modern-cms 1.0.0

package/template/apps/api/src/index.ts

@@ -0,0 +1,66 @@
+import express from "express";
+import cors from "cors";
+import cookieParser from "cookie-parser";
+import { env } from "./env.js";
+import { securityHeaders } from "./middleware/securityHeaders.js";
+import { authRouter } from "./routes/auth.routes.js";
+import { pagesRouter } from "./routes/pages.routes.js";
+import { mediaRouter } from "./routes/media.routes.js";
+import { themeRouter } from "./routes/theme.routes.js";
+import { usersRouter } from "./routes/users.routes.js";
+import { formsRouter } from "./routes/forms.routes.js";
+import { globalSectionsRouter } from "./routes/globalSections.routes.js";
+import { blocksRouter } from "./routes/blocks.routes.js";
+import { collectionsRouter } from "./routes/collections.routes.js";
+import { searchRouter } from "./routes/search.routes.js";
+import { redirectsRouter } from "./routes/redirects.routes.js";
+import { auditRouter } from "./routes/audit.routes.js";
+import { templatesRouter } from "./routes/templates.routes.js";
+import { backupRouter } from "./routes/backup.routes.js";
+import { auditLog } from "./middleware/auditLog.js";
+
+const app = express();
+
+app.set("trust proxy", 1);
+app.use(securityHeaders);
+app.use(cors({ origin: env.webOrigin, credentials: true }));
+app.use(cookieParser());
+app.use(express.json({ limit: "5mb" }));
+
+app.use((req, res, next) => {
+  const start = Date.now();
+  res.on("finish", () => {
+    console.log(`${req.method} ${req.originalUrl} ${res.statusCode} ${Date.now() - start}ms`);
+  });
+  next();
+});
+
+app.get("/health", (_req, res) => res.json({ ok: true }));
+
+// Registered before the routers, but it records on response-finish — by then the
+// router's own requireAuth has attached req.user, so entries carry who did it.
+app.use(auditLog);
+
+app.use("/api/auth", authRouter);
+app.use("/api/pages", pagesRouter);
+app.use("/api/media", mediaRouter);
+app.use("/api/theme", themeRouter);
+app.use("/api/users", usersRouter);
+app.use("/api/forms", formsRouter);
+app.use("/api/global-sections", globalSectionsRouter);
+app.use("/api/blocks", blocksRouter);
+app.use("/api/collections", collectionsRouter);
+app.use("/api/search", searchRouter);
+app.use("/api/redirects", redirectsRouter);
+app.use("/api/audit", auditRouter);
+app.use("/api/templates", templatesRouter);
+app.use("/api/backup", backupRouter);
+
+app.use((err: any, _req: express.Request, res: express.Response, _next: express.NextFunction) => {
+  console.error(err);
+  res.status(err.status ?? 500).json({ error: err.message ?? "Internal server error" });
+});
+
+app.listen(env.port, () => {
+  console.log(`pg-cms API listening on http://localhost:${env.port}`);
+});

package/template/apps/api/src/lib/revalidate.ts

@@ -0,0 +1,28 @@
+/** Ask the Next.js app to bust its ISR cache after content changes. No-op when
+ * REVALIDATE_URL / REVALIDATE_SECRET are unset (typical in local dev). */
+export async function triggerRevalidation(tags: string[]): Promise<void> {
+  const url = process.env.REVALIDATE_URL;
+  const secret = process.env.REVALIDATE_SECRET;
+  if (!url || !secret || tags.length === 0) return;
+
+  try {
+    const res = await fetch(`${url.replace(/\/$/, "")}/api/revalidate`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${secret}`,
+      },
+      body: JSON.stringify({ tags }),
+    });
+    if (!res.ok) {
+      console.warn(`Revalidation failed (${res.status}):`, await res.text());
+    }
+  } catch (err) {
+    console.warn("Revalidation request failed:", err);
+  }
+}
+
+export function pageCacheTags(slug: string): string[] {
+  const normalized = slug || "home";
+  return ["cms", "cms-pages", `page:${normalized}`, "cms-sitemap"];
+}

package/template/apps/api/src/lib/storage/azure.ts

@@ -0,0 +1,25 @@
+import { BlobServiceClient } from "@azure/storage-blob";
+import { env } from "../../env.js";
+import type { StorageProvider } from "./types.js";
+
+export function createAzureStorage(): StorageProvider {
+  const config = env.azure!;
+  const serviceClient = BlobServiceClient.fromConnectionString(config.connectionString);
+  const containerClient = serviceClient.getContainerClient(config.container);
+
+  function publicUrlFor(key: string) {
+    if (config.publicUrl) return `${config.publicUrl}/${key}`;
+    return containerClient.getBlockBlobClient(key).url;
+  }
+
+  return {
+    async upload(key, buffer, contentType) {
+      const blockBlobClient = containerClient.getBlockBlobClient(key);
+      await blockBlobClient.uploadData(buffer, { blobHTTPHeaders: { blobContentType: contentType } });
+      return publicUrlFor(key);
+    },
+    async delete(key) {
+      await containerClient.getBlockBlobClient(key).deleteIfExists();
+    },
+  };
+}

package/template/apps/api/src/lib/storage/cloudinary.ts

@@ -0,0 +1,42 @@
+import { v2 as cloudinary } from "cloudinary";
+import { Readable } from "node:stream";
+import { env } from "../../env.js";
+import type { StorageProvider } from "./types.js";
+
+export function createCloudinaryStorage(): StorageProvider {
+  const config = env.cloudinary!;
+  cloudinary.config({
+    cloud_name: config.cloudName,
+    api_key: config.apiKey,
+    api_secret: config.apiSecret,
+  });
+
+  // Cloudinary's public_id carries no file extension — strip it so a later delete()
+  // targets the exact asset this upload created, not a literal "name.jpg" that doesn't
+  // exist as a public_id.
+  function publicId(key: string) {
+    return `${config.folder}/${key.replace(/\.[^./]+$/, "")}`;
+  }
+
+  return {
+    upload(key, buffer, contentType) {
+      return new Promise<string>((resolve, reject) => {
+        const stream = cloudinary.uploader.upload_stream(
+          {
+            public_id: publicId(key),
+            resource_type: contentType.startsWith("video/") ? "video" : "image",
+            overwrite: true,
+          },
+          (err, result) => {
+            if (err || !result) return reject(err ?? new Error("Cloudinary upload failed"));
+            resolve(result.secure_url);
+          }
+        );
+        Readable.from(buffer).pipe(stream);
+      });
+    },
+    async delete(key) {
+      await cloudinary.uploader.destroy(publicId(key));
+    },
+  };
+}

package/template/apps/api/src/lib/storage/index.ts

@@ -0,0 +1,25 @@
+import { env } from "../../env.js";
+import type { StorageProvider } from "./types.js";
+import { createS3Storage } from "./s3.js";
+import { createAzureStorage } from "./azure.js";
+import { createCloudinaryStorage } from "./cloudinary.js";
+
+let cached: StorageProvider | null = null;
+
+function build(): StorageProvider {
+  if (env.storageProvider === "azure") return createAzureStorage();
+  if (env.storageProvider === "cloudinary") return createCloudinaryStorage();
+  return createS3Storage();
+}
+
+function getStorage(): StorageProvider {
+  return (cached ??= build());
+}
+
+export async function uploadBuffer(key: string, buffer: Buffer, contentType: string): Promise<string> {
+  return getStorage().upload(key, buffer, contentType);
+}
+
+export async function deleteObject(key: string): Promise<void> {
+  return getStorage().delete(key);
+}

package/template/apps/api/src/lib/storage/s3.ts

@@ -0,0 +1,39 @@
+import { S3Client, PutObjectCommand, DeleteObjectCommand } from "@aws-sdk/client-s3";
+import { env } from "../../env.js";
+import type { StorageProvider } from "./types.js";
+
+/** Works for real AWS S3 and any S3-compatible endpoint (MinIO in dev, DigitalOcean
+ * Spaces, Cloudflare R2, etc.) — same client either way, just a different endpoint. */
+export function createS3Storage(): StorageProvider {
+  const config = env.s3!;
+  const client = new S3Client({
+    endpoint: config.endpoint,
+    region: config.region,
+    forcePathStyle: config.forcePathStyle,
+    credentials: {
+      accessKeyId: config.accessKeyId,
+      secretAccessKey: config.secretAccessKey,
+    },
+  });
+
+  function publicUrlFor(key: string) {
+    return `${config.publicUrl}/${key}`;
+  }
+
+  return {
+    async upload(key, buffer, contentType) {
+      await client.send(
+        new PutObjectCommand({
+          Bucket: config.bucket,
+          Key: key,
+          Body: buffer,
+          ContentType: contentType,
+        })
+      );
+      return publicUrlFor(key);
+    },
+    async delete(key) {
+      await client.send(new DeleteObjectCommand({ Bucket: config.bucket, Key: key }));
+    },
+  };
+}

package/template/apps/api/src/lib/storage/types.ts

@@ -0,0 +1,8 @@
+/** Every storage backend (S3-compatible, Azure Blob, Cloudinary) implements this same
+ * shape, so media.routes.ts never has to know which one is active. */
+export interface StorageProvider {
+  /** Uploads a buffer under `key` and returns the public URL the browser can load it
+   * from directly (media assets are never served through a signed-URL proxy today). */
+  upload(key: string, buffer: Buffer, contentType: string): Promise<string>;
+  delete(key: string): Promise<void>;
+}

package/template/apps/api/src/middleware/auditLog.ts

@@ -0,0 +1,32 @@
+import type { NextFunction, Request, Response } from "express";
+import { prisma } from "../prisma.js";
+
+// Paths whose mutations aren't editorial actions worth auditing: public form
+// submissions (spam volume) and the auth endpoints' own bodies (logins ARE logged,
+// via the response hook below, but never their credentials — we only record the URL).
+const SKIP_PREFIXES = ["/api/forms/submit"];
+
+/** Records every successful mutating API call (who, what URL, when) after the
+ * response finishes. Middleware-based so new routes are audited automatically instead
+ * of relying on every future handler remembering to log. Failures to write the log
+ * never affect the request itself. */
+export function auditLog(req: Request, res: Response, next: NextFunction) {
+  const mutating = req.method !== "GET" && req.method !== "HEAD" && req.method !== "OPTIONS";
+  if (!mutating || SKIP_PREFIXES.some((p) => req.path.startsWith(p))) return next();
+
+  res.on("finish", () => {
+    if (res.statusCode >= 400) return; // only record actions that actually happened
+    void prisma.auditLog
+      .create({
+        data: {
+          userId: req.user?.sub ?? null,
+          userEmail: req.user?.email ?? null,
+          action: `${req.method} ${req.path.split("/").slice(0, 4).join("/")}`,
+          entityPath: req.originalUrl.slice(0, 500),
+          status: res.statusCode,
+        },
+      })
+      .catch((err) => console.warn("audit log write failed:", err));
+  });
+  next();
+}

package/template/apps/api/src/middleware/auth.ts

@@ -0,0 +1,53 @@
+import type { NextFunction, Request, Response } from "express";
+import jwt from "jsonwebtoken";
+import type { UserRole } from "@pgcms/shared";
+import { env } from "../env.js";
+
+export type AuthTokenPayload = {
+  sub: string;
+  email: string;
+  role: UserRole;
+};
+
+declare global {
+  // eslint-disable-next-line @typescript-eslint/no-namespace
+  namespace Express {
+    interface Request {
+      user?: AuthTokenPayload;
+    }
+  }
+}
+
+export function signToken(payload: AuthTokenPayload): string {
+  return jwt.sign(payload, env.jwtSecret, { expiresIn: env.jwtExpiresIn as any });
+}
+
+export function requireAuth(req: Request, res: Response, next: NextFunction) {
+  const token = req.cookies?.[env.cookieName];
+  if (!token) return res.status(401).json({ error: "Not authenticated" });
+  try {
+    const payload = jwt.verify(token, env.jwtSecret) as AuthTokenPayload;
+    req.user = payload;
+    next();
+  } catch {
+    return res.status(401).json({ error: "Invalid or expired session" });
+  }
+}
+
+export function requireRole(...roles: UserRole[]) {
+  return (req: Request, res: Response, next: NextFunction) => {
+    if (!req.user) return res.status(401).json({ error: "Not authenticated" });
+    if (!roles.includes(req.user.role)) return res.status(403).json({ error: "Forbidden" });
+    next();
+  };
+}
+
+/** ADMIN/EDITOR can touch any resource, exactly as before AUTHOR existed. An AUTHOR can
+ * only touch a resource they created — used inline in mutation routes (after the
+ * resource is fetched) rather than as router middleware, since ownership can't be
+ * checked before the row exists. `createdById` is nullable (pre-AUTHOR rows, or rows an
+ * ADMIN created on someone's behalf), and null never matches an AUTHOR's own id. */
+export function canModify(user: AuthTokenPayload, resource: { createdById?: string | null }): boolean {
+  if (user.role !== "AUTHOR") return true;
+  return resource.createdById === user.sub;
+}

package/template/apps/api/src/middleware/rateLimit.ts

@@ -0,0 +1,31 @@
+import type { NextFunction, Request, Response } from "express";
+
+type Bucket = { count: number; resetAt: number };
+
+const buckets = new Map<string, Bucket>();
+
+/** Lightweight in-memory rate limiter — good enough for single-instance deploys.
+ * Resets automatically after `windowMs`. */
+export function rateLimit(options: { windowMs: number; max: number; keyPrefix?: string }) {
+  const { windowMs, max, keyPrefix = "" } = options;
+
+  return (req: Request, res: Response, next: NextFunction) => {
+    const ip = req.ip || req.socket.remoteAddress || "unknown";
+    const key = `${keyPrefix}:${ip}`;
+    const now = Date.now();
+    let bucket = buckets.get(key);
+
+    if (!bucket || now >= bucket.resetAt) {
+      bucket = { count: 0, resetAt: now + windowMs };
+      buckets.set(key, bucket);
+    }
+
+    bucket.count += 1;
+    if (bucket.count > max) {
+      res.setHeader("Retry-After", String(Math.ceil((bucket.resetAt - now) / 1000)));
+      return res.status(429).json({ error: "Too many requests — please try again later." });
+    }
+
+    next();
+  };
+}

package/template/apps/api/src/middleware/securityHeaders.ts

@@ -0,0 +1,10 @@
+import type { NextFunction, Request, Response } from "express";
+
+/** Baseline security headers without pulling in helmet (keeps deps lean). */
+export function securityHeaders(_req: Request, res: Response, next: NextFunction) {
+  res.setHeader("X-Content-Type-Options", "nosniff");
+  res.setHeader("X-Frame-Options", "SAMEORIGIN");
+  res.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
+  res.setHeader("Permissions-Policy", "camera=(), microphone=(), geolocation=()");
+  next();
+}

package/template/apps/api/src/prisma.ts

@@ -0,0 +1,3 @@
+import { PrismaClient } from "@prisma/client";
+
+export const prisma = new PrismaClient();

package/template/apps/api/src/routes/audit.routes.ts

@@ -0,0 +1,26 @@
+import { Router } from "express";
+import { prisma } from "../prisma.js";
+import { requireAuth, requireRole } from "../middleware/auth.js";
+
+export const auditRouter = Router();
+
+// Reading the audit trail is an admin-only capability.
+auditRouter.use(requireAuth, requireRole("ADMIN"));
+
+auditRouter.get("/", async (req, res) => {
+  const search = typeof req.query.search === "string" ? req.query.search.trim() : "";
+  const entries = await prisma.auditLog.findMany({
+    where: search
+      ? {
+          OR: [
+            { userEmail: { contains: search, mode: "insensitive" } },
+            { entityPath: { contains: search, mode: "insensitive" } },
+            { action: { contains: search, mode: "insensitive" } },
+          ],
+        }
+      : undefined,
+    orderBy: { createdAt: "desc" },
+    take: 200,
+  });
+  res.json(entries);
+});

package/template/apps/api/src/routes/auth.routes.ts

@@ -0,0 +1,46 @@
+import { Router } from "express";
+import bcrypt from "bcryptjs";
+import { LoginInputSchema } from "@pgcms/shared";
+import { prisma } from "../prisma.js";
+import { signToken, requireAuth } from "../middleware/auth.js";
+import { rateLimit } from "../middleware/rateLimit.js";
+import { env } from "../env.js";
+
+export const authRouter = Router();
+
+const loginLimiter = rateLimit({ windowMs: 15 * 60 * 1000, max: 15, keyPrefix: "login" });
+
+const cookieOptions = {
+  httpOnly: true,
+  sameSite: "lax" as const,
+  secure: process.env.NODE_ENV === "production",
+  maxAge: 7 * 24 * 60 * 60 * 1000,
+  path: "/",
+};
+
+authRouter.post("/login", loginLimiter, async (req, res) => {
+  const parsed = LoginInputSchema.safeParse(req.body);
+  if (!parsed.success) return res.status(400).json({ error: "Invalid input" });
+
+  const { email, password } = parsed.data;
+  const user = await prisma.user.findUnique({ where: { email } });
+  if (!user) return res.status(401).json({ error: "Invalid email or password" });
+
+  const valid = await bcrypt.compare(password, user.passwordHash);
+  if (!valid) return res.status(401).json({ error: "Invalid email or password" });
+
+  const token = signToken({ sub: user.id, email: user.email, role: user.role });
+  res.cookie(env.cookieName, token, cookieOptions);
+  res.json({ id: user.id, email: user.email, role: user.role });
+});
+
+authRouter.post("/logout", (_req, res) => {
+  res.clearCookie(env.cookieName, { ...cookieOptions, maxAge: undefined });
+  res.status(204).end();
+});
+
+authRouter.get("/me", requireAuth, async (req, res) => {
+  const user = await prisma.user.findUnique({ where: { id: req.user!.sub } });
+  if (!user) return res.status(404).json({ error: "Not found" });
+  res.json({ id: user.id, email: user.email, role: user.role });
+});

package/template/apps/api/src/routes/backup.routes.ts

@@ -0,0 +1,216 @@
+import { Router } from "express";
+import { z } from "zod";
+import { nanoid } from "nanoid";
+import { cloneWithNewIds, extractSearchText, PageNodeSchema, type PageNode } from "@pgcms/shared";
+import { prisma } from "../prisma.js";
+import { requireAuth, requireRole } from "../middleware/auth.js";
+
+export const backupRouter = Router();
+
+// Whole-site backup is the most destructive-adjacent feature in the admin — restore is
+// additive-only (never overwrites/deletes), but export alone already reveals every
+// page's content plus theme/nav/redirect configuration, so both directions are
+// ADMIN-only rather than the usual ADMIN/EDITOR pairing.
+backupRouter.use(requireAuth, requireRole("ADMIN"));
+
+backupRouter.get("/export", async (_req, res) => {
+  const [theme, navItems, pages, collections, globalSections, redirects, savedBlocks, templates] =
+    await Promise.all([
+      prisma.siteTheme.findFirst(),
+      prisma.navItem.findMany(),
+      prisma.page.findMany(),
+      prisma.collection.findMany({ include: { items: true } }),
+      prisma.globalSection.findMany(),
+      prisma.redirect.findMany(),
+      prisma.savedBlock.findMany(),
+      prisma.pageTemplate.findMany(),
+    ]);
+
+  res.setHeader("Content-Disposition", `attachment; filename="pg-cms-backup-${Date.now()}.json"`);
+  res.json({
+    exportedAt: new Date().toISOString(),
+    theme,
+    navItems,
+    pages,
+    collections,
+    globalSections,
+    redirects,
+    savedBlocks,
+    templates,
+  });
+});
+
+const BackupSchema = z.object({
+  theme: z.record(z.string(), z.unknown()).nullable().optional(),
+  navItems: z.array(z.record(z.string(), z.unknown())).optional(),
+  pages: z.array(z.record(z.string(), z.unknown())).optional(),
+  collections: z.array(z.record(z.string(), z.unknown())).optional(),
+  globalSections: z.array(z.record(z.string(), z.unknown())).optional(),
+  redirects: z.array(z.record(z.string(), z.unknown())).optional(),
+  savedBlocks: z.array(z.record(z.string(), z.unknown())).optional(),
+  templates: z.array(z.record(z.string(), z.unknown())).optional(),
+});
+
+type Counts = Record<string, number>;
+
+/** Restores a previously exported bundle additively: an entity is created only if
+ * nothing with its natural key already exists, and is otherwise skipped untouched —
+ * never overwritten, never deleted. Mirrors the "never destroy user content" rule the
+ * builder already follows for column/zone/grid-count shrinks. */
+backupRouter.post("/import", async (req, res) => {
+  const parsed = BackupSchema.safeParse(req.body);
+  if (!parsed.success) return res.status(400).json({ error: parsed.error.flatten() });
+  const data = parsed.data;
+  const created: Counts = {};
+  const skipped: Counts = {};
+  const bump = (bucket: Counts, key: string) => (bucket[key] = (bucket[key] ?? 0) + 1);
+
+  if (data.theme && !(await prisma.siteTheme.findFirst())) {
+    const { id: _id, ...rest } = data.theme as Record<string, unknown>;
+    await prisma.siteTheme.create({ data: rest as any });
+    bump(created, "theme");
+  } else if (data.theme) {
+    bump(skipped, "theme");
+  }
+
+  for (const raw of data.navItems ?? []) {
+    const label = String(raw.label ?? "");
+    const href = String(raw.href ?? "");
+    const exists = await prisma.navItem.findFirst({ where: { label, href } });
+    if (exists) {
+      bump(skipped, "navItems");
+      continue;
+    }
+    await prisma.navItem.create({
+      data: { label, href, order: Number(raw.order) || 0 },
+    });
+    bump(created, "navItems");
+  }
+
+  for (const raw of data.pages ?? []) {
+    const slug = String(raw.slug ?? "");
+    if (await prisma.page.findUnique({ where: { slug } })) {
+      bump(skipped, "pages");
+      continue;
+    }
+    const parsedContent = PageNodeSchema.safeParse(raw.content);
+    if (!parsedContent.success) {
+      bump(skipped, "pages");
+      continue;
+    }
+    const content: PageNode = cloneWithNewIds(parsedContent.data);
+    await prisma.page.create({
+      data: {
+        title: String(raw.title ?? "Untitled"),
+        slug,
+        status: "DRAFT",
+        content: content as any,
+        searchText: extractSearchText(content),
+        previewToken: nanoid(24),
+        locale: typeof raw.locale === "string" ? raw.locale : "en",
+        createdById: req.user!.sub,
+      },
+    });
+    bump(created, "pages");
+  }
+
+  for (const rawCollection of data.collections ?? []) {
+    const slug = String(rawCollection.slug ?? "");
+    if (await prisma.collection.findUnique({ where: { slug } })) {
+      bump(skipped, "collections");
+      continue;
+    }
+    const items = Array.isArray(rawCollection.items) ? rawCollection.items : [];
+    const collection = await prisma.collection.create({
+      data: { name: String(rawCollection.name ?? slug), slug },
+    });
+    bump(created, "collections");
+    for (const rawItem of items as Record<string, unknown>[]) {
+      const parsedContent = PageNodeSchema.safeParse(rawItem.content);
+      if (!parsedContent.success) continue;
+      const content: PageNode = cloneWithNewIds(parsedContent.data);
+      await prisma.collectionItem.create({
+        data: {
+          collectionId: collection.id,
+          title: String(rawItem.title ?? "Untitled"),
+          slug: String(rawItem.slug ?? nanoid(8)),
+          content: content as any,
+          searchText: extractSearchText(content),
+          locale: typeof rawItem.locale === "string" ? rawItem.locale : "en",
+          createdById: req.user!.sub,
+        },
+      });
+      bump(created, "collectionItems");
+    }
+  }
+
+  for (const raw of data.globalSections ?? []) {
+    const kind = String(raw.kind ?? "");
+    if (await prisma.globalSection.findUnique({ where: { kind } })) {
+      bump(skipped, "globalSections");
+      continue;
+    }
+    const parsedContent = PageNodeSchema.safeParse(raw.content);
+    if (!parsedContent.success) {
+      bump(skipped, "globalSections");
+      continue;
+    }
+    await prisma.globalSection.create({
+      data: { kind, enabled: Boolean(raw.enabled), content: parsedContent.data as any },
+    });
+    bump(created, "globalSections");
+  }
+
+  for (const raw of data.redirects ?? []) {
+    const fromPath = String(raw.fromPath ?? "");
+    if (await prisma.redirect.findUnique({ where: { fromPath } })) {
+      bump(skipped, "redirects");
+      continue;
+    }
+    await prisma.redirect.create({
+      data: { fromPath, toPath: String(raw.toPath ?? "/"), permanent: raw.permanent !== false },
+    });
+    bump(created, "redirects");
+  }
+
+  for (const raw of data.savedBlocks ?? []) {
+    const name = String(raw.name ?? "");
+    if (await prisma.savedBlock.findFirst({ where: { name } })) {
+      bump(skipped, "savedBlocks");
+      continue;
+    }
+    const parsedContent = PageNodeSchema.safeParse(raw.content);
+    if (!parsedContent.success) {
+      bump(skipped, "savedBlocks");
+      continue;
+    }
+    await prisma.savedBlock.create({
+      data: { name, content: parsedContent.data as any, createdById: req.user!.sub },
+    });
+    bump(created, "savedBlocks");
+  }
+
+  for (const raw of data.templates ?? []) {
+    const name = String(raw.name ?? "");
+    if (await prisma.pageTemplate.findFirst({ where: { name } })) {
+      bump(skipped, "templates");
+      continue;
+    }
+    const parsedContent = PageNodeSchema.safeParse(raw.content);
+    if (!parsedContent.success) {
+      bump(skipped, "templates");
+      continue;
+    }
+    await prisma.pageTemplate.create({
+      data: {
+        name,
+        category: typeof raw.category === "string" ? raw.category : "General",
+        thumbnail: typeof raw.thumbnail === "string" ? raw.thumbnail : null,
+        content: parsedContent.data as any,
+      },
+    });
+    bump(created, "templates");
+  }
+
+  res.json({ created, skipped });
+});