@actuate-media/cms-core 0.19.0 → 0.20.0

package/dist/api/handlers.js

@@ -864,6 +864,132 @@ export function registerCMSRoutes(router) {
             return internalError(err, 'login');
         }
     });
+    // ---------------------------------------------------------------------------
+    // Dev-only auth bypass — `GET /api/cms/dev/login`
+    //
+    // Triple-gated escape hatch for local development:
+    //   1. `ACTUATE_DEV_AUTH_BYPASS=1` must be set in the env, AND
+    //   2. `NODE_ENV` must NOT be `production`, AND
+    //   3. The request must originate from a loopback address (`127.*`, `::1`,
+    //      or `localhost`).
+    //
+    // If any gate fails the route returns 404 — indistinguishable from a route
+    // that doesn't exist, so probing prod can't even confirm the feature is
+    // compiled in.
+    //
+    // When all three pass we look up or create a synthetic admin user
+    // (`dev-bypass@actuate.local`), mint a real session JWT (so every other
+    // route does normal session verification), set the `actuate_session`
+    // cookie, and 302 → `/securelogin`. The result is a fully-real session;
+    // only the credential check was skipped.
+    // ---------------------------------------------------------------------------
+    const handleDevLogin = async (request) => {
+        if (process.env.ACTUATE_DEV_AUTH_BYPASS !== '1')
+            return errorResponse('Not found', 404);
+        if (process.env.NODE_ENV === 'production')
+            return errorResponse('Not found', 404);
+        const ip = getClientIp(request);
+        const ipIsLoopback = ip === '127.0.0.1' ||
+            ip === '::1' ||
+            ip === '::ffff:127.0.0.1' ||
+            ip === 'localhost' ||
+            ip.startsWith('127.');
+        // `getClientIp` returns `'unknown'` whenever no trusted proxy header is
+        // present, which is the default for `next dev` — there's no proxy in
+        // front of the dev server. In that case fall back to the request URL's
+        // hostname, which Next.js sets from the actual TCP connection. We only
+        // accept the literal loopback hostnames; anything else is rejected.
+        let isLoopback = ipIsLoopback;
+        if (!isLoopback && (ip === 'unknown' || !ip)) {
+            try {
+                const host = new URL(request.url).hostname;
+                isLoopback = host === 'localhost' || host === '127.0.0.1' || host === '::1';
+            }
+            catch {
+                isLoopback = false;
+            }
+        }
+        if (!isLoopback)
+            return errorResponse('Not found', 404);
+        try {
+            const d = getDB();
+            if (!hasModel(d, 'user')) {
+                return errorResponse('Dev bypass requires the User model — run prisma migrate first.', 500);
+            }
+            // Use the dedicated dev-bypass user if it already exists; otherwise
+            // mint one. The email is deliberately namespaced under `actuate.local`
+            // so it can never collide with a real user (which uses a real domain).
+            const DEV_BYPASS_EMAIL = 'dev-bypass@actuate.local';
+            let user = await d.user.findUnique({ where: { email: DEV_BYPASS_EMAIL } });
+            if (!user) {
+                try {
+                    user = await d.user.create({
+                        data: {
+                            email: DEV_BYPASS_EMAIL,
+                            name: 'Dev Bypass',
+                            role: 'ADMIN',
+                            // Bcrypt-shaped placeholder. No real password is ever set;
+                            // the user cannot log in through the normal flow.
+                            passwordHash: '$2b$10$dev.bypass.user.cannot.login.through.normal.flow',
+                        },
+                    });
+                }
+                catch (err) {
+                    console.error('[actuate][dev-bypass] user create failed:', err);
+                    throw err;
+                }
+            }
+            const tempSessionId = crypto.randomUUID();
+            const token = await createSession({ userId: user.id, role: user.role, sessionId: tempSessionId }, { secret: getSessionSecret() });
+            if (hasModel(d, 'session')) {
+                await d.session.create({
+                    data: {
+                        id: tempSessionId,
+                        userId: user.id,
+                        token,
+                        expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000),
+                        ipAddress: isResolvedIp(ip) ? ip : null,
+                        userAgent: request.headers.get('user-agent') ?? null,
+                    },
+                });
+            }
+            const csrfToken = await generateCsrfToken();
+            const sessionCookie = [
+                `actuate_session=${token}`,
+                'Path=/',
+                'HttpOnly',
+                'SameSite=Lax',
+                'Max-Age=604800',
+            ].join('; ');
+            const csrfCookie = [
+                `actuate_csrf=${csrfToken}`,
+                'Path=/',
+                'SameSite=Lax',
+                'Max-Age=86400',
+            ].join('; ');
+            // Redirect back to the admin so the cookie attaches on the next
+            // navigation. `?next=` lets callers steer to a specific deep link.
+            const url = new URL(request.url);
+            const nextPath = url.searchParams.get('next') ?? '/securelogin';
+            const safeNext = nextPath.startsWith('/') ? nextPath : '/securelogin';
+            console.warn(`[actuate][dev-bypass] Issued admin session for ${user.email} (${user.id}) — DO NOT USE IN PRODUCTION.`);
+            const response = new Response(null, {
+                status: 302,
+                headers: {
+                    Location: safeNext,
+                    ...SECURITY_HEADERS,
+                },
+            });
+            response.headers.append('Set-Cookie', sessionCookie);
+            response.headers.append('Set-Cookie', csrfCookie);
+            return response;
+        }
+        catch (err) {
+            return internalError(err, 'dev login');
+        }
+    };
+    router.get('/dev/login', handleDevLogin);
+    router.post('/dev/login', handleDevLogin);
     router.post('/auth/logout', async (request) => {
         try {
             const auth = await requireAuth(request);
@@ -2262,6 +2388,8 @@ export function registerCMSRoutes(router) {
         totalUsers: 0,
         formCount: 0,
         avgSeoScore: 0,
+        webhookCount: 0,
+        webhookActiveCount: 0,
         collectionCounts: {},
         statusCounts: {},
         recentDocuments: [],
@@ -2311,7 +2439,7 @@ export function registerCMSRoutes(router) {
             catch {
                 return json({ data: EMPTY_STATS });
             }
-            const [docResult, mediaResult, userResult, recentResult, collGroupResult, statusGroupResult, formResult, seoDocsResult,] = await Promise.allSettled([
+            const [docResult, mediaResult, userResult, recentResult, collGroupResult, statusGroupResult, formResult, seoDocsResult, webhookTotalResult, webhookActiveResult,] = await Promise.allSettled([
                 safeCount(d.document, { deletedAt: null }),
                 safeCount(d.media),
                 safeCount(d.user),
@@ -2337,6 +2465,11 @@ export function registerCMSRoutes(router) {
                     select: { data: true },
                     take: 200,
                 }),
+                // Cheap counts so the dashboard's "Content Delivery" tile doesn't need
+                // a second round-trip. `webhookEndpoint` may not exist on every host,
+                // so `safeCount` swallows missing-model errors and returns 0.
+                safeCount(d.webhookEndpoint),
+                safeCount(d.webhookEndpoint, { active: true }),
             ]);
             const collectionCounts = {};
             if (collGroupResult.status === 'fulfilled') {
@@ -2371,6 +2504,8 @@ export function registerCMSRoutes(router) {
                     totalUsers: userResult.status === 'fulfilled' ? userResult.value : 0,
                     formCount: formResult.status === 'fulfilled' ? formResult.value : 0,
                     avgSeoScore,
+                    webhookCount: webhookTotalResult.status === 'fulfilled' ? webhookTotalResult.value : 0,
+                    webhookActiveCount: webhookActiveResult.status === 'fulfilled' ? webhookActiveResult.value : 0,
                     collectionCounts,
                     statusCounts,
                     recentDocuments: recentDocs,
@@ -3238,10 +3373,31 @@ export function registerCMSRoutes(router) {
     // and the dynamic /og.png OG-image endpoint. These are unauthenticated by
     // design — search engines and social crawlers will fetch them.
     // ---------------------------------------------------------------------------
-    function siteUrlFromRequest(request) {
-        const cfg = getActuateConfig()?.seo;
-        if (cfg?.siteUrl)
-            return cfg.siteUrl.replace(/\/+$/, '');
+    /**
+     * Load the runtime config with DB-stored SEO overrides applied. Used by every
+     * public SEO surface (sitemap, robots, og.png) and by /resolve so admin edits
+     * in the Settings → SEO panel take effect without a redeploy.
+     *
+     * Falls back to the static config when no override row exists yet — first
+     * boot of a freshly-installed CMS keeps working.
+     */
+    async function loadEffectiveConfig() {
+        const base = getActuateConfig();
+        if (!base)
+            return null;
+        try {
+            const { getSeoOverrides, applySeoOverrides } = await import('../seo/config-store.js');
+            const overrides = await getSeoOverrides(db());
+            return applySeoOverrides(base, overrides);
+        }
+        catch {
+            return base;
+        }
+    }
+    function siteUrlFromRequest(request, cfg) {
+        const seo = (cfg ?? getActuateConfig())?.seo;
+        if (seo?.siteUrl)
+            return seo.siteUrl.replace(/\/+$/, '');
         // Fall back to the request origin so the routes work on preview deploys
         // before the integrator has configured siteUrl.
         try {
@@ -3252,13 +3408,13 @@ export function registerCMSRoutes(router) {
             return '';
         }
     }
-    function sitemapEligibleCollections() {
-        const cfg = getActuateConfig();
-        if (!cfg)
+    function sitemapEligibleCollections(cfg) {
+        const resolved = cfg ?? getActuateConfig();
+        if (!resolved)
             return [];
-        const excluded = new Set(cfg.seo?.sitemap?.excludeCollections ?? []);
+        const excluded = new Set(resolved.seo?.sitemap?.excludeCollections ?? []);
         const out = [];
-        for (const [slug, col] of Object.entries(cfg.collections ?? {})) {
+        for (const [slug, col] of Object.entries(resolved.collections ?? {})) {
             if (excluded.has(slug))
                 continue;
             if (col.seo?.excludeFromSitemap)
@@ -3269,11 +3425,11 @@ export function registerCMSRoutes(router) {
     }
     router.get('/sitemap.xml', async (request) => {
         try {
-            const cfg = getActuateConfig();
+            const cfg = await loadEffectiveConfig();
             if (cfg?.seo?.sitemap?.disabled)
                 return errorResponse('Sitemap disabled', 404);
-            const base = siteUrlFromRequest(request);
-            const cols = sitemapEligibleCollections();
+            const base = siteUrlFromRequest(request, cfg);
+            const cols = sitemapEligibleCollections(cfg);
             // Sitemap index points at /sitemaps/:slug.xml for each collection.
             const sitemaps = cols
                 .map((c) => [
@@ -3307,7 +3463,7 @@ export function registerCMSRoutes(router) {
     // require the `.xml` suffix in the handler.
     router.get('/sitemaps/:slug', async (request, params) => {
         try {
-            const cfg = getActuateConfig();
+            const cfg = await loadEffectiveConfig();
             if (cfg?.seo?.sitemap?.disabled)
                 return errorResponse('Sitemap disabled', 404);
             const slugParam = params.slug ?? '';
@@ -3319,7 +3475,7 @@ export function registerCMSRoutes(router) {
                 return errorResponse('Collection not found', 404);
             if (collection.seo?.excludeFromSitemap)
                 return errorResponse('Collection excluded from sitemap', 404);
-            const base = siteUrlFromRequest(request);
+            const base = siteUrlFromRequest(request, cfg);
             const docs = await db().document.findMany({
                 where: { collection: rawSlug, deletedAt: null, status: 'PUBLISHED' },
                 select: { slug: true, updatedAt: true, data: true },
@@ -3381,11 +3537,11 @@ export function registerCMSRoutes(router) {
     });
     router.get('/robots.txt', async (request) => {
         try {
-            const cfg = getActuateConfig();
+            const cfg = await loadEffectiveConfig();
             const seo = cfg?.seo;
             if (seo?.robots?.disabled)
                 return errorResponse('robots.txt disabled', 404);
-            const base = siteUrlFromRequest(request);
+            const base = siteUrlFromRequest(request, cfg);
             const sitemapUrl = seo?.sitemap?.disabled ? undefined : `${base}/api/cms/sitemap.xml`;
             const lines = [
                 'User-agent: *',
@@ -3435,7 +3591,7 @@ export function registerCMSRoutes(router) {
     });
     router.get('/og.png', async (request) => {
         try {
-            const cfg = getActuateConfig();
+            const cfg = await loadEffectiveConfig();
             if (cfg?.seo?.ogImage?.disabled)
                 return errorResponse('og.png disabled', 404);
             const url = new URL(request.url);
@@ -3639,6 +3795,109 @@ export function registerCMSRoutes(router) {
         }
     });
     // ---------------------------------------------------------------------------
+    // SEO config (admin-editable overrides for `actuate.config.ts` seo defaults)
+    // ---------------------------------------------------------------------------
+    /**
+     * Returns:
+     *   - `static`    → the SEO config from `actuate.config.ts` (read-only, code-level)
+     *   - `overrides` → the user-edited DB overrides (or null on first boot)
+     *   - `effective` → static + overrides merged (what the runtime actually uses)
+     *   - `collections` → list of collection slugs + labels the UI should iterate
+     *
+     * The UI uses `static` to show grey "default" placeholders, `overrides` to
+     * populate the form inputs, and writes back just the changed fields via PUT.
+     */
+    router.get('/seo/config', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const { getSeoOverrides, applySeoOverrides } = await import('../seo/config-store.js');
+            const staticCfg = getActuateConfig();
+            const overrides = await getSeoOverrides(db());
+            const effective = applySeoOverrides(staticCfg, overrides);
+            const collections = Object.entries(staticCfg?.collections ?? {})
+                .map(([slug, col]) => ({
+                slug,
+                label: col.labels?.plural ?? slug,
+                type: col.type ?? 'page',
+                urlPrefix: col.urlPrefix,
+                staticSeo: col.seo ?? null,
+                effectiveSeo: effective?.collections?.[slug]?.seo ?? null,
+            }))
+                .sort((a, b) => a.label.localeCompare(b.label));
+            return json({
+                data: {
+                    static: { site: staticCfg?.seo ?? null },
+                    overrides: overrides ?? null,
+                    effective: { site: effective?.seo ?? null },
+                    collections,
+                },
+            });
+        }
+        catch (err) {
+            return internalError(err, 'seo/config GET');
+        }
+    });
+    router.put('/seo/config', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = (await request.json().catch(() => null));
+            if (!body || typeof body !== 'object') {
+                return errorResponse('Request body must be an object', 400);
+            }
+            // Shallow shape validation — we don't want to mirror the entire type
+            // here (the config-store merger ignores unknown keys anyway), but we do
+            // want to reject obviously malformed payloads early so the UI gets a
+            // clear 400 instead of a silent no-op.
+            const site = body.site && typeof body.site === 'object' ? body.site : undefined;
+            const collections = body.collections && typeof body.collections === 'object' ? body.collections : undefined;
+            if (site === undefined && collections === undefined) {
+                return errorResponse('Body must include at least one of `site` or `collections`', 400);
+            }
+            const { putSeoOverrides, getSeoOverrides } = await import('../seo/config-store.js');
+            // Merge with whatever's currently stored so the UI can PATCH a single
+            // section without wiping the other — `PUT /seo/config { site: {...} }`
+            // shouldn't blow away per-collection settings.
+            const current = (await getSeoOverrides(db())) ?? {};
+            const next = {
+                site: site !== undefined ? site : current.site,
+                collections: collections !== undefined
+                    ? { ...(current.collections ?? {}), ...collections }
+                    : current.collections,
+            };
+            const saved = await putSeoOverrides(db(), next, auth.session.userId);
+            // Audit so changes to public SEO surface are traceable.
+            try {
+                await db().auditLog?.create?.({
+                    data: {
+                        action: 'update_seo_config',
+                        actorId: auth.session.userId,
+                        metadata: {
+                            siteKeys: Object.keys(site ?? {}),
+                            collectionKeys: Object.keys(collections ?? {}),
+                        },
+                    },
+                });
+            }
+            catch {
+                // Audit failures must never block the write.
+            }
+            return json({ data: saved });
+        }
+        catch (err) {
+            return internalError(err, 'seo/config PUT');
+        }
+    });
+    // ---------------------------------------------------------------------------
     // URL Resolution — maps a public URL path to its document
     // ---------------------------------------------------------------------------
     const MAX_RESOLVE_DEPTH = 10;
@@ -3862,8 +4121,9 @@ export function registerCMSRoutes(router) {
             // Compose page meta + JSON-LD up front so client renderers (Next.js
             // generateMetadata, plain SSR, MCP agents) don't have to re-derive
             // schema, OG tags, and canonical URLs from raw doc data. Reads the
-            // collection's SEO config and the site-wide SEO defaults.
-            const cfg = getActuateConfig();
+            // collection's SEO config and the site-wide SEO defaults — with
+            // DB overrides from /seo/config applied on top of the static config.
+            const cfg = await loadEffectiveConfig();
             const collectionDef = cfg?.collections?.[matchedCollection] ?? null;
             const { composePageMeta } = await import('../seo/page-meta.js');
             const composed = composePageMeta({
@@ -3879,7 +4139,7 @@ export function registerCMSRoutes(router) {
                 },
                 collection: collectionDef,
                 config: cfg ?? null,
-                siteUrl: siteUrlFromRequest(request),
+                siteUrl: siteUrlFromRequest(request, cfg),
             });
             return json({
                 data: {
@@ -5792,5 +6052,290 @@ export function registerCMSRoutes(router) {
             return internalError(err, 'page-builder fix-a11y');
         }
     });
+    /**
+     * Composite document audit — Slice F.
+     *
+     * Runs every scoring dimension plugin-ai exposes (SEO, readability,
+     * accessibility, freshness) plus structural sanity checks (missing
+     * title, missing meta description, alt-less images, thin body) and
+     * returns a single composite grade with per-dimension breakdowns.
+     *
+     * Two input modes:
+     *  - `{ collection, id }` — load the document from the DB and audit
+     *    its persisted content. Honors field-level access control.
+     *  - `{ title, body, ... }` — audit ad-hoc content without persisting,
+     *    used by inline AI co-author and live-preview drafts.
+     *
+     * Deterministic: makes no LLM calls, so it is cheap and safe to call
+     * on every save / debounced field edit. The expensive AI features
+     * (suggestions, rewrites) live in separate endpoints.
+     */
+    router.post('/ai/audit-document', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const body = (await request.json());
+            let auditModule;
+            try {
+                auditModule = await importAIPlugin();
+            }
+            catch {
+                return errorResponse('AI plugin is not installed. Install @actuate-media/plugin-ai to use document audit.', 501);
+            }
+            if (typeof auditModule?.auditDocument !== 'function') {
+                return errorResponse('AI plugin missing `auditDocument`. Upgrade @actuate-media/plugin-ai to >= 0.3.0.', 501);
+            }
+            // Branch A — load from DB.
+            if (body.collection && body.id) {
+                const scopeErr = requireCollectionScope(auth.session, body.collection, 'read');
+                if (scopeErr)
+                    return scopeErr;
+                const ctx = buildActionContext(auth.session, db());
+                const doc = (await getDocument(body.collection, body.id, ctx));
+                if (!doc)
+                    return errorResponse('Document not found', 404);
+                const data = (doc.data ?? {});
+                const pageSettings = (doc.pageSettings ?? {});
+                const titleStr = String(body.title ?? doc.title ?? data.title ?? data.name ?? '');
+                const bodyStr = String(body.body ?? data.body ?? data.content ?? data.excerpt ?? data.description ?? '');
+                const metaTitle = String(body.metaTitle ?? pageSettings.metaTitle ?? data.metaTitle ?? titleStr);
+                const metaDescription = String(body.metaDescription ??
+                    pageSettings.metaDescription ??
+                    data.metaDescription ??
+                    data.excerpt ??
+                    '');
+                const targetKeyword = body.targetKeyword
+                    ? body.targetKeyword
+                    : typeof pageSettings.targetKeyword === 'string'
+                        ? pageSettings.targetKeyword
+                        : typeof data.targetKeyword === 'string'
+                            ? data.targetKeyword
+                            : undefined;
+                const result = auditModule.auditDocument({
+                    title: titleStr,
+                    body: bodyStr,
+                    metaTitle,
+                    metaDescription,
+                    ...(targetKeyword ? { targetKeyword } : {}),
+                    ...(body.url ? { url: body.url } : {}),
+                    ...(body.headings ? { headings: body.headings } : {}),
+                    ...(body.images ? { images: body.images } : {}),
+                    ...(body.internalLinks ? { internalLinks: body.internalLinks } : {}),
+                    ...(body.externalLinks ? { externalLinks: body.externalLinks } : {}),
+                    ...(doc.publishedAt ? { publishedAt: doc.publishedAt } : {}),
+                    ...(doc.updatedAt ? { updatedAt: doc.updatedAt } : {}),
+                    ...(body.contentType ? { contentType: body.contentType } : {}),
+                });
+                return json({ data: result });
+            }
+            // Branch B — ad-hoc audit.
+            if (!body.title && !body.body) {
+                return errorResponse('Provide either { collection, id } to audit a stored document or at least { title } / { body } for an ad-hoc audit.', 400);
+            }
+            const result = auditModule.auditDocument({
+                title: body.title ?? '',
+                body: body.body ?? '',
+                ...(body.metaTitle ? { metaTitle: body.metaTitle } : {}),
+                ...(body.metaDescription ? { metaDescription: body.metaDescription } : {}),
+                ...(body.targetKeyword ? { targetKeyword: body.targetKeyword } : {}),
+                ...(body.url ? { url: body.url } : {}),
+                ...(body.headings ? { headings: body.headings } : {}),
+                ...(body.images ? { images: body.images } : {}),
+                ...(body.internalLinks ? { internalLinks: body.internalLinks } : {}),
+                ...(body.externalLinks ? { externalLinks: body.externalLinks } : {}),
+                ...(body.publishedAt ? { publishedAt: body.publishedAt } : {}),
+                ...(body.updatedAt ? { updatedAt: body.updatedAt } : {}),
+                ...(body.contentType ? { contentType: body.contentType } : {}),
+            });
+            return json({ data: result });
+        }
+        catch (err) {
+            return internalError(err, 'ai audit-document');
+        }
+    });
+    /**
+     * Internal link suggestions — Slice F.
+     *
+     * Given a body of content, scan published CMS documents for phrases the
+     * author could link to (by title or declared keywords) and return a
+     * ranked list of suggestions. The matching is deterministic (no LLM call)
+     * but expensive enough that we cap the candidate set and the response
+     * size to keep p99 under control.
+     *
+     * Optionally constrain candidates to a single collection (e.g. only
+     * suggest links to `services` while editing a blog post).
+     */
+    /**
+     * Inline AI co-author — text-transformation endpoints (Phase 2).
+     *
+     * Four micro-actions that operate on a chunk of text supplied by the
+     * caller: rewrite, expand, compress, proofread. They wrap the existing
+     * plugin-ai writing primitives so the admin and MCP clients have a
+     * stable HTTP surface.
+     *
+     * Every action is rate-limited under the same bucket as content
+     * generation (20 calls / hour / user) because each one hits the
+     * configured LLM provider.
+     */
+    router.post('/ai/coauthor', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            if (!(await checkRateLimitAsync(aiGenerateLimiter, `ai-coauthor:${auth.session.userId}`))) {
+                return errorResponse('AI co-author rate limit reached. Try again in an hour.', 429);
+            }
+            const body = (await request.json());
+            if (!body.text || typeof body.text !== 'string') {
+                return errorResponse('text is required', 400);
+            }
+            if (body.text.length > AI_CONTEXT_MAX_CHARS) {
+                return errorResponse(`text exceeds ${AI_CONTEXT_MAX_CHARS} character limit`, 400);
+            }
+            const action = body.action ?? 'rewrite';
+            if (!['rewrite', 'expand', 'compress', 'proofread'].includes(action)) {
+                return errorResponse(`Unknown action "${action}"`, 400);
+            }
+            let aiModule;
+            try {
+                aiModule = await importAIPlugin();
+            }
+            catch {
+                return errorResponse('AI plugin is not installed. Install @actuate-media/plugin-ai to use the co-author.', 501);
+            }
+            let result;
+            try {
+                if (action === 'rewrite') {
+                    if (typeof aiModule.rewrite !== 'function') {
+                        return errorResponse('AI plugin missing `rewrite`.', 501);
+                    }
+                    const text = (await aiModule.rewrite(body.text, body.style, body.tone));
+                    result = { text };
+                }
+                else if (action === 'expand') {
+                    if (typeof aiModule.expand !== 'function') {
+                        return errorResponse('AI plugin missing `expand`.', 501);
+                    }
+                    const text = (await aiModule.expand(body.text, body.instructions));
+                    result = { text };
+                }
+                else if (action === 'compress') {
+                    if (typeof aiModule.compress !== 'function') {
+                        return errorResponse('AI plugin missing `compress`.', 501);
+                    }
+                    const text = (await aiModule.compress(body.text, body.targetLength));
+                    result = { text };
+                }
+                else {
+                    if (typeof aiModule.proofread !== 'function') {
+                        return errorResponse('AI plugin missing `proofread`.', 501);
+                    }
+                    const r = (await aiModule.proofread(body.text));
+                    result = { text: r.corrected, changes: r.changes };
+                }
+            }
+            catch (err) {
+                // Surface provider errors (missing API key, rate-limited upstream) with
+                // a meaningful status code instead of 500.
+                const msg = err instanceof Error ? err.message : 'unknown';
+                if (msg.toLowerCase().includes('not configured') || msg.toLowerCase().includes('missing')) {
+                    return errorResponse(`AI provider is not configured: ${msg}`, 501);
+                }
+                throw err;
+            }
+            await logEvent({
+                event: 'settings_changed',
+                userId: auth.session.userId,
+                details: {
+                    action: `ai_coauthor_${action}`,
+                    inputChars: body.text.length,
+                    outputChars: result.text.length,
+                },
+            });
+            return json({ data: { action, ...result } });
+        }
+        catch (err) {
+            return internalError(err, 'ai coauthor');
+        }
+    });
+    router.post('/ai/suggest-internal-links', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const body = (await request.json());
+            if (!body.content || typeof body.content !== 'string') {
+                return errorResponse('content is required', 400);
+            }
+            const limit = Math.max(1, Math.min(50, typeof body.limit === 'number' ? body.limit : 10));
+            let aiModule;
+            try {
+                aiModule = await importAIPlugin();
+            }
+            catch {
+                return errorResponse('AI plugin is not installed. Install @actuate-media/plugin-ai to use internal link suggestions.', 501);
+            }
+            if (typeof aiModule?.suggestInternalLinks !== 'function') {
+                return errorResponse('AI plugin missing `suggestInternalLinks`. Upgrade @actuate-media/plugin-ai to >= 0.3.0.', 501);
+            }
+            const ctx = buildActionContext(auth.session, db());
+            // Pull up to 200 published candidates from the requested collection
+            // (or every readable collection when none is specified). We rely on
+            // listDocuments' built-in access control so the agent can't surface
+            // links to documents it isn't allowed to read.
+            const cfg = getActuateConfig();
+            const collectionSlugs = body.collection
+                ? [body.collection]
+                : Object.keys(cfg?.collections ?? {});
+            const pages = [];
+            for (const slug of collectionSlugs) {
+                const scopeErr = requireCollectionScope(auth.session, slug, 'read');
+                if (scopeErr)
+                    continue;
+                const listed = await listDocuments({ collection: slug, status: 'PUBLISHED', pageSize: 200 }, ctx);
+                for (const doc of listed.docs) {
+                    if (body.excludeId && doc.id === body.excludeId)
+                        continue;
+                    const data = (doc.data ?? {});
+                    const titleStr = String(doc.title ?? data.title ?? data.name ?? '');
+                    if (!titleStr.trim())
+                        continue;
+                    const slugStr = String(doc.slug ?? data.slug ?? doc.id);
+                    const url = `/${slug}/${slugStr}`;
+                    const keywords = [];
+                    if (Array.isArray(data.keywords)) {
+                        for (const k of data.keywords) {
+                            if (typeof k === 'string' && k.trim())
+                                keywords.push(k);
+                        }
+                    }
+                    if (Array.isArray(data.tags)) {
+                        for (const k of data.tags) {
+                            if (typeof k === 'string' && k.trim())
+                                keywords.push(k);
+                        }
+                    }
+                    pages.push({
+                        id: String(doc.id),
+                        title: titleStr,
+                        url,
+                        ...(keywords.length > 0 ? { keywords } : {}),
+                    });
+                }
+            }
+            const suggestions = await aiModule.suggestInternalLinks(body.content, pages);
+            const limited = suggestions.slice(0, limit);
+            return json({
+                data: {
+                    suggestions: limited,
+                    candidatesScanned: pages.length,
+                },
+            });
+        }
+        catch (err) {
+            return internalError(err, 'ai suggest-internal-links');
+        }
+    });
 }
 //# sourceMappingURL=handlers.js.map