@actuate-media/cms-core 0.18.0 → 0.20.0

package/dist/preview/index.d.ts

@@ -2,13 +2,35 @@ export interface PreviewSession {
     token: string;
     collection: string;
     documentId: string;
+    /** When the token expires (server clock). */
     expiresAt: Date;
+    /** The admin who issued the token (used for audit + future revocation). */
+    issuedBy?: string;
+}
+export interface CreatePreviewSessionOptions {
+    /**
+     * Token lifetime in seconds. Defaults to 7 days. The maximum is
+     * enforced server-side ({@link MAX_PREVIEW_TOKEN_TTL_SECONDS}). A short
+     * TTL is preferable for one-off client reviews; longer TTLs are okay
+     * for staging-style preview links shared with trusted partners.
+     */
+    ttlSeconds?: number;
+    /** Issuing admin's user id (recorded in the JWT for audit). */
+    issuedBy?: string;
 }
 export interface PreviewAdapter {
-    createPreviewSession(collection: string, documentId: string): Promise<PreviewSession>;
+    createPreviewSession(collection: string, documentId: string, options?: CreatePreviewSessionOptions): Promise<PreviewSession>;
     validatePreviewToken(token: string): Promise<PreviewSession | null>;
     exitPreview(token: string): Promise<void>;
     getPreviewData(session: PreviewSession): Promise<Record<string, unknown> | null>;
 }
+/** 5 minutes — fits "one tab, one read" review flows. */
+export declare const DEFAULT_PREVIEW_TOKEN_TTL_SECONDS: number;
+/**
+ * Upper bound for token lifetime. Tokens are JWT-signed and stateless, so a
+ * leaked token is valid until expiry — keep the ceiling reasonable. Sites
+ * that need shareable URLs for months should use draft-publishing instead.
+ */
+export declare const MAX_PREVIEW_TOKEN_TTL_SECONDS: number;
 export declare function createPreviewAdapter(secret: string, db: unknown): PreviewAdapter;
 //# sourceMappingURL=index.d.ts.map

package/dist/preview/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/preview/index.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,IAAI,CAAA;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;IACrF,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAA;IACnE,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzC,cAAc,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAA;CACjF;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,GAAG,cAAc,CA4ChF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/preview/index.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,6CAA6C;IAC7C,SAAS,EAAE,IAAI,CAAA;IACf,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,oBAAoB,CAClB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,cAAc,CAAC,CAAA;IAC1B,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAA;IACnE,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzC,cAAc,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAA;CACjF;AAED,yDAAyD;AACzD,eAAO,MAAM,iCAAiC,QAAmB,CAAA;AAEjE;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,QAAoB,CAAA;AAE9D,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,GAAG,cAAc,CA2DhF"}

package/dist/preview/index.js

@@ -1,16 +1,35 @@
 import * as jose from 'jose';
+/** 5 minutes — fits "one tab, one read" review flows. */
+export const DEFAULT_PREVIEW_TOKEN_TTL_SECONDS = 7 * 24 * 60 * 60; // 7 days
+/**
+ * Upper bound for token lifetime. Tokens are JWT-signed and stateless, so a
+ * leaked token is valid until expiry — keep the ceiling reasonable. Sites
+ * that need shareable URLs for months should use draft-publishing instead.
+ */
+export const MAX_PREVIEW_TOKEN_TTL_SECONDS = 30 * 24 * 60 * 60; // 30 days
 export function createPreviewAdapter(secret, db) {
     const secretKey = new TextEncoder().encode(secret);
     return {
-        async createPreviewSession(collection, documentId) {
-            const expiresAt = new Date(Date.now() + 5 * 60 * 1000);
-            const token = await new jose.SignJWT({ collection, documentId })
+        async createPreviewSession(collection, documentId, options) {
+            const requested = options?.ttlSeconds ?? DEFAULT_PREVIEW_TOKEN_TTL_SECONDS;
+            const ttl = Math.max(60, Math.min(requested, MAX_PREVIEW_TOKEN_TTL_SECONDS));
+            const expiresAt = new Date(Date.now() + ttl * 1000);
+            let builder = new jose.SignJWT({ collection, documentId })
                 .setProtectedHeader({ alg: 'HS256' })
                 .setIssuedAt()
                 .setExpirationTime(expiresAt)
-                .setIssuer('actuate-cms-preview')
-                .sign(secretKey);
-            return { token, collection, documentId, expiresAt };
+                .setIssuer('actuate-cms-preview');
+            if (options?.issuedBy) {
+                builder = builder.setSubject(options.issuedBy);
+            }
+            const token = await builder.sign(secretKey);
+            return {
+                token,
+                collection,
+                documentId,
+                expiresAt,
+                issuedBy: options?.issuedBy,
+            };
         },
         async validatePreviewToken(token) {
             try {
@@ -22,6 +41,7 @@ export function createPreviewAdapter(secret, db) {
                     collection: payload.collection,
                     documentId: payload.documentId,
                     expiresAt: new Date((payload.exp ?? 0) * 1000),
+                    issuedBy: typeof payload.sub === 'string' ? payload.sub : undefined,
                 };
             }
             catch {
@@ -29,7 +49,10 @@ export function createPreviewAdapter(secret, db) {
             }
         },
         async exitPreview(_token) {
-            // JWT-based tokens are stateless; no server-side invalidation needed
+            // JWT-based tokens are stateless; no server-side invalidation needed.
+            // For revocation, rotate the global CMS_SECRET (invalidates all tokens
+            // at once). Per-token revocation requires a backing table — track via
+            // future Slice if needed.
         },
         async getPreviewData(session) {
             const prisma = db;

package/dist/preview/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/preview/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAgB5B,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,EAAW;IAC9D,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAElD,OAAO;QACL,KAAK,CAAC,oBAAoB,CAAC,UAAU,EAAE,UAAU;YAC/C,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;YACtD,MAAM,KAAK,GAAG,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;iBAC7D,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;iBACpC,WAAW,EAAE;iBACb,iBAAiB,CAAC,SAAS,CAAC;iBAC5B,SAAS,CAAC,qBAAqB,CAAC;iBAChC,IAAI,CAAC,SAAS,CAAC,CAAA;YAClB,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,CAAA;QACrD,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,KAAK;YAC9B,IAAI,CAAC;gBACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE;oBACzD,MAAM,EAAE,qBAAqB;iBAC9B,CAAC,CAAA;gBACF,OAAO;oBACL,KAAK;oBACL,UAAU,EAAE,OAAO,CAAC,UAAoB;oBACxC,UAAU,EAAE,OAAO,CAAC,UAAoB;oBACxC,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;iBAC/C,CAAA;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,MAAM;YACtB,qEAAqE;QACvE,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,OAAO;YAC1B,MAAM,MAAM,GAAG,EAAS,CAAA;YACxB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC1C,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE;aAClE,CAAC,CAAA;YACF,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAA;YACrB,OAAO,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAA;QACnC,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/preview/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAmC5B,yDAAyD;AACzD,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA,CAAC,SAAS;AAE3E;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA,CAAC,UAAU;AAEzE,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,EAAW;IAC9D,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAElD,OAAO;QACL,KAAK,CAAC,oBAAoB,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO;YACxD,MAAM,SAAS,GAAG,OAAO,EAAE,UAAU,IAAI,iCAAiC,CAAA;YAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,6BAA6B,CAAC,CAAC,CAAA;YAC5E,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC,CAAA;YACnD,IAAI,OAAO,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;iBACvD,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;iBACpC,WAAW,EAAE;iBACb,iBAAiB,CAAC,SAAS,CAAC;iBAC5B,SAAS,CAAC,qBAAqB,CAAC,CAAA;YACnC,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;gBACtB,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YAChD,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YAC3C,OAAO;gBACL,KAAK;gBACL,UAAU;gBACV,UAAU;gBACV,SAAS;gBACT,QAAQ,EAAE,OAAO,EAAE,QAAQ;aAC5B,CAAA;QACH,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,KAAK;YAC9B,IAAI,CAAC;gBACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE;oBACzD,MAAM,EAAE,qBAAqB;iBAC9B,CAAC,CAAA;gBACF,OAAO;oBACL,KAAK;oBACL,UAAU,EAAE,OAAO,CAAC,UAAoB;oBACxC,UAAU,EAAE,OAAO,CAAC,UAAoB;oBACxC,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;oBAC9C,QAAQ,EAAE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;iBACpE,CAAA;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,MAAM;YACtB,sEAAsE;YACtE,uEAAuE;YACvE,sEAAsE;YACtE,0BAA0B;QAC5B,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,OAAO;YAC1B,MAAM,MAAM,GAAG,EAAS,CAAA;YACxB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC1C,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE;aAClE,CAAC,CAAA;YACF,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAA;YACrB,OAAO,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAA;QACnC,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/seo/config-store.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Editable SEO config — DB-backed overrides for the static `actuate.config.ts`
+ * `seo` block + per-collection `CollectionSEOConfig`.
+ *
+ * Static config in `actuate.config.ts` is the source of truth at code level,
+ * but admins need to be able to change site name, default OG image, robots
+ * policy, default Schema.org types per collection, etc. without redeploying.
+ *
+ * Storage: a single Document row with `collection = '__seo_config__'` and
+ * `data.{site, collections}`. The leading double underscore makes the slug
+ * un-spellable as a normal collection (slugs are lowercased + dashed in the
+ * config validator), so it can never collide with a user collection.
+ *
+ * Merge semantics: DB values take precedence over static config, field by
+ * field. Removing a value in the UI (setting it to undefined / empty string)
+ * falls back to the static default — so the admin panel is purely additive,
+ * never destructive of code-level config.
+ */
+import type { ActuateCMSConfig, CollectionSEOConfig, SiteSEOConfig } from '../config/types.js';
+export declare const SEO_CONFIG_COLLECTION = "__seo_config__";
+/**
+ * Shape of the overrides document stored in the DB. Every field is optional —
+ * a freshly-installed CMS has no row at all and the UI lazily creates one on
+ * first save.
+ */
+export interface SeoConfigOverrides {
+    /** Site-wide overrides. Merged shallow-then-deep over static `config.seo`. */
+    site?: Partial<SiteSEOConfig>;
+    /** Per-collection overrides keyed by collection slug. */
+    collections?: Record<string, Partial<CollectionSEOConfig>>;
+    /** Last update timestamp (set by the writer). */
+    updatedAt?: string;
+    /** User id of the last editor (set by the writer). */
+    updatedBy?: string;
+}
+/** Read the SEO overrides document. Returns null when no row exists yet. */
+export declare function getSeoOverrides(db: unknown): Promise<SeoConfigOverrides | null>;
+/**
+ * Upsert the SEO overrides document. The caller is responsible for auth/role
+ * checks — this function only handles storage.
+ */
+export declare function putSeoOverrides(db: unknown, overrides: SeoConfigOverrides, userId: string): Promise<SeoConfigOverrides>;
+/**
+ * Merge static site-wide SEO config with the DB overrides. Nested objects
+ * (`robots`, `sitemap`, `ogImage`, `organization`) merge field-by-field;
+ * primitive values use override-wins-if-set.
+ */
+export declare function mergeSiteSeoConfig(base: SiteSEOConfig | undefined, over: Partial<SiteSEOConfig> | undefined): SiteSEOConfig;
+/** Same merge semantics as the site-wide version, applied to a single collection. */
+export declare function mergeCollectionSeoConfig(base: CollectionSEOConfig | undefined, over: Partial<CollectionSEOConfig> | undefined): CollectionSEOConfig;
+/**
+ * Return a new config object with DB-stored SEO overrides applied. The
+ * static config is never mutated — callers receive a shallow copy with
+ * `seo` and each collection's `seo` block replaced by the merged values.
+ *
+ * Routes that compose SEO output call this once per request, then thread
+ * the result through to `composePageMeta` / sitemap helpers exactly like
+ * the static config they replaced.
+ */
+export declare function applySeoOverrides(config: ActuateCMSConfig | null | undefined, overrides: SeoConfigOverrides | null): ActuateCMSConfig | null;
+//# sourceMappingURL=config-store.d.ts.map

package/dist/seo/config-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../../src/seo/config-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAEhB,mBAAmB,EACnB,aAAa,EACd,MAAM,oBAAoB,CAAA;AAE3B,eAAO,MAAM,qBAAqB,mBAAmB,CAAA;AAErD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,IAAI,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAA;IAC7B,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAA;IAC1D,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,4EAA4E;AAC5E,wBAAsB,eAAe,CAAC,EAAE,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAerF;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,OAAO,EACX,SAAS,EAAE,kBAAkB,EAC7B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,kBAAkB,CAAC,CA8B7B;AAwBD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,aAAa,GAAG,SAAS,EAC/B,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,SAAS,GACvC,aAAa,CA6Bf;AAED,qFAAqF;AACrF,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,mBAAmB,GAAG,SAAS,EACrC,IAAI,EAAE,OAAO,CAAC,mBAAmB,CAAC,GAAG,SAAS,GAC7C,mBAAmB,CAiBrB;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,EAC3C,SAAS,EAAE,kBAAkB,GAAG,IAAI,GACnC,gBAAgB,GAAG,IAAI,CAkBzB"}

package/dist/seo/config-store.js

@@ -0,0 +1,158 @@
+/**
+ * Editable SEO config — DB-backed overrides for the static `actuate.config.ts`
+ * `seo` block + per-collection `CollectionSEOConfig`.
+ *
+ * Static config in `actuate.config.ts` is the source of truth at code level,
+ * but admins need to be able to change site name, default OG image, robots
+ * policy, default Schema.org types per collection, etc. without redeploying.
+ *
+ * Storage: a single Document row with `collection = '__seo_config__'` and
+ * `data.{site, collections}`. The leading double underscore makes the slug
+ * un-spellable as a normal collection (slugs are lowercased + dashed in the
+ * config validator), so it can never collide with a user collection.
+ *
+ * Merge semantics: DB values take precedence over static config, field by
+ * field. Removing a value in the UI (setting it to undefined / empty string)
+ * falls back to the static default — so the admin panel is purely additive,
+ * never destructive of code-level config.
+ */
+export const SEO_CONFIG_COLLECTION = '__seo_config__';
+/** Read the SEO overrides document. Returns null when no row exists yet. */
+export async function getSeoOverrides(db) {
+    const d = db;
+    if (!d?.document?.findFirst)
+        return null;
+    try {
+        const doc = await d.document.findFirst({
+            where: { collection: SEO_CONFIG_COLLECTION, deletedAt: null },
+            select: { data: true },
+        });
+        if (!doc)
+            return null;
+        const data = doc.data;
+        if (!data || typeof data !== 'object')
+            return null;
+        return data;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Upsert the SEO overrides document. The caller is responsible for auth/role
+ * checks — this function only handles storage.
+ */
+export async function putSeoOverrides(db, overrides, userId) {
+    const d = db;
+    const data = {
+        ...overrides,
+        updatedAt: new Date().toISOString(),
+        updatedBy: userId,
+    };
+    const existing = await d.document.findFirst({
+        where: { collection: SEO_CONFIG_COLLECTION, deletedAt: null },
+        select: { id: true },
+    });
+    if (existing) {
+        await d.document.update({
+            where: { id: existing.id },
+            data: { data, updatedById: userId },
+        });
+    }
+    else {
+        await d.document.create({
+            data: {
+                collection: SEO_CONFIG_COLLECTION,
+                data,
+                status: 'PUBLISHED',
+                title: 'SEO defaults',
+                slug: 'seo-config',
+                createdById: userId,
+                updatedById: userId,
+            },
+        });
+    }
+    return data;
+}
+/**
+ * Shallow-merge that drops undefined / empty-string values on the override
+ * side so the UI can "unset" a field by submitting an empty string.
+ */
+function mergeFields(base, over) {
+    const out = { ...(base ?? {}) };
+    if (!over)
+        return out;
+    for (const [k, v] of Object.entries(over)) {
+        if (v === undefined)
+            continue;
+        if (typeof v === 'string' && v.trim() === '')
+            continue;
+        if (v === null) {
+            delete out[k];
+            continue;
+        }
+        out[k] = v;
+    }
+    return out;
+}
+/**
+ * Merge static site-wide SEO config with the DB overrides. Nested objects
+ * (`robots`, `sitemap`, `ogImage`, `organization`) merge field-by-field;
+ * primitive values use override-wins-if-set.
+ */
+export function mergeSiteSeoConfig(base, over) {
+    if (!over)
+        return { ...(base ?? {}) };
+    // The SEO config interfaces are declared with explicit named fields and no
+    // index signature, so we cast through Record<string, unknown> when calling
+    // the generic merge helper. Behaviour is unchanged; this is purely a
+    // structural-typing escape hatch.
+    const merged = mergeFields(base, over);
+    return {
+        ...merged,
+        robots: mergeFields(base?.robots, over.robots),
+        sitemap: mergeFields(base?.sitemap, over.sitemap),
+        ogImage: mergeFields(base?.ogImage, over.ogImage),
+        organization: mergeFields(base?.organization, over.organization),
+    };
+}
+/** Same merge semantics as the site-wide version, applied to a single collection. */
+export function mergeCollectionSeoConfig(base, over) {
+    if (!over)
+        return { ...(base ?? {}) };
+    const merged = mergeFields(base, over);
+    return {
+        ...merged,
+        defaultRobots: mergeFields(base?.defaultRobots, over.defaultRobots),
+        defaultOgImage: mergeFields(base?.defaultOgImage, over.defaultOgImage),
+    };
+}
+/**
+ * Return a new config object with DB-stored SEO overrides applied. The
+ * static config is never mutated — callers receive a shallow copy with
+ * `seo` and each collection's `seo` block replaced by the merged values.
+ *
+ * Routes that compose SEO output call this once per request, then thread
+ * the result through to `composePageMeta` / sitemap helpers exactly like
+ * the static config they replaced.
+ */
+export function applySeoOverrides(config, overrides) {
+    if (!config)
+        return null;
+    if (!overrides)
+        return config;
+    const mergedSite = mergeSiteSeoConfig(config.seo, overrides.site);
+    const mergedCollections = {};
+    for (const [slug, col] of Object.entries(config.collections ?? {})) {
+        const colOver = overrides.collections?.[slug];
+        mergedCollections[slug] = colOver
+            ? { ...col, seo: mergeCollectionSeoConfig(col.seo, colOver) }
+            : col;
+    }
+    return {
+        ...config,
+        seo: mergedSite,
+        collections: mergedCollections,
+    };
+}
+//# sourceMappingURL=config-store.js.map

package/dist/seo/config-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-store.js","sourceRoot":"","sources":["../../src/seo/config-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AASH,MAAM,CAAC,MAAM,qBAAqB,GAAG,gBAAgB,CAAA;AAkBrD,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAW;IAC/C,MAAM,CAAC,GAAG,EAAS,CAAA;IACnB,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS;QAAE,OAAO,IAAI,CAAA;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;YACrC,KAAK,EAAE,EAAE,UAAU,EAAE,qBAAqB,EAAE,SAAS,EAAE,IAAI,EAAE;YAC7D,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;SACvB,CAAC,CAAA;QACF,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QACrB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;QACrB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QAClD,OAAO,IAA0B,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAW,EACX,SAA6B,EAC7B,MAAc;IAEd,MAAM,CAAC,GAAG,EAAS,CAAA;IACnB,MAAM,IAAI,GAAuB;QAC/B,GAAG,SAAS;QACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,MAAM;KAClB,CAAA;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC1C,KAAK,EAAE,EAAE,UAAU,EAAE,qBAAqB,EAAE,SAAS,EAAE,IAAI,EAAE;QAC7D,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;KACrB,CAAC,CAAA;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YACtB,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE;YAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE;SACpC,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YACtB,IAAI,EAAE;gBACJ,UAAU,EAAE,qBAAqB;gBACjC,IAAI;gBACJ,MAAM,EAAE,WAAW;gBACnB,KAAK,EAAE,cAAc;gBACrB,IAAI,EAAE,YAAY;gBAClB,WAAW,EAAE,MAAM;gBACnB,WAAW,EAAE,MAAM;aACpB;SACF,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAClB,IAAmB,EACnB,IAA4B;IAE5B,MAAM,GAAG,GAA4B,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAA;IACxD,IAAI,CAAC,IAAI;QAAE,OAAO,GAAQ,CAAA;IAC1B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,KAAK,SAAS;YAAE,SAAQ;QAC7B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,SAAQ;QACtD,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,OAAO,GAAG,CAAC,CAAC,CAAC,CAAA;YACb,SAAQ;QACV,CAAC;QACD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IACZ,CAAC;IACD,OAAO,GAAQ,CAAA;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAA+B,EAC/B,IAAwC;IAExC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAA;IACrC,2EAA2E;IAC3E,2EAA2E;IAC3E,qEAAqE;IACrE,kCAAkC;IAClC,MAAM,MAAM,GAAG,WAAW,CACxB,IAA0C,EAC1C,IAAmD,CACpD,CAAA;IACD,OAAO;QACL,GAAI,MAAmC;QACvC,MAAM,EAAE,WAAW,CACjB,IAAI,EAAE,MAA6C,EACnD,IAAI,CAAC,MAA6C,CACxB;QAC5B,OAAO,EAAE,WAAW,CAClB,IAAI,EAAE,OAA8C,EACpD,IAAI,CAAC,OAA8C,CACxB;QAC7B,OAAO,EAAE,WAAW,CAClB,IAAI,EAAE,OAA8C,EACpD,IAAI,CAAC,OAA8C,CACxB;QAC7B,YAAY,EAAE,WAAW,CACvB,IAAI,EAAE,YAAmD,EACzD,IAAI,CAAC,YAAmD,CACxB;KACnC,CAAA;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,wBAAwB,CACtC,IAAqC,EACrC,IAA8C;IAE9C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAA;IACrC,MAAM,MAAM,GAAG,WAAW,CACxB,IAA0C,EAC1C,IAAmD,CACpD,CAAA;IACD,OAAO;QACL,GAAI,MAAyC;QAC7C,aAAa,EAAE,WAAW,CACxB,IAAI,EAAE,aAAoD,EAC1D,IAAI,CAAC,aAAoD,CAClB;QACzC,cAAc,EAAE,WAAW,CACzB,IAAI,EAAE,cAAqD,EAC3D,IAAI,CAAC,cAAqD,CAClB;KAC3C,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAA2C,EAC3C,SAAoC;IAEpC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,IAAI,CAAC,SAAS;QAAE,OAAO,MAAM,CAAA;IAE7B,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;IACjE,MAAM,iBAAiB,GAAyC,EAAE,CAAA;IAClE,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;QACnE,MAAM,OAAO,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAA;QAC7C,iBAAiB,CAAC,IAAI,CAAC,GAAG,OAAO;YAC/B,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,wBAAwB,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE;YAC7D,CAAC,CAAC,GAAG,CAAA;IACT,CAAC;IAED,OAAO;QACL,GAAG,MAAM;QACT,GAAG,EAAE,UAAU;QACf,WAAW,EAAE,iBAAiB;KAC/B,CAAA;AACH,CAAC"}

package/dist/seo/index.d.ts

@@ -10,4 +10,6 @@ export { generateLlmsTxt } from './llms-txt.js';
 export type { LlmsTxtConfig, LlmsTxtPage } from './llms-txt.js';
 export { composePageMeta, detectSchemaType } from './page-meta.js';
 export type { ComposePageMetaInput, ComposedPageMeta, ComposeDocumentInput } from './page-meta.js';
+export { SEO_CONFIG_COLLECTION, getSeoOverrides, putSeoOverrides, applySeoOverrides, mergeSiteSeoConfig, mergeCollectionSeoConfig, } from './config-store.js';
+export type { SeoConfigOverrides } from './config-store.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/seo/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/seo/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,eAAe,GAChB,MAAM,eAAe,CAAA;AAEtB,YAAY,EAAE,iBAAiB,EAAE,QAAQ,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAElG,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AAE3F,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAElD,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAErD,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAE1F,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAErE,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAE9E,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAE/C,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAE/D,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAElE,YAAY,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/seo/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,eAAe,GAChB,MAAM,eAAe,CAAA;AAEtB,YAAY,EAAE,iBAAiB,EAAE,QAAQ,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAElG,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AAE3F,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAElD,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAErD,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAE1F,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAErE,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAE9E,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAE/C,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAE/D,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAElE,YAAY,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AAElG,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,mBAAmB,CAAA;AAE1B,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA"}

package/dist/seo/index.js

@@ -4,4 +4,5 @@ export { resolveRobotsDirectives } from './robots.js';
 export { resolveTitle, getDocumentTitle } from './title-templates.js';
 export { generateLlmsTxt } from './llms-txt.js';
 export { composePageMeta, detectSchemaType } from './page-meta.js';
+export { SEO_CONFIG_COLLECTION, getSeoOverrides, putSeoOverrides, applySeoOverrides, mergeSiteSeoConfig, mergeCollectionSeoConfig, } from './config-store.js';
 //# sourceMappingURL=index.js.map

package/dist/seo/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/seo/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,eAAe,GAChB,MAAM,eAAe,CAAA;AAItB,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AAI3F,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAIrD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAIrE,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAI/C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/seo/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,eAAe,GAChB,MAAM,eAAe,CAAA;AAItB,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AAI3F,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAIrD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAIrE,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAI/C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAIlE,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,mBAAmB,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actuate-media/cms-core",
-  "version": "0.18.0",
+  "version": "0.20.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/actuate-media/actuatecms.git",