@actuate-media/cms-core 0.2.3 → 0.3.1

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 Actuate Media
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 Actuate Media
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/__tests__/auth/session.test.js

@@ -51,7 +51,7 @@ describe('refreshSession', () => {
     it('returns a new valid token with the same payload', async () => {
         const original = await createSession(TEST_PAYLOAD, {
             secret: TEST_SECRET,
-            maxAge: 2,
+            maxAge: 10,
         });
         await new Promise((resolve) => setTimeout(resolve, 1100));
         const refreshed = await refreshSession(original, { secret: TEST_SECRET });

package/dist/__tests__/auth/session.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.test.js","sourceRoot":"","sources":["../../../src/__tests__/auth/session.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAErF,MAAM,WAAW,GAAG,+CAA+C,CAAC;AAEpE,MAAM,YAAY,GAAG;IACnB,MAAM,EAAE,UAAU;IAClB,IAAI,EAAE,OAAO;IACb,SAAS,EAAE,aAAa;CACzB,CAAC;AAEF,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACzE,MAAM,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACpE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACpE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE;YAC9C,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,CAAC;SACV,CAAC,CAAC;QAEH,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QAE1D,MAAM,MAAM,CACV,aAAa,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAC9C,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QAEzE,MAAM,MAAM,CACV,aAAa,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC,CACzE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC;QAE9C,MAAM,MAAM,CACV,aAAa,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CACjD,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE;YACjD,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,CAAC;SACV,CAAC,CAAC;QAEH,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QAE1D,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QAE1E,MAAM,CAAC,OAAO,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAErC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"session.test.js","sourceRoot":"","sources":["../../../src/__tests__/auth/session.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAErF,MAAM,WAAW,GAAG,+CAA+C,CAAC;AAEpE,MAAM,YAAY,GAAG;IACnB,MAAM,EAAE,UAAU;IAClB,IAAI,EAAE,OAAO;IACb,SAAS,EAAE,aAAa;CACzB,CAAC;AAEF,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACzE,MAAM,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACpE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACpE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE;YAC9C,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,CAAC;SACV,CAAC,CAAC;QAEH,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QAE1D,MAAM,MAAM,CACV,aAAa,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAC9C,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QAEzE,MAAM,MAAM,CACV,aAAa,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC,CACzE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC;QAE9C,MAAM,MAAM,CACV,aAAa,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CACjD,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE;YACjD,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,EAAE;SACX,CAAC,CAAC;QAEH,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QAE1D,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QAE1E,MAAM,CAAC,OAAO,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAErC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/api/handler-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler-factory.d.ts","sourceRoot":"","sources":["../../src/api/handler-factory.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,uBAAuB;IACtC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7C;AAMD,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,uBAA4B,IA4DtC,SAAS,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC,CA0FnE"}
+{"version":3,"file":"handler-factory.d.ts","sourceRoot":"","sources":["../../src/api/handler-factory.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,uBAAuB;IACtC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7C;AAID,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,uBAA4B,IA4DtC,SAAS,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC,CA0GnE"}

package/dist/api/handler-factory.js

@@ -1,12 +1,13 @@
-import { createApiRouter } from './index.js';
+import { createRequire } from 'node:module';
+import { createApiRouter } from './router.js';
 import { registerCMSRoutes, parseCookieHeader } from './handlers.js';
 import { initDB, isDBInitialized } from '../db.js';
 import { validateCsrfToken } from '../security/index.js';
 import { createRateLimiter } from '../security/rate-limit.js';
 import { autoSeedAdmin } from '../setup/index.js';
-import { createGraphQLHandler } from '../graphql/index.js';
+const _require = createRequire(import.meta.url);
+const { version: CMS_CORE_VERSION } = _require('../../package.json');
 let cachedGraphQL = null;
-const CMS_CORE_VERSION = '0.1.0';
 export function handleActuateAPI(options = {}) {
     globalThis.__actuateCoreVersion = CMS_CORE_VERSION;
     if (options.config) {
@@ -57,83 +58,99 @@ export function handleActuateAPI(options = {}) {
     registerCMSRoutes(router);
     let dbChecked = false;
     return async function handler(request) {
-        if (!isDBInitialized()) {
-            const client = options.prismaClient ?? (options.prismaClientGetter ? await options.prismaClientGetter() : null);
-            if (client) {
-                initDB(client);
-                autoSeedAdmin(client).catch(() => { });
-            }
-        }
-        if (!dbChecked) {
-            dbChecked = true;
-            try {
-                const client = options.prismaClient;
+        try {
+            if (!isDBInitialized()) {
+                const client = options.prismaClient ?? (options.prismaClientGetter ? await options.prismaClientGetter() : null);
                 if (client) {
-                    const required = ['document', 'user', 'session', 'media'];
-                    const missing = required.filter(m => !(m in client));
-                    if (missing.length > 0) {
-                        console.warn(`[Actuate CMS] Prisma client is missing models: ${missing.join(', ')}. `
-                            + 'CMS features that depend on these models will return empty results. '
-                            + 'Add the CMS schema to your project: see @actuate-media/cms-core/prisma/schema');
-                    }
+                    initDB(client);
+                    autoSeedAdmin(client).catch(() => { });
                 }
             }
-            catch { }
-        }
-        const url = new URL(request.url);
-        const originalPath = url.pathname;
-        if (originalPath === '/api/cms/graphql' || originalPath.startsWith('/api/cms/graphql')) {
-            const secret = process.env.CMS_SECRET;
-            if (!secret || secret.length < 32) {
-                return new Response(JSON.stringify({ error: 'Server misconfiguration' }), {
-                    status: 500,
-                    headers: { 'Content-Type': 'application/json' },
-                });
-            }
-            const clientIp = request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ?? 'unknown';
-            const rateLimitResult = await rateLimiter.check(clientIp);
-            if (!rateLimitResult.allowed) {
-                return new Response(JSON.stringify({ error: 'Too many requests' }), {
-                    status: 429,
-                    headers: {
-                        'Content-Type': 'application/json',
-                        'Retry-After': rateLimitResult.retryAfter?.toString() ?? '60',
-                    },
-                });
+            if (!dbChecked) {
+                dbChecked = true;
+                try {
+                    const client = options.prismaClient;
+                    if (client) {
+                        const required = ['document', 'user', 'session', 'media'];
+                        const missing = required.filter(m => !(m in client));
+                        if (missing.length > 0) {
+                            console.warn(`[Actuate CMS] Prisma client is missing models: ${missing.join(', ')}. `
+                                + 'CMS features that depend on these models will return empty results. '
+                                + 'Add the CMS schema to your project: see @actuate-media/cms-core/prisma/schema');
+                        }
+                    }
+                }
+                catch { }
             }
-            if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(request.method)) {
-                const csrfToken = request.headers.get('x-csrf-token');
-                const csrfCookie = parseCookieHeader(request.headers.get('cookie') ?? '')['actuate_csrf'];
-                if (!csrfToken || !csrfCookie || !validateCsrfToken(csrfToken, csrfCookie)) {
-                    return new Response(JSON.stringify({ error: 'Invalid CSRF token' }), {
-                        status: 403,
+            const url = new URL(request.url);
+            const originalPath = url.pathname;
+            if (originalPath === '/api/cms/graphql' || originalPath.startsWith('/api/cms/graphql')) {
+                const secret = process.env.CMS_SECRET;
+                if (!secret || secret.length < 32) {
+                    return new Response(JSON.stringify({ error: 'Server misconfiguration' }), {
+                        status: 500,
                         headers: { 'Content-Type': 'application/json' },
                     });
                 }
-            }
-            const config = globalThis.__actuateConfig;
-            if (config) {
-                if (!cachedGraphQL) {
-                    cachedGraphQL = createGraphQLHandler({ config, secret });
+                const clientIp = request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ?? 'unknown';
+                const rateLimitResult = await rateLimiter.check(clientIp);
+                if (!rateLimitResult.allowed) {
+                    return new Response(JSON.stringify({ error: 'Too many requests' }), {
+                        status: 429,
+                        headers: {
+                            'Content-Type': 'application/json',
+                            'Retry-After': rateLimitResult.retryAfter?.toString() ?? '60',
+                        },
+                    });
                 }
-                return cachedGraphQL.handle(request);
+                if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(request.method)) {
+                    const csrfToken = request.headers.get('x-csrf-token');
+                    const csrfCookie = parseCookieHeader(request.headers.get('cookie') ?? '')['actuate_csrf'];
+                    if (!csrfToken || !csrfCookie || !validateCsrfToken(csrfToken, csrfCookie)) {
+                        return new Response(JSON.stringify({ error: 'Invalid CSRF token' }), {
+                            status: 403,
+                            headers: { 'Content-Type': 'application/json' },
+                        });
+                    }
+                }
+                const config = globalThis.__actuateConfig;
+                if (config) {
+                    if (!cachedGraphQL) {
+                        const { createGraphQLHandler } = await import('../graphql/index.js');
+                        cachedGraphQL = createGraphQLHandler({ config, secret });
+                    }
+                    return cachedGraphQL.handle(request);
+                }
+            }
+            const cmsPrefix = '/api/cms';
+            if (originalPath.startsWith(cmsPrefix)) {
+                const strippedPath = originalPath.slice(cmsPrefix.length) || '/';
+                const rewrittenUrl = new URL(strippedPath, url.origin);
+                rewrittenUrl.search = url.search;
+                const rewrittenRequest = new Request(rewrittenUrl.toString(), {
+                    method: request.method,
+                    headers: request.headers,
+                    body: request.body,
+                    // @ts-ignore -- duplex is needed for streaming bodies
+                    duplex: 'half',
+                });
+                return router.handle(rewrittenRequest);
             }
+            return router.handle(request);
         }
-        const cmsPrefix = '/api/cms';
-        if (originalPath.startsWith(cmsPrefix)) {
-            const strippedPath = originalPath.slice(cmsPrefix.length) || '/';
-            const rewrittenUrl = new URL(strippedPath, url.origin);
-            rewrittenUrl.search = url.search;
-            const rewrittenRequest = new Request(rewrittenUrl.toString(), {
-                method: request.method,
-                headers: request.headers,
-                body: request.body,
-                // @ts-ignore -- duplex is needed for streaming bodies
-                duplex: 'half',
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            const stack = err instanceof Error ? err.stack : undefined;
+            console.error(`[Actuate CMS] Unhandled error in API handler: ${message}`, stack);
+            const isDev = process.env.NODE_ENV !== 'production';
+            return new Response(JSON.stringify({
+                error: 'Internal CMS error',
+                ...(isDev && { detail: message, stack }),
+            }), {
+                status: 500,
+                headers: { 'Content-Type': 'application/json' },
             });
-            return router.handle(rewrittenRequest);
         }
-        return router.handle(request);
     };
 }
 //# sourceMappingURL=handler-factory.js.map

package/dist/api/handler-factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"handler-factory.js","sourceRoot":"","sources":["../../src/api/handler-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAQ3D,IAAI,aAAa,GAAmD,IAAI,CAAC;AAEzE,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAEjC,MAAM,UAAU,gBAAgB,CAAC,UAAmC,EAAE;IACnE,UAAkB,CAAC,oBAAoB,GAAG,gBAAgB,CAAC;IAE5D,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QAClB,UAAkB,CAAC,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC;QAErD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAa,CAAC;QACrC,MAAM,KAAK,GAAU,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;oBACjC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC;QACA,MAAc,CAAC,YAAY,GAAG,KAAK,CAAC;IACvC,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IAEjC,MAAM,WAAW,GAAG,iBAAiB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;IAE7E,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;QAC5F,MAAM,eAAe,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;YAC7B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAE;gBAClE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,eAAe,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,IAAI;iBAC9D;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAChE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,UAAU,GAAG,CAAC,aAAa,EAAE,cAAc,EAAE,qBAAqB,EAAE,aAAa,CAAC,CAAC;YACzF,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;mBAC7D,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAErD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBACtD,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC;gBAC1F,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;oBAC3E,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE;wBACnE,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;qBAChD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAE1B,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,OAAO,KAAK,UAAU,OAAO,CAAC,OAAgB;QAC5C,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAChH,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,CAAC,MAAM,CAAC,CAAC;gBACf,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAS,GAAG,IAAI,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,OAAO,CAAC,YAAmD,CAAC;gBAC3E,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,QAAQ,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;oBAC1D,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC;oBACrD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACvB,OAAO,CAAC,IAAI,CACV,kDAAkD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;8BACtE,sEAAsE;8BACtE,+EAA+E,CAClF,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC;QAElC,IAAI,YAAY,KAAK,kBAAkB,IAAI,YAAY,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACvF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;YACtC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;gBAClC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,EAAE;oBACxE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAChD,CAAC,CAAC;YACL,CAAC;YAED,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;YAC5F,MAAM,eAAe,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC1D,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;gBAC7B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAE;oBAClE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,aAAa,EAAE,eAAe,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,IAAI;qBAC9D;iBACF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBACtD,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC;gBAC1F,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;oBAC3E,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE;wBACnE,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;qBAChD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAI,UAAkB,CAAC,eAAe,CAAC;YACnD,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,aAAa,EAAE,CAAC;oBACnB,aAAa,GAAG,oBAAoB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC3D,CAAC;gBACD,OAAO,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,UAAU,CAAC;QAC7B,IAAI,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;YACjE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACvD,YAAY,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YAEjC,MAAM,gBAAgB,GAAG,IAAI,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE;gBAC5D,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,sDAAsD;gBACtD,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;YAEH,OAAO,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACzC,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"handler-factory.js","sourceRoot":"","sources":["../../src/api/handler-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChD,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,QAAQ,CAAC,oBAAoB,CAAwB,CAAC;AAQ5F,IAAI,aAAa,GAAyF,IAAI,CAAC;AAE/G,MAAM,UAAU,gBAAgB,CAAC,UAAmC,EAAE;IACnE,UAAkB,CAAC,oBAAoB,GAAG,gBAAgB,CAAC;IAE5D,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QAClB,UAAkB,CAAC,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC;QAErD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAa,CAAC;QACrC,MAAM,KAAK,GAAU,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;oBACjC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC;QACA,MAAc,CAAC,YAAY,GAAG,KAAK,CAAC;IACvC,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IAEjC,MAAM,WAAW,GAAG,iBAAiB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;IAE7E,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;QAC5F,MAAM,eAAe,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;YAC7B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAE;gBAClE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,eAAe,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,IAAI;iBAC9D;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAChE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,UAAU,GAAG,CAAC,aAAa,EAAE,cAAc,EAAE,qBAAqB,EAAE,aAAa,CAAC,CAAC;YACzF,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;mBAC7D,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAErD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBACtD,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC;gBAC1F,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;oBAC3E,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE;wBACnE,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;qBAChD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAE1B,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,OAAO,KAAK,UAAU,OAAO,CAAC,OAAgB;QAC5C,IAAI,CAAC;YACH,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAChH,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,CAAC,MAAM,CAAC,CAAC;oBACf,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACxC,CAAC;YACH,CAAC;YAED,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,SAAS,GAAG,IAAI,CAAC;gBACjB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,OAAO,CAAC,YAAmD,CAAC;oBAC3E,IAAI,MAAM,EAAE,CAAC;wBACX,MAAM,QAAQ,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;wBAC1D,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC;wBACrD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BACvB,OAAO,CAAC,IAAI,CACV,kDAAkD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;kCACtE,sEAAsE;kCACtE,+EAA+E,CAClF,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACZ,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC;YAElC,IAAI,YAAY,KAAK,kBAAkB,IAAI,YAAY,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACvF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;gBACtC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;oBAClC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,EAAE;wBACxE,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;qBAChD,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;gBAC5F,MAAM,eAAe,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC1D,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;oBAC7B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAE;wBAClE,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE;4BACP,cAAc,EAAE,kBAAkB;4BAClC,aAAa,EAAE,eAAe,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,IAAI;yBAC9D;qBACF,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAChE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;oBACtD,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC;oBAC1F,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;wBAC3E,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE;4BACnE,MAAM,EAAE,GAAG;4BACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;yBAChD,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAED,MAAM,MAAM,GAAI,UAAkB,CAAC,eAAe,CAAC;gBACnD,IAAI,MAAM,EAAE,CAAC;oBACX,IAAI,CAAC,aAAa,EAAE,CAAC;wBACnB,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;wBACrE,aAAa,GAAG,oBAAoB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;oBAC3D,CAAC;oBACD,OAAO,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC;YAED,MAAM,SAAS,GAAG,UAAU,CAAC;YAC7B,IAAI,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvC,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;gBACjE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBACvD,YAAY,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;gBAEjC,MAAM,gBAAgB,GAAG,IAAI,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE;oBAC5D,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,sDAAsD;oBACtD,MAAM,EAAE,MAAM;iBACf,CAAC,CAAC;gBAEH,OAAO,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACzC,CAAC;YAED,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3D,OAAO,CAAC,KAAK,CAAC,iDAAiD,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;YAEjF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;YACpD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;gBACjC,KAAK,EAAE,oBAAoB;gBAC3B,GAAG,CAAC,KAAK,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;aACzC,CAAC,EAAE;gBACF,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/api/handlers.d.ts

@@ -1,4 +1,4 @@
-import type { ApiRouter } from './index.js';
+import type { ApiRouter } from './router.js';
 export declare function parseCookieHeader(cookieHeader: string): Record<string, string>;
 export declare function registerCMSRoutes(router: ApiRouter): void;
 //# sourceMappingURL=handlers.d.ts.map

package/dist/api/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/api/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AA2L5C,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS9E;AAyDD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAs0EzD"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/api/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAkN7C,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS9E;AAiED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAk8EzD"}

package/dist/api/handlers.js

@@ -64,9 +64,18 @@ function modelNotAvailable(name) {
 }
 async function safeCount(model, where) {
     try {
-        if (!model?.count)
+        if (!model || typeof model !== 'object')
             return 0;
-        return await model.count(where ? { where } : undefined);
+        let countFn;
+        try {
+            countFn = model.count;
+        }
+        catch {
+            return 0;
+        }
+        if (typeof countFn !== 'function')
+            return 0;
+        return await countFn.call(model, where ? { where } : undefined);
     }
     catch {
         return 0;
@@ -74,9 +83,18 @@ async function safeCount(model, where) {
 }
 async function safeFindMany(model, args) {
     try {
-        if (!model?.findMany)
+        if (!model || typeof model !== 'object')
+            return [];
+        let findManyFn;
+        try {
+            findManyFn = model.findMany;
+        }
+        catch {
+            return [];
+        }
+        if (typeof findManyFn !== 'function')
             return [];
-        return await model.findMany(args);
+        return await findManyFn.call(model, args);
     }
     catch {
         return [];
@@ -107,22 +125,44 @@ function isAllowedStorageUrl(url) {
 const ALLOWED_SORT_FIELDS = new Set([
     'createdAt', 'updatedAt', 'publishedAt', 'status', 'collection',
 ]);
+let _secretMissing = false;
+let _secretWarningLogged = false;
 function getSessionSecret() {
     const secret = process.env.CMS_SECRET
         ?? process.env.CMS_SESSION_SECRET
         ?? globalThis.__actuateConfig?.secret;
     if (!secret) {
-        throw new Error('[Actuate CMS] Missing CMS secret. Set the CMS_SECRET environment variable (min 32 characters) '
-            + 'or pass `secret` in your actuate.config.ts. '
-            + 'Generate one with: node -e "console.log(require(\'crypto\').randomBytes(32).toString(\'hex\'))"');
+        _secretMissing = true;
+        if (!_secretWarningLogged) {
+            _secretWarningLogged = true;
+            console.error('[Actuate CMS] Missing CMS secret. Set the CMS_SECRET environment variable (min 32 characters) '
+                + 'or pass `secret` in your actuate.config.ts. '
+                + 'Generate one with: node -e "console.log(require(\'crypto\').randomBytes(32).toString(\'hex\'))" '
+                + '-- All authenticated API routes will return 503 until this is configured.');
+        }
+        throw new Error('CMS secret not configured');
     }
     if (secret.length < 32) {
         throw new Error('[Actuate CMS] CMS secret must be at least 32 characters (got ' + secret.length + '). '
             + 'Generate a secure value with: node -e "console.log(require(\'crypto\').randomBytes(32).toString(\'hex\'))"');
     }
+    _secretMissing = false;
     return secret;
 }
+function isSecretMissing() {
+    if (_secretMissing)
+        return true;
+    try {
+        getSessionSecret();
+        return false;
+    }
+    catch {
+        return true;
+    }
+}
 async function extractSession(request) {
+    if (isSecretMissing())
+        return null;
     let token;
     const authHeader = request.headers.get('Authorization');
     if (authHeader?.startsWith('Bearer ')) {
@@ -163,6 +203,14 @@ export function parseCookieHeader(cookieHeader) {
     return cookies;
 }
 async function requireAuth(request) {
+    if (isSecretMissing()) {
+        return {
+            error: json({
+                error: 'CMS secret not configured. Set CMS_SECRET or CMS_SESSION_SECRET environment variable (min 32 characters).',
+                code: 'MISSING_SECRET',
+            }, 503),
+        };
+    }
     const session = await extractSession(request);
     if (!session) {
         return { error: errorResponse('Unauthorized', 401) };
@@ -206,16 +254,39 @@ class ModelNotAvailableError extends Error {
 export function registerCMSRoutes(router) {
     const rawDb = () => getDB();
     const db = () => {
-        const d = rawDb();
+        let d;
+        try {
+            d = rawDb();
+        }
+        catch (err) {
+            console.error('[actuate][db] Failed to obtain database client:', err instanceof Error ? err.message : err);
+            return new Proxy({}, {
+                get(_target, prop) {
+                    if (typeof prop !== 'string' || prop.startsWith('$') || prop === 'then')
+                        return undefined;
+                    return new Proxy({}, {
+                        get() { throw new ModelNotAvailableError(String(prop)); },
+                    });
+                },
+            });
+        }
         return new Proxy(d, {
             get(target, prop) {
-                const val = target[prop];
-                if (val !== undefined)
+                if (typeof prop !== 'string')
+                    return Reflect.get(target, prop);
+                if (prop.startsWith('$') || prop === 'then')
+                    return Reflect.get(target, prop);
+                let val;
+                try {
+                    val = target[prop];
+                }
+                catch {
+                    val = undefined;
+                }
+                if (val !== undefined && val !== null)
                     return val;
                 return new Proxy({}, {
-                    get() {
-                        throw new ModelNotAvailableError(String(prop));
-                    },
+                    get() { throw new ModelNotAvailableError(String(prop)); },
                 });
             },
         });
@@ -253,17 +324,17 @@ export function registerCMSRoutes(router) {
         });
     });
     router.get('/docs', async () => {
-        const html = `<!DOCTYPE html>
-<html>
-<head>
-  <title>Actuate CMS API Reference</title>
-  <meta charset="utf-8" />
-  <meta name="viewport" content="width=device-width, initial-scale=1" />
-</head>
-<body>
-  <script id="api-reference" data-url="/api/cms/openapi.json"></script>
-  <script src="https://cdn.jsdelivr.net/npm/@scalar/api-reference"></script>
-</body>
+        const html = `<!DOCTYPE html>
+<html>
+<head>
+  <title>Actuate CMS API Reference</title>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+</head>
+<body>
+  <script id="api-reference" data-url="/api/cms/openapi.json"></script>
+  <script src="https://cdn.jsdelivr.net/npm/@scalar/api-reference"></script>
+</body>
 </html>`;
         return new Response(html, {
             status: 200,
@@ -1205,13 +1276,117 @@ export function registerCMSRoutes(router) {
     // ---------------------------------------------------------------------------
     // Stats route
     // ---------------------------------------------------------------------------
+    // ---------------------------------------------------------------------------
+    // Health endpoint -- reports available models and CMS version
+    // ---------------------------------------------------------------------------
+    const CMS_EXPECTED_MODELS = [
+        'document', 'media', 'user', 'session', 'version',
+        'folder', 'redirect', 'formSubmission', 'auditLog',
+        'webhookEndpoint', 'webhookDeliveryLog',
+    ];
+    router.get('/health', async () => {
+        const cmsVersion = globalThis.__actuateCoreVersion ?? '0.0.0';
+        const models = {};
+        let d;
+        try {
+            d = db();
+        }
+        catch {
+            for (const m of CMS_EXPECTED_MODELS)
+                models[m] = false;
+            return json({
+                data: {
+                    status: 'degraded',
+                    version: cmsVersion,
+                    secretConfigured: !isSecretMissing(),
+                    models,
+                    databaseConnected: false,
+                },
+            });
+        }
+        let dbConnected = true;
+        for (const modelName of CMS_EXPECTED_MODELS) {
+            try {
+                const model = d[modelName];
+                if (model && typeof model.count === 'function') {
+                    await model.count({ take: 0 });
+                    models[modelName] = true;
+                }
+                else {
+                    models[modelName] = false;
+                }
+            }
+            catch {
+                models[modelName] = false;
+                if (modelName === CMS_EXPECTED_MODELS[0]) {
+                    dbConnected = false;
+                }
+            }
+        }
+        const allAvailable = Object.values(models).every(Boolean);
+        return json({
+            data: {
+                status: allAvailable ? 'healthy' : 'degraded',
+                version: cmsVersion,
+                secretConfigured: !isSecretMissing(),
+                models,
+                databaseConnected: dbConnected,
+            },
+        });
+    });
+    // ---------------------------------------------------------------------------
+    // Stats route
+    // ---------------------------------------------------------------------------
+    const EMPTY_STATS = {
+        totalDocuments: 0,
+        totalMedia: 0,
+        totalUsers: 0,
+        collectionCounts: {},
+        recentDocuments: [],
+    };
+    async function safeGroupBy(model) {
+        try {
+            if (!model || typeof model !== 'object')
+                return {};
+            let groupByFn;
+            try {
+                groupByFn = model.groupBy;
+            }
+            catch {
+                return {};
+            }
+            if (typeof groupByFn !== 'function')
+                return {};
+            const groups = await groupByFn.call(model, {
+                by: ['collection'],
+                where: { deletedAt: null },
+                _count: { _all: true },
+            });
+            const result = {};
+            for (const g of groups) {
+                result[g.collection] = g._count._all;
+            }
+            return result;
+        }
+        catch {
+            return {};
+        }
+    }
     router.get('/stats', async (request) => {
         try {
-            const auth = await requireAuth(request);
-            if (auth.error)
-                return auth.error;
-            const d = db();
-            const [docResult, mediaResult, userResult, recentResult] = await Promise.allSettled([
+            if (!isSecretMissing()) {
+                const auth = await requireAuth(request);
+                if (auth.error)
+                    return auth.error;
+            }
+            let d;
+            try {
+                d = db();
+            }
+            catch {
+                return json({ data: EMPTY_STATS });
+            }
+            const [docResult, mediaResult, userResult, recentResult, groupResult] = await Promise.allSettled([
                 safeCount(d.document, { deletedAt: null }),
                 safeCount(d.media),
                 safeCount(d.user),
@@ -1219,19 +1394,25 @@ export function registerCMSRoutes(router) {
                     where: { deletedAt: null },
                     orderBy: { updatedAt: 'desc' },
                     take: 10,
+                    select: {
+                        id: true, title: true, status: true, collection: true,
+                        updatedAt: true, createdById: true,
+                    },
                 }),
+                safeGroupBy(d.document),
             ]);
             return json({
                 data: {
                     totalDocuments: docResult.status === 'fulfilled' ? docResult.value : 0,
                     totalMedia: mediaResult.status === 'fulfilled' ? mediaResult.value : 0,
                     totalUsers: userResult.status === 'fulfilled' ? userResult.value : 0,
+                    collectionCounts: groupResult.status === 'fulfilled' ? groupResult.value : {},
                     recentDocuments: recentResult.status === 'fulfilled' ? recentResult.value : [],
                 },
             });
         }
-        catch (err) {
-            return json({ data: { totalDocuments: 0, totalMedia: 0, totalUsers: 0, recentDocuments: [] } });
+        catch {
+            return json({ data: EMPTY_STATS });
         }
     });
     // ---------------------------------------------------------------------------