = await handler(new Request('https://example.com/api/cms/collections/no-such-collection/ai-create', {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ prompt: 'test' }),
+        }));
+        expect(response.status).toBe(404);
+    });
+    it('refuses page-builder collections and points to /page-builder/create', async () => {
+        const { key, record } = await makeKey({ collections: ['pages'], actions: ['create'] });
+        const db = createMockDB({ apiKey: record });
+        initDB(db);
+        const handler = handleActuateAPI({
+            prismaClient: db,
+            config: { collections: { pages: pagesCollection } },
+        });
+        const response = await handler(new Request('https://example.com/api/cms/collections/pages/ai-create', {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ prompt: 'Create a homepage' }),
+        }));
+        expect(response.status).toBe(400);
+        const body = await response.json();
+        expect(body.error).toContain('page-builder/create');
+    });
+    it('rejects callers without create scope on the target collection', async () => {
+        // Key has read scope only.
+        const { key, record } = await makeKey({ collections: ['posts'], actions: ['read'] });
+        const db = createMockDB({ apiKey: record });
+        initDB(db);
+        const handler = handleActuateAPI({
+            prismaClient: db,
+            config: { collections: { posts: postsCollection } },
+        });
+        const response = await handler(new Request('https://example.com/api/cms/collections/posts/ai-create', {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ prompt: 'test' }),
+        }));
+        expect(response.status).toBe(403);
+    });
+    it('publishes immediately when publish: true is passed AND caller has admin scope', async () => {
+        // Publish requires admin scope on the API key — under the hood that
+        // maps to role=ADMIN, which clears the publish gate in updateDocument.
+        // A non-admin key that has only create+update will still create the
+        // draft but be denied the publish transition (see the next test).
+        const { key, record } = await makeKey({ admin: true });
+        const db = createMockDB({ apiKey: record });
+        initDB(db);
+        const handler = handleActuateAPI({
+            prismaClient: db,
+            config: { collections: { posts: postsCollection } },
+        });
+        const response = await handler(new Request('https://example.com/api/cms/collections/posts/ai-create', {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ prompt: 'test', publish: true }),
+        }));
+        expect(response.status).toBe(201);
+        const body = await response.json();
+        expect(body.data.document.status).toBe('PUBLISHED');
+    });
+    it('falls back to DRAFT + warning when publish requested but update scope is missing', async () => {
+        // create-only key — draft will be created, publish will fail.
+        const { key, record } = await makeKey({ collections: ['posts'], actions: ['create'] });
+        const db = createMockDB({ apiKey: record });
+        initDB(db);
+        const handler = handleActuateAPI({
+            prismaClient: db,
+            config: { collections: { posts: postsCollection } },
+        });
+        const response = await handler(new Request('https://example.com/api/cms/collections/posts/ai-create', {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ prompt: 'test', publish: true }),
+        }));
+        expect(response.status).toBe(201);
+        const body = await response.json();
+        expect(body.data.document.status).toBe('DRAFT');
+        expect(body.warning).toMatch(/publish failed/i);
+    });
+    it('honors caller-supplied title and slug overrides', async () => {
+        const { key, record } = await makeKey({ collections: ['posts'], actions: ['create'] });
+        const db = createMockDB({ apiKey: record });
+        initDB(db);
+        const handler = handleActuateAPI({
+            prismaClient: db,
+            config: { collections: { posts: postsCollection } },
+        });
+        const response = await handler(new Request('https://example.com/api/cms/collections/posts/ai-create', {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                prompt: 'test',
+                title: 'My Custom Title',
+                slug: 'my-custom-slug',
+            }),
+        }));
+        expect(response.status).toBe(201);
+        const body = await response.json();
+        expect(body.data.document.title).toBe('My Custom Title');
+        expect(body.data.document.slug).toBe('my-custom-slug');
+    });
+    it('returns 400 when prompt exceeds 4000 char limit', async () => {
+        const { key, record } = await makeKey({ collections: ['posts'], actions: ['create'] });
+        const db = createMockDB({ apiKey: record });
+        initDB(db);
+        const handler = handleActuateAPI({
+            prismaClient: db,
+            config: { collections: { posts: postsCollection } },
+        });
+        const response = await handler(new Request('https://example.com/api/cms/collections/posts/ai-create', {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ prompt: 'A'.repeat(5000) }),
+        }));
+        expect(response.status).toBe(400);
+        const body = await response.json();
+        expect(body.error).toContain('exceeds');
+    });
+});
+//# sourceMappingURL=collections-ai-create.test.js.map

package/dist/__tests__/api/collections-ai-create.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collections-ai-create.test.js","sourceRoot":"","sources":["../../../src/__tests__/api/collections-ai-create.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7D,2EAA2E;AAC3E,uEAAuE;AACvE,0DAA0D;AAC1D,EAAE,CAAC,IAAI,CAAC,0BAA0B,EAAE,GAAG,EAAE,CAAC,CAAC;IACzC,uBAAuB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,KAAU,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,EAAE;YACJ,KAAK,EAAE,2BAA2B;YAClC,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,oBAAoB;YAC7B,IAAI,EAAE,qDAAqD;SAC5D;QACD,KAAK,EAAE,2BAA2B;QAClC,IAAI,EAAE,2BAA2B;QACjC,GAAG,EAAE;YACH,SAAS,EAAE,sBAAsB;YACjC,eAAe,EAAE,0DAA0D;YAC3E,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,iBAAiB,IAAI,SAAS;SACnE;QACD,KAAK,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE;QACnD,UAAU,EAAE,EAAE;KACf,CAAC,CAAC;CACJ,CAAC,CAAC,CAAA;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAA;AAGnE,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAEnC,SAAS,YAAY,CAAC,IAAsB;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IAC1B,IAAI,cAAc,GAAQ,IAAI,CAAA;IAC9B,MAAM,MAAM,GAAQ;QAClB,MAAM,EAAE;YACN,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,UAAU,EAAE,KAAK,EAAE,EAAE,KAAK,EAAO,EAAE,EAAE;gBACnC,IAAI,CAAC,MAAM;oBAAE,OAAO,IAAI,CAAA;gBACxB,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;oBAAE,OAAO,IAAI,CAAA;gBACjD,OAAO,MAAM,CAAA;YACf,CAAC;YACD,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM;SAC3B;QACD,QAAQ,EAAE;YACR,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;YACxB,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,cAAc;YACtC,SAAS,EAAE,KAAK,EAAE,EAAE,KAAK,EAAO,EAAE,EAAE;gBAClC,oEAAoE;gBACpE,6EAA6E;gBAC7E,IAAI,CAAC,cAAc;oBAAE,OAAO,IAAI,CAAA;gBAChC,IAAI,KAAK,EAAE,EAAE,IAAI,KAAK,CAAC,EAAE,KAAK,cAAc,CAAC,EAAE;oBAAE,OAAO,IAAI,CAAA;gBAC5D,OAAO,cAAc,CAAA;YACvB,CAAC;YACD,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YACpB,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAO,EAAE,EAAE;gBAC9B,cAAc,GAAG;oBACf,GAAG,IAAI;oBACP,EAAE,EAAE,UAAU;oBACd,SAAS,EAAE,IAAI,IAAI,EAAE;oBACrB,SAAS,EAAE,IAAI,IAAI,EAAE;iBACtB,CAAA;gBACD,OAAO,cAAc,CAAA;YACvB,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAO,EAAE,EAAE;gBAC9B,cAAc,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAA;gBACtE,OAAO,cAAc,CAAA;YACvB,CAAC;SACF;QACD,OAAO,EAAE;YACP,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;YAC3D,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;SACzB;QACD,gBAAgB,EAAE;YAChB,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;SAC5D;QACD,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE;QACtC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE;QACrC,eAAe,EAAE,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE;QAC7C,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,EAAE;QACX,KAAK,EAAE,EAAE;KACV,CAAA;IACD,wEAAwE;IACxE,0DAA0D;IAC1D,MAAM,CAAC,YAAY,GAAG,KAAK,EAAE,GAAQ,EAAE,EAAE;QACvC,IAAI,OAAO,GAAG,KAAK,UAAU,EAAE,CAAC;YAC9B,OAAO,MAAM,GAAG,CAAC,MAAM,CAAC,CAAA;QAC1B,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACzB,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,MAAmB;IACxC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IACtF,OAAO;QACL,GAAG;QACH,MAAM,EAAE;YACN,EAAE,EAAE,WAAW;YACf,OAAO;YACP,SAAS;YACT,MAAM,EAAE,QAAQ;YAChB,MAAM;YACN,cAAc,EAAE,IAAI;YACpB,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,IAAI;SAChB;KACF,CAAA;AACH,CAAC;AAED,MAAM,eAAe,GAAG;IACtB,IAAI,EAAE,OAAO;IACb,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;IAC7C,IAAI,EAAE,MAAe;IACrB,GAAG,EAAE,EAAE,iBAAiB,EAAE,aAAa,EAAE;IACzC,MAAM,EAAE;QACN,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE;QACvD,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;QACrD,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE;QAC3C,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE;KAC1C;CACF,CAAA;AAED,MAAM,eAAe,GAAG;IACtB,IAAI,EAAE,OAAO;IACb,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;IAC7C,IAAI,EAAE,MAAe;IACrB,MAAM,EAAE;QACN,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE;QACvD,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;QACrD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;KAC5C;CACF,CAAA;AAED,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IACjD,UAAU,CAAC,GAAG,EAAE;QACd,OAAQ,UAAkB,CAAC,eAAe,CAAA;QAC1C,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,YAAY,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QACtF,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QAC3C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC;YAC/B,YAAY,EAAE,EAAE;YAChB,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE;SACpD,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,yDAAyD,EAAE;YACrE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,GAAG,EAAE;gBAC9B,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;SACvE,CAAC,CACH,CAAA;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACxE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC9C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;QAClE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;QACjE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC/C,0EAA0E;QAC1E,4CAA4C;QAC5C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QAC/D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QACtF,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QAC3C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC;YAC/B,YAAY,EAAE,EAAE;YAChB,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE;SACpD,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,yDAAyD,EAAE;YACrE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;SACzB,CAAC,CACH,CAAA;QAED,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QAC3C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC;YAC/B,YAAY,EAAE,EAAE;YAChB,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE;SACpD,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,sEAAsE,EAAE;YAClF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;SACzC,CAAC,CACH,CAAA;QAED,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QACtF,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QAC3C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC;YAC/B,YAAY,EAAE,EAAE;YAChB,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE;SACpD,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,yDAAyD,EAAE;YACrE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;SACtD,CAAC,CACH,CAAA;QAED,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,2BAA2B;QAC3B,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACpF,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QAC3C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC;YAC/B,YAAY,EAAE,EAAE;YAChB,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE;SACpD,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,yDAAyD,EAAE;YACrE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;SACzC,CAAC,CACH,CAAA;QAED,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,oEAAoE;QACpE,uEAAuE;QACvE,oEAAoE;QACpE,kEAAkE;QAClE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QAC3C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC;YAC/B,YAAY,EAAE,EAAE;YAChB,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE;SACpD,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,yDAAyD,EAAE;YACrE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;SACxD,CAAC,CACH,CAAA;QAED,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,8DAA8D;QAC9D,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QACtF,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QAC3C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC;YAC/B,YAAY,EAAE,EAAE;YAChB,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE;SACpD,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,yDAAyD,EAAE;YACrE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;SACxD,CAAC,CACH,CAAA;QAED,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC/C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QACtF,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QAC3C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC;YAC/B,YAAY,EAAE,EAAE;YAChB,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE;SACpD,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,yDAAyD,EAAE;YACrE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,iBAAiB;gBACxB,IAAI,EAAE,gBAAgB;aACvB,CAAC;SACH,CAAC,CACH,CAAA;QAED,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;QACxD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QACtF,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QAC3C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC;YAC/B,YAAY,EAAE,EAAE;YAChB,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE;SACpD,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,yDAAyD,EAAE;YACrE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;SACnD,CAAC,CACH,CAAA;QAED,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/api/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/api/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAigB5C,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS9E;AA2ND,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAgoKzD"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/api/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAigB5C,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS9E;AA2ND,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAuzKzD"}

package/dist/api/handlers.js

@@ -5333,6 +5333,148 @@ export function registerCMSRoutes(router) {
             return internalError(err, 'page-builder create');
         }
     });
+    /**
+     * Generic AI content authoring for ANY collection.
+     *
+     * `POST /collections/:slug/ai-create` is the non-page counterpart to
+     * `/page-builder/create`. It takes a free-form prompt, looks up the
+     * collection's field schema from the running config, asks the AI provider
+     * to produce structured JSON matching that schema, validates / coerces the
+     * output, and persists the result as a draft (or published) document.
+     *
+     * Used by:
+     *   - the admin "Generate from prompt" affordance on the collection list
+     *   - the MCP server's `create_in_collection` / `create_blog_post` / etc.
+     *   - AI agents calling the REST API directly
+     */
+    router.post('/collections/:slug/ai-create', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const targetCollection = params.slug;
+            const scopeErr = requireCollectionScope(auth.session, targetCollection, 'create');
+            if (scopeErr)
+                return scopeErr;
+            if (!(await checkRateLimitAsync(aiGenerateLimiter, `ai-gen:${auth.session.userId}`))) {
+                return errorResponse('AI generation rate limit reached. Try again in an hour.', 429);
+            }
+            const body = (await request.json());
+            if (!body.prompt || typeof body.prompt !== 'string') {
+                return errorResponse('prompt is required', 400);
+            }
+            if (body.prompt.length > AI_PROMPT_MAX_CHARS) {
+                return errorResponse(`prompt exceeds ${AI_PROMPT_MAX_CHARS} character limit`, 400);
+            }
+            if (body.context && body.context.length > AI_CONTEXT_MAX_CHARS) {
+                return errorResponse(`context exceeds ${AI_CONTEXT_MAX_CHARS} character limit`, 400);
+            }
+            const cfg = getActuateConfig();
+            const collection = cfg?.collections?.[targetCollection];
+            if (!collection) {
+                return errorResponse(`Collection "${targetCollection}" not found`, 404);
+            }
+            // Refuse page-builder-driven collections — those have a layout tree
+            // (not flat field data) and should use `/page-builder/create` instead.
+            const hasLayoutField = Object.values(collection.fields).some((f) => f.type === 'blocks');
+            if (hasLayoutField) {
+                return errorResponse(`Collection "${targetCollection}" uses the page builder. Use POST /api/cms/page-builder/create instead.`, 400);
+            }
+            let generateDocumentContent = null;
+            try {
+                const aiModule = await importAIPlugin();
+                generateDocumentContent = aiModule.generateDocumentContent;
+            }
+            catch {
+                return errorResponse('AI plugin is not installed. Install @actuate-media/plugin-ai to use content authoring.', 501);
+            }
+            if (!generateDocumentContent) {
+                return errorResponse('AI plugin missing `generateDocumentContent`. Upgrade @actuate-media/plugin-ai to >= 0.2.0.', 501);
+            }
+            const result = await generateDocumentContent({
+                prompt: body.prompt,
+                collection: {
+                    slug: collection.slug,
+                    labels: collection.labels,
+                    type: collection.type,
+                    fields: collection.fields,
+                    seo: collection.seo,
+                },
+                context: { existingContent: body.context, targetAudience: body.targetAudience },
+                tone: body.tone,
+                ...(typeof body.maxTokens === 'number' ? { maxTokens: body.maxTokens } : {}),
+                ...(typeof body.temperature === 'number' ? { temperature: body.temperature } : {}),
+            });
+            const shouldPublish = body.status === 'PUBLISHED' || body.publish === true;
+            const finalTitle = body.title ?? result.title;
+            const finalSlug = body.slug ?? result.slug;
+            // Spread AI data FIRST so explicit caller overrides (title, slug) win.
+            // We don't use `pageSettings` here — that's a page-builder-specific
+            // wire shape. For non-page collections SEO copy lives on regular
+            // fields (metaTitle / metaDescription) declared via the seoFields
+            // preset, and the AI generator already populates those inside
+            // result.data when they exist on the schema.
+            const docPayload = {
+                ...result.data,
+                title: finalTitle,
+                slug: finalSlug,
+            };
+            const ctx = buildActionContext(auth.session, db());
+            let doc = await createDocument(targetCollection, docPayload, ctx);
+            // Optional publish: createDocument intentionally always returns DRAFT
+            // (only EDITOR+ can publish). If the caller asked for an immediate
+            // publish we do a follow-up updateDocument that runs through the
+            // standard publish access check. Callers without `update` scope on the
+            // collection will get a 403 here even though the create succeeded —
+            // they end up with a draft, which is the safest fallback.
+            if (shouldPublish && doc?.id) {
+                try {
+                    doc = await updateDocument(targetCollection, doc.id, { status: 'PUBLISHED' }, ctx);
+                }
+                catch (publishErr) {
+                    // Surface a 207-style partial success: the draft was created but
+                    // publish was denied. We return 201 with a `warning` field so the
+                    // agent knows the doc landed but needs human publishing.
+                    return json({
+                        data: {
+                            document: doc,
+                            generation: {
+                                usage: result.usage,
+                                durationMs: result.durationMs,
+                                seo: result.seo,
+                            },
+                        },
+                        warning: `Document created as DRAFT — publish failed: ${publishErr instanceof Error ? publishErr.message : 'unknown'}`,
+                    }, 201);
+                }
+            }
+            await logEvent({
+                event: 'settings_changed',
+                userId: auth.session.userId,
+                details: {
+                    action: 'collection_ai_create',
+                    collection: targetCollection,
+                    documentId: doc?.id,
+                    prompt: redactSecrets(body.prompt).slice(0, 500),
+                    tokensUsed: result.usage,
+                    durationMs: result.durationMs,
+                },
+            });
+            return json({
+                data: {
+                    document: doc,
+                    generation: {
+                        usage: result.usage,
+                        durationMs: result.durationMs,
+                        seo: result.seo,
+                    },
+                },
+            }, 201);
+        }
+        catch (err) {
+            return internalError(err, 'collections/:slug/ai-create');
+        }
+    });
     router.post('/page-builder/audit-a11y', async (request) => {
         try {
             const auth = await requireAuth(request);