@orion-studios/cms 0.5.0

package/dist/server/index.js

@@ -0,0 +1,2280 @@
+import {
+  CONTENT_CACHE_TAG
+} from "../chunk-HVJCF2IZ.js";
+import {
+  createMemoryRateLimitStore,
+  isOriginAllowed,
+  processSubmission
+} from "../chunk-VPUODCNH.js";
+
+// src/server/routes.ts
+import { createHash as createHash2 } from "crypto";
+
+// src/analytics/aggregate.ts
+var CONVERSION_NAMES = /* @__PURE__ */ new Set(["call", "email"]);
+function normalizeSource(utmSource, referrer) {
+  const tag = utmSource.trim().toLowerCase();
+  if (tag) {
+    if (["gbp", "gmb", "google-business", "google_business", "business.google.com"].includes(tag)) {
+      return "Google Business Profile";
+    }
+    if (tag === "google") return "Google";
+    if (tag === "facebook" || tag === "fb") return "Facebook";
+    if (tag === "instagram" || tag === "ig") return "Instagram";
+    return utmSource.trim();
+  }
+  const host = referrer.trim().toLowerCase();
+  if (!host) return "direct";
+  if (host === "business.google.com") return "Google Business Profile";
+  if (host.includes("google.")) return "Google search";
+  if (host.includes("bing.")) return "Bing";
+  if (host.includes("duckduckgo.")) return "DuckDuckGo";
+  if (host.includes("yahoo.")) return "Yahoo";
+  if (host.includes("facebook.") || host === "fb.com" || host.startsWith("l.facebook")) return "Facebook";
+  if (host.includes("instagram.")) return "Instagram";
+  if (host.includes("nextdoor.")) return "Nextdoor";
+  if (host.includes("yelp.")) return "Yelp";
+  if (host.includes("linkedin.") || host === "lnkd.in") return "LinkedIn";
+  if (host.includes("twitter.") || host === "t.co" || host.includes("x.com")) return "X (Twitter)";
+  return host;
+}
+var isConversion = (event) => event.type === "click" && CONVERSION_NAMES.has(event.name) || event.type === "form" && event.name.endsWith(":submit");
+var top = (map, limit, by) => [...map.entries()].sort((a, b) => by(b[1]) - by(a[1])).slice(0, limit);
+function computeKpis(events) {
+  const sessions = /* @__PURE__ */ new Set();
+  const visitors = /* @__PURE__ */ new Set();
+  const visitorSessions = /* @__PURE__ */ new Map();
+  const converting = /* @__PURE__ */ new Set();
+  let pageviews = 0;
+  let calls = 0;
+  let formSubmits = 0;
+  let emails = 0;
+  let portalClicks = 0;
+  for (const event of events) {
+    if (event.session_key) sessions.add(event.session_key);
+    const identity = event.visitor_key || event.session_key;
+    if (identity) visitors.add(identity);
+    if (event.visitor_key && event.session_key) {
+      const keys = visitorSessions.get(event.visitor_key) || /* @__PURE__ */ new Set();
+      keys.add(event.session_key);
+      visitorSessions.set(event.visitor_key, keys);
+    }
+    if (event.type === "pageview") pageviews += 1;
+    if (event.type === "click" && event.name === "call") calls += 1;
+    if (event.type === "click" && event.name === "email") emails += 1;
+    if (event.type === "click" && event.name === "portal") portalClicks += 1;
+    if (event.type === "form" && event.name.endsWith(":submit")) formSubmits += 1;
+    if (isConversion(event) && event.session_key) converting.add(event.session_key);
+  }
+  const conversions = calls + formSubmits + emails;
+  const returningVisitors = [...visitorSessions.values()].filter((keys) => keys.size > 1).length;
+  return {
+    visitors: visitors.size,
+    identifiedVisitors: visitorSessions.size,
+    returningVisitors,
+    sessions: sessions.size,
+    pageviews,
+    pagesPerVisitor: visitors.size > 0 ? pageviews / visitors.size : 0,
+    calls,
+    formSubmits,
+    emails,
+    portalClicks,
+    conversions,
+    conversionRate: sessions.size > 0 ? converting.size / sessions.size : 0
+  };
+}
+function aggregateAnalytics(events, previousEvents, range) {
+  const kpis = computeKpis(events);
+  const previous = computeKpis(previousEvents);
+  const byDay = /* @__PURE__ */ new Map();
+  const dayOf = (iso) => iso.slice(0, 10);
+  for (const event of events) {
+    const day = dayOf(event.created_at);
+    const entry = byDay.get(day) || { visitors: /* @__PURE__ */ new Set(), conversions: 0 };
+    const identity = event.visitor_key || event.session_key;
+    if (identity) entry.visitors.add(identity);
+    if (isConversion(event)) entry.conversions += 1;
+    byDay.set(day, entry);
+  }
+  const trend = [];
+  for (let cursor = /* @__PURE__ */ new Date(`${dayOf(range.from)}T00:00:00Z`); cursor.toISOString().slice(0, 10) <= dayOf(range.to); cursor.setUTCDate(cursor.getUTCDate() + 1)) {
+    const day = cursor.toISOString().slice(0, 10);
+    const entry = byDay.get(day);
+    trend.push({ day, visitors: entry?.visitors.size ?? 0, conversions: entry?.conversions ?? 0 });
+    if (trend.length > 370) break;
+  }
+  const bySession = /* @__PURE__ */ new Map();
+  for (const event of events) {
+    if (!event.session_key) continue;
+    const list = bySession.get(event.session_key) || [];
+    list.push(event);
+    bySession.set(event.session_key, list);
+  }
+  for (const list of bySession.values()) {
+    list.sort((a, b) => a.created_at.localeCompare(b.created_at));
+  }
+  const pages = /* @__PURE__ */ new Map();
+  const pageEntry = (path) => {
+    const entry = pages.get(path) || { views: 0, entries: 0, conversions: 0 };
+    pages.set(path, entry);
+    return entry;
+  };
+  for (const event of events) {
+    if (event.type === "pageview") pageEntry(event.path).views += 1;
+    if (isConversion(event)) pageEntry(event.path).conversions += 1;
+  }
+  for (const list of bySession.values()) {
+    const first = list.find((event) => event.type === "pageview");
+    if (first) pageEntry(first.path).entries += 1;
+  }
+  const sources = /* @__PURE__ */ new Map();
+  for (const list of bySession.values()) {
+    const first = list.find((event) => event.type === "pageview");
+    const label = normalizeSource(first?.utm?.source || "", first?.referrer || "");
+    const entry = sources.get(label) || { sessions: 0, conversions: 0 };
+    entry.sessions += 1;
+    if (list.some(isConversion)) entry.conversions += 1;
+    sources.set(label, entry);
+  }
+  const locations = /* @__PURE__ */ new Map();
+  const devices = /* @__PURE__ */ new Map();
+  for (const list of bySession.values()) {
+    const sample = list[0];
+    const location = [sample.city, sample.region].filter(Boolean).join(", ");
+    if (location) locations.set(location, (locations.get(location) || 0) + 1);
+    if (sample.device) devices.set(sample.device, (devices.get(sample.device) || 0) + 1);
+  }
+  const hours = new Array(24).fill(0);
+  for (const event of events) {
+    if (event.type !== "pageview") continue;
+    const hour = new Date(event.created_at).getUTCHours();
+    if (Number.isFinite(hour)) hours[hour] += 1;
+  }
+  const pathCounts = /* @__PURE__ */ new Map();
+  for (const list of bySession.values()) {
+    const steps = [];
+    for (const event of list) {
+      if (event.type !== "pageview") continue;
+      if (steps[steps.length - 1] !== event.path) steps.push(event.path);
+      if (steps.length >= 5) break;
+    }
+    if (steps.length < 2) continue;
+    const key = steps.join(" \u2192 ");
+    const entry = pathCounts.get(key) || { count: 0, converted: 0 };
+    entry.count += 1;
+    if (list.some(isConversion)) entry.converted += 1;
+    pathCounts.set(key, entry);
+  }
+  const forms = /* @__PURE__ */ new Map();
+  for (const event of events) {
+    if (event.type !== "form") continue;
+    const [slug, stage] = event.name.split(":");
+    if (!slug || !stage) continue;
+    const entry = forms.get(slug) || { views: 0, starts: 0, submits: 0 };
+    if (stage === "view") entry.views += 1;
+    if (stage === "start") entry.starts += 1;
+    if (stage === "submit") entry.submits += 1;
+    forms.set(slug, entry);
+  }
+  const notFound = /* @__PURE__ */ new Map();
+  for (const event of events) {
+    if (event.type === "not_found") notFound.set(event.path, (notFound.get(event.path) || 0) + 1);
+  }
+  return {
+    range,
+    kpis,
+    previous,
+    trend,
+    pages: top(pages, 25, (page) => page.views).map(([path, data]) => ({ path, ...data })),
+    sources: top(sources, 15, (source) => source.sessions).map(([source, data]) => ({ source, ...data })),
+    locations: top(locations, 15, (count) => count).map(([location, sessions]) => ({ location, sessions })),
+    devices: [...devices.entries()].map(([device, sessions]) => ({ device, sessions })),
+    hours,
+    paths: top(pathCounts, 8, (path) => path.count).map(([key, data]) => ({
+      path: key.split(" \u2192 "),
+      ...data
+    })),
+    forms: [...forms.entries()].map(([form, data]) => ({ form, ...data })),
+    notFound: top(notFound, 20, (count) => count).map(([path, count]) => ({ path, count }))
+  };
+}
+
+// src/analytics/ingest.ts
+import { createHash, createHmac } from "crypto";
+var EVENT_TYPES = ["pageview", "click", "form", "not_found"];
+var MAX_EVENTS_PER_BATCH = 20;
+var MAX_TEXT = 300;
+var MAX_META_JSON = 1e3;
+function sessionKeyFor(ip, userAgent, secret, now = /* @__PURE__ */ new Date()) {
+  const day = now.toISOString().slice(0, 10);
+  return createHash("sha256").update(`${secret}|${day}|${ip}|${userAgent}`).digest("hex").slice(0, 24);
+}
+function visitorKeyFor(visitorId, secret) {
+  if (typeof visitorId !== "string" || !/^[0-9a-f-]{36}$/i.test(visitorId)) return "";
+  return createHmac("sha256", secret).update(visitorId).digest("hex").slice(0, 24);
+}
+var BOT_PATTERN = /bot|crawl|spider|slurp|headless|lighthouse|pingdom|pagespeed|facebookexternalhit|preview|scan|monitor|curl|wget|python-requests|axios|go-http/i;
+function isBotRequest(userAgent) {
+  if (!userAgent || userAgent.length < 12) return true;
+  return BOT_PATTERN.test(userAgent);
+}
+function deviceFrom(userAgent) {
+  if (/ipad|tablet/i.test(userAgent)) return "tablet";
+  if (/mobi|iphone|android/i.test(userAgent)) return "mobile";
+  return "desktop";
+}
+var clip = (value, max = MAX_TEXT) => typeof value === "string" ? value.slice(0, max) : "";
+var referrerHost = (value) => {
+  const raw = clip(value);
+  if (!raw) return "";
+  try {
+    return new URL(raw).hostname;
+  } catch {
+    return "";
+  }
+};
+var cleanUtm = (value) => {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  const out = {};
+  for (const key of ["source", "medium", "campaign", "term", "content"]) {
+    const entry = value[key];
+    if (typeof entry === "string" && entry) out[key] = entry.slice(0, 100);
+  }
+  return out;
+};
+var cleanMeta = (value) => {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  const json2 = JSON.stringify(value);
+  if (json2.length > MAX_META_JSON) return {};
+  return value;
+};
+function parseEventBatch(body, context) {
+  const list = Array.isArray(body?.events) ? body.events : [];
+  const rows = [];
+  let dropped = 0;
+  for (const raw of list.slice(0, MAX_EVENTS_PER_BATCH)) {
+    if (!raw || typeof raw !== "object") {
+      dropped += 1;
+      continue;
+    }
+    const event = raw;
+    const type = event.type;
+    if (!EVENT_TYPES.includes(type)) {
+      dropped += 1;
+      continue;
+    }
+    const path = clip(event.path);
+    if (!path.startsWith("/")) {
+      dropped += 1;
+      continue;
+    }
+    rows.push({
+      session_key: context.sessionKey,
+      visitor_key: context.visitorKey || "",
+      type,
+      name: clip(event.name, 100),
+      path,
+      referrer: type === "pageview" ? referrerHost(event.referrer) : "",
+      utm: type === "pageview" ? cleanUtm(event.utm) : {},
+      device: context.device,
+      region: context.region,
+      city: context.city,
+      meta: cleanMeta(event.meta)
+    });
+  }
+  dropped += Math.max(0, list.length - MAX_EVENTS_PER_BATCH);
+  return { rows, dropped };
+}
+function geoFrom(request) {
+  const decode2 = (value) => {
+    if (!value) return "";
+    try {
+      return decodeURIComponent(value).slice(0, 80);
+    } catch {
+      return value.slice(0, 80);
+    }
+  };
+  return {
+    region: decode2(request.headers.get("x-vercel-ip-country-region")),
+    city: decode2(request.headers.get("x-vercel-ip-city"))
+  };
+}
+
+// src/server/notify.ts
+function createResendSender(options = {}) {
+  const apiKey = options.apiKey ?? process.env.RESEND_API_KEY ?? "";
+  if (!apiKey) return null;
+  const from = options.from || process.env.CMS_EMAIL_FROM || "onboarding@resend.dev";
+  return async (message) => {
+    const response = await fetch("https://api.resend.com/emails", {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${apiKey}`,
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({
+        from,
+        to: message.to,
+        subject: message.subject,
+        text: message.text,
+        ...message.replyTo ? { reply_to: message.replyTo } : {}
+      })
+    });
+    if (!response.ok) {
+      const body = await response.text().catch(() => "");
+      throw new Error(`Resend ${response.status}: ${body.slice(0, 300)}`);
+    }
+  };
+}
+var isEmail = (value) => typeof value === "string" && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value);
+function formatSubmissionText(data) {
+  const lines = [];
+  for (const [key, value] of Object.entries(data)) {
+    const label = key.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[-_.]+/g, " ").replace(/\b\w/g, (char) => char.toUpperCase());
+    const rendered = Array.isArray(value) ? value.join(", ") : typeof value === "string" ? value : JSON.stringify(value);
+    lines.push(`${label}:
+${rendered}
+`);
+  }
+  return lines.join("\n");
+}
+async function notifySubmission(args) {
+  const notify = args.config.notify || {};
+  const recipients = (notify.emails || []).filter(isEmail);
+  const submitterEmail = Object.entries(args.data).find(
+    ([key, value]) => key.toLowerCase().includes("email") && isEmail(value)
+  )?.[1];
+  const subject = (notify.subject || "New {form} submission").replace(
+    /\{form\}/g,
+    args.formTitle || "form"
+  );
+  if (recipients.length > 0) {
+    try {
+      await args.sendEmail({
+        to: recipients,
+        subject,
+        text: formatSubmissionText(args.data),
+        ...submitterEmail ? { replyTo: submitterEmail } : {}
+      });
+    } catch (error) {
+      console.error("[orion-cms] submission notification failed:", error);
+    }
+  }
+  if (notify.autoReply && submitterEmail) {
+    try {
+      await args.sendEmail({
+        to: [submitterEmail],
+        subject: `We received your request${args.siteName ? ` \u2014 ${args.siteName}` : ""}`,
+        text: (args.successMessage || "Thanks \u2014 we received your request and will follow up soon.") + "\n\n\u2014 " + (args.siteName || args.formTitle)
+      });
+    } catch (error) {
+      console.error("[orion-cms] auto-reply failed:", error);
+    }
+  }
+}
+
+// src/server/permissions.ts
+var ROLE_RANK = {
+  content: 0,
+  editor: 1,
+  admin: 2,
+  developer: 3
+};
+var MIN_ROLE = {
+  "pages.read": "content",
+  "pages.saveDraft": "content",
+  "pages.changeStructure": "editor",
+  "pages.publish": "editor",
+  "pages.create": "editor",
+  "pages.delete": "admin",
+  "pages.restore": "editor",
+  "globals.read": "content",
+  "globals.write": "content",
+  "media.read": "content",
+  "media.upload": "content",
+  "media.update": "content",
+  "media.delete": "editor",
+  "forms.read": "content",
+  "forms.write": "editor",
+  "forms.delete": "admin",
+  "submissions.read": "content",
+  "submissions.manage": "editor",
+  "redirects.manage": "editor",
+  "activity.read": "editor",
+  "analytics.read": "content",
+  "sync.run": "admin",
+  "users.manage": "admin"
+};
+function can(user, action) {
+  if (!user) return false;
+  return ROLE_RANK[user.role] >= ROLE_RANK[MIN_ROLE[action]];
+}
+var CMS_ROLES = ["content", "editor", "admin", "developer"];
+var isCmsRole = (value) => typeof value === "string" && CMS_ROLES.includes(value);
+var outranksOrEqual = (actor, target) => ROLE_RANK[actor] >= ROLE_RANK[target];
+var assignableRoles = (actor) => CMS_ROLES.filter((role) => outranksOrEqual(actor, role));
+function isStructuralChange(previous, next) {
+  if (previous.length !== next.length) return true;
+  for (let index = 0; index < previous.length; index += 1) {
+    if (previous[index].id !== next[index].id) return true;
+    if (previous[index].type !== next[index].type) return true;
+  }
+  return false;
+}
+
+// src/server/preview.ts
+import { createHmac as createHmac2, timingSafeEqual } from "crypto";
+var encode = (value) => Buffer.from(value, "utf8").toString("base64url");
+var decode = (value) => Buffer.from(value, "base64url").toString("utf8");
+var sign = (payload, secret) => createHmac2("sha256", secret).update(payload).digest("base64url");
+var PREVIEW_TOKEN_TTL_MS = 60 * 60 * 1e3;
+function createPreviewToken(pageId, secret, ttlMs = PREVIEW_TOKEN_TTL_MS) {
+  const payload = encode(`${pageId}|${Date.now() + ttlMs}`);
+  return `${payload}.${sign(payload, secret)}`;
+}
+function verifyPreviewToken(token, secret) {
+  const [payload, signature] = token.split(".");
+  if (!payload || !signature) return null;
+  const expected = sign(payload, secret);
+  const expectedBuffer = Buffer.from(expected);
+  const actualBuffer = Buffer.from(signature);
+  if (expectedBuffer.length !== actualBuffer.length) return null;
+  if (!timingSafeEqual(expectedBuffer, actualBuffer)) return null;
+  try {
+    const [pageId, expiresAt] = decode(payload).split("|");
+    if (!pageId || Number(expiresAt) < Date.now()) return null;
+    return pageId;
+  } catch {
+    return null;
+  }
+}
+async function getPreviewPage(client, token, secret) {
+  const pageId = verifyPreviewToken(token, secret);
+  if (!pageId) return null;
+  const { data } = await client.from("cms_pages").select("id, slug, path, title, seo, draft_layout").eq("id", pageId).maybeSingle();
+  if (!data) return null;
+  return {
+    id: String(data.id),
+    slug: String(data.slug),
+    path: String(data.path),
+    title: String(data.title ?? ""),
+    seo: data.seo ?? {},
+    layout: data.draft_layout ?? []
+  };
+}
+
+// src/server/supabase.ts
+import { createClient } from "@supabase/supabase-js";
+function readCmsEnv() {
+  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL || process.env.SUPABASE_URL || "";
+  const serviceRoleKey = process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_SECRET_KEY || "";
+  if (!supabaseUrl || !serviceRoleKey) {
+    throw new Error(
+      "Orion CMS: NEXT_PUBLIC_SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY (or SUPABASE_SECRET_KEY) must be set."
+    );
+  }
+  return { supabaseUrl, serviceRoleKey };
+}
+var serviceClient = null;
+function getServiceClient(env = readCmsEnv()) {
+  if (!serviceClient) {
+    serviceClient = createClient(env.supabaseUrl, env.serviceRoleKey, {
+      auth: { persistSession: false, autoRefreshToken: false }
+    });
+  }
+  return serviceClient;
+}
+function setServiceClientForTesting(client) {
+  serviceClient = client;
+}
+async function resolveUser(request, client = getServiceClient()) {
+  const header = request.headers.get("authorization") || "";
+  const token = header.startsWith("Bearer ") ? header.slice(7).trim() : "";
+  if (!token) return null;
+  const { data, error } = await client.auth.getUser(token);
+  if (error || !data.user) return null;
+  const { data: profile } = await client.from("cms_profiles").select("role, name").eq("user_id", data.user.id).maybeSingle();
+  if (!profile) return null;
+  return {
+    id: data.user.id,
+    email: data.user.email ?? null,
+    role: profile.role,
+    name: profile.name || ""
+  };
+}
+
+// src/server/sync.ts
+var isRecord = (value) => Boolean(value) && typeof value === "object" && !Array.isArray(value);
+var mimeByExtension = {
+  avif: "image/avif",
+  gif: "image/gif",
+  ico: "image/x-icon",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  pdf: "application/pdf",
+  png: "image/png",
+  svg: "image/svg+xml",
+  webp: "image/webp"
+};
+var cleanPath = (src) => src.split("?")[0]?.split("#")[0] || src;
+var filenameFromPath = (path) => {
+  const clean = cleanPath(path);
+  return clean.split("/").filter(Boolean).pop() || clean;
+};
+var mimeFromPath = (path) => {
+  const extension = filenameFromPath(path).split(".").pop()?.toLowerCase() || "";
+  return mimeByExtension[extension] || "";
+};
+var shouldIndexMediaPath = (src) => Boolean(src) && !src.startsWith("data:") && !/^https?:\/\//i.test(src);
+var toSyncMedia = (value) => {
+  const src = typeof value.src === "string" ? value.src.trim() : "";
+  if (!shouldIndexMediaPath(src)) return null;
+  const filename = typeof value.filename === "string" && value.filename.trim() ? value.filename.trim() : filenameFromPath(src);
+  return {
+    storagePath: src,
+    filename,
+    alt: typeof value.alt === "string" ? value.alt : "",
+    caption: typeof value.caption === "string" ? value.caption : "",
+    mimeType: mimeFromPath(src)
+  };
+};
+var collectLayoutMedia = (value, media) => {
+  if (Array.isArray(value)) {
+    for (const item of value) collectLayoutMedia(item, media);
+    return;
+  }
+  if (!isRecord(value)) return;
+  if (typeof value.src === "string" && ("mediaId" in value || "alt" in value || "caption" in value || "filename" in value)) {
+    const item = toSyncMedia(value);
+    if (item && !media.has(item.storagePath)) media.set(item.storagePath, item);
+  }
+  for (const child of Object.values(value)) collectLayoutMedia(child, media);
+};
+var normalizeManualMedia = (item) => {
+  if (!item || typeof item.storagePath !== "string") return null;
+  const storagePath = item.storagePath.trim();
+  if (!shouldIndexMediaPath(storagePath)) return null;
+  return {
+    storagePath,
+    filename: typeof item.filename === "string" && item.filename.trim() ? item.filename.trim() : filenameFromPath(storagePath),
+    alt: typeof item.alt === "string" ? item.alt : "",
+    caption: typeof item.caption === "string" ? item.caption : "",
+    mimeType: typeof item.mimeType === "string" ? item.mimeType : mimeFromPath(storagePath),
+    width: typeof item.width === "number" ? item.width : null,
+    height: typeof item.height === "number" ? item.height : null,
+    filesize: typeof item.filesize === "number" ? item.filesize : null
+  };
+};
+async function runContentSync(client, registry, input) {
+  const pages = input.pages || [];
+  const globals = input.globals || [];
+  const forms = input.forms || [];
+  const media = /* @__PURE__ */ new Map();
+  const synced = [];
+  const skipped = [];
+  for (const page of pages) {
+    if (!page || typeof page.slug !== "string") continue;
+    const validated = registry.validateLayout(page.layout ?? []);
+    if (!validated.ok) {
+      skipped.push({ slug: page.slug, issues: validated.issues });
+      continue;
+    }
+    const { error } = await client.rpc("cms_sync_page", {
+      p_slug: page.slug,
+      p_path: typeof page.path === "string" ? page.path : page.slug === "home" ? "/" : `/${page.slug}`,
+      p_title: typeof page.title === "string" ? page.title : page.slug,
+      p_seo: isRecord(page.seo) ? page.seo : {},
+      p_layout: validated.layout
+    });
+    if (error) {
+      skipped.push({ slug: page.slug, issues: error.message });
+      continue;
+    }
+    collectLayoutMedia(validated.layout, media);
+    synced.push(page.slug);
+  }
+  for (const item of input.media || []) {
+    const normalized = normalizeManualMedia(item);
+    if (normalized && !media.has(normalized.storagePath)) media.set(normalized.storagePath, normalized);
+  }
+  let syncedMedia = 0;
+  for (const item of media.values()) {
+    const { data: existing, error: readError } = await client.from("cms_media").select("id").eq("storage_path", item.storagePath).maybeSingle();
+    if (readError || existing) continue;
+    const { error: insertError } = await client.from("cms_media").insert({
+      storage_path: item.storagePath,
+      filename: item.filename || filenameFromPath(item.storagePath),
+      alt: item.alt || "",
+      caption: item.caption || "",
+      mime_type: item.mimeType || mimeFromPath(item.storagePath),
+      width: item.width ?? null,
+      height: item.height ?? null,
+      filesize: item.filesize ?? null
+    });
+    if (!insertError) syncedMedia += 1;
+  }
+  const failed = [];
+  let syncedGlobals = 0;
+  for (const global of globals) {
+    if (!global || typeof global.key !== "string" || !isRecord(global.data)) continue;
+    const { error } = await client.from("cms_globals").upsert({ key: global.key, data: global.data, updated_at: (/* @__PURE__ */ new Date()).toISOString() });
+    if (error) failed.push({ kind: "global", key: global.key, error: error.message });
+    else syncedGlobals += 1;
+  }
+  let syncedForms = 0;
+  for (const form of forms) {
+    if (!form || typeof form.slug !== "string") continue;
+    const { error } = await client.from("cms_forms").upsert(
+      {
+        slug: form.slug,
+        title: typeof form.title === "string" ? form.title : form.slug,
+        config: isRecord(form.config) ? form.config : {},
+        success_message: typeof form.successMessage === "string" ? form.successMessage : "",
+        updated_at: (/* @__PURE__ */ new Date()).toISOString()
+      },
+      { onConflict: "slug" }
+    );
+    if (error) failed.push({ kind: "form", key: form.slug, error: error.message });
+    else syncedForms += 1;
+  }
+  return { synced, skipped, globals: syncedGlobals, forms: syncedForms, media: syncedMedia, failed };
+}
+
+// src/server/routes.ts
+import { timingSafeEqual as timingSafeEqual2 } from "crypto";
+var tokenEquals = (candidate, secret) => {
+  if (!candidate || !secret) return false;
+  const a = Buffer.from(candidate);
+  const b = Buffer.from(secret);
+  return a.length === b.length && timingSafeEqual2(a, b);
+};
+var json = (body, status = 200) => new Response(JSON.stringify(body), {
+  status,
+  headers: { "content-type": "application/json" }
+});
+var errors = {
+  unauthorized: () => json({ error: "Not authorized." }, 401),
+  forbidden: () => json({ error: "Forbidden." }, 403),
+  notFound: () => json({ error: "Not found." }, 404),
+  badRequest: (message, extra) => json({ error: message, ...extra }, 400),
+  conflict: (message, extra) => json({ error: message, ...extra }, 409)
+};
+var isRecord2 = (value) => Boolean(value) && typeof value === "object" && !Array.isArray(value);
+var SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var PATH_PATTERN = /^\/(?:[a-z0-9-]+(?:\/[a-z0-9-]+)*)?$/;
+var DEFAULT_MAX_UPLOAD_BYTES = 15 * 1024 * 1024;
+var ALLOWED_UPLOAD_TYPES = /* @__PURE__ */ new Set([
+  "image/jpeg",
+  "image/png",
+  "image/webp",
+  "image/gif",
+  "image/avif",
+  "image/svg+xml",
+  "application/pdf"
+]);
+async function readJson(request) {
+  try {
+    const parsed = await request.json();
+    return isRecord2(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+async function revalidateContent() {
+  try {
+    const mod = await import("next/cache");
+    if (typeof mod.updateTag === "function") {
+      ;
+      mod.updateTag(CONTENT_CACHE_TAG);
+    } else if (typeof mod.revalidateTag === "function") {
+      ;
+      mod.revalidateTag(CONTENT_CACHE_TAG, "max");
+    }
+  } catch {
+  }
+}
+var clientKey = (request) => {
+  const vercel = request.headers.get("x-vercel-forwarded-for");
+  if (vercel) return vercel.split(",").pop().trim();
+  const real = request.headers.get("x-real-ip");
+  if (real) return real.trim();
+  const forwarded = request.headers.get("x-forwarded-for");
+  if (forwarded) {
+    const parts = forwarded.split(",").map((part) => part.trim()).filter(Boolean);
+    if (parts.length > 0) return parts[parts.length - 1];
+  }
+  return "unknown";
+};
+var MAX_PUBLIC_BODY_BYTES = 64 * 1024;
+var MAX_PUBLIC_BODY_DEPTH = 12;
+function exceedsDepth(value, limit, depth = 0) {
+  if (depth > limit) return true;
+  if (Array.isArray(value)) return value.some((item) => exceedsDepth(item, limit, depth + 1));
+  if (isRecord2(value)) return Object.values(value).some((item) => exceedsDepth(item, limit, depth + 1));
+  return false;
+}
+async function readJsonLimited(request, limits) {
+  let text;
+  try {
+    text = await request.text();
+  } catch {
+    return null;
+  }
+  if (text.length > limits.maxBytes) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  if (!isRecord2(parsed)) return null;
+  if (exceedsDepth(parsed, limits.maxDepth)) return null;
+  return parsed;
+}
+var hashedClientKey = (ip) => createHash2("sha256").update(ip).digest("hex").slice(0, 24);
+function createDurableRateLimitStore(getClient, options) {
+  const max = options?.max ?? 5;
+  const windowSeconds = Math.max(1, Math.round((options?.windowMs ?? 6e4) / 1e3));
+  const bucket = options?.bucket ?? "default";
+  return {
+    async isLimited(key) {
+      try {
+        const { data, error } = await getClient().rpc("cms_rate_limit_consume", {
+          p_key: `${bucket}:${key}`,
+          p_max: max,
+          p_window_seconds: windowSeconds
+        });
+        if (error) return false;
+        return data === false;
+      } catch {
+        return false;
+      }
+    }
+  };
+}
+function createCmsRoutes(options) {
+  const { registry, allowedOrigins, syncToken, knownGoodEmailDomains } = options;
+  const db = () => options.client ?? getServiceClient();
+  const rateLimit = options.rateLimitStore === null ? null : options.rateLimitStore || (options.memoryMode ? createMemoryRateLimitStore() : createDurableRateLimitStore(db, { max: 5, windowMs: 6e4, bucket: "submit" }));
+  const sendEmail = options.sendEmail === null ? null : options.sendEmail || createResendSender();
+  const maxUploadBytes = options.maxUploadBytes ?? DEFAULT_MAX_UPLOAD_BYTES;
+  const previewSecret = () => options.previewSecret || process.env.SUPABASE_SERVICE_ROLE_KEY || (options.memoryMode ? "orion-memory-preview-secret" : "");
+  const eventsRateLimit = options.memoryMode ? createMemoryRateLimitStore({ max: 120, windowMs: 6e4 }) : createDurableRateLimitStore(db, { max: 120, windowMs: 6e4, bucket: "events" });
+  const analyticsRetentionDays = options.analyticsRetentionDays ?? 90;
+  const requestSessionKey = (request) => {
+    const secret = previewSecret() || "orion-analytics";
+    return sessionKeyFor(clientKey(request), request.headers.get("user-agent") || "", secret);
+  };
+  const guard = async (request, action) => {
+    const user = await resolveUser(request, db());
+    if (!user) return errors.unauthorized();
+    if (!can(user, action)) return errors.forbidden();
+    return { user };
+  };
+  const logActivity = async (user, action, subject) => {
+    try {
+      await db().from("cms_activity").insert({
+        actor: user?.id ?? null,
+        actor_name: user?.name || user?.email || "",
+        action,
+        subject
+      });
+    } catch {
+    }
+  };
+  const hasDraftChanges = (page) => {
+    if (page.status !== "published") return true;
+    return JSON.stringify(page.draft_layout ?? []) !== JSON.stringify(page.published_layout ?? []);
+  };
+  const listPages = async (request) => {
+    const auth = await guard(request, "pages.read");
+    if (auth instanceof Response) return auth;
+    const { data, error } = await db().from("cms_pages").select(
+      "id, slug, path, title, status, builder_owned, updated_at, published_at, publish_at, draft_layout, published_layout"
+    ).order("path");
+    if (error) return errors.badRequest(error.message);
+    const pages = (data || []).map((page) => {
+      const { draft_layout, published_layout, ...summary } = page;
+      void draft_layout;
+      void published_layout;
+      return { ...summary, has_draft_changes: hasDraftChanges(page) };
+    });
+    return json({ pages });
+  };
+  const getPage = async (request, id) => {
+    const auth = await guard(request, "pages.read");
+    if (auth instanceof Response) return auth;
+    const { data, error } = await db().from("cms_pages").select("*").eq("id", id).maybeSingle();
+    if (error) return errors.badRequest(error.message);
+    if (!data) return errors.notFound();
+    return json({ page: data });
+  };
+  const createPage = async (request) => {
+    const auth = await guard(request, "pages.create");
+    if (auth instanceof Response) return auth;
+    const body = await readJson(request);
+    if (!body || typeof body.slug !== "string" || typeof body.title !== "string") {
+      return errors.badRequest("slug and title are required.");
+    }
+    const slug = body.slug.trim().toLowerCase();
+    if (!SLUG_PATTERN.test(slug)) {
+      return errors.badRequest("Slug may only contain lowercase letters, numbers, and dashes.");
+    }
+    const path = typeof body.path === "string" && body.path.length > 0 ? body.path : slug === "home" ? "/" : `/${slug}`;
+    if (!PATH_PATTERN.test(path)) {
+      return errors.badRequest("Path must look like /about or /services/pest-control.");
+    }
+    const { data, error } = await db().from("cms_pages").insert({ slug, path, title: body.title, seo: isRecord2(body.seo) ? body.seo : {} }).select("*").single();
+    if (error) {
+      if (error.message.includes("duplicate")) {
+        return errors.badRequest("A page with this slug or path already exists.");
+      }
+      return errors.badRequest(error.message);
+    }
+    await logActivity(auth.user, "page.create", path);
+    return json({ page: data }, 201);
+  };
+  const savePageDraft = async (request, id) => {
+    const auth = await guard(request, "pages.saveDraft");
+    if (auth instanceof Response) return auth;
+    const body = await readJson(request);
+    if (!body) return errors.badRequest("Invalid body.");
+    let layout = null;
+    if (body.layout !== void 0) {
+      const validated = registry.validateLayout(body.layout);
+      if (!validated.ok) {
+        return errors.badRequest("Layout validation failed.", { issues: validated.issues });
+      }
+      layout = validated.layout;
+    }
+    const wantsIdentityChange = body.slug !== void 0 || body.path !== void 0;
+    const wantsSchedule = body.publishAt !== void 0;
+    const needCurrent = wantsIdentityChange || wantsSchedule || layout !== null && !can(auth.user, "pages.changeStructure");
+    let current = null;
+    if (needCurrent) {
+      const { data: data2 } = await db().from("cms_pages").select("*").eq("id", id).maybeSingle();
+      if (!data2) return errors.notFound();
+      current = data2;
+    }
+    if (layout && !can(auth.user, "pages.changeStructure") && current) {
+      const previous = current.draft_layout || [];
+      if (isStructuralChange(previous, layout)) {
+        return errors.forbidden();
+      }
+    }
+    if (wantsIdentityChange && current) {
+      if (!can(auth.user, "pages.create")) return errors.forbidden();
+      const patch = {};
+      if (body.slug !== void 0) {
+        const slug = String(body.slug).trim().toLowerCase();
+        if (!SLUG_PATTERN.test(slug)) {
+          return errors.badRequest("Slug may only contain lowercase letters, numbers, and dashes.");
+        }
+        patch.slug = slug;
+      }
+      if (body.path !== void 0) {
+        const path = String(body.path).trim();
+        if (!PATH_PATTERN.test(path)) {
+          return errors.badRequest("Path must look like /about or /services/pest-control.");
+        }
+        patch.path = path;
+      }
+      if (Object.keys(patch).length > 0) {
+        const oldPath = String(current.path || "");
+        const wasPublished = current.status === "published";
+        const { error: error2 } = await db().from("cms_pages").update(patch).eq("id", id);
+        if (error2) {
+          if (error2.message.includes("duplicate")) {
+            return errors.badRequest("Another page already uses this slug or path.");
+          }
+          return errors.badRequest(error2.message);
+        }
+        const newPath = typeof patch.path === "string" ? patch.path : oldPath;
+        if (newPath !== oldPath && wasPublished && oldPath !== "/") {
+          await db().from("cms_redirects").delete().eq("from_path", newPath);
+          await db().from("cms_redirects").upsert({ from_path: oldPath, to_path: newPath, permanent: true }, { onConflict: "from_path" });
+        }
+        if (newPath !== oldPath) {
+          await logActivity(auth.user, "page.rename", `${oldPath} \u2192 ${newPath}`);
+          await revalidateContent();
+        }
+      }
+    }
+    if (wantsSchedule) {
+      if (!can(auth.user, "pages.publish")) return errors.forbidden();
+      let publishAt = null;
+      if (body.publishAt !== null) {
+        const parsed = Date.parse(String(body.publishAt));
+        if (Number.isNaN(parsed)) return errors.badRequest("publishAt must be a valid date.");
+        publishAt = new Date(parsed).toISOString();
+      }
+      const { error: error2 } = await db().from("cms_pages").update({ publish_at: publishAt }).eq("id", id);
+      if (error2) return errors.badRequest(error2.message);
+      await logActivity(
+        auth.user,
+        publishAt ? "page.schedule" : "page.unschedule",
+        `${current?.path ?? id}${publishAt ? ` @ ${publishAt}` : ""}`
+      );
+    }
+    const hasContentChange = body.title !== void 0 || body.seo !== void 0 || layout !== null;
+    if (!hasContentChange) {
+      const { data: data2 } = await db().from("cms_pages").select("*").eq("id", id).maybeSingle();
+      return json({ page: data2 });
+    }
+    const { data, error } = await db().rpc("cms_save_page_draft", {
+      p_page_id: id,
+      p_title: typeof body.title === "string" ? body.title : null,
+      p_seo: isRecord2(body.seo) ? body.seo : null,
+      p_layout: layout,
+      p_actor: auth.user.id
+    });
+    if (error) return errors.badRequest(error.message);
+    return json({ page: data });
+  };
+  const publishPage = async (request, id) => {
+    const auth = await guard(request, "pages.publish");
+    if (auth instanceof Response) return auth;
+    const { data, error } = await db().rpc("cms_publish_page", {
+      p_page_id: id,
+      p_actor: auth.user.id
+    });
+    if (error) return errors.badRequest(error.message);
+    await db().from("cms_pages").update({ publish_at: null }).eq("id", id);
+    await logActivity(auth.user, "page.publish", String(data?.path ?? id));
+    await revalidateContent();
+    return json({ page: data });
+  };
+  const unpublishPage = async (request, id) => {
+    const auth = await guard(request, "pages.publish");
+    if (auth instanceof Response) return auth;
+    const { data, error } = await db().from("cms_pages").update({ status: "draft", publish_at: null, updated_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", id).select("*").single();
+    if (error) return errors.badRequest(error.message);
+    await logActivity(auth.user, "page.unpublish", String(data?.path ?? id));
+    await revalidateContent();
+    return json({ page: data });
+  };
+  const duplicatePage = async (request, id) => {
+    const auth = await guard(request, "pages.create");
+    if (auth instanceof Response) return auth;
+    const { data: source } = await db().from("cms_pages").select("*").eq("id", id).maybeSingle();
+    if (!source) return errors.notFound();
+    const baseSlug = `${source.slug}-copy`;
+    let slug = baseSlug;
+    for (let attempt = 2; attempt < 50; attempt += 1) {
+      const { data: existing } = await db().from("cms_pages").select("id").eq("slug", slug).maybeSingle();
+      if (!existing) break;
+      slug = `${baseSlug}-${attempt}`;
+    }
+    const { data, error } = await db().from("cms_pages").insert({
+      slug,
+      path: `/${slug}`,
+      title: `${source.title} (copy)`,
+      seo: source.seo ?? {},
+      draft_layout: source.draft_layout ?? [],
+      status: "draft",
+      builder_owned: true
+    }).select("*").single();
+    if (error) return errors.badRequest(error.message);
+    await logActivity(auth.user, "page.duplicate", `${source.path} \u2192 /${slug}`);
+    return json({ page: data }, 201);
+  };
+  const deletePage = async (request, id) => {
+    const auth = await guard(request, "pages.delete");
+    if (auth instanceof Response) return auth;
+    const { data: doc } = await db().from("cms_pages").select("path").eq("id", id).maybeSingle();
+    const { error } = await db().from("cms_pages").delete().eq("id", id);
+    if (error) return errors.badRequest(error.message);
+    await logActivity(auth.user, "page.delete", String(doc?.path ?? id));
+    await revalidateContent();
+    return json({ success: true });
+  };
+  const previewToken = async (request, id) => {
+    const auth = await guard(request, "pages.read");
+    if (auth instanceof Response) return auth;
+    const secret = previewSecret();
+    if (!secret) return errors.badRequest("Preview is not configured on this site.");
+    const { data } = await db().from("cms_pages").select("id, path").eq("id", id).maybeSingle();
+    if (!data) return errors.notFound();
+    const token = createPreviewToken(id, secret);
+    return json({ token, path: data.path, url: `${data.path}?preview=${encodeURIComponent(token)}` });
+  };
+  const previewPage = async (request) => {
+    const secret = previewSecret();
+    if (!secret) return errors.notFound();
+    const token = new URL(request.url).searchParams.get("token") || "";
+    const pageId = verifyPreviewToken(token, secret);
+    if (!pageId) return errors.forbidden();
+    const { data } = await db().from("cms_pages").select("id, slug, path, title, seo, draft_layout").eq("id", pageId).maybeSingle();
+    if (!data) return errors.notFound();
+    return json({
+      page: {
+        id: data.id,
+        slug: data.slug,
+        path: data.path,
+        title: data.title,
+        seo: data.seo ?? {},
+        layout: data.draft_layout ?? []
+      }
+    });
+  };
+  const listVersions = async (request, id) => {
+    const auth = await guard(request, "pages.restore");
+    if (auth instanceof Response) return auth;
+    const { data, error } = await db().from("cms_page_versions").select("id, kind, title, created_by, created_at").eq("page_id", id).order("created_at", { ascending: false }).limit(50);
+    if (error) return errors.badRequest(error.message);
+    const { data: profiles } = await db().from("cms_profiles").select("user_id, name");
+    const names = new Map(
+      (profiles || []).map((profile) => [profile.user_id, profile.name || ""])
+    );
+    const versions = (data || []).map((version) => ({
+      ...version,
+      author: version.created_by ? names.get(version.created_by) || "Unknown user" : "System"
+    }));
+    return json({ versions });
+  };
+  const getVersion = async (request, versionId) => {
+    const auth = await guard(request, "pages.restore");
+    if (auth instanceof Response) return auth;
+    const { data, error } = await db().from("cms_page_versions").select("*").eq("id", Number(versionId)).maybeSingle();
+    if (error) return errors.badRequest(error.message);
+    if (!data) return errors.notFound();
+    return json({ version: data });
+  };
+  const restoreVersion = async (request, versionId) => {
+    const auth = await guard(request, "pages.restore");
+    if (auth instanceof Response) return auth;
+    const { data, error } = await db().rpc("cms_restore_page_version", {
+      p_version_id: Number(versionId),
+      p_actor: auth.user.id
+    });
+    if (error) return errors.badRequest(error.message);
+    await logActivity(auth.user, "page.restore", String(data?.path ?? versionId));
+    return json({ page: data });
+  };
+  const getGlobal = async (request, key) => {
+    const auth = await guard(request, "globals.read");
+    if (auth instanceof Response) return auth;
+    const { data, error } = await db().from("cms_globals").select("*").eq("key", key).maybeSingle();
+    if (error) return errors.badRequest(error.message);
+    return json({ global: data ?? { key, data: {} } });
+  };
+  const updateGlobal = async (request, key) => {
+    const auth = await guard(request, "globals.write");
+    if (auth instanceof Response) return auth;
+    const body = await readJson(request);
+    if (!body || !isRecord2(body.data)) return errors.badRequest("data object required.");
+    const { data, error } = await db().rpc("cms_update_global", {
+      p_key: key,
+      p_data: body.data,
+      p_actor: auth.user.id
+    });
+    if (error) return errors.badRequest(error.message);
+    await logActivity(auth.user, "global.save", key);
+    await revalidateContent();
+    return json({ global: data });
+  };
+  const listGlobalVersions = async (request, key) => {
+    const auth = await guard(request, "globals.read");
+    if (auth instanceof Response) return auth;
+    const { data, error } = await db().from("cms_global_versions").select("id, key, data, created_by, created_at").eq("key", key).order("created_at", { ascending: false }).limit(30);
+    if (error) return errors.badRequest(error.message);
+    return json({ versions: data });
+  };
+  const restoreGlobalVersion = async (request, versionId) => {
+    const auth = await guard(request, "globals.write");
+    if (auth instanceof Response) return auth;
+    const { data: version } = await db().from("cms_global_versions").select("*").eq("id", Number(versionId)).maybeSingle();
+    if (!version) return errors.notFound();
+    const { data, error } = await db().from("cms_globals").upsert({
+      key: version.key,
+      data: version.data,
+      updated_at: (/* @__PURE__ */ new Date()).toISOString()
+    }).select("*").single();
+    if (error) return errors.badRequest(error.message);
+    await db().from("cms_global_versions").insert({ key: version.key, data: version.data, created_by: auth.user.id });
+    await logActivity(auth.user, "global.restore", String(version.key));
+    await revalidateContent();
+    return json({ global: data });
+  };
+  const listMedia = async (request) => {
+    const auth = await guard(request, "media.read");
+    if (auth instanceof Response) return auth;
+    const { data, error } = await db().from("cms_media").select("*").order("created_at", { ascending: false }).limit(500);
+    if (error) return errors.badRequest(error.message);
+    return json({ media: data });
+  };
+  const validateUpload = (file) => {
+    if (file.size > maxUploadBytes) {
+      return `File is too large (max ${Math.round(maxUploadBytes / 1024 / 1024)} MB).`;
+    }
+    const type = file.type || "";
+    if (!ALLOWED_UPLOAD_TYPES.has(type)) {
+      return "Unsupported file type. Allowed: images (JPEG, PNG, WebP, GIF, AVIF, SVG) and PDF.";
+    }
+    return null;
+  };
+  const uploadMedia = async (request) => {
+    const auth = await guard(request, "media.upload");
+    if (auth instanceof Response) return auth;
+    const form = await request.formData().catch(() => null);
+    const file = form?.get("file");
+    if (!form || !(file instanceof File)) return errors.badRequest("file is required.");
+    const invalid = validateUpload(file);
+    if (invalid) return errors.badRequest(invalid);
+    const safeName = file.name.replace(/[^a-zA-Z0-9._-]+/g, "-").toLowerCase();
+    let storagePath = `${Date.now().toString(36)}-${safeName}`;
+    if (options.memoryMode) {
+      const buffer = Buffer.from(await file.arrayBuffer());
+      storagePath = `data:${file.type || "application/octet-stream"};base64,${buffer.toString("base64")}`;
+    } else {
+      const { error: storageError } = await db().storage.from("media").upload(storagePath, file, { contentType: file.type || "application/octet-stream" });
+      if (storageError) return errors.badRequest(storageError.message);
+    }
+    const uploadedToStorage = !options.memoryMode;
+    const width = Number(form.get("width")) || null;
+    const height = Number(form.get("height")) || null;
+    const { data, error } = await db().from("cms_media").insert({
+      storage_path: storagePath,
+      filename: safeName,
+      alt: String(form.get("alt") || ""),
+      caption: String(form.get("caption") || ""),
+      mime_type: file.type || "",
+      width,
+      height,
+      filesize: file.size
+    }).select("*").single();
+    if (error) {
+      if (uploadedToStorage) {
+        await db().storage.from("media").remove([storagePath]).catch(() => void 0);
+      }
+      return errors.badRequest(error.message);
+    }
+    await logActivity(auth.user, "media.upload", safeName);
+    return json({ media: data }, 201);
+  };
+  const updateMedia = async (request, id) => {
+    const auth = await guard(request, "media.update");
+    if (auth instanceof Response) return auth;
+    const body = await readJson(request);
+    if (!body) return errors.badRequest("Invalid body.");
+    const patch = { updated_at: (/* @__PURE__ */ new Date()).toISOString() };
+    if (typeof body.alt === "string") patch.alt = body.alt;
+    if (typeof body.caption === "string") patch.caption = body.caption;
+    if (typeof body.filename === "string" && body.filename.trim()) {
+      patch.filename = body.filename.trim().replace(/[^a-zA-Z0-9._-]+/g, "-").toLowerCase();
+    }
+    const { data, error } = await db().from("cms_media").update(patch).eq("id", id).select("*").single();
+    if (error) return errors.badRequest(error.message);
+    if (!data) return errors.notFound();
+    return json({ media: data });
+  };
+  const findMediaUsage = async (mediaId) => {
+    const { data: pages } = await db().from("cms_pages").select("id, title, path, draft_layout, published_layout");
+    const needle = `"mediaId":"${mediaId}"`;
+    return (pages || []).filter((page) => {
+      const haystack = JSON.stringify(page.draft_layout ?? []) + JSON.stringify(page.published_layout ?? []);
+      return haystack.includes(needle);
+    }).map((page) => ({
+      id: String(page.id),
+      title: String(page.title ?? ""),
+      path: String(page.path ?? "")
+    }));
+  };
+  const mediaUsage = async (request, id) => {
+    const auth = await guard(request, "media.read");
+    if (auth instanceof Response) return auth;
+    return json({ usage: await findMediaUsage(id) });
+  };
+  const replaceMedia = async (request, id) => {
+    const auth = await guard(request, "media.upload");
+    if (auth instanceof Response) return auth;
+    const { data: doc } = await db().from("cms_media").select("*").eq("id", id).maybeSingle();
+    if (!doc) return errors.notFound();
+    const form = await request.formData().catch(() => null);
+    const file = form?.get("file");
+    if (!form || !(file instanceof File)) return errors.badRequest("file is required.");
+    const invalid = validateUpload(file);
+    if (invalid) return errors.badRequest(invalid);
+    let storagePath = String(doc.storage_path);
+    if (options.memoryMode) {
+      const buffer = Buffer.from(await file.arrayBuffer());
+      storagePath = `data:${file.type || "application/octet-stream"};base64,${buffer.toString("base64")}`;
+    } else {
+      const { error: storageError } = await db().storage.from("media").upload(storagePath, file, {
+        contentType: file.type || "application/octet-stream",
+        upsert: true
+      });
+      if (storageError) return errors.badRequest(storageError.message);
+    }
+    const width = Number(form.get("width")) || null;
+    const height = Number(form.get("height")) || null;
+    const { data, error } = await db().from("cms_media").update({
+      storage_path: storagePath,
+      mime_type: file.type || "",
+      filesize: file.size,
+      width,
+      height,
+      updated_at: (/* @__PURE__ */ new Date()).toISOString()
+    }).eq("id", id).select("*").single();
+    if (error) return errors.badRequest(error.message);
+    await logActivity(auth.user, "media.replace", String(doc.filename));
+    await revalidateContent();
+    return json({ media: data });
+  };
+  const deleteMedia = async (request, id) => {
+    const auth = await guard(request, "media.delete");
+    if (auth instanceof Response) return auth;
+    const { data: doc } = await db().from("cms_media").select("*").eq("id", id).maybeSingle();
+    if (!doc) return errors.notFound();
+    const force = new URL(request.url).searchParams.get("force") === "true";
+    const usage = await findMediaUsage(id);
+    if (usage.length > 0 && !force) {
+      return errors.conflict("This file is used on pages.", { usage });
+    }
+    const { error } = await db().from("cms_media").delete().eq("id", id);
+    if (error) return errors.badRequest(error.message);
+    if (!String(doc.storage_path).startsWith("data:")) {
+      await db().storage.from("media").remove([doc.storage_path]).catch(() => void 0);
+    }
+    await logActivity(auth.user, "media.delete", String(doc.filename));
+    return json({ success: true });
+  };
+  const listForms = async (request) => {
+    const auth = await guard(request, "forms.read");
+    if (auth instanceof Response) return auth;
+    const { data: forms, error } = await db().from("cms_forms").select("id, slug, title, config, success_message, updated_at").order("title");
+    if (error) return errors.badRequest(error.message);
+    const { data: submissions } = await db().from("cms_form_submissions").select("form_id, read_at").limit(1e4);
+    const counts = /* @__PURE__ */ new Map();
+    for (const submission of submissions || []) {
+      const formId = String(submission.form_id);
+      const entry = counts.get(formId) || { total: 0, unread: 0 };
+      entry.total += 1;
+      if (!submission.read_at) entry.unread += 1;
+      counts.set(formId, entry);
+    }
+    return json({
+      forms: (forms || []).map((form) => ({
+        ...form,
+        submissionCount: counts.get(String(form.id))?.total ?? 0,
+        unreadCount: counts.get(String(form.id))?.unread ?? 0
+      }))
+    });
+  };
+  const createForm = async (request) => {
+    const auth = await guard(request, "forms.write");
+    if (auth instanceof Response) return auth;
+    const body = await readJson(request);
+    const slug = typeof body?.slug === "string" ? body.slug.trim().toLowerCase() : "";
+    const title = typeof body?.title === "string" ? body.title.trim() : "";
+    if (!slug || !SLUG_PATTERN.test(slug)) {
+      return errors.badRequest("Slug may only contain lowercase letters, numbers, and dashes.");
+    }
+    if (!title) return errors.badRequest("Title is required.");
+    const { data, error } = await db().from("cms_forms").insert({
+      slug,
+      title,
+      config: { steps: [{ title: "", fields: [] }] },
+      success_message: "Thanks \u2014 we received your submission."
+    }).select("*").single();
+    if (error) {
+      if (error.message.includes("duplicate")) {
+        return errors.badRequest("A form with this slug already exists.");
+      }
+      return errors.badRequest(error.message);
+    }
+    await logActivity(auth.user, "form.create", slug);
+    return json({ form: data }, 201);
+  };
+  const getForm = async (request, slug) => {
+    const auth = await guard(request, "forms.read");
+    if (auth instanceof Response) return auth;
+    const { data, error } = await db().from("cms_forms").select("*").eq("slug", slug).maybeSingle();
+    if (error) return errors.badRequest(error.message);
+    if (!data) return errors.notFound();
+    return json({ form: data });
+  };
+  const updateForm = async (request, slug) => {
+    const auth = await guard(request, "forms.write");
+    if (auth instanceof Response) return auth;
+    const body = await readJson(request);
+    if (!body) return errors.badRequest("Invalid body.");
+    const config = isRecord2(body.config) ? { ...body.config } : {};
+    const notify = isRecord2(body.notify) ? body.notify : isRecord2(config.notify) ? config.notify : {};
+    delete config.notify;
+    const { data, error } = await db().from("cms_forms").upsert(
+      {
+        slug,
+        title: typeof body.title === "string" ? body.title : "",
+        config,
+        notify,
+        success_message: typeof body.successMessage === "string" ? body.successMessage : "",
+        updated_at: (/* @__PURE__ */ new Date()).toISOString()
+      },
+      { onConflict: "slug" }
+    ).select("*").single();
+    if (error) return errors.badRequest(error.message);
+    await logActivity(auth.user, "form.update", slug);
+    return json({ form: data });
+  };
+  const deleteForm = async (request, slug) => {
+    const auth = await guard(request, "forms.delete");
+    if (auth instanceof Response) return auth;
+    const { data: doc } = await db().from("cms_forms").select("id").eq("slug", slug).maybeSingle();
+    if (!doc) return errors.notFound();
+    const { error } = await db().from("cms_forms").delete().eq("slug", slug);
+    if (error) return errors.badRequest(error.message);
+    await logActivity(auth.user, "form.delete", slug);
+    return json({ success: true });
+  };
+  const listSubmissions = async (request) => {
+    const auth = await guard(request, "submissions.read");
+    if (auth instanceof Response) return auth;
+    const url = new URL(request.url);
+    const form = url.searchParams.get("form") || "";
+    const beforeId = Number(url.searchParams.get("beforeId")) || 0;
+    const unreadOnly = url.searchParams.get("unread") === "1";
+    const limit = Math.min(Math.max(Number(url.searchParams.get("limit")) || 50, 1), 200);
+    let query = db().from("cms_form_submissions").select("id, form_id, data, source, read_at, created_at").order("id", { ascending: false }).limit(limit + 1);
+    if (form) query = query.eq("form_id", form);
+    if (unreadOnly) query = query.is("read_at", null);
+    if (beforeId > 0) query = query.lt("id", beforeId);
+    const { data, error } = await query;
+    if (error) return errors.badRequest(error.message);
+    const rows = data || [];
+    const hasMore = rows.length > limit;
+    return json({ submissions: rows.slice(0, limit), hasMore });
+  };
+  const updateSubmission = async (request, id) => {
+    const auth = await guard(request, "submissions.read");
+    if (auth instanceof Response) return auth;
+    const body = await readJson(request);
+    if (!body || typeof body.read !== "boolean") return errors.badRequest("read boolean required.");
+    const { error } = await db().from("cms_form_submissions").update({ read_at: body.read ? (/* @__PURE__ */ new Date()).toISOString() : null }).eq("id", Number(id));
+    if (error) return errors.badRequest(error.message);
+    return json({ success: true });
+  };
+  const deleteSubmission = async (request, id) => {
+    const auth = await guard(request, "submissions.manage");
+    if (auth instanceof Response) return auth;
+    const { error } = await db().from("cms_form_submissions").delete().eq("id", Number(id));
+    if (error) return errors.badRequest(error.message);
+    return json({ success: true });
+  };
+  const csvEscape = (value) => {
+    let text = Array.isArray(value) ? value.join("; ") : typeof value === "string" ? value : value === null || value === void 0 ? "" : JSON.stringify(value);
+    if (/^[=+\-@\t\r]/.test(text)) text = `'${text}`;
+    return /[",\n]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
+  };
+  const exportSubmissions = async (request) => {
+    const auth = await guard(request, "submissions.read");
+    if (auth instanceof Response) return auth;
+    const url = new URL(request.url);
+    const form = url.searchParams.get("form") || "";
+    let query = db().from("cms_form_submissions").select("id, form_id, data, created_at").order("created_at", { ascending: false }).limit(5e3);
+    if (form) query = query.eq("form_id", form);
+    const { data, error } = await query;
+    if (error) return errors.badRequest(error.message);
+    const rows = data || [];
+    const keys = [];
+    for (const row of rows) {
+      for (const key of Object.keys(row.data || {})) {
+        if (!keys.includes(key)) keys.push(key);
+      }
+    }
+    const header = ["submitted_at", ...keys];
+    const lines = [header.map(csvEscape).join(",")];
+    for (const row of rows) {
+      const record = row.data || {};
+      lines.push(
+        [row.created_at, ...keys.map((key) => record[key])].map(csvEscape).join(",")
+      );
+    }
+    return new Response(lines.join("\n"), {
+      status: 200,
+      headers: {
+        "content-type": "text/csv; charset=utf-8",
+        "content-disposition": `attachment; filename="submissions-${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}.csv"`
+      }
+    });
+  };
+  const getFormConfig = async (slug) => {
+    const { data, error } = await db().from("cms_forms").select("slug, title, config, success_message").eq("slug", slug).maybeSingle();
+    if (error) return errors.badRequest(error.message);
+    if (!data) return errors.notFound();
+    const config = { ...data.config || {} };
+    delete config.notify;
+    return json({
+      slug: data.slug,
+      title: data.title,
+      config,
+      successMessage: data.success_message
+    });
+  };
+  const verifyTurnstile = async (token, ip) => {
+    if (!options.turnstileSecret) return true;
+    if (!token) return false;
+    try {
+      const response = await fetch("https://challenges.cloudflare.com/turnstile/v0/siteverify", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ secret: options.turnstileSecret, response: token, remoteip: ip })
+      });
+      const body = await response.json();
+      return body.success === true;
+    } catch {
+      return false;
+    }
+  };
+  const submitForm = async (request, slug) => {
+    if (!isOriginAllowed(request, allowedOrigins)) return errors.forbidden();
+    const now = Date.now();
+    const ip = clientKey(request);
+    const key = hashedClientKey(ip);
+    if (rateLimit && await rateLimit.isLimited(key, now)) {
+      return json({ error: "Too many requests. Please try again shortly." }, 429);
+    }
+    const body = await readJsonLimited(request, {
+      maxBytes: MAX_PUBLIC_BODY_BYTES,
+      maxDepth: MAX_PUBLIC_BODY_DEPTH
+    });
+    if (!body) return errors.badRequest("Invalid submission body.");
+    const data = isRecord2(body.data) ? body.data : body;
+    if (!await verifyTurnstile(String(data._turnstileToken || ""), ip)) {
+      return errors.badRequest("Verification failed. Please try again.");
+    }
+    const { data: form, error: formError } = await db().from("cms_forms").select("id, slug, title, config, notify, success_message").eq("slug", slug).maybeSingle();
+    if (formError || !form) return errors.notFound();
+    const result = processSubmission({
+      config: form.config,
+      data,
+      now,
+      knownGoodEmailDomains
+    });
+    if (result.outcome === "spam") return json({ success: true });
+    if (result.outcome === "invalid") {
+      return json({ error: "Validation failed.", fieldErrors: result.fieldErrors }, 422);
+    }
+    const { data: created, error } = await db().from("cms_form_submissions").insert({
+      form_id: form.id,
+      data: result.normalizedData,
+      client_key: key,
+      // Same daily hash the analytics events use — links this lead to the
+      // journey that produced it without identifying anyone.
+      session_key: requestSessionKey(request)
+    }).select("id").single();
+    if (error) return errors.badRequest(error.message);
+    if (sendEmail) {
+      await notifySubmission({
+        sendEmail,
+        formTitle: String(form.title || form.slug),
+        // Notify settings live in their own column; merge for legacy configs.
+        config: {
+          ...form.config || {},
+          ...isRecord2(form.notify) && Object.keys(form.notify).length > 0 ? { notify: form.notify } : {}
+        },
+        successMessage: String(form.success_message || ""),
+        data: result.normalizedData,
+        siteName: options.siteName
+      });
+    }
+    return json({ success: true, id: created.id });
+  };
+  const listRedirects = async (request) => {
+    const auth = await guard(request, "redirects.manage");
+    if (auth instanceof Response) return auth;
+    const { data, error } = await db().from("cms_redirects").select("*").order("from_path");
+    if (error) return errors.badRequest(error.message);
+    return json({ redirects: data });
+  };
+  const createRedirect = async (request) => {
+    const auth = await guard(request, "redirects.manage");
+    if (auth instanceof Response) return auth;
+    const body = await readJson(request);
+    const fromPath = typeof body?.fromPath === "string" ? body.fromPath.trim() : "";
+    const toPath = typeof body?.toPath === "string" ? body.toPath.trim() : "";
+    const permanent = body?.permanent !== false;
+    if (!fromPath.startsWith("/")) return errors.badRequest("From path must start with /.");
+    if (!toPath.startsWith("/") && !/^https?:\/\//.test(toPath)) {
+      return errors.badRequest("To path must start with / or be a full URL.");
+    }
+    if (fromPath === toPath) return errors.badRequest("A redirect cannot point at itself.");
+    const { data, error } = await db().from("cms_redirects").upsert({ from_path: fromPath, to_path: toPath, permanent }, { onConflict: "from_path" }).select("*").single();
+    if (error) return errors.badRequest(error.message);
+    await logActivity(auth.user, "redirect.save", `${fromPath} \u2192 ${toPath}`);
+    return json({ redirect: data }, 201);
+  };
+  const deleteRedirect = async (request, id) => {
+    const auth = await guard(request, "redirects.manage");
+    if (auth instanceof Response) return auth;
+    const { error } = await db().from("cms_redirects").delete().eq("id", id);
+    if (error) return errors.badRequest(error.message);
+    return json({ success: true });
+  };
+  const ingestEvents = async (request) => {
+    if (!isOriginAllowed(request, allowedOrigins)) return errors.forbidden();
+    const userAgent = request.headers.get("user-agent") || "";
+    if (isBotRequest(userAgent)) return json({ success: true });
+    const key = hashedClientKey(clientKey(request));
+    if (await eventsRateLimit.isLimited(key, Date.now())) return json({ success: true });
+    const body = await readJsonLimited(request, { maxBytes: 128 * 1024, maxDepth: 8 });
+    if (!body) return json({ success: true });
+    const { rows } = parseEventBatch(body, {
+      sessionKey: requestSessionKey(request),
+      visitorKey: visitorKeyFor(
+        body?.visitorId,
+        previewSecret() || "orion-analytics"
+      ),
+      device: deviceFrom(userAgent),
+      ...geoFrom(request)
+    });
+    if (rows.length > 0) {
+      try {
+        await db().from("cms_events").insert(rows);
+      } catch {
+      }
+    }
+    return json({ success: true });
+  };
+  const fetchEvents = async (fromIso, toIso) => {
+    const all = [];
+    let cursor = 0;
+    for (let page = 0; page < 60; page += 1) {
+      const { data, error } = await db().from("cms_events").select("id, session_key, type, name, path, referrer, utm, device, region, city, meta, created_at").gte("created_at", fromIso).lte("created_at", toIso).gt("id", cursor).order("id", { ascending: true }).limit(1e3);
+      if (error || !data || data.length === 0) break;
+      all.push(...data);
+      cursor = Number(data[data.length - 1].id);
+      if (data.length < 1e3) break;
+    }
+    return all;
+  };
+  const getAnalytics = async (request) => {
+    const auth = await guard(request, "analytics.read");
+    if (auth instanceof Response) return auth;
+    const url = new URL(request.url);
+    const toMs = Date.parse(url.searchParams.get("to") || "") || Date.now();
+    const defaultFrom = toMs - 30 * 864e5;
+    const fromMs = Math.min(Date.parse(url.searchParams.get("from") || "") || defaultFrom, toMs);
+    const windowMs = Math.max(toMs - fromMs, 864e5);
+    const from = new Date(fromMs).toISOString();
+    const to = new Date(toMs).toISOString();
+    const previousFrom = new Date(fromMs - windowMs).toISOString();
+    const [events, previousEvents] = await Promise.all([
+      fetchEvents(from, to),
+      fetchEvents(previousFrom, from)
+    ]);
+    return json(aggregateAnalytics(events, previousEvents, { from, to }));
+  };
+  const pruneEvents = async () => {
+    const cutoff = new Date(Date.now() - analyticsRetentionDays * 864e5).toISOString();
+    try {
+      await db().from("cms_events").delete().lt("created_at", cutoff);
+    } catch {
+    }
+  };
+  const publishDuePages = async () => {
+    const { data, error } = await db().rpc("cms_publish_due_pages");
+    if (error) throw new Error(error.message);
+    const published = Array.isArray(data) ? data.map((row) => typeof row === "string" ? row : String(row?.cms_publish_due_pages ?? "")).filter(Boolean) : [];
+    if (published.length > 0) await revalidateContent();
+    return published;
+  };
+  const cronPublishDue = async (request) => {
+    const bearer = (request.headers.get("authorization") || "").replace(/^Bearer\s+/i, "");
+    let authorized = tokenEquals(bearer, syncToken || "") || tokenEquals(bearer, process.env.CRON_SECRET || "");
+    if (!authorized) {
+      const user = await resolveUser(request, db());
+      authorized = Boolean(user && can(user, "pages.publish"));
+    }
+    if (!authorized) return errors.forbidden();
+    const published = await publishDuePages();
+    await pruneEvents();
+    return json({ success: true, published });
+  };
+  const dashboard = async (request) => {
+    const auth = await guard(request, "pages.read");
+    if (auth instanceof Response) return auth;
+    await publishDuePages().catch(() => void 0);
+    const { data: pages } = await db().from("cms_pages").select(
+      "id, title, path, status, updated_at, published_at, publish_at, draft_layout, published_layout"
+    );
+    const allPages = pages || [];
+    const pendingDrafts = allPages.filter((page) => hasDraftChanges(page));
+    const recentPages = [...allPages].sort((a, b) => String(b.updated_at).localeCompare(String(a.updated_at))).slice(0, 5).map(({ draft_layout, published_layout, ...summary }) => {
+      void draft_layout;
+      void published_layout;
+      return summary;
+    });
+    const lastPublishedAt = allPages.map((page) => page.published_at).filter(Boolean).sort().pop();
+    const { data: submissions } = await db().from("cms_form_submissions").select("id, form_id, data, read_at, created_at").order("created_at", { ascending: false }).limit(200);
+    const allSubmissions = submissions || [];
+    const unread = allSubmissions.filter((submission) => !submission.read_at);
+    let activity = [];
+    if (can(auth.user, "activity.read")) {
+      const { data: events } = await db().from("cms_activity").select("id, actor_name, action, subject, created_at").order("created_at", { ascending: false }).limit(12);
+      activity = events || [];
+    }
+    return json({
+      pages: {
+        total: allPages.length,
+        pendingDrafts: pendingDrafts.map((page) => ({
+          id: page.id,
+          title: page.title,
+          path: page.path,
+          status: page.status,
+          publish_at: page.publish_at
+        })),
+        recent: recentPages,
+        lastPublishedAt: lastPublishedAt ?? null
+      },
+      submissions: {
+        total: allSubmissions.length,
+        unread: unread.length,
+        recent: allSubmissions.slice(0, 5)
+      },
+      activity
+    });
+  };
+  const listActivity = async (request) => {
+    const auth = await guard(request, "activity.read");
+    if (auth instanceof Response) return auth;
+    const { data, error } = await db().from("cms_activity").select("id, actor, actor_name, action, subject, created_at").order("created_at", { ascending: false }).limit(50);
+    if (error) return errors.badRequest(error.message);
+    return json({ activity: data });
+  };
+  const listUsers = async (request) => {
+    const auth = await guard(request, "users.manage");
+    if (auth instanceof Response) return auth;
+    const { data: authData, error: authError } = await db().auth.admin.listUsers({ perPage: 1e3 });
+    if (authError) return errors.badRequest(authError.message);
+    const { data: profiles, error: profileError } = await db().from("cms_profiles").select("user_id, role, name");
+    if (profileError) return errors.badRequest(profileError.message);
+    const roleById = new Map(
+      (profiles || []).map((profile) => [profile.user_id, profile])
+    );
+    const users = authData.users.map((user) => {
+      const profile = roleById.get(user.id);
+      return {
+        id: user.id,
+        email: user.email ?? null,
+        name: profile?.name || "",
+        role: profile?.role ?? null,
+        created_at: user.created_at ?? null,
+        last_sign_in_at: user.last_sign_in_at ?? null
+      };
+    });
+    return json({ users, assignableRoles: assignableRoles(auth.user.role) });
+  };
+  const createUser = async (request) => {
+    const auth = await guard(request, "users.manage");
+    if (auth instanceof Response) return auth;
+    const body = await readJson(request);
+    const email = typeof body?.email === "string" ? body.email.trim().toLowerCase() : "";
+    const password = typeof body?.password === "string" ? body.password : "";
+    const name = typeof body?.name === "string" ? body.name.trim() : "";
+    const role = body?.role;
+    if (!email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
+      return errors.badRequest("A valid email is required.");
+    }
+    if (password.length < 8) return errors.badRequest("Password must be at least 8 characters.");
+    if (!isCmsRole(role)) return errors.badRequest("A valid role is required.");
+    if (!outranksOrEqual(auth.user.role, role)) {
+      return errors.badRequest("You can only assign roles at or below your own.");
+    }
+    const { data: created, error: createError } = await db().auth.admin.createUser({
+      email,
+      password,
+      email_confirm: true
+    });
+    if (createError) return errors.badRequest(createError.message);
+    const userId = created.user.id;
+    const { error: profileError } = await db().from("cms_profiles").upsert({ user_id: userId, role, name }, { onConflict: "user_id" });
+    if (profileError) {
+      await db().auth.admin.deleteUser(userId).catch(() => void 0);
+      return errors.badRequest(profileError.message);
+    }
+    await logActivity(auth.user, "user.create", email);
+    return json({ user: { id: userId, email, name, role } }, 201);
+  };
+  const targetRole = async (userId) => {
+    const { data } = await db().from("cms_profiles").select("role").eq("user_id", userId).maybeSingle();
+    return data?.role ?? null;
+  };
+  const updateUser = async (request, userId) => {
+    const auth = await guard(request, "users.manage");
+    if (auth instanceof Response) return auth;
+    const body = await readJson(request);
+    if (!body) return errors.badRequest("Invalid body.");
+    const current = await targetRole(userId);
+    if (current && !outranksOrEqual(auth.user.role, current)) return errors.forbidden();
+    if (body.role !== void 0) {
+      if (!isCmsRole(body.role)) return errors.badRequest("Invalid role.");
+      if (userId === auth.user.id && body.role !== auth.user.role) {
+        return errors.badRequest("You can't change your own role.");
+      }
+      if (!outranksOrEqual(auth.user.role, body.role)) {
+        return errors.badRequest("You can only assign roles at or below your own.");
+      }
+    }
+    if (typeof body.password === "string") {
+      if (body.password.length < 8) return errors.badRequest("Password must be at least 8 characters.");
+      const { error: passwordError } = await db().auth.admin.updateUserById(userId, {
+        password: body.password
+      });
+      if (passwordError) return errors.badRequest(passwordError.message);
+    }
+    if (body.role !== void 0 || typeof body.name === "string") {
+      const patch = { user_id: userId };
+      if (body.role !== void 0) patch.role = body.role;
+      if (typeof body.name === "string") patch.name = body.name.trim();
+      const { error: profileError } = await db().from("cms_profiles").upsert(patch, { onConflict: "user_id" });
+      if (profileError) return errors.badRequest(profileError.message);
+    }
+    await logActivity(auth.user, "user.update", userId);
+    return json({ success: true });
+  };
+  const deleteUser = async (request, userId) => {
+    const auth = await guard(request, "users.manage");
+    if (auth instanceof Response) return auth;
+    if (userId === auth.user.id) return errors.badRequest("You can't remove your own account.");
+    const current = await targetRole(userId);
+    if (current && !outranksOrEqual(auth.user.role, current)) return errors.forbidden();
+    const { error: authError } = await db().auth.admin.deleteUser(userId);
+    if (authError) return errors.badRequest(authError.message);
+    const { error: profileError } = await db().from("cms_profiles").delete().eq("user_id", userId);
+    if (profileError) return errors.badRequest(profileError.message);
+    await logActivity(auth.user, "user.delete", userId);
+    return json({ success: true });
+  };
+  const runSync = async (request) => {
+    const bearer = (request.headers.get("authorization") || "").replace(/^Bearer\s+/i, "");
+    let authorized = tokenEquals(bearer, syncToken || "");
+    if (!authorized) {
+      const user = await resolveUser(request, db());
+      authorized = Boolean(user && can(user, "sync.run"));
+    }
+    if (!authorized) return errors.forbidden();
+    const body = await readJson(request);
+    if (!body) return errors.badRequest("Invalid body.");
+    const result = await runContentSync(db(), registry, body);
+    await revalidateContent();
+    return json({ success: true, ...result });
+  };
+  const dispatch = async (request, context) => {
+    const params = await context.params;
+    const segments = params?.path || [];
+    const method = request.method.toUpperCase();
+    const [head, second, third] = segments;
+    if (head === "pages") {
+      if (!second) {
+        if (method === "GET") return listPages(request);
+        if (method === "POST") return createPage(request);
+      } else if (!third) {
+        if (method === "GET") return getPage(request, second);
+        if (method === "PATCH") return savePageDraft(request, second);
+        if (method === "DELETE") return deletePage(request, second);
+      } else if (third === "publish" && method === "POST") {
+        return publishPage(request, second);
+      } else if (third === "unpublish" && method === "POST") {
+        return unpublishPage(request, second);
+      } else if (third === "duplicate" && method === "POST") {
+        return duplicatePage(request, second);
+      } else if (third === "preview" && method === "POST") {
+        return previewToken(request, second);
+      } else if (third === "versions" && method === "GET") {
+        return listVersions(request, second);
+      }
+    }
+    if (head === "preview" && !second && method === "GET") return previewPage(request);
+    if (head === "versions" && second) {
+      if (third === "restore" && method === "POST") return restoreVersion(request, second);
+      if (!third && method === "GET") return getVersion(request, second);
+    }
+    if (head === "globals" && second) {
+      if (third === "versions" && method === "GET") return listGlobalVersions(request, second);
+      if (!third && method === "GET") return getGlobal(request, second);
+      if (!third && method === "PATCH") return updateGlobal(request, second);
+    }
+    if (head === "global-versions" && second && third === "restore" && method === "POST") {
+      return restoreGlobalVersion(request, second);
+    }
+    if (head === "media") {
+      if (!second) {
+        if (method === "GET") return listMedia(request);
+        if (method === "POST") return uploadMedia(request);
+      } else if (!third) {
+        if (method === "PATCH") return updateMedia(request, second);
+        if (method === "DELETE") return deleteMedia(request, second);
+      } else if (third === "usage" && method === "GET") {
+        return mediaUsage(request, second);
+      } else if (third === "replace" && method === "POST") {
+        return replaceMedia(request, second);
+      }
+    }
+    if (head === "forms") {
+      if (!second) {
+        if (method === "GET") return listForms(request);
+        if (method === "POST") return createForm(request);
+      } else {
+        if (third === "submit" && method === "POST") return submitForm(request, second);
+        if (third === "config" && method === "GET") return getFormConfig(second);
+        if (!third && method === "GET") return getForm(request, second);
+        if (!third && method === "PATCH") return updateForm(request, second);
+        if (!third && method === "DELETE") return deleteForm(request, second);
+      }
+    }
+    if (head === "submissions") {
+      if (!second) {
+        if (method === "GET") return listSubmissions(request);
+      } else if (second === "export" && method === "GET") {
+        return exportSubmissions(request);
+      } else if (!third) {
+        if (method === "PATCH") return updateSubmission(request, second);
+        if (method === "DELETE") return deleteSubmission(request, second);
+      }
+    }
+    if (head === "redirects") {
+      if (!second) {
+        if (method === "GET") return listRedirects(request);
+        if (method === "POST") return createRedirect(request);
+      } else if (method === "DELETE") {
+        return deleteRedirect(request, second);
+      }
+    }
+    if (head === "cron" && second === "publish-due" && (method === "POST" || method === "GET")) {
+      return cronPublishDue(request);
+    }
+    if (head === "events" && !second && method === "POST") return ingestEvents(request);
+    if (head === "analytics" && !second && method === "GET") return getAnalytics(request);
+    if (head === "dashboard" && method === "GET") return dashboard(request);
+    if (head === "activity" && method === "GET") return listActivity(request);
+    if (head === "users") {
+      if (!second) {
+        if (method === "GET") return listUsers(request);
+        if (method === "POST") return createUser(request);
+      } else if (!third) {
+        if (method === "PATCH") return updateUser(request, second);
+        if (method === "DELETE") return deleteUser(request, second);
+      }
+    }
+    if (head === "sync" && method === "POST") return runSync(request);
+    if (head === "me" && method === "GET") {
+      const user = await resolveUser(request, db());
+      if (!user) return errors.unauthorized();
+      return json({ user });
+    }
+    return errors.notFound();
+  };
+  return {
+    GET: dispatch,
+    POST: dispatch,
+    PATCH: dispatch,
+    DELETE: dispatch
+  };
+}
+
+// src/server/memory.ts
+var MEMORY_DEV_TOKEN = "orion-dev-token";
+var DEV_USER_ID = "00000000-0000-4000-8000-000000000001";
+var nowIso = () => (/* @__PURE__ */ new Date()).toISOString();
+var newId = () => "xxxxxxxx-xxxx-4xxx-8xxx-xxxxxxxxxxxx".replace(
+  /x/g,
+  () => Math.floor(Math.random() * 16).toString(16)
+);
+var MemoryQuery = class _MemoryQuery {
+  rows;
+  table;
+  store;
+  filters = [];
+  orderKey = null;
+  orderAsc = true;
+  limitCount = null;
+  pendingWrite = null;
+  constructor(store, table) {
+    this.store = store;
+    this.table = table;
+    this.rows = store.table(table);
+  }
+  select(_columns, _options) {
+    return this;
+  }
+  eq(column, value) {
+    this.filters.push((row) => row[column] === value);
+    return this;
+  }
+  neq(column, value) {
+    this.filters.push((row) => row[column] !== value);
+    return this;
+  }
+  static compare(left, right) {
+    if (typeof left === "number" && typeof right === "number") return left - right;
+    return String(left ?? "") < String(right ?? "") ? -1 : String(left ?? "") > String(right ?? "") ? 1 : 0;
+  }
+  lt(column, value) {
+    this.filters.push((row) => _MemoryQuery.compare(row[column], value) < 0);
+    return this;
+  }
+  lte(column, value) {
+    this.filters.push((row) => _MemoryQuery.compare(row[column], value) <= 0);
+    return this;
+  }
+  gt(column, value) {
+    this.filters.push((row) => _MemoryQuery.compare(row[column], value) > 0);
+    return this;
+  }
+  gte(column, value) {
+    this.filters.push((row) => _MemoryQuery.compare(row[column], value) >= 0);
+    return this;
+  }
+  is(column, value) {
+    this.filters.push((row) => value === null ? row[column] == null : row[column] === value);
+    return this;
+  }
+  order(column, options) {
+    this.orderKey = column;
+    this.orderAsc = options?.ascending !== false;
+    return this;
+  }
+  limit(count) {
+    this.limitCount = count;
+    return this;
+  }
+  insert(values) {
+    this.pendingWrite = { kind: "insert", values };
+    return this;
+  }
+  upsert(values, options) {
+    this.pendingWrite = { kind: "upsert", values, conflictKey: options?.onConflict || "key" };
+    return this;
+  }
+  update(values) {
+    this.pendingWrite = { kind: "update", values };
+    return this;
+  }
+  delete() {
+    this.pendingWrite = { kind: "delete" };
+    return this;
+  }
+  applyWrite() {
+    const write = this.pendingWrite;
+    if (!write) return { data: null, error: null };
+    if (write.kind === "delete") {
+      const remaining = this.rows.filter((row) => !this.filters.every((filter) => filter(row)));
+      this.store.setTable(this.table, remaining);
+      return { data: null, error: null };
+    }
+    if (write.kind === "update") {
+      const matched = this.rows.filter((row) => this.filters.every((filter) => filter(row)));
+      for (const row of matched) {
+        Object.assign(row, write.values);
+      }
+      return { data: matched[0] ?? null, error: null };
+    }
+    if (write.kind === "insert" && Array.isArray(write.values)) {
+      let first = null;
+      for (const entry of write.values) {
+        this.pendingWrite = { kind: "insert", values: entry };
+        const { data, error } = this.applyWrite();
+        if (error) return { data: null, error };
+        first = first ?? data;
+      }
+      return { data: first, error: null };
+    }
+    const values = { ...write.values };
+    if (write.kind === "upsert") {
+      const conflictKey = write.conflictKey || "key";
+      const existing = this.rows.find((row) => row[conflictKey] === values[conflictKey]);
+      if (existing) {
+        Object.assign(existing, values);
+        return { data: existing, error: null };
+      }
+    }
+    if (this.table === "cms_pages") {
+      if (this.rows.some((row) => row.slug === values.slug)) {
+        return { data: null, error: { message: 'duplicate key value violates unique constraint "cms_pages_slug_key"' } };
+      }
+      values.draft_layout = values.draft_layout ?? [];
+      values.published_layout = values.published_layout ?? null;
+      values.status = values.status ?? "draft";
+      values.builder_owned = values.builder_owned ?? false;
+      values.seo = values.seo ?? {};
+    }
+    const serialTables = /* @__PURE__ */ new Set([
+      "cms_form_submissions",
+      "cms_page_versions",
+      "cms_global_versions",
+      "cms_activity",
+      "cms_events"
+    ]);
+    values.id = values.id ?? (serialTables.has(this.table) ? this.store.nextSerial() : newId());
+    values.created_at = values.created_at ?? nowIso();
+    values.updated_at = values.updated_at ?? nowIso();
+    this.rows.push(values);
+    return { data: values, error: null };
+  }
+  resolve() {
+    let result = this.rows.filter((row) => this.filters.every((filter) => filter(row)));
+    if (this.orderKey) {
+      const key = this.orderKey;
+      result = [...result].sort((a, b) => {
+        const order = _MemoryQuery.compare(a[key], b[key]);
+        return this.orderAsc ? order : -order;
+      });
+    }
+    if (this.limitCount !== null) result = result.slice(0, this.limitCount);
+    return { data: result, error: null };
+  }
+  async maybeSingle() {
+    if (this.pendingWrite) {
+      const { data: data2, error } = this.applyWrite();
+      return { data: data2, error };
+    }
+    const { data } = this.resolve();
+    return { data: data[0] ?? null, error: null };
+  }
+  async single() {
+    return this.maybeSingle();
+  }
+  // Thenable: `await query` resolves list reads and writes without .select()
+  then(onFulfilled) {
+    if (this.pendingWrite) {
+      const { data, error } = this.applyWrite();
+      return Promise.resolve(onFulfilled({ data, error }));
+    }
+    return Promise.resolve(onFulfilled(this.resolve()));
+  }
+};
+var MemoryStore = class {
+  tables = /* @__PURE__ */ new Map();
+  serial = 0;
+  table(name) {
+    if (!this.tables.has(name)) this.tables.set(name, []);
+    return this.tables.get(name);
+  }
+  setTable(name, rows) {
+    this.tables.set(name, rows);
+  }
+  nextSerial() {
+    this.serial += 1;
+    return this.serial;
+  }
+};
+function runRpc(store, fn, args = {}) {
+  const pages = store.table("cms_pages");
+  const versions = store.table("cms_page_versions");
+  const snapshot = (page, kind, layout) => {
+    const latest = [...versions].filter((v) => v.page_id === page.id).pop();
+    if ((kind === "draft" || kind === "sync") && latest && JSON.stringify(latest.title) === JSON.stringify(page.title ?? "") && JSON.stringify(latest.seo) === JSON.stringify(page.seo ?? {}) && JSON.stringify(latest.layout) === JSON.stringify(layout ?? [])) {
+      return;
+    }
+    versions.push({
+      id: store.nextSerial(),
+      page_id: page.id,
+      kind,
+      title: page.title ?? "",
+      seo: page.seo ?? {},
+      layout: layout ?? [],
+      created_by: args.p_actor ?? null,
+      created_at: nowIso()
+    });
+  };
+  switch (fn) {
+    case "cms_save_page_draft": {
+      const page = pages.find((row) => row.id === args.p_page_id);
+      if (!page) return { data: null, error: { message: `page ${args.p_page_id} not found` } };
+      if (args.p_title != null) page.title = args.p_title;
+      if (args.p_seo != null) page.seo = args.p_seo;
+      if (args.p_layout != null) page.draft_layout = args.p_layout;
+      page.builder_owned = Boolean(page.builder_owned) || args.p_mark_builder_owned !== false;
+      page.updated_at = nowIso();
+      snapshot(page, "draft", page.draft_layout);
+      return { data: page, error: null };
+    }
+    case "cms_publish_page": {
+      const page = pages.find((row) => row.id === args.p_page_id);
+      if (!page) return { data: null, error: { message: `page ${args.p_page_id} not found` } };
+      page.published_layout = page.draft_layout;
+      page.status = "published";
+      page.published_at = nowIso();
+      page.updated_at = nowIso();
+      snapshot(page, "publish", page.published_layout);
+      return { data: page, error: null };
+    }
+    case "cms_update_global": {
+      const globals = store.table("cms_globals");
+      const globalVersions = store.table("cms_global_versions");
+      const key = String(args.p_key);
+      let row = globals.find((r) => r.key === key);
+      if (!row) {
+        row = { key, label: "", data: args.p_data ?? {}, updated_at: nowIso() };
+        globals.push(row);
+      } else {
+        row.data = args.p_data ?? {};
+        row.updated_at = nowIso();
+      }
+      globalVersions.push({
+        id: store.nextSerial(),
+        key,
+        data: args.p_data ?? {},
+        created_by: args.p_actor ?? null,
+        created_at: nowIso()
+      });
+      return { data: row, error: null };
+    }
+    case "cms_rate_limit_consume": {
+      const limits = store.table("cms_rate_limits");
+      const key = String(args.p_key);
+      const max = Number(args.p_max);
+      const windowMs = Number(args.p_window_seconds) * 1e3;
+      const nowMs = Date.now();
+      let row = limits.find((r) => r.key === key);
+      if (!row) {
+        row = { key, window_start: nowMs, count: 0 };
+        limits.push(row);
+      }
+      if (nowMs - Number(row.window_start) >= windowMs) {
+        row.window_start = nowMs;
+        row.count = 1;
+      } else {
+        row.count = Number(row.count) + 1;
+      }
+      return { data: Number(row.count) <= max, error: null };
+    }
+    case "cms_publish_due_pages": {
+      const nowMs = Date.now();
+      const published = [];
+      for (const page of pages) {
+        const at = typeof page.publish_at === "string" ? Date.parse(page.publish_at) : NaN;
+        if (Number.isNaN(at) || at > nowMs) continue;
+        page.published_layout = page.draft_layout;
+        page.status = "published";
+        page.published_at = nowIso();
+        page.publish_at = null;
+        page.updated_at = nowIso();
+        snapshot(page, "publish", page.published_layout);
+        published.push(String(page.path));
+      }
+      return { data: published, error: null };
+    }
+    case "cms_restore_page_version": {
+      const version = versions.find((row) => row.id === Number(args.p_version_id));
+      if (!version) return { data: null, error: { message: `version ${args.p_version_id} not found` } };
+      const page = pages.find((row) => row.id === version.page_id);
+      if (!page) return { data: null, error: { message: "page not found" } };
+      page.draft_layout = version.layout;
+      page.title = version.title;
+      page.seo = version.seo;
+      page.builder_owned = true;
+      page.updated_at = nowIso();
+      snapshot(page, "restore", version.layout);
+      return { data: page, error: null };
+    }
+    case "cms_sync_page": {
+      let page = pages.find((row) => row.slug === args.p_slug);
+      if (!page) {
+        page = {
+          id: newId(),
+          slug: args.p_slug,
+          path: args.p_path,
+          title: args.p_title,
+          seo: args.p_seo ?? {},
+          draft_layout: args.p_layout ?? [],
+          published_layout: args.p_layout ?? [],
+          status: "published",
+          builder_owned: false,
+          created_at: nowIso(),
+          updated_at: nowIso(),
+          published_at: nowIso()
+        };
+        pages.push(page);
+      } else if (!page.builder_owned) {
+        page.path = args.p_path;
+        page.title = args.p_title;
+        page.seo = args.p_seo ?? {};
+        page.draft_layout = args.p_layout ?? [];
+        page.published_layout = args.p_layout ?? [];
+        page.updated_at = nowIso();
+      }
+      snapshot(page, "sync", page.draft_layout);
+      return { data: page, error: null };
+    }
+    default:
+      return { data: null, error: { message: `unknown function ${fn}` } };
+  }
+}
+function createMemoryCms() {
+  const store = new MemoryStore();
+  store.setTable("cms_profiles", [
+    { user_id: DEV_USER_ID, role: "admin", name: "Dev Admin", created_at: nowIso() }
+  ]);
+  store.setTable("auth_users", [
+    { id: DEV_USER_ID, email: "dev@local", created_at: nowIso(), last_sign_in_at: nowIso() }
+  ]);
+  const client = {
+    from: (table) => new MemoryQuery(store, table),
+    rpc: async (fn, args) => runRpc(store, fn, args),
+    auth: {
+      getUser: async (token) => token === MEMORY_DEV_TOKEN ? { data: { user: { id: DEV_USER_ID, email: "dev@local" } }, error: null } : { data: { user: null }, error: { message: "invalid token" } },
+      admin: {
+        listUsers: async () => ({ data: { users: [...store.table("auth_users")] }, error: null }),
+        createUser: async (attributes) => {
+          const users = store.table("auth_users");
+          if (users.some((user2) => user2.email === attributes.email)) {
+            return { data: { user: null }, error: { message: "A user with this email already exists." } };
+          }
+          const user = { id: newId(), email: attributes.email, created_at: nowIso(), last_sign_in_at: null };
+          users.push(user);
+          return { data: { user }, error: null };
+        },
+        updateUserById: async (id) => store.table("auth_users").some((user) => user.id === id) ? { data: {}, error: null } : { data: {}, error: { message: "User not found." } },
+        deleteUser: async (id) => {
+          store.setTable("auth_users", store.table("auth_users").filter((user) => user.id !== id));
+          return { data: {}, error: null };
+        }
+      }
+    },
+    storage: {
+      from: () => ({
+        upload: async () => ({ error: null }),
+        remove: async () => ({ error: null })
+      })
+    }
+  };
+  return { client, store, devToken: MEMORY_DEV_TOKEN };
+}
+function getMemoryCms() {
+  const globalStore = globalThis;
+  if (!globalStore.__orionMemoryCms) {
+    globalStore.__orionMemoryCms = createMemoryCms();
+  }
+  return globalStore.__orionMemoryCms;
+}
+export {
+  CONTENT_CACHE_TAG,
+  MEMORY_DEV_TOKEN,
+  PREVIEW_TOKEN_TTL_MS,
+  aggregateAnalytics,
+  can,
+  createCmsRoutes,
+  createDurableRateLimitStore,
+  createMemoryCms,
+  createPreviewToken,
+  createResendSender,
+  deviceFrom,
+  formatSubmissionText,
+  geoFrom,
+  getMemoryCms,
+  getPreviewPage,
+  getServiceClient,
+  isBotRequest,
+  isStructuralChange,
+  notifySubmission,
+  parseEventBatch,
+  readCmsEnv,
+  resolveUser,
+  runContentSync,
+  sessionKeyFor,
+  setServiceClientForTesting,
+  verifyPreviewToken,
+  visitorKeyFor
+};