@actuate-media/cms-core 0.82.0 → 0.84.0

package/dist/__tests__/api/security-routes.test.js

@@ -1,212 +0,0 @@
-import { beforeEach, describe, expect, it } from 'vitest';
-import { handleActuateAPI } from '../../api/index.js';
-import { initDB } from '../../db.js';
-import { generateApiKey } from '../../security/api-key-enhanced.js';
-/**
- * Contract tests for the Security Center endpoints:
- *   - GET  /security                     → authed (admin), computed posture.
- *   - PUT  /security                     → persists enforced policy, lockout-safe.
- *   - POST /security/sessions/revoke-all → revokes the caller's other sessions.
- *
- * Proves the response never leaks secret values, that lockout-safe MFA enabling
- * is enforced server-side, and that policy round-trips through the settings global.
- */
-const VALID_SECRET = 'a'.repeat(48);
-function createMockDB(state, apiKey) {
-    const tx = {
-        document: {
-            update: async ({ data }) => {
-                state.settings = data.data;
-                return { id: 'settings-doc', data: state.settings };
-            },
-            create: async ({ data }) => {
-                state.settings = data.data;
-                return { id: 'settings-doc', data: state.settings };
-            },
-        },
-        version: { create: async () => ({ id: 'v1' }) },
-    };
-    return {
-        apiKey: {
-            findMany: async () => (apiKey ? [apiKey] : []),
-            findUnique: async ({ where }) => apiKey && apiKey.keyHash === where.keyHash ? apiKey : null,
-            update: async () => apiKey,
-        },
-        document: {
-            findFirst: async () => ({ id: 'settings-doc', data: state.settings }),
-            findMany: async () => [],
-            count: async () => 0,
-        },
-        version: { create: async () => ({ id: 'v1' }) },
-        user: {
-            findMany: async () => [
-                { role: 'ADMIN', isActive: true, totpEnabled: state.viewerHasMfa },
-                { role: 'EDITOR', isActive: true, totpEnabled: false },
-            ],
-            findUnique: async () => ({ totpEnabled: state.viewerHasMfa }),
-            count: async () => 1,
-        },
-        session: {
-            findMany: async () => [],
-            count: async () => 2,
-            updateMany: async (args) => {
-                state.revokeAllArgs = args;
-                return { count: state.revokeAllResult };
-            },
-        },
-        auditLog: {
-            count: async () => 3,
-            create: async () => ({ id: 'log1' }),
-        },
-        $transaction: async (fn) => fn(tx),
-    };
-}
-async function makeKey(scopes) {
-    const { key, keyHash, keyPrefix } = await generateApiKey({ prefix: 'act_sk', scopes });
-    return {
-        key,
-        record: {
-            id: 'apikey-1',
-            keyHash,
-            keyPrefix,
-            userId: 'user-1',
-            scopes,
-            ipRestrictions: null,
-            expiresAt: null,
-            lastUsedAt: null,
-            revokedAt: null,
-        },
-    };
-}
-function freshState() {
-    return {
-        settings: { siteTitle: 'Actuate Media' },
-        viewerHasMfa: false,
-        revokeAllResult: 2,
-    };
-}
-beforeEach(() => {
-    delete globalThis.__actuateConfig;
-    process.env.CMS_SECRET = VALID_SECRET;
-});
-describe('GET /security', () => {
-    it('requires authentication', async () => {
-        const db = createMockDB(freshState());
-        initDB(db);
-        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
-        const res = await handler(new Request('https://example.com/api/cms/security'));
-        expect(res.status).toBe(401);
-    });
-    it('rejects non-admin API keys', async () => {
-        const { key, record } = await makeKey({ media: true });
-        const db = createMockDB(freshState(), record);
-        initDB(db);
-        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
-        const res = await handler(new Request('https://example.com/api/cms/security', {
-            headers: { Authorization: `Bearer ${key}` },
-        }));
-        expect(res.status).toBe(403);
-    });
-    it('returns computed posture + summaries and never leaks secret values', async () => {
-        const { key, record } = await makeKey({ admin: true });
-        const db = createMockDB(freshState(), record);
-        initDB(db);
-        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
-        const res = await handler(new Request('https://example.com/api/cms/security', {
-            headers: { Authorization: `Bearer ${key}` },
-        }));
-        expect(res.status).toBe(200);
-        const body = (await res.json());
-        expect(body.data.status.status).toBeDefined();
-        expect(Array.isArray(body.data.status.checks)).toBe(true);
-        expect(body.data.users.totalAdmins).toBe(1);
-        expect(body.data.secrets.cmsSecret).toBe('pass');
-        expect(body.data.activeSessions).toBe(2);
-        expect(body.data.failedLogins24h).toBe(3);
-        // The raw secret value must never appear anywhere in the payload.
-        expect(JSON.stringify(body)).not.toContain(VALID_SECRET);
-    });
-});
-describe('PUT /security', () => {
-    it('persists the enforced policy and reflects it on read-back', async () => {
-        const { key, record } = await makeKey({ admin: true });
-        const state = freshState();
-        const db = createMockDB(state, record);
-        initDB(db);
-        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
-        const res = await handler(new Request('https://example.com/api/cms/security', {
-            method: 'PUT',
-            headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
-            body: JSON.stringify({
-                mfa: { required: false, gracePeriodDays: 14 },
-                session: { maxConcurrentSessions: 3 },
-            }),
-        }));
-        expect(res.status).toBe(200);
-        const body = (await res.json());
-        expect(body.data.settings.session.maxConcurrentSessions).toBe(3);
-        expect(body.data.settings.mfa.gracePeriodDays).toBe(14);
-        // Persisted into the settings global without clobbering siblings.
-        expect(state.settings.security.session.maxConcurrentSessions).toBe(3);
-        expect(state.settings.siteTitle).toBe('Actuate Media');
-    });
-    it('blocks enabling MFA when the acting admin has no MFA (lockout-safe)', async () => {
-        const { key, record } = await makeKey({ admin: true });
-        const state = freshState();
-        state.viewerHasMfa = false;
-        const db = createMockDB(state, record);
-        initDB(db);
-        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
-        const res = await handler(new Request('https://example.com/api/cms/security', {
-            method: 'PUT',
-            headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
-            body: JSON.stringify({
-                mfa: { required: true, gracePeriodDays: 7 },
-                session: { maxConcurrentSessions: 5 },
-            }),
-        }));
-        expect(res.status).toBe(409);
-        const body = (await res.json());
-        expect(body.code).toBe('MFA_LOCKOUT_RISK');
-        // Nothing should have been persisted.
-        expect(state.settings.security).toBeUndefined();
-    });
-    it('allows enabling MFA when the acting admin has MFA', async () => {
-        const { key, record } = await makeKey({ admin: true });
-        const state = freshState();
-        state.viewerHasMfa = true;
-        const db = createMockDB(state, record);
-        initDB(db);
-        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
-        const res = await handler(new Request('https://example.com/api/cms/security', {
-            method: 'PUT',
-            headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
-            body: JSON.stringify({
-                mfa: { required: true, gracePeriodDays: 7 },
-                session: { maxConcurrentSessions: 5 },
-            }),
-        }));
-        expect(res.status).toBe(200);
-        expect(state.settings.security.mfa.required).toBe(true);
-        expect(typeof state.settings.security.mfa.requiredAt).toBe('string');
-    });
-});
-describe('POST /security/sessions/revoke-all', () => {
-    it("revokes the caller's other sessions and returns the count", async () => {
-        const { key, record } = await makeKey({ admin: true });
-        const state = freshState();
-        const db = createMockDB(state, record);
-        initDB(db);
-        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
-        const res = await handler(new Request('https://example.com/api/cms/security/sessions/revoke-all', {
-            method: 'POST',
-            headers: { Authorization: `Bearer ${key}` },
-        }));
-        expect(res.status).toBe(200);
-        const body = (await res.json());
-        expect(body.data.revoked).toBe(2);
-        // Excludes the current session id.
-        expect(state.revokeAllArgs?.where?.id?.not).toBe('apikey-1');
-    });
-});
-//# sourceMappingURL=security-routes.test.js.map

package/dist/__tests__/api/security-routes.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"security-routes.test.js","sourceRoot":"","sources":["../../../src/__tests__/api/security-routes.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAA;AAGnE;;;;;;;;GAQG;AACH,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAqBnC,SAAS,YAAY,CAAC,KAAgB,EAAE,MAAyB;IAC/D,MAAM,EAAE,GAAG;QACT,QAAQ,EAAE;YACR,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAA+C,EAAE,EAAE;gBACtE,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAA;gBAC1B,OAAO,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAA;YACrD,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAA+C,EAAE,EAAE;gBACtE,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAA;gBAC1B,OAAO,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAA;YACrD,CAAC;SACF;QACD,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;KAChD,CAAA;IACD,OAAO;QACL,MAAM,EAAE;YACN,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,UAAU,EAAE,KAAK,EAAE,EAAE,KAAK,EAAkC,EAAE,EAAE,CAC9D,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;YAC5D,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM;SAC3B;QACD,QAAQ,EAAE;YACR,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;YACxB,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;SACrB;QACD,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;QAC/C,IAAI,EAAE;YACJ,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC;gBACpB,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE;gBAClE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;aACvD;YACD,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;YAC7D,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;SACrB;QACD,OAAO,EAAE;YACP,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;YACxB,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YACpB,UAAU,EAAE,KAAK,EAAE,IAA2C,EAAE,EAAE;gBAChE,KAAK,CAAC,aAAa,GAAG,IAAI,CAAA;gBAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,eAAe,EAAE,CAAA;YACzC,CAAC;SACF;QACD,QAAQ,EAAE;YACR,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YACpB,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;SACrC;QACD,YAAY,EAAE,KAAK,EAAE,EAAsC,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;KAChE,CAAA;AACV,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,MAAmB;IACxC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IACtF,OAAO;QACL,GAAG;QACH,MAAM,EAAE;YACN,EAAE,EAAE,UAAU;YACd,OAAO;YACP,SAAS;YACT,MAAM,EAAE,QAAQ;YAChB,MAAM;YACN,cAAc,EAAE,IAAI;YACpB,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,IAAI;SAChB;KACF,CAAA;AACH,CAAC;AAED,SAAS,UAAU;IACjB,OAAO;QACL,QAAQ,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE;QACxC,YAAY,EAAE,KAAK;QACnB,eAAe,EAAE,CAAC;KACnB,CAAA;AACH,CAAC;AAED,UAAU,CAAC,GAAG,EAAE;IACd,OAAQ,UAAkB,CAAC,eAAe,CAAA;IAC1C,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,YAAY,CAAA;AACvC,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,CAAA;QACrC,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACnF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,OAAO,CAAC,sCAAsC,CAAC,CAAC,CAAA;QAC9E,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAA;QAC7C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACnF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,sCAAsC,EAAE;YAClD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAA;QAC7C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACnF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,sCAAsC,EAAE;YAClD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAA;QAEtC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAA;QAC7C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACzD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC3C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAChD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACxC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACzC,kEAAkE;QAClE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;IAC1D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAA;QAC1B,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACtC,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAEnF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,sCAAsC,EAAE;YAClD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE;gBAC7C,OAAO,EAAE,EAAE,qBAAqB,EAAE,CAAC,EAAE;aACtC,CAAC;SACH,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAA;QACtC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAChE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACvD,kEAAkE;QAClE,MAAM,CAAE,KAAK,CAAC,QAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC9E,MAAM,CAAE,KAAK,CAAC,QAAgB,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAA;QAC1B,KAAK,CAAC,YAAY,GAAG,KAAK,CAAA;QAC1B,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACtC,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAEnF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,sCAAsC,EAAE;YAClD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE;gBAC3C,OAAO,EAAE,EAAE,qBAAqB,EAAE,CAAC,EAAE;aACtC,CAAC;SACH,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAA;QACtC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QAC1C,sCAAsC;QACtC,MAAM,CAAE,KAAK,CAAC,QAAgB,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAA;IAC1D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAA;QAC1B,KAAK,CAAC,YAAY,GAAG,IAAI,CAAA;QACzB,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACtC,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAEnF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,sCAAsC,EAAE;YAClD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE;gBAC3C,OAAO,EAAE,EAAE,qBAAqB,EAAE,CAAC,EAAE;aACtC,CAAC;SACH,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,CAAE,KAAK,CAAC,QAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChE,MAAM,CAAC,OAAQ,KAAK,CAAC,QAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAA;QAC1B,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACtC,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAEnF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,0DAA0D,EAAE;YACtE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAA;QACtC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjC,mCAAmC;QACnC,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC9D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/api/seo-read-access.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=seo-read-access.test.d.ts.map

package/dist/__tests__/api/seo-read-access.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"seo-read-access.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/api/seo-read-access.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/api/seo-read-access.test.js

@@ -1,101 +0,0 @@
-import { beforeEach, describe, expect, it } from 'vitest';
-import { handleActuateAPI } from '../../api/index.js';
-import { initDB } from '../../db.js';
-import { generateApiKey } from '../../security/api-key-enhanced.js';
-/**
- * Regression test for the SEO read-endpoint access blocker. The
- * `/seo/analysis|readability|internal-links|schema|meta` endpoints previously
- * only checked `requireAuth`, so any authenticated principal could pull SEO
- * intelligence for documents in collections they have no read access to. They
- * must now enforce the collection's `access.read` rule.
- */
-const VALID_SECRET = 'a'.repeat(48);
-async function makeKey(scopes) {
-    const { key, keyHash, keyPrefix } = await generateApiKey({ prefix: 'act_sk', scopes });
-    return {
-        key,
-        record: {
-            id: 'apikey-1',
-            keyHash,
-            keyPrefix,
-            userId: 'user-1',
-            scopes,
-            ipRestrictions: null,
-            expiresAt: null,
-            lastUsedAt: null,
-            revokedAt: null,
-        },
-    };
-}
-function createMockDB(apiKey, doc) {
-    return {
-        apiKey: {
-            findMany: async () => [apiKey],
-            findUnique: async ({ where }) => apiKey.keyHash === where.keyHash ? apiKey : null,
-            update: async () => apiKey,
-        },
-        document: {
-            findFirst: async () => doc,
-            findMany: async () => [],
-            count: async () => 0,
-        },
-        user: {},
-        session: {},
-        media: {},
-    };
-}
-const PAGE_DOC = {
-    id: 'doc-1',
-    collection: 'pages',
-    title: 'Hello',
-    slug: 'hello',
-    data: { content: 'Some body content for analysis.' },
-    createdAt: new Date(),
-    updatedAt: new Date(),
-};
-describe('GET /seo/analysis access control', () => {
-    beforeEach(() => {
-        delete globalThis.__actuateConfig;
-        process.env.CMS_SECRET = VALID_SECRET;
-    });
-    it('returns 403 when the collection access.read rule denies the user', async () => {
-        const { key, record } = await makeKey({ collections: ['pages'], actions: ['read'] });
-        const db = createMockDB(record, PAGE_DOC);
-        initDB(db);
-        const handler = handleActuateAPI({
-            prismaClient: db,
-            config: { collections: { pages: { access: { read: () => false } } } },
-        });
-        const res = await handler(new Request('https://x.com/api/cms/seo/analysis/doc-1', {
-            headers: { Authorization: `Bearer ${key}` },
-        }));
-        expect(res.status).toBe(403);
-    });
-    it('returns 200 when the collection access.read rule allows the user', async () => {
-        const { key, record } = await makeKey({ collections: ['pages'], actions: ['read'] });
-        const db = createMockDB(record, PAGE_DOC);
-        initDB(db);
-        const handler = handleActuateAPI({
-            prismaClient: db,
-            config: { collections: { pages: { access: { read: () => true } } } },
-        });
-        const res = await handler(new Request('https://x.com/api/cms/seo/analysis/doc-1', {
-            headers: { Authorization: `Bearer ${key}` },
-        }));
-        expect(res.status).toBe(200);
-    });
-    it('rejects an API key without read scope on the collection (403)', async () => {
-        const { key, record } = await makeKey({ collections: ['posts'], actions: ['read'] });
-        const db = createMockDB(record, PAGE_DOC);
-        initDB(db);
-        const handler = handleActuateAPI({
-            prismaClient: db,
-            config: { collections: { pages: { access: { read: () => true } } } },
-        });
-        const res = await handler(new Request('https://x.com/api/cms/seo/analysis/doc-1', {
-            headers: { Authorization: `Bearer ${key}` },
-        }));
-        expect(res.status).toBe(403);
-    });
-});
-//# sourceMappingURL=seo-read-access.test.js.map

package/dist/__tests__/api/seo-read-access.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"seo-read-access.test.js","sourceRoot":"","sources":["../../../src/__tests__/api/seo-read-access.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAA;AAGnE;;;;;;GAMG;AAEH,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAEnC,KAAK,UAAU,OAAO,CAAC,MAAmB;IACxC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IACtF,OAAO;QACL,GAAG;QACH,MAAM,EAAE;YACN,EAAE,EAAE,UAAU;YACd,OAAO;YACP,SAAS;YACT,MAAM,EAAE,QAAQ;YAChB,MAAM;YACN,cAAc,EAAE,IAAI;YACpB,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,IAAI;SAChB;KACF,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAW,EAAE,GAAQ;IACzC,OAAO;QACL,MAAM,EAAE;YACN,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YAC9B,UAAU,EAAE,KAAK,EAAE,EAAE,KAAK,EAAkC,EAAE,EAAE,CAC9D,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;YAClD,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM;SAC3B;QACD,QAAQ,EAAE;YACR,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,GAAG;YAC1B,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;YACxB,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;SACrB;QACD,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,EAAE;QACX,KAAK,EAAE,EAAE;KACH,CAAA;AACV,CAAC;AAED,MAAM,QAAQ,GAAG;IACf,EAAE,EAAE,OAAO;IACX,UAAU,EAAE,OAAO;IACnB,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,EAAE,OAAO,EAAE,iCAAiC,EAAE;IACpD,SAAS,EAAE,IAAI,IAAI,EAAE;IACrB,SAAS,EAAE,IAAI,IAAI,EAAE;CACtB,CAAA;AAED,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;IAChD,UAAU,CAAC,GAAG,EAAE;QACd,OAAQ,UAAkB,CAAC,eAAe,CAAA;QAC1C,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,YAAY,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACpF,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACzC,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC;YAC/B,YAAY,EAAE,EAAE;YAChB,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE,EAAE,EAAW;SAC/E,CAAC,CAAA;QAEF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,0CAA0C,EAAE;YACtD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACpF,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACzC,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC;YAC/B,YAAY,EAAE,EAAE;YAChB,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAW;SAC9E,CAAC,CAAA;QAEF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,0CAA0C,EAAE;YACtD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACpF,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACzC,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC;YAC/B,YAAY,EAAE,EAAE;YAChB,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAW;SAC9E,CAAC,CAAA;QAEF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,0CAA0C,EAAE;YACtD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/api/seo-summary-ssrf.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=seo-summary-ssrf.test.d.ts.map

package/dist/__tests__/api/seo-summary-ssrf.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"seo-summary-ssrf.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/api/seo-summary-ssrf.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/api/seo-summary-ssrf.test.js

@@ -1,80 +0,0 @@
-import { beforeEach, describe, expect, it } from 'vitest';
-import { handleActuateAPI } from '../../api/index.js';
-import { initDB } from '../../db.js';
-import { generateApiKey } from '../../security/api-key-enhanced.js';
-/**
- * Regression test for the `/seo/summary` SSRF blocker. The link-health probe
- * issues outbound requests, so the endpoint must be gated to EDITOR+ (mirroring
- * `/seo/link-health`) rather than any authenticated user. The SSRF primitive
- * itself (private-IP blocking via `safeFetch`) is covered by
- * `__tests__/security/safe-fetch.test.ts`.
- */
-const VALID_SECRET = 'a'.repeat(48);
-async function makeKey(scopes) {
-    const { key, keyHash, keyPrefix } = await generateApiKey({ prefix: 'act_sk', scopes });
-    return {
-        key,
-        record: {
-            id: 'apikey-1',
-            keyHash,
-            keyPrefix,
-            userId: 'user-1',
-            scopes,
-            ipRestrictions: null,
-            expiresAt: null,
-            lastUsedAt: null,
-            revokedAt: null,
-        },
-    };
-}
-function createMockDB(apiKey) {
-    return {
-        apiKey: {
-            findMany: async () => [apiKey],
-            findUnique: async ({ where }) => apiKey.keyHash === where.keyHash ? apiKey : null,
-            update: async () => apiKey,
-        },
-        document: { findMany: async () => [], count: async () => 0, findFirst: async () => null },
-        user: {},
-        session: {},
-        media: {},
-    };
-}
-describe('GET /seo/summary access control', () => {
-    beforeEach(() => {
-        delete globalThis.__actuateConfig;
-        delete process.env.NEXT_PUBLIC_SITE_URL;
-        process.env.CMS_SECRET = VALID_SECRET;
-    });
-    it('rejects a non-privileged (non-admin) API key with 403', async () => {
-        const { key, record } = await makeKey({ collections: ['pages'], actions: ['read'] });
-        const db = createMockDB(record);
-        initDB(db);
-        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
-        const res = await handler(new Request('https://x.com/api/cms/seo/summary', {
-            headers: { Authorization: `Bearer ${key}` },
-        }));
-        expect(res.status).toBe(403);
-    });
-    it('requires authentication', async () => {
-        const { record } = await makeKey({ collections: ['pages'], actions: ['read'] });
-        const db = createMockDB(record);
-        initDB(db);
-        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
-        const res = await handler(new Request('https://x.com/api/cms/seo/summary'));
-        expect(res.status).toBe(401);
-    });
-    it('allows an admin key and does not probe external hosts when site URL is unset', async () => {
-        const { key, record } = await makeKey({ admin: true });
-        const db = createMockDB(record);
-        initDB(db);
-        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
-        const res = await handler(new Request('https://x.com/api/cms/seo/summary', {
-            headers: { Authorization: `Bearer ${key}` },
-        }));
-        expect(res.status).toBe(200);
-        const body = (await res.json());
-        expect(body.data.issuesSummary.brokenInternalLinks).toBe(0);
-    });
-});
-//# sourceMappingURL=seo-summary-ssrf.test.js.map

package/dist/__tests__/api/seo-summary-ssrf.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"seo-summary-ssrf.test.js","sourceRoot":"","sources":["../../../src/__tests__/api/seo-summary-ssrf.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAA;AAGnE;;;;;;GAMG;AAEH,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAEnC,KAAK,UAAU,OAAO,CAAC,MAAmB;IACxC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IACtF,OAAO;QACL,GAAG;QACH,MAAM,EAAE;YACN,EAAE,EAAE,UAAU;YACd,OAAO;YACP,SAAS;YACT,MAAM,EAAE,QAAQ;YAChB,MAAM;YACN,cAAc,EAAE,IAAI;YACpB,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,IAAI;SAChB;KACF,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAW;IAC/B,OAAO;QACL,MAAM,EAAE;YACN,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YAC9B,UAAU,EAAE,KAAK,EAAE,EAAE,KAAK,EAAkC,EAAE,EAAE,CAC9D,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;YAClD,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM;SAC3B;QACD,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE;QACzF,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,EAAE;QACX,KAAK,EAAE,EAAE;KACH,CAAA;AACV,CAAC;AAED,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,UAAU,CAAC,GAAG,EAAE;QACd,OAAQ,UAAkB,CAAC,eAAe,CAAA;QAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAA;QACvC,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,YAAY,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACpF,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;QAC/B,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAW,EAAE,CAAC,CAAA;QAE5F,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,mCAAmC,EAAE;YAC/C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAC/E,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;QAC/B,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAW,EAAE,CAAC,CAAA;QAE5F,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,OAAO,CAAC,mCAAmC,CAAC,CAAC,CAAA;QAC3E,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAiB,CAAC,CAAA;QACrE,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;QAC/B,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAW,EAAE,CAAC,CAAA;QAE5F,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,mCAAmC,EAAE;YAC/C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiE,CAAA;QAC/F,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/api/sitemap-pagination.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=sitemap-pagination.test.d.ts.map

package/dist/__tests__/api/sitemap-pagination.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sitemap-pagination.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/api/sitemap-pagination.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/api/sitemap-pagination.test.js

@@ -1,100 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest';
-import { handleActuateAPI } from '../../api/index.js';
-import { initDB } from '../../db.js';
-/**
- * Regression test for sitemap pagination. The old per-collection sitemap capped
- * at 5,000 URLs and silently dropped the rest, and the index emitted a single
- * `<sitemap>` per collection regardless of size. Collections larger than the
- * 50k protocol limit must now be split across `?page=N` files referenced from
- * the index.
- */
-const SITEMAP_PAGE_SIZE = 45000;
-function createMockDB(opts) {
-    return {
-        document: {
-            count: vi.fn(async () => opts.count),
-            findMany: opts.findMany,
-            findFirst: vi.fn(async () => null),
-        },
-        user: {},
-        session: {},
-        media: {},
-    };
-}
-const postsConfig = {
-    seo: { siteUrl: 'https://example.com' },
-    collections: {
-        posts: {
-            slug: 'posts',
-            labels: { singular: 'Post', plural: 'Posts' },
-            urlPrefix: 'blog',
-            type: 'post',
-            fields: {},
-        },
-    },
-};
-describe('sitemap pagination', () => {
-    beforeEach(() => {
-        delete globalThis.__actuateConfig;
-    });
-    it('emits one <sitemap> entry per 45k-doc page in the index', async () => {
-        const findMany = vi.fn(async () => []);
-        const db = createMockDB({ count: SITEMAP_PAGE_SIZE * 2 + 10, findMany });
-        initDB(db);
-        const handler = handleActuateAPI({ prismaClient: db, config: postsConfig });
-        const res = await handler(new Request('https://example.com/api/cms/sitemap.xml'));
-        expect(res.status).toBe(200);
-        const text = await res.text();
-        // 90,010 docs / 45,000 = 3 pages → page 0 (bare) + page 1 + page 2.
-        expect(text).toContain('<loc>https://example.com/api/cms/sitemaps/posts.xml</loc>');
-        expect(text).toContain('<loc>https://example.com/api/cms/sitemaps/posts.xml?page=1</loc>');
-        expect(text).toContain('<loc>https://example.com/api/cms/sitemaps/posts.xml?page=2</loc>');
-        expect(text).not.toContain('?page=3');
-    });
-    it('emits a single entry for a small collection', async () => {
-        const findMany = vi.fn(async () => []);
-        const db = createMockDB({ count: 12, findMany });
-        initDB(db);
-        const handler = handleActuateAPI({ prismaClient: db, config: postsConfig });
-        const res = await handler(new Request('https://example.com/api/cms/sitemap.xml'));
-        const text = await res.text();
-        expect(text).toContain('<loc>https://example.com/api/cms/sitemaps/posts.xml</loc>');
-        expect(text).not.toContain('?page=1');
-    });
-    it('applies skip/take when a page is requested', async () => {
-        const findMany = vi.fn(async (_args) => []);
-        const db = createMockDB({ count: SITEMAP_PAGE_SIZE * 2, findMany });
-        initDB(db);
-        const handler = handleActuateAPI({ prismaClient: db, config: postsConfig });
-        await handler(new Request('https://example.com/api/cms/sitemaps/posts.xml?page=2'));
-        expect(findMany).toHaveBeenCalledTimes(1);
-        const arg = (findMany.mock.calls[0]?.[0] ?? {});
-        expect(arg.skip).toBe(2 * SITEMAP_PAGE_SIZE);
-        expect(arg.take).toBe(SITEMAP_PAGE_SIZE);
-    });
-    it('omits the archive URL on pages after the first', async () => {
-        const findMany = vi.fn(async () => []);
-        const db = createMockDB({ count: SITEMAP_PAGE_SIZE * 2, findMany });
-        initDB(db);
-        const handler = handleActuateAPI({
-            prismaClient: db,
-            config: {
-                seo: { siteUrl: 'https://example.com' },
-                collections: {
-                    posts: {
-                        slug: 'posts',
-                        labels: { singular: 'Post', plural: 'Posts' },
-                        urlPrefix: 'blog',
-                        type: 'post',
-                        seo: { archivePath: '/blog' },
-                        fields: {},
-                    },
-                },
-            },
-        });
-        const res = await handler(new Request('https://example.com/api/cms/sitemaps/posts.xml?page=1'));
-        const text = await res.text();
-        expect(text).not.toContain('<loc>https://example.com/blog</loc>');
-    });
-});
-//# sourceMappingURL=sitemap-pagination.test.js.map

package/dist/__tests__/api/sitemap-pagination.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sitemap-pagination.test.js","sourceRoot":"","sources":["../../../src/__tests__/api/sitemap-pagination.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC;;;;;;GAMG;AAEH,MAAM,iBAAiB,GAAG,KAAK,CAAA;AAE/B,SAAS,YAAY,CAAC,IAA2D;IAC/E,OAAO;QACL,QAAQ,EAAE;YACR,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;YACpC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC;SACnC;QACD,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,EAAE;QACX,KAAK,EAAE,EAAE;KACH,CAAA;AACV,CAAC;AAED,MAAM,WAAW,GAAG;IAClB,GAAG,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE;IACvC,WAAW,EAAE;QACX,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;YAC7C,SAAS,EAAE,MAAM;YACjB,IAAI,EAAE,MAAe;YACrB,MAAM,EAAE,EAAE;SACX;KACF;CACF,CAAA;AAED,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,UAAU,CAAC,GAAG,EAAE;QACd,OAAQ,UAAkB,CAAC,eAAe,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;QACtC,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,KAAK,EAAE,iBAAiB,GAAG,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;QACxE,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,WAAoB,EAAE,CAAC,CAAA;QAEpF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,OAAO,CAAC,yCAAyC,CAAC,CAAC,CAAA;QACjF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAE7B,oEAAoE;QACpE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,2DAA2D,CAAC,CAAA;QACnF,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kEAAkE,CAAC,CAAA;QAC1F,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kEAAkE,CAAC,CAAA;QAC1F,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;QACtC,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;QAChD,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,WAAoB,EAAE,CAAC,CAAA;QAEpF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,OAAO,CAAC,yCAAyC,CAAC,CAAC,CAAA;QACjF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC7B,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,2DAA2D,CAAC,CAAA;QACnF,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,KAAwC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;QAC9E,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,KAAK,EAAE,iBAAiB,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;QACnE,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,WAAoB,EAAE,CAAC,CAAA;QAEpF,MAAM,OAAO,CAAC,IAAI,OAAO,CAAC,uDAAuD,CAAC,CAAC,CAAA;QAEnF,MAAM,CAAC,QAAQ,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;QACzC,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAqC,CAAA;QACnF,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAA;QAC5C,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;QACtC,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,KAAK,EAAE,iBAAiB,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;QACnE,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC;YAC/B,YAAY,EAAE,EAAE;YAChB,MAAM,EAAE;gBACN,GAAG,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE;gBACvC,WAAW,EAAE;oBACX,KAAK,EAAE;wBACL,IAAI,EAAE,OAAO;wBACb,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;wBAC7C,SAAS,EAAE,MAAM;wBACjB,IAAI,EAAE,MAAe;wBACrB,GAAG,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE;wBAC7B,MAAM,EAAE,EAAE;qBACX;iBACF;aACO;SACX,CAAC,CAAA;QAEF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,OAAO,CAAC,uDAAuD,CAAC,CAAC,CAAA;QAC/F,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC7B,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/api/stats-collection-filter.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=stats-collection-filter.test.d.ts.map

package/dist/__tests__/api/stats-collection-filter.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"stats-collection-filter.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/api/stats-collection-filter.test.ts"],"names":[],"mappings":""}