@actuate-media/cms-core 0.30.0 → 0.31.0

package/dist/api/handlers.js

@@ -23,6 +23,8 @@ import { schedulingCronHandler } from '../scheduling/index.js';
 import { isAuthorizedCronRequest, processCleanup, processSeoScan } from '../cron/index.js';
 import { processContentHealthScan } from '../content-health/cron.js';
 import { verifyCaptcha, getCaptchaConfig } from '../security/captcha.js';
+import { listForms as listFormsService, getFormById as getFormByIdService, createForm as createFormService, updateForm as updateFormService, duplicateForm as duplicateFormService, deleteForm as deleteFormService, saveFormSchema as saveFormSchemaService, getFormSchema as getFormSchemaService, getNotificationSettings as getFormNotificationSettingsService, updateNotificationSettings as updateFormNotificationSettingsService, setNotifyEnabled as setFormNotifyEnabledService, getEmbedSettings as getFormEmbedSettingsService, updateEmbedSettings as updateFormEmbedSettingsService, getFormStats as getFormStatsService, getFormsSidebarCounts as getFormsSidebarCountsService, FormNotFoundError, FormValidationError, FormConflictError, FormHasSubmissionsError, } from '../forms/service.js';
+import { listEntries as listEntriesService, getEntryWithSchema as getEntryWithSchemaService, getEntryCounts as getEntryCountsService, updateEntry as updateEntryService, bulkUpdateEntries as bulkUpdateEntriesService, deleteEntry as deleteEntryService, } from '../forms/entries.js';
 import { checkForUpdates } from '../upgrade/version-check.js';
 import { createUpgradePR } from '../upgrade/upgrade-pr.js';
 import { encryptField, decryptField } from '../security/encrypted-fields.js';
@@ -246,17 +248,6 @@ function asRecord(value) {
         ? value
         : {};
 }
-function normalizeFormDocument(form, submissions = 0) {
-    const data = asRecord(form.data);
-    const fields = Array.isArray(data.fields) ? data.fields.length : Number(data.fields ?? 0);
-    return {
-        ...form,
-        name: data.name ?? form.name ?? form.title ?? 'Untitled form',
-        description: data.description ?? form.description ?? '',
-        fields,
-        submissions,
-    };
-}
 function normalizeSubmission(submission) {
     const data = asRecord(submission.data);
     const attribution = asRecord(submission.attribution);
@@ -281,6 +272,66 @@ function normalizeSubmission(submission) {
         },
     };
 }
+/**
+ * Map a forms-service domain error to an HTTP response. Returns `null` for
+ * unrecognised errors so the caller can fall through to `internalError`.
+ */
+function mapFormError(err) {
+    if (err instanceof FormNotFoundError)
+        return errorResponse(err.message, 404);
+    if (err instanceof FormValidationError) {
+        return json({ error: err.message, code: 'INVALID_SCHEMA', details: err.errors }, 400);
+    }
+    if (err instanceof FormConflictError)
+        return errorResponse(err.message, 409);
+    if (err instanceof FormHasSubmissionsError) {
+        return json({ error: err.message, code: 'FORM_HAS_SUBMISSIONS', submissionCount: err.submissionCount }, 409);
+    }
+    return null;
+}
+function parseFormsQuery(url) {
+    const sp = url.searchParams;
+    const status = sp.get('status');
+    const notify = sp.get('notifyEnabled');
+    return {
+        search: sp.get('search') ?? undefined,
+        status: status === 'active' || status === 'draft' || status === 'archived' ? status : undefined,
+        notifyEnabled: notify == null ? undefined : notify === 'true',
+        sortBy: sp.get('sortBy') ?? undefined,
+        sortDirection: sp.get('sortDirection') === 'asc'
+            ? 'asc'
+            : sp.get('sortDirection') === 'desc'
+                ? 'desc'
+                : undefined,
+        page: sp.get('page') ? Number(sp.get('page')) : undefined,
+        pageSize: sp.get('pageSize') ? Number(sp.get('pageSize')) : undefined,
+    };
+}
+function parseEntriesQuery(url) {
+    const sp = url.searchParams;
+    const spam = sp.get('spamStatus');
+    const boolParam = (key) => {
+        const v = sp.get(key);
+        return v == null ? undefined : v === 'true';
+    };
+    return {
+        search: sp.get('search') ?? undefined,
+        formId: sp.get('formId') ?? sp.get('form') ?? undefined,
+        unread: boolParam('unread'),
+        starred: boolParam('starred'),
+        archived: boolParam('archived'),
+        spamStatus: spam === 'clean' || spam === 'suspected' || spam === 'spam'
+            ? spam
+            : undefined,
+        dateFrom: sp.get('dateFrom') ?? undefined,
+        dateTo: sp.get('dateTo') ?? undefined,
+        thisWeek: boolParam('thisWeek'),
+        sortBy: sp.get('sortBy') ?? undefined,
+        sortDirection: sp.get('sortDirection') === 'asc' ? 'asc' : undefined,
+        page: sp.get('page') ? Number(sp.get('page')) : undefined,
+        pageSize: sp.get('pageSize') ? Number(sp.get('pageSize')) : undefined,
+    };
+}
 function normalizeRedirect(redirect) {
     return {
         ...redirect,
@@ -3992,35 +4043,17 @@ export function registerCMSRoutes(router) {
             const roleErr = requireRole(auth.session.role, WRITE_ROLES);
             if (roleErr)
                 return roleErr;
-            const d = db();
-            const forms = await d.document.findMany({
-                where: { collection: 'forms', deletedAt: null },
-                orderBy: { createdAt: 'desc' },
-            });
-            // Single grouped count is far cheaper than N+1 count() per form once
-            // the dashboard grows past a handful of forms. Fall back to per-form
-            // .count() when the consumer's Prisma client doesn't expose groupBy
-            // (older schemas, custom adapters).
-            let submissionCounts = new Map();
-            if (hasModel(d, 'formSubmission') && forms.length > 0) {
-                const ids = forms.map((f) => f.id);
-                if (typeof d.formSubmission.groupBy === 'function') {
-                    const grouped = await d.formSubmission.groupBy({
-                        by: ['formId'],
-                        where: { formId: { in: ids } },
-                        _count: { _all: true },
-                    });
-                    submissionCounts = new Map(grouped.map((g) => [g.formId, g._count._all]));
-                }
-                else {
-                    for (const id of ids) {
-                        const count = await d.formSubmission.count({ where: { formId: id } });
-                        submissionCounts.set(id, count);
-                    }
-                }
-            }
-            const normalized = forms.map((form) => normalizeFormDocument(form, submissionCounts.get(form.id) ?? 0));
-            return json({ data: normalized });
+            const url = new URL(request.url);
+            const { forms, total, page, pageSize } = await listFormsService(parseFormsQuery(url));
+            // Response is a superset of the typed FormDefinition with legacy aliases
+            // (`submissions`, `fieldCount`) so older admin views keep working while
+            // PR3 migrates them to the typed shape.
+            const data = forms.map((f) => ({
+                ...f,
+                fieldCount: f.fields?.length ?? 0,
+                submissions: f.totalEntries ?? 0,
+            }));
+            return json({ data, total, page, pageSize });
         }
         catch (err) {
             return internalError(err);
@@ -4127,6 +4160,348 @@ export function registerCMSRoutes(router) {
         }
     });
     // ---------------------------------------------------------------------------
+    // Forms management routes (admin) — services in ../forms/*.
+    //
+    // Route order matters: the router matches the first registered pattern, and
+    // `:id` is a greedy `[^/]+`. All static `/forms/<word>` GETs are registered
+    // before `/forms/:id` so e.g. `/forms/entries` is not captured as an id.
+    // ---------------------------------------------------------------------------
+    router.get('/forms/stats', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            return json({ data: await getFormStatsService() });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.get('/forms/sidebar-counts', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            return json({ data: await getFormsSidebarCountsService() });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.get('/forms/entries/counts', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const counts = await getEntryCountsService(parseEntriesQuery(new URL(request.url)));
+            return json({ data: counts });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.get('/forms/entries/:entryId', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const result = await getEntryWithSchemaService(params.entryId);
+            if (!result)
+                return errorResponse('Entry not found', 404);
+            return json({ data: result });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.patch('/forms/entries/:entryId', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = (await request.json().catch(() => ({})));
+            const ctx = buildActionContext(auth.session, db());
+            const updated = await updateEntryService(ctx, params.entryId, body);
+            if (!updated)
+                return errorResponse('Entry not found', 404);
+            return json({ data: updated });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.delete('/forms/entries/:entryId', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const ctx = buildActionContext(auth.session, db());
+            await deleteEntryService(ctx, params.entryId);
+            return json({ data: { success: true } });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.post('/forms/entries/bulk', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = (await request.json().catch(() => ({})));
+            if (!Array.isArray(body.ids) || body.ids.length === 0) {
+                return errorResponse('"ids" must be a non-empty array', 400);
+            }
+            const ctx = buildActionContext(auth.session, db());
+            const count = await bulkUpdateEntriesService(ctx, body.ids, body.patch ?? {});
+            return json({ data: { updated: count } });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.get('/forms/entries', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const result = await listEntriesService(parseEntriesQuery(new URL(request.url)));
+            return json({ data: result });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.post('/forms', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = (await request.json().catch(() => null));
+            if (!body || typeof body.name !== 'string' || !body.name.trim()) {
+                return errorResponse('"name" is required', 400);
+            }
+            const ctx = buildActionContext(auth.session, db());
+            const form = await createFormService(ctx, body);
+            return json({ data: form }, 201);
+        }
+        catch (err) {
+            return mapFormError(err) ?? internalError(err);
+        }
+    });
+    router.get('/forms/:id', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const form = await getFormByIdService(params.id);
+            if (!form)
+                return errorResponse('Form not found', 404);
+            return json({ data: form });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.patch('/forms/:id', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = (await request.json().catch(() => ({})));
+            const ctx = buildActionContext(auth.session, db());
+            const form = await updateFormService(ctx, params.id, body);
+            return json({ data: form });
+        }
+        catch (err) {
+            return mapFormError(err) ?? internalError(err);
+        }
+    });
+    router.delete('/forms/:id', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const url = new URL(request.url);
+            const force = url.searchParams.get('force') === 'true';
+            const ctx = buildActionContext(auth.session, db());
+            await deleteFormService(ctx, params.id, { force });
+            return json({ data: { success: true } });
+        }
+        catch (err) {
+            return mapFormError(err) ?? internalError(err);
+        }
+    });
+    router.post('/forms/:id/duplicate', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const ctx = buildActionContext(auth.session, db());
+            const form = await duplicateFormService(ctx, params.id);
+            return json({ data: form }, 201);
+        }
+        catch (err) {
+            return mapFormError(err) ?? internalError(err);
+        }
+    });
+    router.get('/forms/:id/schema', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const schema = await getFormSchemaService(params.id);
+            return json({ data: schema });
+        }
+        catch (err) {
+            return mapFormError(err) ?? internalError(err);
+        }
+    });
+    router.put('/forms/:id/schema', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = (await request.json().catch(() => ({})));
+            if (!Array.isArray(body.fields)) {
+                return errorResponse('"fields" must be an array', 400);
+            }
+            const ctx = buildActionContext(auth.session, db());
+            const result = await saveFormSchemaService(ctx, params.id, body.fields, body.notes);
+            return json({ data: result });
+        }
+        catch (err) {
+            return mapFormError(err) ?? internalError(err);
+        }
+    });
+    router.get('/forms/:id/notifications', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const settings = await getFormNotificationSettingsService(params.id);
+            return json({ data: settings });
+        }
+        catch (err) {
+            return mapFormError(err) ?? internalError(err);
+        }
+    });
+    router.put('/forms/:id/notifications', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = (await request.json().catch(() => ({})));
+            const ctx = buildActionContext(auth.session, db());
+            const settings = await updateFormNotificationSettingsService(ctx, params.id, body);
+            return json({ data: settings });
+        }
+        catch (err) {
+            return mapFormError(err) ?? internalError(err);
+        }
+    });
+    // Lightweight notify toggle used by the forms table switch.
+    router.put('/forms/:id/notify', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = (await request.json().catch(() => ({})));
+            const ctx = buildActionContext(auth.session, db());
+            const settings = await setFormNotifyEnabledService(ctx, params.id, Boolean(body.enabled));
+            return json({ data: { notifyEnabled: settings.enabled } });
+        }
+        catch (err) {
+            return mapFormError(err) ?? internalError(err);
+        }
+    });
+    router.get('/forms/:id/embed', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const settings = await getFormEmbedSettingsService(params.id);
+            return json({ data: settings });
+        }
+        catch (err) {
+            return mapFormError(err) ?? internalError(err);
+        }
+    });
+    router.put('/forms/:id/embed', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = (await request.json().catch(() => ({})));
+            const ctx = buildActionContext(auth.session, db());
+            const settings = await updateFormEmbedSettingsService(ctx, params.id, body);
+            return json({ data: settings });
+        }
+        catch (err) {
+            return mapFormError(err) ?? internalError(err);
+        }
+    });
+    // ---------------------------------------------------------------------------
     // Redirects routes
     // ---------------------------------------------------------------------------
     router.get('/redirects', async (request) => {
@@ -4438,8 +4813,10 @@ export function registerCMSRoutes(router) {
             }
             const { suggestRedirectTarget } = await import('../redirects/suggest.js');
             // Candidate set: published page/post URLs.
-            const { gatherAuditEntities } = await import('../seo/audit-runner.js');
-            const entities = await gatherAuditEntities(db());
+            const { gatherAuditEntities, frontEndContentCollectionTypes } = await import('../seo/audit-runner.js');
+            const entities = await gatherAuditEntities(db(), {
+                collectionTypes: frontEndContentCollectionTypes(getActuateConfig()),
+            });
             const candidates = entities.map((e) => ({ url: e.url, title: e.title }));
             const unresolved = await db().redirect404Hit.findMany({ where: { resolvedAt: null } });
             let created = 0;
@@ -5046,60 +5423,13 @@ export function registerCMSRoutes(router) {
             if (!(await checkRateLimitAsync(seoAuditLimiter, scanKey))) {
                 return errorResponse('Too many scans. Please try again later.', 429);
             }
-            const documents = await db().document.findMany({
-                where: { status: 'PUBLISHED', deletedAt: null },
-                select: {
-                    id: true,
-                    title: true,
-                    slug: true,
-                    collection: true,
-                    data: true,
-                    plainText: true,
-                },
-                orderBy: { updatedAt: 'desc' },
-                take: 5000,
-            });
-            const issues = [];
-            for (const doc of documents) {
-                const data = (doc.data ?? {});
-                const problems = [];
-                if (!data.metaTitle && !data.seoTitle)
-                    problems.push('Missing meta title');
-                if (!data.metaDescription && !data.seoDescription)
-                    problems.push('Missing meta description');
-                if (!data.canonical)
-                    problems.push('No canonical URL set');
-                if (!data.schemaType)
-                    problems.push('No Schema.org type');
-                const plainText = (doc.plainText ?? '');
-                if (plainText.length > 0 && plainText.length < 300)
-                    problems.push('Content is too short (< 300 characters)');
-                const content = typeof data.body === 'string'
-                    ? data.body
-                    : typeof data.content === 'string'
-                        ? data.content
-                        : '';
-                if (content) {
-                    const imgMatches = content.match(/<img\b[^>]*>/gi) ?? [];
-                    const missingAlt = imgMatches.filter((img) => !img.includes('alt=')).length;
-                    if (missingAlt > 0)
-                        problems.push(`${missingAlt} image(s) missing alt text`);
-                    if (!content.includes('<h1') && !content.includes('<h1>'))
-                        problems.push('No H1 heading found in content');
-                }
-                if (problems.length > 0) {
-                    issues.push({
-                        documentId: doc.id,
-                        title: doc.title ?? 'Untitled',
-                        slug: doc.slug ?? '',
-                        problems,
-                    });
-                }
-            }
-            const total = documents.length;
-            const pagesWithIssues = issues.length;
-            const totalProblems = issues.reduce((sum, i) => sum + i.problems.length, 0);
-            return json({ data: { total, pagesWithIssues, totalProblems, issues } });
+            // Scope the scan to configured front-end content collections so structural
+            // (navigation/footer) and benchmark documents are never reported. Shares
+            // the exact scan logic with the cron path via processSeoScan.
+            const { frontEndContentCollectionTypes } = await import('../seo/audit-runner.js');
+            const allowedCollections = Object.keys(frontEndContentCollectionTypes(getActuateConfig()));
+            const result = await processSeoScan(db(), { allowedCollections, maxDocuments: 5000 });
+            return json({ data: result });
         }
         catch (err) {
             return internalError(err);
@@ -5152,9 +5482,10 @@ export function registerCMSRoutes(router) {
         };
     }
     async function buildSeoContentRecords() {
-        const { gatherAuditEntities } = await import('../seo/audit-runner.js');
+        const { gatherAuditEntities, frontEndContentCollectionTypes } = await import('../seo/audit-runner.js');
         const { calculatePageSeoScore } = await import('../seo/score.js');
-        const entities = await gatherAuditEntities(db());
+        const collectionTypes = frontEndContentCollectionTypes(getActuateConfig());
+        const entities = await gatherAuditEntities(db(), { collectionTypes });
         return entities.map((e) => {
             const score = calculatePageSeoScore(e);
             return {
@@ -5232,8 +5563,12 @@ export function registerCMSRoutes(router) {
             }
             const body = (await request.json().catch(() => ({})));
             const scope = body?.scope ?? 'full';
-            const { runAndPersistAudit } = await import('../seo/audit-runner.js');
-            const run = await runAndPersistAudit(db(), { scope, startedById: auth.session.userId });
+            const { runAndPersistAudit, frontEndContentCollectionTypes } = await import('../seo/audit-runner.js');
+            const run = await runAndPersistAudit(db(), {
+                scope,
+                startedById: auth.session.userId,
+                collectionTypes: frontEndContentCollectionTypes(getActuateConfig()),
+            });
             try {
                 await logEvent({
                     event: 'settings_changed',
@@ -5827,6 +6162,13 @@ export function registerCMSRoutes(router) {
         const excluded = new Set(resolved.seo?.sitemap?.excludeCollections ?? []);
         const out = [];
         for (const [slug, col] of Object.entries(resolved.collections ?? {})) {
+            // Only publicly-rendered content types belong in the sitemap. Structural
+            // / utility collections (navigation menus, footers, tags, templates) have
+            // no `type` and must never produce indexable sitemap URLs.
+            if (col.type !== 'page' && col.type !== 'post')
+                continue;
+            if (col.admin?.hidden)
+                continue;
             if (excluded.has(slug))
                 continue;
             if (col.seo?.excludeFromSitemap)
@@ -5907,6 +6249,12 @@ export function registerCMSRoutes(router) {
             const collection = cfg?.collections?.[rawSlug];
             if (!collection)
                 return errorResponse('Collection not found', 404);
+            // Only publicly-rendered page/post collections are sitemap-eligible —
+            // structural/utility collections (menus, tags, templates) are not.
+            if (collection.type !== 'page' && collection.type !== 'post')
+                return errorResponse('Collection excluded from sitemap', 404);
+            if (collection.admin?.hidden)
+                return errorResponse('Collection excluded from sitemap', 404);
             if (collection.seo?.excludeFromSitemap)
                 return errorResponse('Collection excluded from sitemap', 404);
             const base = siteUrlFromRequest(request, cfg);
@@ -8023,7 +8371,9 @@ export function registerCMSRoutes(router) {
             if (!isAuthorizedCronRequest(request.headers.get('authorization'))) {
                 return errorResponse('Unauthorized', 401);
             }
-            const result = await processSeoScan(db());
+            const { frontEndContentCollectionTypes } = await import('../seo/audit-runner.js');
+            const allowedCollections = Object.keys(frontEndContentCollectionTypes(getActuateConfig()));
+            const result = await processSeoScan(db(), { allowedCollections });
             return json({ data: result });
         }
         catch (err) {