@prenta/core 7.7.0 → 7.7.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @actuate-media/cms-core
 
+## 7.7.1
+
+### Patch Changes
+
+- 3343dac: Split SEO route registration into per-area handlers. HTTP behavior is unchanged.
+
 ## 7.7.0
 
 ### Minor Changes

package/dist/api/routes/seo/handlers/analysis.d.ts

@@ -0,0 +1,4 @@
+export declare function getSeoAnalysis(request: Request, params: Record<string, string>): Promise<Response>;
+export declare function getSeoReadability(request: Request, params: Record<string, string>): Promise<Response>;
+export declare function getSeoInternalLinks(request: Request, params: Record<string, string>): Promise<Response>;
+//# sourceMappingURL=analysis.d.ts.map

package/dist/api/routes/seo/handlers/analysis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analysis.d.ts","sourceRoot":"","sources":["../../../../../src/api/routes/seo/handlers/analysis.ts"],"names":[],"mappings":"AAaA,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,OAAO,CAAC,QAAQ,CAAC,CAkDnB;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,OAAO,CAAC,QAAQ,CAAC,CAuBnB;AAED,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,OAAO,CAAC,QAAQ,CAAC,CA8CnB"}

package/dist/api/routes/seo/handlers/analysis.js

@@ -0,0 +1,131 @@
+import { getPrentaConfig } from '../../../../config/runtime.js';
+import { extraImagesForSeoAnalysis, firstSectionHeading } from '../../../../seo/document-content.js';
+import { errorResponse, internalError, requireAuth, enforceDocumentReadAccess, } from '../../../route-helpers.js';
+import { db } from './shared.js';
+// ---------------------------------------------------------------------------
+// SEO analysis, readability, internal links, schema, meta
+// ---------------------------------------------------------------------------
+export async function getSeoAnalysis(request, params) {
+    try {
+        const auth = await requireAuth(request);
+        if (auth.error)
+            return auth.error;
+        const doc = await db().document.findFirst({
+            where: { id: params.documentId, deletedAt: null },
+        });
+        if (!doc)
+            return errorResponse('Not found', 404);
+        const accessErr = await enforceDocumentReadAccess(auth.session, doc.collection);
+        if (accessErr)
+            return accessErr;
+        const { analyzeContent } = await import('../../../../seo/analysis.js');
+        const { documentToAuditEntity, frontEndContentCollectionTypes } = await import('../../../../seo/audit-runner.js');
+        const { applySeoOverrides, getSeoOverrides } = await import('../../../../seo/config-store.js');
+        const data = doc.data || {};
+        // Same content assembly as readability + audit entity (`documentContentForSeoAnalysis`)
+        // so MCP/admin scores agree and section-built pages still get plainText/sections.
+        const collectionTypes = frontEndContentCollectionTypes(getPrentaConfig());
+        const overrides = await getSeoOverrides(db()).catch(() => null);
+        const siteSeo = applySeoOverrides(getPrentaConfig(), overrides)?.seo;
+        const entity = documentToAuditEntity(doc, collectionTypes, siteSeo);
+        const result = analyzeContent({
+            title: entity.title,
+            slug: doc.slug || data.slug || '',
+            content: entity.content ?? '',
+            // Rendered title (site template applied) — the same value the page
+            // score measures, so both agree instead of one reading the page portion.
+            metaTitle: entity.metaTitle ?? undefined,
+            metaDescription: entity.metaDescription ?? undefined,
+            focusKeyphrase: entity.focusKeyword ?? undefined,
+            canonical: entity.canonicalUrl ?? undefined,
+            ogTitle: entity.ogTitle ?? undefined,
+            ogDescription: entity.ogDescription ?? undefined,
+            ogImage: entity.ogImage ?? undefined,
+            extraImages: extraImagesForSeoAnalysis(data),
+            entityType: entity.entityType,
+            sectionH1: firstSectionHeading(data) ?? undefined,
+            isCornerstone: data.isCornerstone,
+        });
+        return new Response(JSON.stringify(result), {
+            status: 200,
+            headers: { 'Content-Type': 'application/json' },
+        });
+    }
+    catch (err) {
+        return internalError(err, 'seo/analysis');
+    }
+}
+export async function getSeoReadability(request, params) {
+    try {
+        const auth = await requireAuth(request);
+        if (auth.error)
+            return auth.error;
+        const doc = await db().document.findFirst({
+            where: { id: params.documentId, deletedAt: null },
+        });
+        if (!doc)
+            return errorResponse('Not found', 404);
+        const accessErr = await enforceDocumentReadAccess(auth.session, doc.collection);
+        if (accessErr)
+            return accessErr;
+        const { calculateReadability, stripHtmlTags } = await import('../../../../seo/analysis.js');
+        const { documentContentForSeoAnalysis } = await import('../../../../seo/document-content.js');
+        const text = stripHtmlTags(documentContentForSeoAnalysis(doc));
+        const result = calculateReadability(text);
+        return new Response(JSON.stringify(result), {
+            status: 200,
+            headers: { 'Content-Type': 'application/json' },
+        });
+    }
+    catch (err) {
+        return internalError(err, 'seo/readability');
+    }
+}
+export async function getSeoInternalLinks(request, params) {
+    try {
+        const auth = await requireAuth(request);
+        if (auth.error)
+            return auth.error;
+        const doc = await db().document.findFirst({
+            where: { id: params.documentId, deletedAt: null },
+        });
+        if (!doc)
+            return errorResponse('Not found', 404);
+        const accessErr = await enforceDocumentReadAccess(auth.session, doc.collection);
+        if (accessErr)
+            return accessErr;
+        const data = doc.data || {};
+        const title = doc.title || data.title || '';
+        const keywords = title
+            .split(/\s+/)
+            .filter((w) => w.length > 3)
+            .slice(0, 5);
+        if (keywords.length === 0) {
+            return new Response(JSON.stringify({ suggestions: [] }), {
+                status: 200,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        const suggestions = await db().document.findMany({
+            where: {
+                id: { not: params.documentId },
+                status: 'PUBLISHED',
+                deletedAt: null,
+                OR: keywords.map((kw) => ({
+                    title: { contains: kw, mode: 'insensitive' },
+                })),
+            },
+            select: { id: true, title: true, slug: true, collection: true },
+            take: 10,
+            orderBy: { updatedAt: 'desc' },
+        });
+        return new Response(JSON.stringify({ suggestions }), {
+            status: 200,
+            headers: { 'Content-Type': 'application/json' },
+        });
+    }
+    catch (err) {
+        return internalError(err, 'seo/internal-links');
+    }
+}
+//# sourceMappingURL=analysis.js.map

package/dist/api/routes/seo/handlers/analysis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analysis.js","sourceRoot":"","sources":["../../../../../src/api/routes/seo/handlers/analysis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAC/D,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAA;AACpG,OAAO,EACL,aAAa,EACb,aAAa,EACb,WAAW,EACX,yBAAyB,GAC1B,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAEhC,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAgB,EAChB,MAA8B;IAE9B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAA;QACvC,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAA;QACjC,MAAM,GAAG,GAAG,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YACxC,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,UAAW,EAAE,SAAS,EAAE,IAAI,EAAE;SACnD,CAAC,CAAA;QACF,IAAI,CAAC,GAAG;YAAE,OAAO,aAAa,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;QAChD,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,CAAA;QAC/E,IAAI,SAAS;YAAE,OAAO,SAAS,CAAA;QAE/B,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAA;QACtE,MAAM,EAAE,qBAAqB,EAAE,8BAA8B,EAAE,GAC7D,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAA;QACjD,MAAM,EAAE,iBAAiB,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAA;QAC9F,MAAM,IAAI,GAAI,GAAG,CAAC,IAA4B,IAAI,EAAE,CAAA;QAEpD,wFAAwF;QACxF,kFAAkF;QAClF,MAAM,eAAe,GAAG,8BAA8B,CAAC,eAAe,EAAE,CAAC,CAAA;QACzE,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QAC/D,MAAM,OAAO,GAAG,iBAAiB,CAAC,eAAe,EAAE,EAAE,SAAS,CAAC,EAAE,GAAG,CAAA;QACpE,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,CAAC,CAAA;QAEnE,MAAM,MAAM,GAAG,cAAc,CAAC;YAC5B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE;YACjC,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;YAC7B,mEAAmE;YACnE,yEAAyE;YACzE,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,SAAS;YACxC,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,SAAS;YACpD,cAAc,EAAE,MAAM,CAAC,YAAY,IAAI,SAAS;YAChD,SAAS,EAAE,MAAM,CAAC,YAAY,IAAI,SAAS;YAC3C,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,SAAS;YACpC,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;YAChD,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,SAAS;YACpC,WAAW,EAAE,yBAAyB,CAAC,IAAI,CAAC;YAC5C,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,SAAS,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,SAAS;YACjD,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC,CAAA;QAEF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;YAC1C,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;IAC3C,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAgB,EAChB,MAA8B;IAE9B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAA;QACvC,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAA;QACjC,MAAM,GAAG,GAAG,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YACxC,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,UAAW,EAAE,SAAS,EAAE,IAAI,EAAE;SACnD,CAAC,CAAA;QACF,IAAI,CAAC,GAAG;YAAE,OAAO,aAAa,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;QAChD,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,CAAA;QAC/E,IAAI,SAAS;YAAE,OAAO,SAAS,CAAA;QAE/B,MAAM,EAAE,oBAAoB,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAA;QAC3F,MAAM,EAAE,6BAA6B,EAAE,GAAG,MAAM,MAAM,CAAC,qCAAqC,CAAC,CAAA;QAC7F,MAAM,IAAI,GAAG,aAAa,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC,CAAA;QAC9D,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;QAEzC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;YAC1C,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,aAAa,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAA;IAC9C,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAgB,EAChB,MAA8B;IAE9B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAA;QACvC,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAA;QACjC,MAAM,GAAG,GAAG,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YACxC,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,UAAW,EAAE,SAAS,EAAE,IAAI,EAAE;SACnD,CAAC,CAAA;QACF,IAAI,CAAC,GAAG;YAAE,OAAO,aAAa,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;QAChD,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,CAAA;QAC/E,IAAI,SAAS;YAAE,OAAO,SAAS,CAAA;QAE/B,MAAM,IAAI,GAAI,GAAG,CAAC,IAA4B,IAAI,EAAE,CAAA;QACpD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,CAAA;QAC3C,MAAM,QAAQ,GAAG,KAAK;aACnB,KAAK,CAAC,KAAK,CAAC;aACZ,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;aACnC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QAEd,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,EAAE;gBACvD,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC/C,KAAK,EAAE;gBACL,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,UAAW,EAAE;gBAC/B,MAAM,EAAE,WAAW;gBACnB,SAAS,EAAE,IAAI;gBACf,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,CAAC;oBAChC,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,aAAsB,EAAE;iBACtD,CAAC,CAAC;aACJ;YACD,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;YAC/D,IAAI,EAAE,EAAE;YACR,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;SAC/B,CAAC,CAAA;QAEF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE;YACnD,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,aAAa,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAA;IACjD,CAAC;AACH,CAAC"}

package/dist/api/routes/seo/handlers/audits.d.ts

@@ -0,0 +1,5 @@
+export declare function postSeoScan(request: Request): Promise<Response>;
+export declare function postSeoAudit(request: Request): Promise<Response>;
+export declare function getSeoAudits(request: Request): Promise<Response>;
+export declare function getSeoAudit(request: Request, params: Record<string, string>): Promise<Response>;
+//# sourceMappingURL=audits.d.ts.map

package/dist/api/routes/seo/handlers/audits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audits.d.ts","sourceRoot":"","sources":["../../../../../src/api/routes/seo/handlers/audits.ts"],"names":[],"mappings":"AAmBA,wBAAsB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CA4BrE;AAED,wBAAsB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAqDtE;AAED,wBAAsB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAatE;AAED,wBAAsB,WAAW,CAC/B,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,OAAO,CAAC,QAAQ,CAAC,CAWnB"}

package/dist/api/routes/seo/handlers/audits.js

@@ -0,0 +1,121 @@
+import { logEvent } from '../../../../security/audit.js';
+import { processSeoScan } from '../../../../cron/index.js';
+import { isResolvedIp } from '../../../../security/client-ip.js';
+import { getPrentaConfig } from '../../../../config/runtime.js';
+import { json, errorResponse, internalError, hasModel, modelNotAvailable, requireAuth, WRITE_ROLES, requireRole, seoAuditLimiter, checkRateLimitAsync, clientIp, } from '../../../route-helpers.js';
+import { db } from './shared.js';
+export async function postSeoScan(request) {
+    try {
+        const auth = await requireAuth(request);
+        if (auth.error)
+            return auth.error;
+        const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+        if (roleErr)
+            return roleErr;
+        // Expensive: loads + regex-scans every published doc. Rate-limit it (same
+        // budget as the full audit) so it can't be hammered into an OOM/CPU spike.
+        const scanIp = clientIp(request);
+        const scanKey = isResolvedIp(scanIp)
+            ? `seo-scan:${scanIp}`
+            : `seo-scan-user:${auth.session.userId}`;
+        if (!(await checkRateLimitAsync(seoAuditLimiter, scanKey))) {
+            return errorResponse('Too many scans. Please try again later.', 429);
+        }
+        // Scope the scan to configured front-end content collections so structural
+        // (navigation/footer) and benchmark documents are never reported. Shares
+        // the exact scan logic with the cron path via processSeoScan.
+        const { frontEndContentCollectionTypes } = await import('../../../../seo/audit-runner.js');
+        const allowedCollections = Object.keys(frontEndContentCollectionTypes(getPrentaConfig()));
+        const result = await processSeoScan(db(), { allowedCollections, maxDocuments: 5000 });
+        return json({ data: result });
+    }
+    catch (err) {
+        return internalError(err);
+    }
+}
+export async function postSeoAudit(request) {
+    try {
+        const auth = await requireAuth(request);
+        if (auth.error)
+            return auth.error;
+        const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+        if (roleErr)
+            return roleErr;
+        if (!hasModel(db(), 'seoAuditRun') || !hasModel(db(), 'seoIssue')) {
+            return modelNotAvailable('SeoAuditRun');
+        }
+        const ip = clientIp(request);
+        const rateKey = isResolvedIp(ip) ? `seo-audit:${ip}` : `seo-audit-user:${auth.session.userId}`;
+        if (!(await checkRateLimitAsync(seoAuditLimiter, rateKey))) {
+            return errorResponse('Too many audits. Please try again later.', 429);
+        }
+        const body = (await request.json().catch(() => ({})));
+        const scope = body?.scope ?? 'full';
+        const { runAndPersistAudit, frontEndContentCollectionTypes } = await import('../../../../seo/audit-runner.js');
+        const run = await runAndPersistAudit(db(), {
+            scope,
+            startedById: auth.session.userId,
+            collectionTypes: frontEndContentCollectionTypes(getPrentaConfig()),
+        });
+        try {
+            await logEvent({
+                event: 'settings_changed',
+                userId: auth.session.userId,
+                details: { action: 'seo_audit', auditRunId: run.id, scope },
+            });
+        }
+        catch {
+            /* audit-log failures never block */
+        }
+        return json({
+            data: {
+                id: run.id,
+                status: run.status,
+                siteScoreAfter: run.siteScoreAfter,
+                issuesFound: run.issuesFound,
+                criticalCount: run.criticalCount,
+                warningCount: run.warningCount,
+                infoCount: run.infoCount,
+                pagesScanned: run.pagesScanned,
+                renderedAudit: run.renderedAudit,
+            },
+        });
+    }
+    catch (err) {
+        return internalError(err, 'seo/audit');
+    }
+}
+export async function getSeoAudits(request) {
+    try {
+        const auth = await requireAuth(request);
+        if (auth.error)
+            return auth.error;
+        if (!hasModel(db(), 'seoAuditRun'))
+            return json({ data: { runs: [] } });
+        const runs = await db().seoAuditRun.findMany({
+            orderBy: { startedAt: 'desc' },
+            take: 50,
+        });
+        return json({ data: { runs } });
+    }
+    catch (err) {
+        return internalError(err, 'seo/audits');
+    }
+}
+export async function getSeoAudit(request, params) {
+    try {
+        const auth = await requireAuth(request);
+        if (auth.error)
+            return auth.error;
+        if (!hasModel(db(), 'seoAuditRun'))
+            return modelNotAvailable('SeoAuditRun');
+        const run = await db().seoAuditRun.findUnique({ where: { id: params.id } });
+        if (!run)
+            return errorResponse('Audit run not found', 404);
+        return json({ data: run });
+    }
+    catch (err) {
+        return internalError(err, 'seo/audits/:id');
+    }
+}
+//# sourceMappingURL=audits.js.map

package/dist/api/routes/seo/handlers/audits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audits.js","sourceRoot":"","sources":["../../../../../src/api/routes/seo/handlers/audits.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAA;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAC/D,OAAO,EACL,IAAI,EACJ,aAAa,EACb,aAAa,EACb,QAAQ,EACR,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,WAAW,EACX,eAAe,EACf,mBAAmB,EACnB,QAAQ,GACT,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAEhC,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAgB;IAChD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAA;QACvC,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAA;QACjC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QAC3D,IAAI,OAAO;YAAE,OAAO,OAAO,CAAA;QAE3B,0EAA0E;QAC1E,2EAA2E;QAC3E,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;QAChC,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC;YAClC,CAAC,CAAC,YAAY,MAAM,EAAE;YACtB,CAAC,CAAC,iBAAiB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAA;QAC1C,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YAC3D,OAAO,aAAa,CAAC,yCAAyC,EAAE,GAAG,CAAC,CAAA;QACtE,CAAC;QAED,2EAA2E;QAC3E,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,EAAE,8BAA8B,EAAE,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAA;QAC1F,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,eAAe,EAAE,CAAC,CAAC,CAAA;QACzF,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,kBAAkB,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAA;QAErF,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,aAAa,CAAC,GAAG,CAAC,CAAA;IAC3B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAgB;IACjD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAA;QACvC,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAA;QACjC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QAC3D,IAAI,OAAO;YAAE,OAAO,OAAO,CAAA;QAC3B,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC;YAClE,OAAO,iBAAiB,CAAC,aAAa,CAAC,CAAA;QACzC,CAAC;QAED,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;QAC5B,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAA;QAC9F,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YAC3D,OAAO,aAAa,CAAC,0CAA0C,EAAE,GAAG,CAAC,CAAA;QACvE,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA8B,CAAA;QAClF,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,MAAM,CAAA;QAEnC,MAAM,EAAE,kBAAkB,EAAE,8BAA8B,EAAE,GAC1D,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAA;QACjD,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,EAAE;YACzC,KAAK;YACL,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;YAChC,eAAe,EAAE,8BAA8B,CAAC,eAAe,EAAE,CAAC;SACnE,CAAC,CAAA;QAEF,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC;gBACb,KAAK,EAAE,kBAAkB;gBACzB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;gBAC3B,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE;aAC5D,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;QAED,OAAO,IAAI,CAAC;YACV,IAAI,EAAE;gBACJ,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,aAAa,EAAE,GAAG,CAAC,aAAa;aACjC;SACF,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;IACxC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAgB;IACjD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAA;QACvC,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAA;QACjC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,aAAa,CAAC;YAAE,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACvE,MAAM,IAAI,GAAG,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC;YAC3C,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;YAC9B,IAAI,EAAE,EAAE;SACT,CAAC,CAAA;QACF,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,aAAa,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;IACzC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAgB,EAChB,MAA8B;IAE9B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAA;QACvC,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAA;QACjC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,aAAa,CAAC;YAAE,OAAO,iBAAiB,CAAC,aAAa,CAAC,CAAA;QAC3E,MAAM,GAAG,GAAG,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,EAAE,CAAC,CAAA;QAC5E,IAAI,CAAC,GAAG;YAAE,OAAO,aAAa,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAA;QAC1D,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAA;IAC7C,CAAC;AACH,CAAC"}

package/dist/api/routes/seo/handlers/content.d.ts

@@ -0,0 +1,4 @@
+export declare function getSeoContent(request: Request): Promise<Response>;
+export declare function getSeoContentRecord(request: Request, params: Record<string, string>): Promise<Response>;
+export declare function putSeoContentRecord(request: Request, params: Record<string, string>): Promise<Response>;
+//# sourceMappingURL=content.d.ts.map

package/dist/api/routes/seo/handlers/content.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content.d.ts","sourceRoot":"","sources":["../../../../../src/api/routes/seo/handlers/content.ts"],"names":[],"mappings":"AAgIA,wBAAsB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CA4BvE;AAED,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,OAAO,CAAC,QAAQ,CAAC,CAqDnB;AAED,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,OAAO,CAAC,QAAQ,CAAC,CAmInB"}

package/dist/api/routes/seo/handlers/content.js

@@ -0,0 +1,330 @@
+import { updateDocumentSeoFields } from '../../../../actions.js';
+import { logEvent } from '../../../../security/audit.js';
+import { DEFAULT_DIRECTIVES, coerceMaxImagePreview } from '../../../../seo/robots-directives.js';
+import { getPrentaConfig } from '../../../../config/runtime.js';
+import { syncSchemaTypeFields } from '../../../../seo/schema-sync.js';
+import { json, errorResponse, internalError, asRecord, requireAuth, buildActionContext, WRITE_ROLES, requireRole, enforceDocumentReadAccess, clampPage, clampPageSize, } from '../../../route-helpers.js';
+import { db } from './shared.js';
+/**
+ * Compute the set of front-end content collections the caller may read.
+ * Mirrors the per-document `enforceDocumentReadAccess` check the sibling
+ * `/seo/analysis|readability|…` endpoints run, but resolved once for the
+ * collection list so the aggregate `/seo/content` view can never surface SEO
+ * fields for a collection the caller's scope/role forbids.
+ */
+async function readableSeoCollections(session) {
+    const { frontEndContentCollectionTypes } = await import('../../../../seo/audit-runner.js');
+    const collectionTypes = frontEndContentCollectionTypes(getPrentaConfig());
+    const allowed = new Set();
+    for (const slug of Object.keys(collectionTypes)) {
+        const err = await enforceDocumentReadAccess(session, slug);
+        if (!err)
+            allowed.add(slug);
+    }
+    return allowed;
+}
+async function buildSeoContentRecords(allowedCollections, 
+/**
+ * Restrict to specific documents, regardless of publication status. Used by
+ * the per-document GET, which must answer for a saved draft — the list
+ * endpoints deliberately stay published-only.
+ */
+documentIds, page) {
+    const { gatherAuditEntities, countAuditEntities, frontEndContentCollectionTypes } = await import('../../../../seo/audit-runner.js');
+    const { applySeoOverrides, getSeoOverrides } = await import('../../../../seo/config-store.js');
+    const { calculatePageSeoScore } = await import('../../../../seo/score.js');
+    const allTypes = frontEndContentCollectionTypes(getPrentaConfig());
+    // When a readable-collection allow-list is supplied, scope the gather to it
+    // so records for forbidden collections are never even built.
+    const collectionTypes = allowedCollections
+        ? Object.fromEntries(Object.entries(allTypes).filter(([slug]) => allowedCollections.has(slug)))
+        : allTypes;
+    const overrides = await getSeoOverrides(db()).catch(() => null);
+    const siteSeo = applySeoOverrides(getPrentaConfig(), overrides)?.seo;
+    const [entities, total] = await Promise.all([
+        gatherAuditEntities(db(), {
+            collectionTypes,
+            documentIds,
+            skip: page?.skip,
+            take: page?.take,
+        }),
+        documentIds
+            ? Promise.resolve(documentIds.length)
+            : countAuditEntities(db(), { collectionTypes }),
+    ]);
+    const records = entities.map((e) => {
+        const score = calculatePageSeoScore(e);
+        return {
+            id: `${e.entityType}:${e.entityId}`,
+            entityType: e.entityType,
+            entityId: e.entityId,
+            title: e.title,
+            url: e.url,
+            canonicalUrl: e.canonicalUrl ?? null,
+            /** Rendered public title (after site title template). */
+            metaTitle: e.metaTitle ?? null,
+            /** Stored page-specific portion (`%page%` token). */
+            metaTitlePage: e.metaTitlePage ?? null,
+            siteName: siteSeo?.siteName ?? null,
+            titleTemplate: siteSeo?.titleTemplate ?? null,
+            metaDescription: e.metaDescription ?? null,
+            focusKeyword: e.focusKeyword ?? null,
+            keyTakeaway: e.keyTakeaway ?? null,
+            ogTitle: e.ogTitle ?? null,
+            ogDescription: e.ogDescription ?? null,
+            ogImageId: null,
+            ogImage: e.ogImage ?? null,
+            twitterTitle: null,
+            twitterDescription: null,
+            twitterImageId: null,
+            noindex: e.noindex ?? false,
+            nofollow: false,
+            // Permissive defaults; the single-record GET overlays what is stored.
+            nosnippet: false,
+            noarchive: false,
+            maxImagePreview: DEFAULT_DIRECTIVES.maxImagePreview,
+            structuredDataType: e.structuredDataType ?? null,
+            structuredData: null,
+            // llms.txt curation defaults; the single-record GET overlays the real
+            // stored values (the list endpoint doesn't surface these).
+            llmsInclude: 'AUTO',
+            llmsDescription: null,
+            llmsSection: null,
+            llmsOptional: false,
+            seoScore: score.score,
+            seoGrade: score.grade,
+            updatedAt: e.updatedAt instanceof Date
+                ? e.updatedAt.toISOString()
+                : typeof e.updatedAt === 'string'
+                    ? e.updatedAt
+                    : null,
+        };
+    });
+    return {
+        records,
+        total,
+        truncated: !documentIds && total > records.length,
+    };
+}
+export async function getSeoContent(request) {
+    try {
+        const auth = await requireAuth(request);
+        if (auth.error)
+            return auth.error;
+        // Scope the list to the collections this caller may read — otherwise a
+        // collection-scoped API key (or a collection-restricted role) could pull
+        // metaTitle/description/canonical/OG for every collection, the exact
+        // bypass the sibling document-level SEO endpoints already prevent.
+        const allowed = await readableSeoCollections(auth.session);
+        const url = new URL(request.url);
+        const page = clampPage(url.searchParams.get('page'));
+        const pageSize = clampPageSize(url.searchParams.get('pageSize'), 100, 50);
+        const result = await buildSeoContentRecords(allowed, undefined, {
+            skip: (page - 1) * pageSize,
+            take: pageSize,
+        });
+        return json({
+            data: {
+                records: result.records,
+                total: result.total,
+                page,
+                pageSize,
+                truncated: result.truncated,
+            },
+        });
+    }
+    catch (err) {
+        return internalError(err, 'seo/content');
+    }
+}
+export async function getSeoContentRecord(request, params) {
+    try {
+        const auth = await requireAuth(request);
+        if (auth.error)
+            return auth.error;
+        // Load the target first so we can enforce the collection's read-access
+        // rule (requireCollectionScope + assertCollectionAccess) before returning
+        // any SEO fields — parity with /seo/analysis and friends.
+        const doc = await db().document.findFirst({
+            where: { id: params.entityId, deletedAt: null },
+            select: { data: true, collection: true },
+        });
+        if (!doc)
+            return errorResponse('Content record not found', 404);
+        const accessErr = await enforceDocumentReadAccess(auth.session, doc.collection);
+        if (accessErr)
+            return accessErr;
+        // Scoped to THIS document and not filtered by publication status: a saved
+        // draft has SEO worth editing, and the matching PUT accepts one. Resolving
+        // through the published-only gather made drafts 404 here while remaining
+        // writable — so an editor could save SEO and never read it back.
+        const { records } = await buildSeoContentRecords(null, [params.entityId]);
+        const record = records.find((r) => r.entityType === params.entityType && r.entityId === params.entityId);
+        if (!record)
+            return errorResponse('Content record not found', 404);
+        // Overlay the real llms.txt curation values from the stored document
+        // (the audit-entity pipeline that builds the base record doesn't carry
+        // these convention keys).
+        const data = asRecord(doc.data);
+        const includeRaw = String(data.llmsInclude ?? '').toUpperCase();
+        const merged = {
+            ...record,
+            llmsInclude: includeRaw === 'ALWAYS' || includeRaw === 'NEVER'
+                ? includeRaw
+                : 'AUTO',
+            llmsDescription: typeof data.llmsDescription === 'string' ? data.llmsDescription : null,
+            llmsSection: typeof data.llmsSection === 'string' ? data.llmsSection : null,
+            llmsOptional: data.llmsOptional === true,
+            // Robots directives live in the same content JSON. Overlaid here for
+            // the same reason as the llms.txt keys: the audit-entity pipeline that
+            // builds the base record does not carry them, so without this the
+            // editor would read every page back as fully permissive and silently
+            // overwrite a real restriction on the next save.
+            nosnippet: data.nosnippet === true,
+            noarchive: data.noarchive === true,
+            maxImagePreview: coerceMaxImagePreview(data.maxImagePreview),
+        };
+        return json({ data: merged });
+    }
+    catch (err) {
+        return internalError(err, 'seo/content/:id');
+    }
+}
+export async function putSeoContentRecord(request, params) {
+    try {
+        const auth = await requireAuth(request);
+        if (auth.error)
+            return auth.error;
+        const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+        if (roleErr)
+            return roleErr;
+        const body = (await request.json().catch(() => null));
+        if (!body || typeof body !== 'object') {
+            return errorResponse('Request body must be an object', 400);
+        }
+        const doc = await db().document.findFirst({
+            where: { id: params.entityId, deletedAt: null },
+            select: { id: true, collection: true },
+        });
+        if (!doc)
+            return errorResponse('Document not found', 404);
+        // String SEO fields: payload key -> stored data key, each with a max
+        // length so we never persist unbounded/megabyte values into the content
+        // JSON. Canonical is stored as `canonical` to match normalizeSeoPage.
+        const TEXT_FIELDS = {
+            metaTitle: { target: 'metaTitle', max: 300 },
+            metaDescription: { target: 'metaDescription', max: 1000 },
+            canonicalUrl: { target: 'canonical', max: 2000 },
+            focusKeyword: { target: 'focusKeyword', max: 200 },
+            keyTakeaway: { target: 'keyTakeaway', max: 500 },
+            ogTitle: { target: 'ogTitle', max: 300 },
+            ogDescription: { target: 'ogDescription', max: 1000 },
+            ogImage: { target: 'ogImage', max: 2000 },
+            twitterTitle: { target: 'twitterTitle', max: 300 },
+            twitterDescription: { target: 'twitterDescription', max: 1000 },
+            twitterImage: { target: 'twitterImage', max: 2000 },
+            structuredDataType: { target: 'structuredDataType', max: 100 },
+            schemaType: { target: 'schemaType', max: 100 },
+            llmsDescription: { target: 'llmsDescription', max: 500 },
+            llmsSection: { target: 'llmsSection', max: 100 },
+        };
+        const patch = {};
+        for (const [key, { target, max }] of Object.entries(TEXT_FIELDS)) {
+            if (!(key in body))
+                continue;
+            const value = body[key];
+            if (value === null || value === '') {
+                patch[target] = '';
+                continue;
+            }
+            if (typeof value !== 'string') {
+                return errorResponse(`Field "${key}" must be a string`, 400);
+            }
+            if (value.length > max) {
+                return errorResponse(`Field "${key}" exceeds the ${max}-character limit`, 400);
+            }
+            patch[target] = value;
+        }
+        if ('noindex' in body)
+            patch.noindex = body.noindex === true;
+        if ('nofollow' in body)
+            patch.nofollow = body.nofollow === true;
+        if ('nosnippet' in body)
+            patch.nosnippet = body.nosnippet === true;
+        if ('noarchive' in body)
+            patch.noarchive = body.noarchive === true;
+        if ('maxImagePreview' in body) {
+            // Coerced rather than rejected: the field is an enum with a permissive
+            // default, and refusing the write would block an otherwise valid patch
+            // over a value the composer already knows how to fall back from.
+            patch.maxImagePreview = coerceMaxImagePreview(body.maxImagePreview);
+        }
+        if ('llmsOptional' in body)
+            patch.llmsOptional = body.llmsOptional === true;
+        if ('llmsInclude' in body) {
+            const v = String(body.llmsInclude ?? '').toUpperCase();
+            if (v !== 'AUTO' && v !== 'ALWAYS' && v !== 'NEVER') {
+                return errorResponse('llmsInclude must be one of AUTO, ALWAYS, NEVER', 400);
+            }
+            // AUTO is the default — store empty so the field falls back cleanly.
+            patch.llmsInclude = v === 'AUTO' ? '' : v;
+        }
+        if ('llmsPriority' in body) {
+            const n = body.llmsPriority;
+            if (n !== null && typeof n !== 'number') {
+                return errorResponse('llmsPriority must be a number', 400);
+            }
+            patch.llmsPriority = n ?? 0;
+        }
+        if ('structuredData' in body) {
+            const sd = body.structuredData;
+            if (sd !== null && (typeof sd !== 'object' || Array.isArray(sd))) {
+                return errorResponse('structuredData must be a JSON object', 400);
+            }
+            if (sd && JSON.stringify(sd).length > 50_000) {
+                return errorResponse('structuredData payload is too large', 400);
+            }
+            patch.structuredData = sd;
+        }
+        if (Object.keys(patch).length === 0) {
+            return errorResponse('No recognized SEO fields in request body', 400);
+        }
+        if ('structuredDataType' in patch || 'schemaType' in patch) {
+            Object.assign(patch, syncSchemaTypeFields(patch));
+        }
+        // Route through the data layer so the edit gets per-collection access
+        // control, a Version snapshot, search re-indexing and the afterUpdate
+        // hook — never write document.data directly. (updateDocumentSeoFields
+        // preserves the undeclared SEO convention keys that the generic
+        // updateDocument field-access layer would strip.)
+        const ctx = buildActionContext(auth.session, db());
+        try {
+            await updateDocumentSeoFields(doc.collection, doc.id, patch, ctx);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : '';
+            if (msg.includes('Access denied'))
+                return errorResponse('Insufficient permissions', 403);
+            if (msg.includes('not found'))
+                return errorResponse('Document not found', 404);
+            throw err;
+        }
+        try {
+            await logEvent({
+                event: 'document_updated',
+                userId: auth.session.userId,
+                details: { action: 'seo_fields_update', documentId: doc.id },
+            });
+        }
+        catch {
+            /* noop */
+        }
+        const { records } = await buildSeoContentRecords(null, [doc.id]);
+        const record = records.find((r) => r.entityId === doc.id);
+        return json({ data: record ?? { ok: true } });
+    }
+    catch (err) {
+        return internalError(err, 'seo/content PUT');
+    }
+}
+//# sourceMappingURL=content.js.map