@minamocms/framework 0.0.0-stage → 0.10.1

package/dist/routes/capabilities.js

@@ -0,0 +1,27 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { CURRENT_SCHEMA_VERSION } from "../migrations/index.js";
+import { NO_AUTH_ROUTE_RATE_LIMIT } from "../services/rate-limit-config.js";
+import { DRIVER_NAME } from "../search/drivers/node-sqlite-driver.js";
+// The agent's own bundled package.json, not site data - the same
+// import.meta.dirname-relative pattern already established in
+// validation.ts/startup-checks.ts for the agent's own files.
+export function readAgentVersion() {
+    const packageJsonPath = join(import.meta.dirname, '..', '..', 'package.json');
+    const packageJson = JSON.parse(readFileSync(packageJsonPath, 'utf-8'));
+    return packageJson.version ?? '0.0.0';
+}
+export const capabilitiesRoutes = async (fastify, opts) => {
+    fastify.get('/capabilities', { config: NO_AUTH_ROUTE_RATE_LIMIT }, async () => ({
+        agentVersion: readAgentVersion(),
+        contentSchemaVersion: CURRENT_SCHEMA_VERSION,
+        sqliteDriver: DRIVER_NAME,
+        // Named distinctly from site.config.json's own "media.maxUploadBytes"
+        // key so this response reads unambiguously next to its siblings -
+        // lets the admin's own client-side upload check validate against
+        // the same limit the server will actually enforce (@fastify/multipart's
+        // limits.fileSize in media.ts), rather than a separately hardcoded
+        // guess that could drift.
+        maxMediaUploadBytes: opts.maxUploadBytes,
+    }));
+};

package/dist/routes/content.d.ts

@@ -0,0 +1,8 @@
+import type { FastifyPluginAsync } from 'fastify';
+import type { SiteConfig } from '../config.ts';
+import type { TokenEntry } from '../server-config.ts';
+export interface ContentRouteOptions {
+    config: SiteConfig;
+    tokens: TokenEntry[];
+}
+export declare const contentRoutes: FastifyPluginAsync<ContentRouteOptions>;

package/dist/routes/content.js

@@ -0,0 +1,169 @@
+import { ContentReadError, listContent, readContentFile } from "../services/content-read.js";
+import { DeleteContentError, deleteContent } from "../services/delete-content.js";
+import { isValidCommitAuthor } from "../services/git.js";
+import { MoveError, movePage } from "../services/move.js";
+import { PathSafetyError } from "../services/path-safety.js";
+import { WRITE_ROUTE_RATE_LIMIT } from "../services/rate-limit-config.js";
+import { requireScope } from "../services/token-auth.js";
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.length > 0;
+}
+// content/drafts/ and content/redirects.json sit inside contentRoot
+// (Group N) but are not page-shaped content reachable through the
+// generic content routes - drafts have their own dedicated /v1/drafts/*
+// surface with its own semantics, and redirects.json is agent-managed
+// data with its own /v1/redirects surface. Without this check, a
+// client request resolving into either would either leak an unpublished
+// draft's raw bytes through the "live content" read endpoint, or
+// (for DELETE) unlink a file that was never git-tracked and blow up in
+// commitPaths with a spurious 500 - both real bugs the nesting would
+// introduce, not present when drafts/redirects.json were siteRoot
+// siblings of contentRoot.
+function isReservedContentPath(relativePath) {
+    return (relativePath === 'redirects.json' ||
+        relativePath === 'settings.json' ||
+        relativePath === 'drafts' ||
+        relativePath.startsWith('drafts/'));
+}
+async function handleReadContent(request, reply, config) {
+    const relativePath = request.params['*'];
+    if (isReservedContentPath(relativePath)) {
+        reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No content at "${relativePath}"` });
+        return;
+    }
+    try {
+        const { bytes, etag } = readContentFile(config.contentRoot, relativePath);
+        reply.header('etag', etag).type('application/json; charset=utf-8').send(bytes);
+    }
+    catch (error) {
+        // PathSafetyError has no .statusCode - left uncaught it would fall
+        // through to the global handler's generic sanitised 500, matching
+        // the gap preview.ts's precedent already guards against.
+        if (error instanceof PathSafetyError || (error instanceof ContentReadError && error.reason === 'not-found')) {
+            reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No content at "${relativePath}"` });
+            return;
+        }
+        throw error;
+    }
+}
+function parseDeleteContentBody(body) {
+    if (typeof body !== 'object' || body === null) {
+        return null;
+    }
+    const { redirectTo, message, author } = body;
+    if (redirectTo !== undefined && !isNonEmptyString(redirectTo)) {
+        return null;
+    }
+    if (!isNonEmptyString(message) || !isValidCommitAuthor(author)) {
+        return null;
+    }
+    return { redirectTo, message, author };
+}
+async function handleDeleteContent(request, reply, config) {
+    const relativePath = request.params['*'];
+    if (isReservedContentPath(relativePath)) {
+        reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No content at "${relativePath}"` });
+        return;
+    }
+    const parsed = parseDeleteContentBody(request.body);
+    if (!parsed) {
+        reply.code(400).send({
+            statusCode: 400,
+            error: 'Bad Request',
+            message: 'Expected { redirectTo?: string, message: string, author: { name, email } }',
+        });
+        return;
+    }
+    try {
+        await deleteContent(config, relativePath, parsed.redirectTo, parsed.message, parsed.author);
+        reply.code(204).send();
+    }
+    catch (error) {
+        if (error instanceof PathSafetyError) {
+            reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No content at "${relativePath}"` });
+            return;
+        }
+        if (error instanceof DeleteContentError) {
+            if (error.reason === 'page-not-found') {
+                reply.code(404).send({ statusCode: 404, error: 'Not Found', message: error.message });
+                return;
+            }
+            if (error.reason === 'has-children') {
+                reply.code(409).send({ statusCode: 409, error: 'Conflict', message: error.message });
+                return;
+            }
+            if (error.reason === 'redirect-cycle' || error.reason === 'invalid-redirect-target') {
+                reply.code(400).send({ statusCode: 400, error: 'Bad Request', message: error.message });
+                return;
+            }
+        }
+        throw error;
+    }
+}
+function parseMoveContentBody(body) {
+    if (typeof body !== 'object' || body === null) {
+        return null;
+    }
+    const { from, to, message, author, createRedirect } = body;
+    if (!isNonEmptyString(from) || !isNonEmptyString(to)) {
+        return null;
+    }
+    if (!isNonEmptyString(message) || !isValidCommitAuthor(author)) {
+        return null;
+    }
+    if (createRedirect !== undefined && typeof createRedirect !== 'boolean') {
+        return null;
+    }
+    return { from, to, message, author, createRedirect };
+}
+async function handleMoveContent(request, reply, config) {
+    const parsed = parseMoveContentBody(request.body);
+    if (!parsed) {
+        reply.code(400).send({
+            statusCode: 400,
+            error: 'Bad Request',
+            message: 'Expected { from: string, to: string, message: string, author: { name, email } }',
+        });
+        return;
+    }
+    try {
+        await movePage(config, parsed.from, parsed.to, parsed.message, parsed.author, {
+            createRedirect: parsed.createRedirect,
+        });
+        reply.send({ ok: true });
+    }
+    catch (error) {
+        if (error instanceof PathSafetyError) {
+            reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No page at "${parsed.from}"` });
+            return;
+        }
+        if (error instanceof MoveError) {
+            if (error.reason === 'source-not-found') {
+                reply.code(404).send({ statusCode: 404, error: 'Not Found', message: error.message });
+                return;
+            }
+            if (error.reason === 'destination-exists') {
+                reply.code(409).send({ statusCode: 409, error: 'Conflict', message: error.message });
+                return;
+            }
+        }
+        throw error;
+    }
+}
+async function handleListContent(request, reply, config) {
+    const { type, prefix, draftStatus } = request.query;
+    const entries = listContent(config, { type, prefix, draftStatus });
+    reply.send(entries);
+}
+export const contentRoutes = async (fastify, opts) => {
+    fastify.get('/content', { preHandler: requireScope(opts.tokens, 'content') }, async (request, reply) => handleListContent(request, reply, opts.config));
+    fastify.get('/content/*', { preHandler: requireScope(opts.tokens, 'content') }, async (request, reply) => handleReadContent(request, reply, opts.config));
+    fastify.delete('/content/*', { preHandler: requireScope(opts.tokens, 'content'), config: WRITE_ROUTE_RATE_LIMIT }, async (request, reply) => handleDeleteContent(request, reply, opts.config));
+    // A static path, distinct from the GET/DELETE /content/* wildcard
+    // above by method as well as by not matching the wildcard's own
+    // prefix shape at all (POST here, GET/DELETE there) - no routing
+    // collision, per Group C's own verified precedent that Fastify
+    // prefers static/exact matches over a wildcard regardless of
+    // registration order.
+    fastify.post('/content/move', { preHandler: requireScope(opts.tokens, 'content'), config: WRITE_ROUTE_RATE_LIMIT }, async (request, reply) => handleMoveContent(request, reply, opts.config));
+};

package/dist/routes/deleted-pages.d.ts

@@ -0,0 +1,8 @@
+import type { FastifyPluginAsync } from 'fastify';
+import type { SiteConfig } from '../config.ts';
+import type { TokenEntry } from '../server-config.ts';
+export interface DeletedPagesRouteOptions {
+    config: SiteConfig;
+    tokens: TokenEntry[];
+}
+export declare const deletedPagesRoutes: FastifyPluginAsync<DeletedPagesRouteOptions>;

package/dist/routes/deleted-pages.js

@@ -0,0 +1,9 @@
+import { listDeletedPages } from "../services/deleted-pages.js";
+import { requireScope } from "../services/token-auth.js";
+// GET /v1/deleted-pages: pages that were deleted and aren't back, newest
+// first, each with the ref to restore it from (POST /v1/git/revert).
+export const deletedPagesRoutes = async (fastify, opts) => {
+    fastify.get('/deleted-pages', { preHandler: requireScope(opts.tokens, 'content') }, async (_request, reply) => {
+        reply.send({ pages: listDeletedPages(opts.config) });
+    });
+};

package/dist/routes/drafts.d.ts

@@ -0,0 +1,10 @@
+import type { FastifyPluginAsync } from 'fastify';
+import type { SiteConfig } from '../config.ts';
+import type { ThemeState } from '../theme-state.ts';
+import type { TokenEntry } from '../server-config.ts';
+export interface DraftsRouteOptions {
+    config: SiteConfig;
+    theme: ThemeState;
+    tokens: TokenEntry[];
+}
+export declare const draftsRoutes: FastifyPluginAsync<DraftsRouteOptions>;

package/dist/routes/drafts.js

@@ -0,0 +1,73 @@
+import { ContentReadError, readContentFile } from "../services/content-read.js";
+import { DraftError, discardDraft, saveDraft } from "../services/drafts.js";
+import { PathSafetyError } from "../services/path-safety.js";
+import { WRITE_ROUTE_RATE_LIMIT } from "../services/rate-limit-config.js";
+import { requireScope } from "../services/token-auth.js";
+async function handleReadDraft(request, reply, config) {
+    const relativePath = request.params['*'];
+    try {
+        const { bytes, etag } = readContentFile(config.draftsRoot, relativePath);
+        reply.header('etag', etag).type('application/json; charset=utf-8').send(bytes);
+    }
+    catch (error) {
+        if (error instanceof PathSafetyError || (error instanceof ContentReadError && error.reason === 'not-found')) {
+            reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No draft at "${relativePath}"` });
+            return;
+        }
+        throw error;
+    }
+}
+async function handleSaveDraft(request, reply, config, themeSchemas) {
+    const relativePath = request.params['*'];
+    // A static per-request property (is the header present at all on
+    // *this* request), not shared mutable state - no TOCTOU risk in
+    // checking it here, before the queue, unlike the ETag comparison
+    // itself (E2/E4/E6), which must happen inside saveDraftJob.
+    const ifMatch = request.headers['if-match'];
+    if (typeof ifMatch !== 'string' || ifMatch.length === 0) {
+        reply.code(428).send({
+            statusCode: 428,
+            error: 'Precondition Required',
+            message: 'An If-Match header is required to save a draft',
+        });
+        return;
+    }
+    try {
+        const newEtag = await saveDraft(config, themeSchemas, relativePath, request.body, ifMatch);
+        reply.header('etag', newEtag).send({ ok: true });
+    }
+    catch (error) {
+        if (error instanceof PathSafetyError) {
+            reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No draft at "${relativePath}"` });
+            return;
+        }
+        if (error instanceof DraftError && error.reason === 'conflict') {
+            reply.code(409).send({ statusCode: 409, error: 'Conflict', message: error.message });
+            return;
+        }
+        if (error instanceof DraftError && error.reason === 'validation-failed') {
+            reply.code(400).send({ statusCode: 400, error: 'Bad Request', message: error.message, errors: error.errors });
+            return;
+        }
+        throw error;
+    }
+}
+async function handleDiscardDraft(request, reply, config) {
+    const relativePath = request.params['*'];
+    try {
+        await discardDraft(config, relativePath);
+        reply.code(204).send();
+    }
+    catch (error) {
+        if (error instanceof PathSafetyError) {
+            reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No draft at "${relativePath}"` });
+            return;
+        }
+        throw error;
+    }
+}
+export const draftsRoutes = async (fastify, opts) => {
+    fastify.get('/drafts/*', { preHandler: requireScope(opts.tokens, 'content') }, async (request, reply) => handleReadDraft(request, reply, opts.config));
+    fastify.put('/drafts/*', { preHandler: requireScope(opts.tokens, 'content'), config: WRITE_ROUTE_RATE_LIMIT }, async (request, reply) => handleSaveDraft(request, reply, opts.config, opts.theme.current.themeSchemas));
+    fastify.delete('/drafts/*', { preHandler: requireScope(opts.tokens, 'content'), config: WRITE_ROUTE_RATE_LIMIT }, async (request, reply) => handleDiscardDraft(request, reply, opts.config));
+};

package/dist/routes/git.d.ts

@@ -0,0 +1,8 @@
+import type { FastifyPluginAsync } from 'fastify';
+import type { SiteConfig } from '../config.ts';
+import type { TokenEntry } from '../server-config.ts';
+export interface GitRouteOptions {
+    config: SiteConfig;
+    tokens: TokenEntry[];
+}
+export declare const gitRoutes: FastifyPluginAsync<GitRouteOptions>;

package/dist/routes/git.js

@@ -0,0 +1,158 @@
+import { commitWorkingTreeChanges } from "../services/git-commit.js";
+import { GitShowError, getCommitLog, readFileAtRevision } from "../services/git-history.js";
+import { RevertError, revertPaths } from "../services/git-revert.js";
+import { isValidCommitAuthor, isValidGitRef } from "../services/git.js";
+import { mimeTypeFor } from "../services/mime-types.js";
+import { PathSafetyError } from "../services/path-safety.js";
+import { WRITE_ROUTE_RATE_LIMIT } from "../services/rate-limit-config.js";
+import { requireScope } from "../services/token-auth.js";
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.length > 0;
+}
+async function handleGitLog(request, reply, config) {
+    const { path, limit: rawLimit } = request.query;
+    let limit;
+    if (rawLimit !== undefined) {
+        const parsed = Number(rawLimit);
+        if (!Number.isInteger(parsed) || parsed < 1) {
+            reply.code(400).send({
+                statusCode: 400,
+                error: 'Bad Request',
+                message: '"limit" must be a positive integer',
+            });
+            return;
+        }
+        limit = parsed;
+    }
+    try {
+        const result = getCommitLog(config, { path, limit });
+        reply.send(result);
+    }
+    catch (error) {
+        // PathSafetyError has no .statusCode - left uncaught it falls
+        // through to the global handler's sanitised 500, the same gap
+        // every other route touching a :path already guards against.
+        if (error instanceof PathSafetyError) {
+            reply.code(404).send({ statusCode: 404, error: 'Not Found', message: 'No content at that path' });
+            return;
+        }
+        throw error;
+    }
+}
+async function handleGitShow(request, reply, config) {
+    const { ref } = request.params;
+    const relativePath = request.params['*'];
+    if (!isValidGitRef(ref)) {
+        reply.code(400).send({ statusCode: 400, error: 'Bad Request', message: `Invalid ref: "${ref}"` });
+        return;
+    }
+    try {
+        const content = readFileAtRevision(config, ref, relativePath);
+        reply.type(mimeTypeFor(relativePath)).send(content);
+    }
+    catch (error) {
+        if (error instanceof PathSafetyError) {
+            reply.code(404).send({ statusCode: 404, error: 'Not Found', message: 'No content at that path' });
+            return;
+        }
+        if (error instanceof GitShowError) {
+            // Two distinct codes, not collapsed to one 404: unlike public.ts's
+            // deliberate traversal-vs-miss collapse (justified there because
+            // that route is unauthenticated, where leaking which case
+            // occurred would aid enumeration), this route sits behind
+            // requireScope already - there's no equivalent risk, and
+            // collapsing here would only make an admin's diff/history UI
+            // worse for no security benefit.
+            const code = error.reason === 'invalid-ref' ? 400 : 404;
+            reply.code(code).send({
+                statusCode: code,
+                error: code === 400 ? 'Bad Request' : 'Not Found',
+                message: error.message,
+            });
+            return;
+        }
+        throw error;
+    }
+}
+function parseRevertBody(body) {
+    if (typeof body !== 'object' || body === null) {
+        return null;
+    }
+    const { ref, paths, message, author } = body;
+    if (!isNonEmptyString(ref)) {
+        return null;
+    }
+    if (!Array.isArray(paths) || paths.length === 0 || !paths.every(isNonEmptyString)) {
+        return null;
+    }
+    if (!isNonEmptyString(message) || !isValidCommitAuthor(author)) {
+        return null;
+    }
+    return { ref, paths, message, author };
+}
+async function handleGitRevert(request, reply, config) {
+    const parsed = parseRevertBody(request.body);
+    if (!parsed) {
+        reply.code(400).send({
+            statusCode: 400,
+            error: 'Bad Request',
+            message: 'Expected { ref: string, paths: string[], message: string, author: { name, email } }',
+        });
+        return;
+    }
+    try {
+        await revertPaths(config, parsed.ref, parsed.paths, parsed.message, parsed.author);
+        reply.send({ ok: true });
+    }
+    catch (error) {
+        if (error instanceof PathSafetyError) {
+            reply.code(404).send({ statusCode: 404, error: 'Not Found', message: 'No content at that path' });
+            return;
+        }
+        if (error instanceof RevertError) {
+            if (error.reason === 'invalid-ref') {
+                reply.code(400).send({ statusCode: 400, error: 'Bad Request', message: error.message });
+                return;
+            }
+            if (error.reason === 'path-not-found-at-ref') {
+                reply.code(404).send({ statusCode: 404, error: 'Not Found', message: error.message });
+                return;
+            }
+            // write-failed/commit-failed/rollback-failed: no client-side fix
+            // applies, fall through to the global handler's sanitised 500.
+        }
+        throw error;
+    }
+}
+function parseCommitBody(body) {
+    if (typeof body !== 'object' || body === null) {
+        return null;
+    }
+    const { message, author } = body;
+    if (!isNonEmptyString(message) || !isValidCommitAuthor(author)) {
+        return null;
+    }
+    return { message, author };
+}
+async function handleGitCommit(request, reply, config) {
+    const parsed = parseCommitBody(request.body);
+    if (!parsed) {
+        reply.code(400).send({
+            statusCode: 400,
+            error: 'Bad Request',
+            message: 'Expected { message: string, author: { name, email } }',
+        });
+        return;
+    }
+    // Any GitOperationError here is not caught - it rethrows to the
+    // global error handler's sanitised 500, same as every other route's
+    // uncaught commitPaths failure.
+    const result = await commitWorkingTreeChanges(config, parsed.message, parsed.author);
+    reply.send({ ok: true, committed: result === 'committed' });
+}
+export const gitRoutes = async (fastify, opts) => {
+    fastify.get('/git/log', { preHandler: requireScope(opts.tokens, 'content') }, async (request, reply) => handleGitLog(request, reply, opts.config));
+    fastify.get('/git/show/:ref/*', { preHandler: requireScope(opts.tokens, 'content') }, async (request, reply) => handleGitShow(request, reply, opts.config));
+    fastify.post('/git/revert', { preHandler: requireScope(opts.tokens, 'content'), config: WRITE_ROUTE_RATE_LIMIT }, async (request, reply) => handleGitRevert(request, reply, opts.config));
+    fastify.post('/git/commit', { preHandler: requireScope(opts.tokens, 'content'), config: WRITE_ROUTE_RATE_LIMIT }, async (request, reply) => handleGitCommit(request, reply, opts.config));
+};

package/dist/routes/index.d.ts

@@ -0,0 +1,12 @@
+import type { FastifyPluginAsync } from 'fastify';
+import type { SiteConfig } from '../config.ts';
+import type { TokenEntry } from '../server-config.ts';
+import type { ThemeState } from '../theme-state.ts';
+export interface V1RouteOptions {
+    config: SiteConfig;
+    theme: ThemeState;
+    tokens: TokenEntry[];
+    ipAllowlist: string[];
+    maxUploadBytes: number;
+}
+export declare const v1Routes: FastifyPluginAsync<V1RouteOptions>;

package/dist/routes/index.js

@@ -0,0 +1,86 @@
+import { batchRoutes } from "./batch.js";
+import { capabilitiesRoutes } from "./capabilities.js";
+import { contentRoutes } from "./content.js";
+import { draftsRoutes } from "./drafts.js";
+import { gitRoutes } from "./git.js";
+import { mediaRoutes } from "./media.js";
+import { menusRoutes } from "./menus.js";
+import { previewRevisionRoutes } from "./preview-revision.js";
+import { previewRoutes } from "./preview.js";
+import { publishRoutes } from "./publish.js";
+import { redirectsRoutes } from "./redirects.js";
+import { searchRoutes } from "./search.js";
+import { deletedPagesRoutes } from "./deleted-pages.js";
+import { linksRoutes } from "./links.js";
+import { settingsRoutes } from "./settings.js";
+import { themeRoutes } from "./theme.js";
+import { ipAllowlistGuard } from "../services/ip-allowlist.js";
+// The /v1 aggregator: buildServer registers this once with
+// { prefix: '/v1', ...V1RouteOptions }, and every route-group plugin
+// (capabilities.ts, preview.ts, and later content/drafts/publish/etc.)
+// registers itself here with a bare, unprefixed path. Each route-group
+// plugin is registered plainly (never wrapped in fastify-plugin's
+// fp()), so it keeps its own encapsulation scope - required for Group
+// B's auth preHandler hooks to gate only the routes that need them.
+// Plugins that don't need site data (capabilities.ts) simply ignore
+// the passed-through opts.
+export const v1Routes = async (fastify, opts) => {
+    // A coarse "is this client's network address allowed to talk to the
+    // API at all" gate, applied to the entire /v1 surface uniformly
+    // (including capabilities.ts and every GET route) - orthogonal to
+    // requireScope's per-route, per-scope exemptions. Added on this
+    // fastify instance (v1Routes's own parameter, never wrapped in fp())
+    // before any nested register() call, so it cascades to every plugin
+    // registered as a child below but never to publicRoutes/assetsRoutes
+    // (siblings registered directly on the root app, outside this
+    // encapsulation context) - verified with a real request, not just
+    // asserted.
+    fastify.addHook('onRequest', ipAllowlistGuard(opts.ipAllowlist));
+    fastify.register(capabilitiesRoutes, { maxUploadBytes: opts.maxUploadBytes });
+    // Fastify passes the *entire* options object a plugin was registered
+    // with - including `prefix` - through as this plugin's own second
+    // argument. Passing `opts` straight through to a nested register()
+    // call would carry that `prefix: '/v1'` along with it, double-
+    // applying the prefix (confirmed empirically: routes ended up
+    // registered at /v1/v1/preview/*). Re-pack only the site-data
+    // fields, never `opts` itself, for any nested plugin registration.
+    fastify.register(previewRoutes, {
+        config: opts.config,
+        theme: opts.theme,
+        tokens: opts.tokens,
+    });
+    fastify.register(previewRevisionRoutes, {
+        config: opts.config,
+        theme: opts.theme,
+        tokens: opts.tokens,
+    });
+    // contentRoutes needs no themeTemplates (it never renders anything),
+    // so it gets its own narrower options shape rather than the full
+    // bundle out of convenience - matching capabilities.ts's precedent
+    // of registering with only what it actually uses.
+    fastify.register(contentRoutes, { config: opts.config, tokens: opts.tokens });
+    fastify.register(draftsRoutes, {
+        config: opts.config,
+        theme: opts.theme,
+        tokens: opts.tokens,
+    });
+    fastify.register(publishRoutes, {
+        config: opts.config,
+        theme: opts.theme,
+        tokens: opts.tokens,
+    });
+    fastify.register(batchRoutes, {
+        config: opts.config,
+        theme: opts.theme,
+        tokens: opts.tokens,
+    });
+    fastify.register(gitRoutes, { config: opts.config, tokens: opts.tokens });
+    fastify.register(mediaRoutes, { config: opts.config, tokens: opts.tokens, maxUploadBytes: opts.maxUploadBytes });
+    fastify.register(searchRoutes, { config: opts.config, tokens: opts.tokens });
+    fastify.register(redirectsRoutes, { config: opts.config, tokens: opts.tokens });
+    fastify.register(menusRoutes, { config: opts.config, tokens: opts.tokens });
+    fastify.register(themeRoutes, { config: opts.config, theme: opts.theme, tokens: opts.tokens });
+    fastify.register(settingsRoutes, { config: opts.config, theme: opts.theme, tokens: opts.tokens });
+    fastify.register(linksRoutes, { config: opts.config, tokens: opts.tokens });
+    fastify.register(deletedPagesRoutes, { config: opts.config, tokens: opts.tokens });
+};

package/dist/routes/links.d.ts

@@ -0,0 +1,8 @@
+import type { FastifyPluginAsync } from 'fastify';
+import type { SiteConfig } from '../config.ts';
+import type { TokenEntry } from '../server-config.ts';
+export interface LinksRouteOptions {
+    config: SiteConfig;
+    tokens: TokenEntry[];
+}
+export declare const linksRoutes: FastifyPluginAsync<LinksRouteOptions>;

package/dist/routes/links.js

@@ -0,0 +1,18 @@
+import { findReferences, linkTarget } from "../services/links.js";
+import { requireScope } from "../services/token-auth.js";
+// GET /v1/links?to=/about: every page, draft, menu and the site settings
+// that link to that page - what the admin lists before a page is
+// deleted. `to` is only ever compared against links found in content,
+// never used as a file path. Found by reading the content each time
+// rather than kept in an index: always current, and cheap at a site's
+// size.
+export const linksRoutes = async (fastify, opts) => {
+    fastify.get('/links', { preHandler: requireScope(opts.tokens, 'content') }, async (request, reply) => {
+        const to = request.query.to;
+        if (typeof to !== 'string' || linkTarget(to) === null) {
+            reply.code(400).send({ statusCode: 400, error: 'Bad Request', message: 'Expected ?to=/a-page-path' });
+            return;
+        }
+        reply.send({ to: linkTarget(to), references: findReferences(opts.config, to) });
+    });
+};

package/dist/routes/media-public.d.ts

@@ -0,0 +1,11 @@
+import type { FastifyPluginAsync } from 'fastify';
+import type { SiteConfig } from '../config.ts';
+type ResolvedRange = {
+    start: number;
+    end: number;
+} | null | 'unsatisfiable';
+export declare function resolveRange(header: string | undefined, size: number): ResolvedRange;
+export declare const mediaPublicRoutes: FastifyPluginAsync<{
+    config: SiteConfig;
+}>;
+export {};