@actuate-media/cms-core 0.5.0 → 0.9.0

package/dist/api/handlers.js

@@ -1,6 +1,7 @@
 import { listDocuments, getDocument, createDocument, updateDocument, deleteDocument, getGlobal, updateGlobal, } from '../actions.js';
 import { verifyPassword } from '../auth/password.js';
 import { createSession, verifySession, revokeSession } from '../auth/session.js';
+import { createPasswordReset, executePasswordReset } from '../auth/reset.js';
 import { checkSetupRequired, createInitialAdmin } from '../setup/index.js';
 import { getDB } from '../db.js';
 import { generateCodeVerifier, generateCodeChallenge, generateState, getAuthorizationUrl, handleOAuthCallback, } from '../auth/oauth.js';
@@ -17,12 +18,19 @@ import { encryptField, decryptField } from '../security/encrypted-fields.js';
 import { createRateLimiter } from '../security/rate-limit.js';
 import { generateOpenAPISpec } from './openapi.js';
 import { createSSEPresenceAdapter } from '../presence/index.js';
+import { BUILT_IN_TEMPLATES } from '../page-builder/templates.js';
+import { validateTree } from '../page-builder/validate.js';
+import { auditAccessibility, fixAccessibility } from '../page-builder/a11y-fix.js';
 // Opaque dynamic import so Turbopack/webpack won't statically analyze the specifier.
 // Returns { put, del, ... } from @vercel/blob when available.
 async function importBlobStorage() {
     const mod = '@vercel/' + 'blob';
     return import(/* webpackIgnore: true */ mod);
 }
+async function importAIPlugin() {
+    const mod = '@actuate-media/' + 'plugin-ai';
+    return import(/* webpackIgnore: true */ mod);
+}
 const SECURITY_HEADERS = {
     'Content-Type': 'application/json',
     'X-Content-Type-Options': 'nosniff',
@@ -460,6 +468,70 @@ export function registerCMSRoutes(router) {
             return internalError(err, 'logout');
         }
     });
+    router.post('/auth/forgot-password', async (request) => {
+        try {
+            const body = await request.json();
+            const { email } = body;
+            if (!email) {
+                return errorResponse('Email is required', 400);
+            }
+            const clientIp = request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ?? 'unknown';
+            if (!(await checkRateLimitAsync(loginLimiter, `forgot:${clientIp}`))) {
+                return errorResponse('Too many requests. Please try again later.', 429);
+            }
+            const d = db();
+            if (!hasModel(d, 'user'))
+                return modelNotAvailable('user');
+            const siteUrl = process.env.NEXT_PUBLIC_SITE_URL ?? new URL(request.url).origin;
+            const cmsConfig = globalThis.__actuateConfig;
+            await createPasswordReset(d, email.toLowerCase().trim(), {
+                siteUrl,
+                platform: cmsConfig?.platform,
+            });
+            await logEvent({
+                event: 'password_reset_request',
+                ipAddress: clientIp,
+                userAgent: request.headers.get('user-agent') ?? undefined,
+                details: { email: email.toLowerCase().trim() },
+            });
+            return json({ data: { success: true } });
+        }
+        catch (err) {
+            return internalError(err, 'forgot-password');
+        }
+    });
+    router.post('/auth/reset-password', async (request) => {
+        try {
+            const body = await request.json();
+            const { token, password } = body;
+            if (!token || !password) {
+                return errorResponse('Token and new password are required', 400);
+            }
+            if (password.length < 8) {
+                return errorResponse('Password must be at least 8 characters', 400);
+            }
+            const clientIp = request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ?? 'unknown';
+            if (!(await checkRateLimitAsync(loginLimiter, `reset:${clientIp}`))) {
+                return errorResponse('Too many requests. Please try again later.', 429);
+            }
+            const d = db();
+            if (!hasModel(d, 'user'))
+                return modelNotAvailable('user');
+            const result = await executePasswordReset(d, token, password);
+            if (!result.success) {
+                return errorResponse(result.error ?? 'Password reset failed', 400);
+            }
+            await logEvent({
+                event: 'password_reset_complete',
+                ipAddress: clientIp,
+                userAgent: request.headers.get('user-agent') ?? undefined,
+            });
+            return json({ data: { success: true } });
+        }
+        catch (err) {
+            return internalError(err, 'reset-password');
+        }
+    });
     router.get('/auth/me', async (request) => {
         try {
             const auth = await requireAuth(request);
@@ -2760,6 +2832,208 @@ export function registerCMSRoutes(router) {
         }
     });
     // ---------------------------------------------------------------------------
+    // Script Tags
+    // ---------------------------------------------------------------------------
+    router.get('/script-tags/resolve', async (request) => {
+        try {
+            const d = db();
+            if (!hasModel(d, 'scriptTag'))
+                return modelNotAvailable('ScriptTag');
+            const url = new URL(request.url);
+            const pathParam = url.searchParams.get('path') ?? '/';
+            const normalizedPath = '/' + pathParam.replace(/^\/|\/$/g, '');
+            const tags = await d.scriptTag.findMany({
+                where: { enabled: true },
+                orderBy: { priority: 'asc' },
+            });
+            const matched = [];
+            for (const tag of tags) {
+                if (tag.scope === 'site') {
+                    matched.push(tag);
+                    continue;
+                }
+                if (tag.scope === 'parents' && Array.isArray(tag.targetPaths)) {
+                    for (const target of tag.targetPaths) {
+                        const norm = '/' + target.replace(/^\/|\/$/g, '');
+                        if (normalizedPath === norm || normalizedPath.startsWith(norm + '/')) {
+                            matched.push(tag);
+                            break;
+                        }
+                    }
+                    continue;
+                }
+                if (tag.scope === 'urls' && Array.isArray(tag.targetPaths)) {
+                    for (const target of tag.targetPaths) {
+                        const norm = '/' + target.replace(/^\/|\/$/g, '');
+                        if (normalizedPath === norm) {
+                            matched.push(tag);
+                            break;
+                        }
+                    }
+                }
+            }
+            const grouped = { head: [], body_open: [], body_close: [] };
+            for (const tag of matched) {
+                const bucket = grouped[tag.placement];
+                if (bucket) {
+                    bucket.push(tag.code);
+                }
+            }
+            return json(grouped);
+        }
+        catch (err) {
+            return internalError(err, 'script-tags/resolve');
+        }
+    });
+    router.get('/script-tags', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const d = db();
+            if (!hasModel(d, 'scriptTag'))
+                return modelNotAvailable('ScriptTag');
+            const tags = await d.scriptTag.findMany({
+                orderBy: { priority: 'asc' },
+            });
+            return json({ data: tags });
+        }
+        catch (err) {
+            return internalError(err, 'script-tags list');
+        }
+    });
+    router.post('/script-tags', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const d = db();
+            if (!hasModel(d, 'scriptTag'))
+                return modelNotAvailable('ScriptTag');
+            const body = await request.json();
+            if (!body.name || !body.code || !body.placement) {
+                return errorResponse('name, code, and placement are required', 400);
+            }
+            const validPlacements = ['head', 'body_open', 'body_close'];
+            if (!validPlacements.includes(body.placement)) {
+                return errorResponse('placement must be head, body_open, or body_close', 400);
+            }
+            const validScopes = ['site', 'parents', 'urls'];
+            const scope = body.scope || 'site';
+            if (!validScopes.includes(scope)) {
+                return errorResponse('scope must be site, parents, or urls', 400);
+            }
+            const tag = await d.scriptTag.create({
+                data: {
+                    name: body.name,
+                    code: body.code,
+                    placement: body.placement,
+                    scope,
+                    targetPaths: Array.isArray(body.targetPaths) ? body.targetPaths : [],
+                    priority: typeof body.priority === 'number' ? body.priority : 100,
+                    enabled: body.enabled !== false,
+                },
+            });
+            await logEvent({
+                event: 'settings_changed',
+                userId: auth.session.userId,
+                details: { action: 'script_tag_created', tagId: tag.id, name: tag.name },
+            });
+            return json({ data: tag }, 201);
+        }
+        catch (err) {
+            return internalError(err, 'script-tags create');
+        }
+    });
+    router.put('/script-tags/:id', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const d = db();
+            if (!hasModel(d, 'scriptTag'))
+                return modelNotAvailable('ScriptTag');
+            const existing = await d.scriptTag.findUnique({ where: { id: params.id } });
+            if (!existing)
+                return errorResponse('Script tag not found', 404);
+            const body = await request.json();
+            const update = {};
+            if (body.name !== undefined)
+                update.name = body.name;
+            if (body.code !== undefined)
+                update.code = body.code;
+            if (body.placement !== undefined) {
+                const validPlacements = ['head', 'body_open', 'body_close'];
+                if (!validPlacements.includes(body.placement)) {
+                    return errorResponse('placement must be head, body_open, or body_close', 400);
+                }
+                update.placement = body.placement;
+            }
+            if (body.scope !== undefined) {
+                const validScopes = ['site', 'parents', 'urls'];
+                if (!validScopes.includes(body.scope)) {
+                    return errorResponse('scope must be site, parents, or urls', 400);
+                }
+                update.scope = body.scope;
+            }
+            if (body.targetPaths !== undefined) {
+                update.targetPaths = Array.isArray(body.targetPaths) ? body.targetPaths : [];
+            }
+            if (typeof body.priority === 'number')
+                update.priority = body.priority;
+            if (typeof body.enabled === 'boolean')
+                update.enabled = body.enabled;
+            const tag = await d.scriptTag.update({
+                where: { id: params.id },
+                data: update,
+            });
+            await logEvent({
+                event: 'settings_changed',
+                userId: auth.session.userId,
+                details: { action: 'script_tag_updated', tagId: tag.id, name: tag.name },
+            });
+            return json({ data: tag });
+        }
+        catch (err) {
+            return internalError(err, 'script-tags update');
+        }
+    });
+    router.delete('/script-tags/:id', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const d = db();
+            if (!hasModel(d, 'scriptTag'))
+                return modelNotAvailable('ScriptTag');
+            const existing = await d.scriptTag.findUnique({ where: { id: params.id } });
+            if (!existing)
+                return errorResponse('Script tag not found', 404);
+            await d.scriptTag.delete({ where: { id: params.id } });
+            await logEvent({
+                event: 'settings_changed',
+                userId: auth.session.userId,
+                details: { action: 'script_tag_deleted', tagId: existing.id, name: existing.name },
+            });
+            return json({ data: { deleted: true } });
+        }
+        catch (err) {
+            return internalError(err, 'script-tags delete');
+        }
+    });
+    // ---------------------------------------------------------------------------
     // Presence SSE
     // ---------------------------------------------------------------------------
     router.get('/presence/:documentId', async (request, params) => {
@@ -2788,5 +3062,528 @@ export function registerCMSRoutes(router) {
             return internalError(err);
         }
     });
+    // ---------------------------------------------------------------------------
+    // Page Templates
+    // ---------------------------------------------------------------------------
+    async function seedBuiltInTemplates(d) {
+        for (const [key, template] of Object.entries(BUILT_IN_TEMPLATES)) {
+            await d.pageTemplate.upsert({
+                where: { id: `builtin-${key}` },
+                create: {
+                    id: `builtin-${key}`,
+                    name: template.name,
+                    description: template.description,
+                    category: template.category,
+                    tree: template.tree,
+                    builtIn: true,
+                },
+                update: {
+                    name: template.name,
+                    description: template.description,
+                    category: template.category,
+                    tree: template.tree,
+                },
+            });
+        }
+    }
+    router.get('/page-templates', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const d = db();
+            if (!hasModel(d, 'pageTemplate'))
+                return modelNotAvailable('PageTemplate');
+            const url = new URL(request.url, 'http://localhost');
+            const category = url.searchParams.get('category');
+            const builtInCount = await safeCount(d.pageTemplate, { builtIn: true });
+            if (builtInCount === 0) {
+                await seedBuiltInTemplates(d);
+            }
+            const where = {};
+            if (category)
+                where.category = category;
+            const templates = await d.pageTemplate.findMany({
+                where,
+                orderBy: [{ builtIn: 'desc' }, { updatedAt: 'desc' }],
+            });
+            return json({ data: templates });
+        }
+        catch (err) {
+            return internalError(err, 'page-templates list');
+        }
+    });
+    router.get('/page-templates/:id', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const d = db();
+            if (!hasModel(d, 'pageTemplate'))
+                return modelNotAvailable('PageTemplate');
+            const template = await d.pageTemplate.findUnique({ where: { id: params.id } });
+            if (!template)
+                return errorResponse('Template not found', 404);
+            return json({ data: template });
+        }
+        catch (err) {
+            return internalError(err, 'page-templates get');
+        }
+    });
+    router.post('/page-templates', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const d = db();
+            if (!hasModel(d, 'pageTemplate'))
+                return modelNotAvailable('PageTemplate');
+            const body = await request.json();
+            if (!body.name)
+                return errorResponse('name is required', 400);
+            if (!body.tree)
+                return errorResponse('tree is required', 400);
+            const validation = validateTree(body.tree);
+            if (!validation.valid) {
+                return errorResponse(`Invalid tree: ${validation.errors.join('; ')}`, 400);
+            }
+            const validCategories = ['landing', 'content', 'utility'];
+            const category = body.category || 'content';
+            if (!validCategories.includes(category)) {
+                return errorResponse('category must be landing, content, or utility', 400);
+            }
+            const template = await d.pageTemplate.create({
+                data: {
+                    name: body.name,
+                    description: body.description || null,
+                    category,
+                    tree: body.tree,
+                    thumbnail: body.thumbnail || null,
+                    builtIn: false,
+                },
+            });
+            await logEvent({
+                event: 'settings_changed',
+                userId: auth.session.userId,
+                details: { action: 'page_template_created', templateId: template.id, name: template.name },
+            });
+            return json({ data: template }, 201);
+        }
+        catch (err) {
+            return internalError(err, 'page-templates create');
+        }
+    });
+    router.put('/page-templates/:id', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const d = db();
+            if (!hasModel(d, 'pageTemplate'))
+                return modelNotAvailable('PageTemplate');
+            const existing = await d.pageTemplate.findUnique({ where: { id: params.id } });
+            if (!existing)
+                return errorResponse('Template not found', 404);
+            if (existing.builtIn)
+                return errorResponse('Cannot update built-in templates', 403);
+            const body = await request.json();
+            const update = {};
+            if (body.name !== undefined)
+                update.name = body.name;
+            if (body.description !== undefined)
+                update.description = body.description;
+            if (body.thumbnail !== undefined)
+                update.thumbnail = body.thumbnail;
+            if (body.category !== undefined) {
+                const validCategories = ['landing', 'content', 'utility'];
+                if (!validCategories.includes(body.category)) {
+                    return errorResponse('category must be landing, content, or utility', 400);
+                }
+                update.category = body.category;
+            }
+            if (body.tree !== undefined) {
+                const validation = validateTree(body.tree);
+                if (!validation.valid) {
+                    return errorResponse(`Invalid tree: ${validation.errors.join('; ')}`, 400);
+                }
+                update.tree = body.tree;
+            }
+            const template = await d.pageTemplate.update({
+                where: { id: params.id },
+                data: update,
+            });
+            await logEvent({
+                event: 'settings_changed',
+                userId: auth.session.userId,
+                details: { action: 'page_template_updated', templateId: template.id, name: template.name },
+            });
+            return json({ data: template });
+        }
+        catch (err) {
+            return internalError(err, 'page-templates update');
+        }
+    });
+    router.delete('/page-templates/:id', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const d = db();
+            if (!hasModel(d, 'pageTemplate'))
+                return modelNotAvailable('PageTemplate');
+            const existing = await d.pageTemplate.findUnique({ where: { id: params.id } });
+            if (!existing)
+                return errorResponse('Template not found', 404);
+            if (existing.builtIn)
+                return errorResponse('Cannot delete built-in templates', 403);
+            await d.pageTemplate.delete({ where: { id: params.id } });
+            await logEvent({
+                event: 'settings_changed',
+                userId: auth.session.userId,
+                details: { action: 'page_template_deleted', templateId: existing.id, name: existing.name },
+            });
+            return json({ data: { deleted: true } });
+        }
+        catch (err) {
+            return internalError(err, 'page-templates delete');
+        }
+    });
+    router.post('/page-templates/seed', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const d = db();
+            if (!hasModel(d, 'pageTemplate'))
+                return modelNotAvailable('PageTemplate');
+            await seedBuiltInTemplates(d);
+            await logEvent({
+                event: 'settings_changed',
+                userId: auth.session.userId,
+                details: { action: 'page_templates_seeded' },
+            });
+            return json({ data: { seeded: Object.keys(BUILT_IN_TEMPLATES).length } });
+        }
+        catch (err) {
+            return internalError(err, 'page-templates seed');
+        }
+    });
+    // ---------------------------------------------------------------------------
+    // Saved Sections
+    // ---------------------------------------------------------------------------
+    router.get('/saved-sections', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const d = db();
+            if (!hasModel(d, 'savedSection'))
+                return modelNotAvailable('SavedSection');
+            const url = new URL(request.url, 'http://localhost');
+            const category = url.searchParams.get('category');
+            const where = {};
+            if (category)
+                where.category = category;
+            const sections = await d.savedSection.findMany({
+                where,
+                orderBy: { updatedAt: 'desc' },
+            });
+            return json({ data: sections });
+        }
+        catch (err) {
+            return internalError(err, 'saved-sections list');
+        }
+    });
+    router.get('/saved-sections/:id', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const d = db();
+            if (!hasModel(d, 'savedSection'))
+                return modelNotAvailable('SavedSection');
+            const section = await d.savedSection.findUnique({ where: { id: params.id } });
+            if (!section)
+                return errorResponse('Saved section not found', 404);
+            return json({ data: section });
+        }
+        catch (err) {
+            return internalError(err, 'saved-sections get');
+        }
+    });
+    router.post('/saved-sections', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const d = db();
+            if (!hasModel(d, 'savedSection'))
+                return modelNotAvailable('SavedSection');
+            const body = await request.json();
+            if (!body.name)
+                return errorResponse('name is required', 400);
+            if (!body.tree)
+                return errorResponse('tree is required', 400);
+            const wrappedTree = { id: '__validation_wrapper__', type: 'page', children: [body.tree] };
+            const validation = validateTree(wrappedTree);
+            if (!validation.valid) {
+                return errorResponse(`Invalid section tree: ${validation.errors.join('; ')}`, 400);
+            }
+            const validCategories = ['header', 'footer', 'content', 'sidebar'];
+            const category = body.category || 'content';
+            if (!validCategories.includes(category)) {
+                return errorResponse('category must be header, footer, content, or sidebar', 400);
+            }
+            const section = await d.savedSection.create({
+                data: {
+                    name: body.name,
+                    description: body.description || null,
+                    category,
+                    tree: body.tree,
+                    thumbnail: body.thumbnail || null,
+                },
+            });
+            await logEvent({
+                event: 'settings_changed',
+                userId: auth.session.userId,
+                details: { action: 'saved_section_created', sectionId: section.id, name: section.name },
+            });
+            return json({ data: section }, 201);
+        }
+        catch (err) {
+            return internalError(err, 'saved-sections create');
+        }
+    });
+    router.put('/saved-sections/:id', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const d = db();
+            if (!hasModel(d, 'savedSection'))
+                return modelNotAvailable('SavedSection');
+            const existing = await d.savedSection.findUnique({ where: { id: params.id } });
+            if (!existing)
+                return errorResponse('Saved section not found', 404);
+            const body = await request.json();
+            const update = {};
+            if (body.name !== undefined)
+                update.name = body.name;
+            if (body.description !== undefined)
+                update.description = body.description;
+            if (body.thumbnail !== undefined)
+                update.thumbnail = body.thumbnail;
+            if (body.category !== undefined) {
+                const validCategories = ['header', 'footer', 'content', 'sidebar'];
+                if (!validCategories.includes(body.category)) {
+                    return errorResponse('category must be header, footer, content, or sidebar', 400);
+                }
+                update.category = body.category;
+            }
+            if (body.tree !== undefined) {
+                const wrappedTree = { id: '__validation_wrapper__', type: 'page', children: [body.tree] };
+                const validation = validateTree(wrappedTree);
+                if (!validation.valid) {
+                    return errorResponse(`Invalid section tree: ${validation.errors.join('; ')}`, 400);
+                }
+                update.tree = body.tree;
+            }
+            const section = await d.savedSection.update({
+                where: { id: params.id },
+                data: update,
+            });
+            await logEvent({
+                event: 'settings_changed',
+                userId: auth.session.userId,
+                details: { action: 'saved_section_updated', sectionId: section.id, name: section.name },
+            });
+            return json({ data: section });
+        }
+        catch (err) {
+            return internalError(err, 'saved-sections update');
+        }
+    });
+    router.delete('/saved-sections/:id', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const d = db();
+            if (!hasModel(d, 'savedSection'))
+                return modelNotAvailable('SavedSection');
+            const existing = await d.savedSection.findUnique({ where: { id: params.id } });
+            if (!existing)
+                return errorResponse('Saved section not found', 404);
+            await d.savedSection.delete({ where: { id: params.id } });
+            await logEvent({
+                event: 'settings_changed',
+                userId: auth.session.userId,
+                details: { action: 'saved_section_deleted', sectionId: existing.id, name: existing.name },
+            });
+            return json({ data: { deleted: true } });
+        }
+        catch (err) {
+            return internalError(err, 'saved-sections delete');
+        }
+    });
+    // ─── Page Builder AI Generation ─────────────────────────────────────
+    router.post('/page-builder/generate', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = await request.json();
+            const { prompt, template, context, steps, tone } = body;
+            if (!prompt || typeof prompt !== 'string') {
+                return errorResponse('prompt is required', 400);
+            }
+            if (!steps || !Array.isArray(steps) || steps.length === 0) {
+                return errorResponse('steps array is required', 400);
+            }
+            const validSteps = ['structure', 'content', 'seo', 'accessibility'];
+            for (const s of steps) {
+                if (!validSteps.includes(s)) {
+                    return errorResponse(`Invalid step: ${s}. Valid steps: ${validSteps.join(', ')}`, 400);
+                }
+            }
+            await logEvent({
+                event: 'settings_changed',
+                userId: auth.session.userId,
+                details: { action: 'page_generation_started', prompt, steps, template },
+            });
+            let generatePage = null;
+            try {
+                const aiModule = await importAIPlugin();
+                generatePage = aiModule.generatePage;
+            }
+            catch {
+                return errorResponse('AI plugin is not installed. Install @actuate-media/plugin-ai to use page generation.', 501);
+            }
+            const result = await generatePage({ prompt, template, context, steps, tone });
+            await logEvent({
+                event: 'settings_changed',
+                userId: auth.session.userId,
+                details: {
+                    action: 'page_generation_completed',
+                    totalTokensUsed: result.totalTokensUsed,
+                    totalDurationMs: result.totalDurationMs,
+                    stepsCompleted: result.steps.map((s) => s.step),
+                },
+            });
+            return json({ data: result });
+        }
+        catch (err) {
+            return internalError(err, 'page-builder generate');
+        }
+    });
+    router.post('/page-builder/generate-block', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = await request.json();
+            const { blockType, variant, pageContext, tone } = body;
+            if (!blockType || typeof blockType !== 'string') {
+                return errorResponse('blockType is required', 400);
+            }
+            let generateBlockContent = null;
+            try {
+                const aiModule = await importAIPlugin();
+                generateBlockContent = aiModule.generateBlockContent;
+            }
+            catch {
+                return errorResponse('AI plugin is not installed. Install @actuate-media/plugin-ai to use block generation.', 501);
+            }
+            const data = await generateBlockContent({ blockType, variant, pageContext, tone });
+            return json({ data });
+        }
+        catch (err) {
+            return internalError(err, 'page-builder generate-block');
+        }
+    });
+    router.post('/page-builder/audit-a11y', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = await request.json();
+            const tree = body.tree;
+            if (!tree || tree.type !== 'page') {
+                return errorResponse('A valid page tree is required', 400);
+            }
+            const issues = auditAccessibility(tree);
+            return json({ data: { issues } });
+        }
+        catch (err) {
+            return internalError(err, 'page-builder audit-a11y');
+        }
+    });
+    router.post('/page-builder/fix-a11y', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = await request.json();
+            const tree = body.tree;
+            if (!tree || tree.type !== 'page') {
+                return errorResponse('A valid page tree is required', 400);
+            }
+            const result = fixAccessibility(tree);
+            await logEvent({
+                event: 'settings_changed',
+                userId: auth.session.userId,
+                details: { action: 'a11y_auto_fix', fixedCount: result.report.fixedCount, remainingCount: result.report.remainingCount },
+            });
+            return json({ data: result });
+        }
+        catch (err) {
+            return internalError(err, 'page-builder fix-a11y');
+        }
+    });
 }
 //# sourceMappingURL=handlers.js.map