@minamocms/framework 0.0.0-stage → 0.10.1

package/dist/routes/media-public.js

@@ -0,0 +1,125 @@
+import { openLocalFsMediaDriver } from "../media/drivers/local-fs-driver.js";
+import { mimeTypeFor } from "../services/mime-types.js";
+export function resolveRange(header, size) {
+    if (header === undefined) {
+        return null;
+    }
+    const match = /^bytes=(\d*)-(\d*)$/.exec(header.trim());
+    if (!match) {
+        return null;
+    }
+    const [, rawStart, rawEnd] = match;
+    if (rawStart === '' && rawEnd === '') {
+        return null;
+    }
+    // "bytes=-500" means the LAST 500 bytes, not "from 0 to 500" - a
+    // classic misreading, and one that silently serves the wrong part of
+    // a file rather than failing.
+    if (rawStart === '') {
+        const suffixLength = Number(rawEnd);
+        if (suffixLength === 0) {
+            return 'unsatisfiable';
+        }
+        return { start: Math.max(0, size - suffixLength), end: size - 1 };
+    }
+    const start = Number(rawStart);
+    if (start >= size) {
+        return 'unsatisfiable';
+    }
+    // An end past the last byte is clamped, not rejected: browsers
+    // routinely ask for more than exists (e.g. bytes=0-999999 on a small
+    // file) and expect the server to simply return what it has.
+    const end = rawEnd === '' ? size - 1 : Math.min(Number(rawEnd), size - 1);
+    if (end < start) {
+        return 'unsatisfiable';
+    }
+    return { start, end };
+}
+async function handleMediaRequest(request, reply, config) {
+    const relativePath = request.params['*'];
+    // Never read: Fastify doesn't require query params to be declared or
+    // consumed, so a Shopify-style ?width=1500 suffix
+    // (docs/cms-build-plan.md's Phase 4) is automatically inert with no
+    // code needed to "ignore" it - this route is the MVP passthrough
+    // driver, real resizing is separately-scoped future work.
+    const bytes = await openLocalFsMediaDriver(config.mediaRoot).get(relativePath);
+    if (bytes === null) {
+        reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No media file at "${relativePath}"` });
+        return;
+    }
+    // nosniff: mimeTypeFor() falls back to application/octet-stream for
+    // anything outside its small known-extension table (uploads aren't
+    // restricted to that table, only to the images-only allowlist in
+    // media.ts), and without this header some browsers will still
+    // content-sniff an octet-stream response - the same stored-content
+    // risk class SVG rejection already exists to avoid for that specific
+    // case.
+    // Access-Control-Allow-Origin: * - same reasoning as assets.ts:
+    // fonts specifically enforce CORS unconditionally, and the admin's
+    // preview route proxies a site's HTML into its own origin (with a
+    // <base href> fix), making genuinely cross-origin browser requests
+    // for what looks like a same-origin path. Consistent with this
+    // route already being deliberately unauthenticated and public.
+    //
+    // Cache-Control: immutable, a full year - safe unconditionally
+    // because filenames are content-addressed (a hash of the file's own
+    // bytes, see media/filename.ts): a given URL's content can never
+    // change, so there is no invalidation case to ever design for here.
+    // Accept-Ranges on every media response, not just ranged ones - it is
+    // how a client learns ranges are available at all before asking.
+    //
+    // This matters far beyond scrubbing: Safari and iOS open a <video>
+    // with "Range: bytes=0-1" and will refuse to play at all if answered
+    // with a plain 200, so range support is what makes video work in
+    // those browsers rather than an optimisation. It also lets
+    // preload="metadata" fetch just the header instead of pulling the
+    // whole file down to read a duration.
+    //
+    // Sliced from the already-buffered read rather than streamed: the
+    // driver's own get() contract returns a whole Buffer (drivers/
+    // driver.ts) and assets.ts documents reply.send(stream) returning an
+    // empty body in this Fastify version, verified there with a minimal
+    // repro. With uploads capped (10MB by default) the memory held per
+    // request is bounded and no worse than this route's existing
+    // behaviour, so slicing buys correct semantics without taking on
+    // that risk or widening the driver interface a future object-storage
+    // driver would have to satisfy.
+    reply
+        .header('X-Content-Type-Options', 'nosniff')
+        .header('Access-Control-Allow-Origin', '*')
+        .header('Cache-Control', 'public, max-age=31536000, immutable')
+        .header('Accept-Ranges', 'bytes')
+        .type(mimeTypeFor(relativePath));
+    const range = resolveRange(request.headers.range, bytes.length);
+    if (range === 'unsatisfiable') {
+        // 416 carries its own required Content-Range naming the real size,
+        // which is how a client corrects itself rather than retrying blind.
+        reply.code(416).header('Content-Range', `bytes */${bytes.length}`).send();
+        return;
+    }
+    if (range !== null) {
+        const slice = bytes.subarray(range.start, range.end + 1);
+        reply
+            .code(206)
+            .header('Content-Range', `bytes ${range.start}-${range.end}/${bytes.length}`)
+            .header('Content-Length', slice.length)
+            .send(slice);
+        return;
+    }
+    reply.send(bytes);
+}
+// Deliberately and permanently unauthenticated, same reasoning as
+// assets.ts: uploaded media must be fetchable by any visitor's browser
+// without a token, same as the public website itself. Registered
+// without a /v1 prefix, directly on app in server.ts, alongside
+// assetsRoutes/publicRoutes.
+//
+// Reads go through MediaStorageDriver.get() rather than raw fs calls
+// (unlike assets.ts, which touches fs directly since theme assets are
+// always local) - the one deliberate deviation from assets.ts's own
+// shape, since a future object-storage driver needs this route to
+// stay storage-agnostic. sanitisePath is called inside the driver
+// itself (local-fs-driver.ts), not here - see that file's own comment.
+export const mediaPublicRoutes = async (fastify, opts) => {
+    fastify.get('/media/*', async (request, reply) => handleMediaRequest(request, reply, opts.config));
+};

package/dist/routes/media.d.ts

@@ -0,0 +1,9 @@
+import type { FastifyPluginAsync } from 'fastify';
+import type { SiteConfig } from '../config.ts';
+import type { TokenEntry } from '../server-config.ts';
+export interface MediaRouteOptions {
+    config: SiteConfig;
+    tokens: TokenEntry[];
+    maxUploadBytes: number;
+}
+export declare const mediaRoutes: FastifyPluginAsync<MediaRouteOptions>;

package/dist/routes/media.js

@@ -0,0 +1,80 @@
+import { extname } from 'node:path';
+import multipart from '@fastify/multipart';
+import { ALLOWED_UPLOAD_EXTENSIONS } from "../media/filename.js";
+import { ManageMediaError, deleteMedia, listMedia, putMedia } from "../media/manage-media.js";
+import { PathSafetyError } from "../services/path-safety.js";
+import { WRITE_ROUTE_RATE_LIMIT } from "../services/rate-limit-config.js";
+import { requireScope } from "../services/token-auth.js";
+function sendManageMediaError(reply, error) {
+    if (error.reason === 'not-found') {
+        reply.code(404).send({ statusCode: 404, error: 'Not Found', message: error.message });
+        return;
+    }
+    throw error;
+}
+async function handleListMedia(_request, reply, config) {
+    reply.send(await listMedia(config));
+}
+async function handleUploadMedia(request, reply, config) {
+    const data = await request.file();
+    if (!data) {
+        reply.code(400).send({ statusCode: 400, error: 'Bad Request', message: 'Expected a multipart file upload' });
+        return;
+    }
+    // Checked against the *original* uploaded filename, not the
+    // client-supplied mimetype header (trivially spoofable) and not the
+    // stored content-addressed filename (built only after this check
+    // passes, from the same already-validated extension).
+    const extension = extname(data.filename).toLowerCase();
+    if (!ALLOWED_UPLOAD_EXTENSIONS.has(extension)) {
+        reply.code(415).send({
+            statusCode: 415,
+            error: 'Unsupported Media Type',
+            message: `"${extension}" is not an accepted media type`,
+        });
+        return;
+    }
+    // No try/catch around toBuffer(): @fastify/multipart's own
+    // RequestFileTooLargeError already carries .statusCode = 413, so it
+    // passes straight through server.ts's existing global error handler
+    // unchanged - the same "just throw and let the existing handler map
+    // it" pattern already used for AuthError elsewhere. busboy enforces
+    // limits.fileSize *during* the stream (rejecting once the cap is
+    // hit, never silently truncating), not after buffering an unbounded
+    // body into memory first - this is what "capped at the stream
+    // level" actually means in practice.
+    const bytes = await data.toBuffer();
+    const result = await putMedia(config, data.filename, bytes);
+    reply.code(201).send(result);
+}
+async function handleDeleteMedia(request, reply, config) {
+    const filename = request.params['*'];
+    try {
+        await deleteMedia(config, filename);
+        reply.code(204).send();
+    }
+    catch (error) {
+        if (error instanceof PathSafetyError) {
+            reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No media file at "${filename}"` });
+            return;
+        }
+        if (error instanceof ManageMediaError) {
+            sendManageMediaError(reply, error);
+            return;
+        }
+        throw error;
+    }
+}
+export const mediaRoutes = async (fastify, opts) => {
+    // Registered inside this plugin's own encapsulation scope (media.ts
+    // is registered plainly, never wrapped in fastify-plugin's fp() -
+    // matching this codebase's house rule so Group B's auth preHandler
+    // hooks keep working), not globally in server.ts - confines the
+    // multipart content-type parser and .file()/.files() decorations to
+    // media routes only, leaving every other route file's default JSON
+    // body parsing completely untouched.
+    await fastify.register(multipart, { limits: { fileSize: opts.maxUploadBytes } });
+    fastify.get('/media', { preHandler: requireScope(opts.tokens, 'media') }, async (request, reply) => handleListMedia(request, reply, opts.config));
+    fastify.post('/media', { preHandler: requireScope(opts.tokens, 'media'), config: WRITE_ROUTE_RATE_LIMIT }, async (request, reply) => handleUploadMedia(request, reply, opts.config));
+    fastify.delete('/media/*', { preHandler: requireScope(opts.tokens, 'media'), config: WRITE_ROUTE_RATE_LIMIT }, async (request, reply) => handleDeleteMedia(request, reply, opts.config));
+};

package/dist/routes/menus.d.ts

@@ -0,0 +1,8 @@
+import type { FastifyPluginAsync } from 'fastify';
+import type { SiteConfig } from '../config.ts';
+import type { TokenEntry } from '../server-config.ts';
+export interface MenusRouteOptions {
+    config: SiteConfig;
+    tokens: TokenEntry[];
+}
+export declare const menusRoutes: FastifyPluginAsync<MenusRouteOptions>;

package/dist/routes/menus.js

@@ -0,0 +1,148 @@
+import { isValidCommitAuthor } from "../services/git.js";
+import { ManageMenuError, renameMenu, saveMenu } from "../services/manage-menus.js";
+import { findMenuReferences, isValidMenuHandle } from "../services/menu-references.js";
+import { PathSafetyError } from "../services/path-safety.js";
+import { WRITE_ROUTE_RATE_LIMIT } from "../services/rate-limit-config.js";
+import { requireScope } from "../services/token-auth.js";
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.length > 0;
+}
+// The body is wrapped ({ content, message, author }), not raw menu
+// content the way PUT /v1/drafts/:path is: unlike a draft save, this
+// commits immediately, so it needs the same message/author metadata
+// every other commit-creating write in this API takes in its body
+// (redirects, publish, delete, move) - a header-based convention would
+// be a new, inconsistent pattern for no reason.
+function parseSaveMenuBody(body) {
+    if (typeof body !== 'object' || body === null) {
+        return null;
+    }
+    const { content, message, author } = body;
+    if (content === undefined || !isNonEmptyString(message) || !isValidCommitAuthor(author)) {
+        return null;
+    }
+    return { content, message, author };
+}
+async function handleSaveMenu(request, reply, config) {
+    const relativePath = request.params['*'];
+    // A static per-request property (is the header present at all on
+    // *this* request), not shared mutable state - no TOCTOU risk in
+    // checking it here, before the queue, matching drafts.ts's own
+    // precedent exactly (the ETag comparison itself must happen inside
+    // the queued job, this presence check does not).
+    const ifMatch = request.headers['if-match'];
+    if (typeof ifMatch !== 'string' || ifMatch.length === 0) {
+        reply.code(428).send({
+            statusCode: 428,
+            error: 'Precondition Required',
+            message: 'An If-Match header is required to save a menu',
+        });
+        return;
+    }
+    const parsed = parseSaveMenuBody(request.body);
+    if (!parsed) {
+        reply.code(400).send({
+            statusCode: 400,
+            error: 'Bad Request',
+            message: 'Expected { content: object, message: string, author: { name, email } }',
+        });
+        return;
+    }
+    try {
+        const newEtag = await saveMenu(config, relativePath, parsed.content, ifMatch, parsed.message, parsed.author);
+        reply.header('etag', newEtag).send({ ok: true });
+    }
+    catch (error) {
+        if (error instanceof PathSafetyError) {
+            reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No menu at "${relativePath}"` });
+            return;
+        }
+        if (error instanceof ManageMenuError && error.reason === 'conflict') {
+            reply.code(409).send({ statusCode: 409, error: 'Conflict', message: error.message });
+            return;
+        }
+        if (error instanceof ManageMenuError && error.reason === 'validation-failed') {
+            reply.code(400).send({ statusCode: 400, error: 'Bad Request', message: error.message });
+            return;
+        }
+        throw error;
+    }
+}
+function parseRenameMenuBody(body) {
+    if (typeof body !== 'object' || body === null) {
+        return null;
+    }
+    const { from, to, message, author } = body;
+    if (!isNonEmptyString(from) || !isNonEmptyString(to) || !isNonEmptyString(message) || !isValidCommitAuthor(author)) {
+        return null;
+    }
+    return { from, to, message, author };
+}
+// Takes handles (what a layout writes: menus.<handle>.items), not file
+// paths - a rename can only ever move a menu within content/menus/.
+// If-Match is the menu's current etag, as for a save.
+async function handleRenameMenu(request, reply, config) {
+    const ifMatch = request.headers['if-match'];
+    if (typeof ifMatch !== 'string' || ifMatch.length === 0) {
+        reply.code(428).send({
+            statusCode: 428,
+            error: 'Precondition Required',
+            message: 'An If-Match header is required to rename a menu',
+        });
+        return;
+    }
+    const parsed = parseRenameMenuBody(request.body);
+    if (!parsed) {
+        reply.code(400).send({
+            statusCode: 400,
+            error: 'Bad Request',
+            message: 'Expected { from: string, to: string, message: string, author: { name, email } }',
+        });
+        return;
+    }
+    try {
+        const result = await renameMenu(config, parsed.from, parsed.to, ifMatch, parsed.message, parsed.author);
+        reply.header('etag', result.etag).send({ ok: true, staleThemeReferences: result.staleThemeReferences });
+    }
+    catch (error) {
+        if (error instanceof PathSafetyError) {
+            reply.code(400).send({ statusCode: 400, error: 'Bad Request', message: 'Not a valid menu handle' });
+            return;
+        }
+        if (error instanceof ManageMenuError && error.reason === 'not-found') {
+            reply.code(404).send({ statusCode: 404, error: 'Not Found', message: error.message });
+            return;
+        }
+        if (error instanceof ManageMenuError && error.reason === 'conflict') {
+            reply.code(409).send({ statusCode: 409, error: 'Conflict', message: error.message });
+            return;
+        }
+        if (error instanceof ManageMenuError && error.reason === 'validation-failed') {
+            reply.code(400).send({ statusCode: 400, error: 'Bad Request', message: error.message });
+            return;
+        }
+        throw error;
+    }
+}
+// Read-only and advisory: which theme files mention a handle, so the
+// admin can warn before a rename or delete empties a nav.
+function handleMenuReferences(request, reply, config) {
+    const handle = request.query.handle;
+    if (typeof handle !== 'string' || !isValidMenuHandle(handle)) {
+        reply.code(400).send({ statusCode: 400, error: 'Bad Request', message: 'Expected ?handle=<menu handle>' });
+        return;
+    }
+    reply.send({ handle, themeFiles: findMenuReferences(config, handle) });
+}
+// GET/DELETE/move for menus/ paths deliberately stay on the existing
+// generic /v1/content routes (Group N) - only this write path is new.
+// Its own namespace (/v1/menus, not wedged into /v1/content), matching
+// how redirects got /v1/redirects rather than overloading /v1/content
+// with type-conditional write behaviour.
+export const menusRoutes = async (fastify, opts) => {
+    fastify.put('/menus/*', { preHandler: requireScope(opts.tokens, 'content'), config: WRITE_ROUTE_RATE_LIMIT }, async (request, reply) => handleSaveMenu(request, reply, opts.config));
+    // Static paths, distinct from PUT /menus/* by method (POST/GET), the
+    // same way POST /content/move sits beside DELETE /content/*.
+    fastify.post('/menus/rename', { preHandler: requireScope(opts.tokens, 'content'), config: WRITE_ROUTE_RATE_LIMIT }, async (request, reply) => handleRenameMenu(request, reply, opts.config));
+    fastify.get('/menus/references', { preHandler: requireScope(opts.tokens, 'content') }, async (request, reply) => handleMenuReferences(request, reply, opts.config));
+};

package/dist/routes/preview-revision.d.ts

@@ -0,0 +1,10 @@
+import type { FastifyPluginAsync } from 'fastify';
+import type { SiteConfig } from '../config.ts';
+import type { ThemeState } from '../theme-state.ts';
+import type { TokenEntry } from '../server-config.ts';
+export interface PreviewRevisionRouteOptions {
+    config: SiteConfig;
+    theme: ThemeState;
+    tokens: TokenEntry[];
+}
+export declare const previewRevisionRoutes: FastifyPluginAsync<PreviewRevisionRouteOptions>;

package/dist/routes/preview-revision.js

@@ -0,0 +1,96 @@
+import { join } from 'node:path';
+import { PageRenderError, parsePageContent, renderLoadedPage } from "../renderer/render-page.js";
+import { GitShowError, readFileAtRevision } from "../services/git-history.js";
+import { isValidGitRef } from "../services/git.js";
+import { PathSafetyError } from "../services/path-safety.js";
+import { requireScope } from "../services/token-auth.js";
+import { urlToPagePath } from "../services/urls.js";
+import { resolveSiteSettings } from "../services/site-settings.js";
+// A dedicated top-level route rather than nesting under /preview/*
+// (e.g. /preview/:ref/*): page URLs can be arbitrarily nested
+// (E1 - content/pages/about/team.json resolves at /about/team), so a
+// parametric+wildcard sibling registered under the same prefix as the
+// existing bare /preview/* wildcard would make any multi-segment
+// preview URL genuinely ambiguous between "page team under about" and
+// "ref=about, page /team". Keeping this on its own /preview-revision
+// prefix, a sibling of /preview rather than nested inside it, avoids
+// that collision entirely - the same shape /git/show/:ref/* already
+// uses alongside /preview/*.
+//
+// readFileAtRevision resolves paths relative to config.siteRoot, not
+// config.contentRoot (confirmed by git-history.ts/git.test.ts's own
+// "content/pages/about.json" usage) - so unlike preview.ts's
+// toRenderPath (contentRoot-relative), the path built here is prefixed
+// with "content/".
+function toRevisionPath(pagesRelativePath) {
+    return join('content', 'pages', pagesRelativePath);
+}
+async function handlePreviewRevisionRequest(request, reply, config, themeTemplates, layouts, engine, themeSchemas) {
+    const { ref } = request.params;
+    const url = `/${request.params['*']}`;
+    if (!isValidGitRef(ref)) {
+        reply.code(400).send({ statusCode: 400, error: 'Bad Request', message: `Invalid ref: "${ref}"` });
+        return;
+    }
+    try {
+        const repoRelativePath = toRevisionPath(urlToPagePath(url));
+        const raw = readFileAtRevision(config, ref, repoRelativePath);
+        const page = parsePageContent(raw.toString('utf-8'));
+        // Today's site settings, as with menus: only the page itself is
+        // shown as it was at that revision.
+        const html = await renderLoadedPage(page, config, themeTemplates, layouts, engine, resolveSiteSettings(config, themeSchemas));
+        reply.type('text/html; charset=utf-8').send(html);
+    }
+    catch (error) {
+        if (error instanceof PathSafetyError) {
+            reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No page at "${url}"` });
+            return;
+        }
+        if (error instanceof GitShowError) {
+            const code = error.reason === 'invalid-ref' ? 400 : 404;
+            reply.code(code).send({
+                statusCode: code,
+                error: code === 400 ? 'Bad Request' : 'Not Found',
+                message: error.message,
+            });
+            return;
+        }
+        if (error instanceof SyntaxError) {
+            reply.code(404).send({
+                statusCode: 404,
+                error: 'Not Found',
+                message: `No renderable page at "${url}" at revision "${ref}"`,
+            });
+            return;
+        }
+        if (error instanceof PageRenderError) {
+            if (error.reason === 'page-not-found') {
+                reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No page at "${url}"` });
+                return;
+            }
+            // missing-section-type/missing-block-type/missing-layout/
+            // template-error: a deliberate divergence from preview.ts and
+            // public.ts, which let these reasons bubble to an uncaught 500.
+            // For those routes, a broken theme/content combination reachable
+            // today is genuinely an operational bug worth alerting on. Here,
+            // "today's theme doesn't have a section type this old revision
+            // used" is an expected, user-facing outcome (themes/layouts/menus
+            // are never revision-pinned, only the page body is - see
+            // render-page.ts's renderLoadedPage comment), not a bug - the
+            // admin needs a stable 4xx it can catch and turn into "this
+            // revision can't be previewed with the current theme" copy,
+            // not a raw 500.
+            reply.code(422).send({
+                statusCode: 422,
+                error: 'Unprocessable Entity',
+                message: error.message,
+                reason: error.reason,
+            });
+            return;
+        }
+        throw error;
+    }
+}
+export const previewRevisionRoutes = async (fastify, opts) => {
+    fastify.get('/preview-revision/:ref/*', { preHandler: requireScope(opts.tokens, 'content') }, async (request, reply) => handlePreviewRevisionRequest(request, reply, opts.config, opts.theme.current.themeTemplates, opts.theme.current.layouts, opts.theme.current.engine, opts.theme.current.themeSchemas));
+};

package/dist/routes/preview.d.ts

@@ -0,0 +1,10 @@
+import type { FastifyPluginAsync } from 'fastify';
+import type { SiteConfig } from '../config.ts';
+import type { ThemeState } from '../theme-state.ts';
+import type { TokenEntry } from '../server-config.ts';
+export interface PreviewRouteOptions {
+    config: SiteConfig;
+    theme: ThemeState;
+    tokens: TokenEntry[];
+}
+export declare const previewRoutes: FastifyPluginAsync<PreviewRouteOptions>;

package/dist/routes/preview.js

@@ -0,0 +1,56 @@
+import { join } from 'node:path';
+import { PageRenderError, renderPage } from "../renderer/render-page.js";
+import { PathSafetyError } from "../services/path-safety.js";
+import { requireScope } from "../services/token-auth.js";
+import { urlToPagePath } from "../services/urls.js";
+import { resolveSiteSettings, resolveSiteSettingsFrom } from "../services/site-settings.js";
+import { validateSiteSettings } from "../services/validation.js";
+// Same pagesRoot/contentRoot seam as public.ts - see that file's
+// toRenderPath comment. Preview never consults redirects.json:
+// redirects are a public-URL concept, and an editor previewing a
+// specific page path isn't redirected.
+function toRenderPath(pagesRelativePath) {
+    return join('pages', pagesRelativePath);
+}
+// ?settings=<JSON>: site settings an editor has changed in the admin but
+// not saved, so the preview shows them before they go live. Never
+// written anywhere. Values the theme's schema rejects (or that aren't
+// JSON) are ignored and the saved settings used, the same as no query:
+// a half-typed value must never break the preview.
+function previewSiteSettings(query, config, themeSchemas) {
+    const raw = query?.settings;
+    if (typeof raw === 'string') {
+        try {
+            const given = JSON.parse(raw);
+            if (validateSiteSettings(given, themeSchemas).valid) {
+                return resolveSiteSettingsFrom(given, themeSchemas);
+            }
+        }
+        catch {
+            // Not JSON: fall through to the saved settings.
+        }
+    }
+    return resolveSiteSettings(config, themeSchemas);
+}
+async function handlePreviewRequest(request, reply, config, themeTemplates, layouts, engine, themeSchemas) {
+    const url = `/${request.params['*']}`;
+    try {
+        const relativePath = urlToPagePath(url);
+        const html = await renderPage(config, themeTemplates, layouts, engine, toRenderPath(relativePath), 'preview', previewSiteSettings(request.query, config, themeSchemas));
+        reply.type('text/html; charset=utf-8').send(html);
+    }
+    catch (error) {
+        if (error instanceof PathSafetyError) {
+            reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No page at "${url}"` });
+            return;
+        }
+        if (error instanceof PageRenderError && error.reason === 'page-not-found') {
+            reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No page at "${url}"` });
+            return;
+        }
+        throw error;
+    }
+}
+export const previewRoutes = async (fastify, opts) => {
+    fastify.get('/preview/*', { preHandler: requireScope(opts.tokens, 'content') }, async (request, reply) => handlePreviewRequest(request, reply, opts.config, opts.theme.current.themeTemplates, opts.theme.current.layouts, opts.theme.current.engine, opts.theme.current.themeSchemas));
+};

package/dist/routes/public.d.ts

@@ -0,0 +1,10 @@
+import type { FastifyPluginAsync } from 'fastify';
+import type { SiteConfig } from '../config.ts';
+import type { RenderCache } from '../renderer/render-cache.ts';
+import type { ThemeState } from '../theme-state.ts';
+export interface PublicRouteOptions {
+    config: SiteConfig;
+    theme: ThemeState;
+    renderCache: RenderCache;
+}
+export declare const publicRoutes: FastifyPluginAsync<PublicRouteOptions>;