@minamocms/framework 0.0.0-stage → 0.10.2

package/dist/routes/public.js

@@ -0,0 +1,123 @@
+import { join } from 'node:path';
+import { getMenusMtimeMs, getPageMtimeMs, PageRenderError, renderPage } from "../renderer/render-page.js";
+import { PathSafetyError } from "../services/path-safety.js";
+import { resolveUrl } from "../services/resolve-url.js";
+import { findStaticFile, sendStaticFile } from "../services/static-file.js";
+import { resolveSiteSettings } from "../services/site-settings.js";
+// resolveUrl's relativePath is relative to pagesRoot (e.g. "about.json"),
+// but renderPage's relativePath is relative to contentRoot/draftsRoot
+// directly (e.g. "pages/about.json") - two already-correct modules with
+// two different conventions for the same string. This is the seam
+// between them, not an arbitrary literal.
+function toRenderPath(pagesRelativePath) {
+    return join('pages', pagesRelativePath);
+}
+// A themed 404: content/pages/404.json, if it exists and is published,
+// is rendered through the ordinary public renderPage pipeline (layout +
+// sections + blocks, same as any other page) - no special-casing in
+// render-page.ts itself, no separate "is this the 404 page" concept.
+// The HTTP status is always 404 regardless, even though the body is a
+// full HTML page. Any failure at all while attempting this - no
+// 404.json, it's unpublished, or its own theme is broken - falls back
+// to today's plain JSON error rather than ever turning a 404 into a
+// 500 for a visitor who was already looking at a missing page.
+async function sendNotFound(reply, config, themeTemplates, layouts, engine, url, themeSchemas) {
+    try {
+        const html = await renderPage(config, themeTemplates, layouts, engine, toRenderPath('404.json'), 'public', resolveSiteSettings(config, themeSchemas));
+        reply.code(404).type('text/html; charset=utf-8').send(html);
+    }
+    catch {
+        reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No page at "${url}"` });
+    }
+}
+async function handlePublicRequest(request, reply, config, themeTemplates, layouts, engine, renderCache, 
+// Which theme rendered a cached page: one pushed since makes it stale.
+themeGeneration, themeSchemas) {
+    // The public catch-all is registered without a /v1 prefix alongside
+    // v1Routes (which has its own exact/prefixed routes). Fastify's
+    // router already prefers exact matches over this wildcard regardless
+    // of registration order, but an *unmatched* /v1/* path would
+    // otherwise fall through to here and get treated as a page lookup
+    // instead of Fastify's real 404 - this guard is what actually keeps
+    // A4 true for any future typo'd or removed /v1/* route, not
+    // registration order.
+    if (request.url === '/v1' || request.url.startsWith('/v1/')) {
+        return reply.callNotFound();
+    }
+    // theme/root/ mirrors arbitrary bare paths (robots.txt, .well-known/*)
+    // at the site root, checked before page resolution - unlike /assets/
+    // or /media/, these aren't distinguishable by a fixed prefix, so
+    // Fastify's own "specific route beats /*" behaviour can't do this for
+    // us automatically. A miss (including the bare "/" itself - a
+    // directory, never a file) falls straight through to the existing
+    // page-lookup logic below, unchanged.
+    const rootMirrorMatch = findStaticFile(config.rootMirrorRoot, request.params['*']);
+    if (rootMirrorMatch) {
+        sendStaticFile(reply, rootMirrorMatch);
+        return;
+    }
+    const url = `/${request.params['*']}`;
+    try {
+        const resolved = resolveUrl(config, url);
+        if (resolved.kind === 'not-found') {
+            await sendNotFound(reply, config, themeTemplates, layouts, engine, url, themeSchemas);
+            return;
+        }
+        if (resolved.kind === 'redirect') {
+            reply.code(301).header('location', resolved.to).send();
+            return;
+        }
+        const renderPath = toRenderPath(resolved.relativePath);
+        // Validated against real filesystem state, not invalidated by
+        // hooking every write path (publish/unpublish/delete/move/batch) -
+        // see render-cache.ts's own comment for why. pageMtimeMs is null
+        // only if the file vanished between resolveUrl confirming it
+        // exists and this check (vanishingly unlikely) - falls through to
+        // an ordinary uncached render rather than treating that as
+        // fatal.
+        const pageMtimeMs = getPageMtimeMs(config, renderPath);
+        if (pageMtimeMs !== null) {
+            const menusMtimeMs = getMenusMtimeMs(config);
+            const cached = renderCache.get(renderPath);
+            if (cached &&
+                cached.pageMtimeMs === pageMtimeMs &&
+                cached.menusMtimeMs === menusMtimeMs &&
+                cached.themeGeneration === themeGeneration) {
+                reply.type('text/html; charset=utf-8').send(cached.html);
+                return;
+            }
+            const html = await renderPage(config, themeTemplates, layouts, engine, renderPath, 'public', resolveSiteSettings(config, themeSchemas));
+            renderCache.set(renderPath, { html, pageMtimeMs, menusMtimeMs, themeGeneration });
+            reply.type('text/html; charset=utf-8').send(html);
+            return;
+        }
+        const html = await renderPage(config, themeTemplates, layouts, engine, renderPath, 'public', resolveSiteSettings(config, themeSchemas));
+        reply.type('text/html; charset=utf-8').send(html);
+    }
+    catch (error) {
+        // A traversal attempt and an ordinary miss get the identical 404 -
+        // deliberately not 400, so a public, unauthenticated route never
+        // gives an attacker a signal that distinguishes the two.
+        if (error instanceof PathSafetyError) {
+            await sendNotFound(reply, config, themeTemplates, layouts, engine, url, themeSchemas);
+            return;
+        }
+        if (error instanceof PageRenderError && error.reason === 'page-not-found') {
+            await sendNotFound(reply, config, themeTemplates, layouts, engine, url, themeSchemas);
+            return;
+        }
+        // Any other PageRenderError reason (missing-section-type,
+        // missing-block-type, template-error) is a broken theme/content
+        // problem, not something to explain to a public visitor - rethrow
+        // and let the global error handler sanitise it as a 500 (A5).
+        throw error;
+    }
+}
+export const publicRoutes = async (fastify, opts) => {
+    fastify.get('/*', async (request, reply) => {
+        // Read once per request: a theme pushed mid-request applies to the
+        // next one, never half of this one.
+        const theme = opts.theme.current;
+        return handlePublicRequest(request, reply, opts.config, theme.themeTemplates, theme.layouts, theme.engine, opts.renderCache, theme.generation, theme.themeSchemas);
+    });
+};

package/dist/routes/publish.d.ts

@@ -0,0 +1,10 @@
+import type { FastifyPluginAsync } from 'fastify';
+import type { SiteConfig } from '../config.ts';
+import type { ThemeState } from '../theme-state.ts';
+import type { TokenEntry } from '../server-config.ts';
+export interface PublishRouteOptions {
+    config: SiteConfig;
+    theme: ThemeState;
+    tokens: TokenEntry[];
+}
+export declare const publishRoutes: FastifyPluginAsync<PublishRouteOptions>;

package/dist/routes/publish.js

@@ -0,0 +1,139 @@
+import { isValidCommitAuthor } from "../services/git.js";
+import { PathSafetyError } from "../services/path-safety.js";
+import { WRITE_ROUTE_RATE_LIMIT } from "../services/rate-limit-config.js";
+import { PublishError, publishDrafts, publishPage, unpublishPage } from "../services/publish.js";
+import { requireScope } from "../services/token-auth.js";
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.length > 0;
+}
+function parsePublishBody(body) {
+    if (typeof body !== 'object' || body === null) {
+        return null;
+    }
+    const { paths, message, author } = body;
+    if (!Array.isArray(paths) || paths.length === 0 || !paths.every(isNonEmptyString)) {
+        return null;
+    }
+    if (!isNonEmptyString(message) || !isValidCommitAuthor(author)) {
+        return null;
+    }
+    return { paths, message, author };
+}
+function parsePublishedFlagBody(body) {
+    if (typeof body !== 'object' || body === null) {
+        return null;
+    }
+    const { message, author } = body;
+    if (!isNonEmptyString(message) || !isValidCommitAuthor(author)) {
+        return null;
+    }
+    return { message, author };
+}
+// Shared by both handlers below: each only ever sees the subset of
+// reasons its own service function can actually throw.
+function replyForPublishError(reply, error) {
+    if (error.reason === 'validation-failed' || error.reason === 'duplicate-path') {
+        reply.code(400).send({ statusCode: 400, error: 'Bad Request', message: error.message });
+        return;
+    }
+    if (error.reason === 'draft-not-found' || error.reason === 'page-not-found') {
+        reply.code(404).send({ statusCode: 404, error: 'Not Found', message: error.message });
+        return;
+    }
+    throw error;
+}
+export const publishRoutes = async (fastify, opts) => {
+    fastify.post('/publish', { preHandler: requireScope(opts.tokens, 'content'), config: WRITE_ROUTE_RATE_LIMIT }, async (request, reply) => {
+        const parsed = parsePublishBody(request.body);
+        if (!parsed) {
+            reply.code(400).send({
+                statusCode: 400,
+                error: 'Bad Request',
+                message: 'Expected { paths: string[], message: string, author: { name, email } }',
+            });
+            return;
+        }
+        try {
+            await publishDrafts(opts.config, opts.theme.current.themeSchemas, parsed.paths, parsed.message, parsed.author);
+            reply.send({ ok: true });
+        }
+        catch (error) {
+            // PathSafetyError has no .statusCode - left uncaught it falls
+            // through to the global handler's sanitised 500, the same gap
+            // every other route touching a :path already guards against.
+            if (error instanceof PathSafetyError) {
+                reply.code(404).send({ statusCode: 404, error: 'Not Found', message: 'No content at that path' });
+                return;
+            }
+            if (error instanceof PublishError) {
+                replyForPublishError(reply, error);
+                return;
+            }
+            throw error;
+        }
+    });
+    fastify.post('/unpublish/*', { preHandler: requireScope(opts.tokens, 'content'), config: WRITE_ROUTE_RATE_LIMIT }, async (request, reply) => {
+        const parsed = parsePublishedFlagBody(request.body);
+        if (!parsed) {
+            reply.code(400).send({
+                statusCode: 400,
+                error: 'Bad Request',
+                message: 'Expected { message: string, author: { name, email } }',
+            });
+            return;
+        }
+        const relativePath = request.params['*'];
+        try {
+            await unpublishPage(opts.config, relativePath, parsed.message, parsed.author);
+            reply.send({ ok: true });
+        }
+        catch (error) {
+            // PathSafetyError has no .statusCode - left uncaught it falls
+            // through to the global handler's sanitised 500, the same gap
+            // every other route touching a :path already guards against.
+            if (error instanceof PathSafetyError) {
+                reply.code(404).send({ statusCode: 404, error: 'Not Found', message: 'No content at that path' });
+                return;
+            }
+            if (error instanceof PublishError) {
+                replyForPublishError(reply, error);
+                return;
+            }
+            throw error;
+        }
+    });
+    // The twin of /unpublish/* above: sets published:true on a live page
+    // in place and commits. Deliberately separate from /publish, which
+    // promotes drafts - a page that is live but unpublished has no draft
+    // to promote, so /publish cannot reach it at all (draft-not-found),
+    // and promoting a draft would publish every pending edit along with
+    // the flag. This only ever changes the one boolean.
+    fastify.post('/publish-page/*', { preHandler: requireScope(opts.tokens, 'content'), config: WRITE_ROUTE_RATE_LIMIT }, async (request, reply) => {
+        const parsed = parsePublishedFlagBody(request.body);
+        if (!parsed) {
+            reply.code(400).send({
+                statusCode: 400,
+                error: 'Bad Request',
+                message: 'Expected { message: string, author: { name, email } }',
+            });
+            return;
+        }
+        const relativePath = request.params['*'];
+        try {
+            await publishPage(opts.config, relativePath, parsed.message, parsed.author);
+            reply.send({ ok: true });
+        }
+        catch (error) {
+            // Same PathSafetyError guard as every other :path route here.
+            if (error instanceof PathSafetyError) {
+                reply.code(404).send({ statusCode: 404, error: 'Not Found', message: 'No content at that path' });
+                return;
+            }
+            if (error instanceof PublishError) {
+                replyForPublishError(reply, error);
+                return;
+            }
+            throw error;
+        }
+    });
+};

package/dist/routes/redirects.d.ts

@@ -0,0 +1,8 @@
+import type { FastifyPluginAsync } from 'fastify';
+import type { SiteConfig } from '../config.ts';
+import type { TokenEntry } from '../server-config.ts';
+export interface RedirectsRouteOptions {
+    config: SiteConfig;
+    tokens: TokenEntry[];
+}
+export declare const redirectsRoutes: FastifyPluginAsync<RedirectsRouteOptions>;

package/dist/routes/redirects.js

@@ -0,0 +1,132 @@
+import { isValidCommitAuthor } from "../services/git.js";
+import { ManageRedirectError, createRedirect, deleteRedirect, updateRedirect } from "../services/manage-redirects.js";
+import { loadRedirects } from "../services/redirects.js";
+import { WRITE_ROUTE_RATE_LIMIT } from "../services/rate-limit-config.js";
+import { requireScope } from "../services/token-auth.js";
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.length > 0;
+}
+function parseUpsertRedirectBody(body) {
+    if (typeof body !== 'object' || body === null) {
+        return null;
+    }
+    const { from, to, note, message, author } = body;
+    if (!isNonEmptyString(from) || !isNonEmptyString(to)) {
+        return null;
+    }
+    if (note !== undefined && typeof note !== 'string') {
+        return null;
+    }
+    if (!isNonEmptyString(message) || !isValidCommitAuthor(author)) {
+        return null;
+    }
+    return { from, to, note, message, author };
+}
+function parseDeleteRedirectBody(body) {
+    if (typeof body !== 'object' || body === null) {
+        return null;
+    }
+    const { from, message, author } = body;
+    if (!isNonEmptyString(from) || !isNonEmptyString(message) || !isValidCommitAuthor(author)) {
+        return null;
+    }
+    return { from, message, author };
+}
+function sendManageRedirectError(reply, error) {
+    if (error.reason === 'invalid-from' || error.reason === 'invalid-target' || error.reason === 'redirect-cycle') {
+        reply.code(400).send({ statusCode: 400, error: 'Bad Request', message: error.message });
+        return;
+    }
+    if (error.reason === 'not-found') {
+        reply.code(404).send({ statusCode: 404, error: 'Not Found', message: error.message });
+        return;
+    }
+    if (error.reason === 'already-exists' || error.reason === 'live-content-exists') {
+        reply.code(409).send({ statusCode: 409, error: 'Conflict', message: error.message });
+        return;
+    }
+    throw error;
+}
+async function handleListRedirects(_request, reply, config) {
+    reply.send(loadRedirects(config));
+}
+async function handleCreateRedirect(request, reply, config) {
+    const parsed = parseUpsertRedirectBody(request.body);
+    if (!parsed) {
+        reply.code(400).send({
+            statusCode: 400,
+            error: 'Bad Request',
+            message: 'Expected { from: string, to: string, note?: string, message: string, author: { name, email } }',
+        });
+        return;
+    }
+    try {
+        const result = await createRedirect(config, parsed.from, parsed.to, parsed.note, parsed.message, parsed.author);
+        reply.send(result);
+    }
+    catch (error) {
+        if (error instanceof ManageRedirectError) {
+            sendManageRedirectError(reply, error);
+            return;
+        }
+        throw error;
+    }
+}
+async function handleUpdateRedirect(request, reply, config) {
+    const parsed = parseUpsertRedirectBody(request.body);
+    if (!parsed) {
+        reply.code(400).send({
+            statusCode: 400,
+            error: 'Bad Request',
+            message: 'Expected { from: string, to: string, note?: string, message: string, author: { name, email } }',
+        });
+        return;
+    }
+    try {
+        const result = await updateRedirect(config, parsed.from, parsed.to, parsed.note, parsed.message, parsed.author);
+        reply.send(result);
+    }
+    catch (error) {
+        if (error instanceof ManageRedirectError) {
+            sendManageRedirectError(reply, error);
+            return;
+        }
+        throw error;
+    }
+}
+async function handleDeleteRedirect(request, reply, config) {
+    const parsed = parseDeleteRedirectBody(request.body);
+    if (!parsed) {
+        reply.code(400).send({
+            statusCode: 400,
+            error: 'Bad Request',
+            message: 'Expected { from: string, message: string, author: { name, email } }',
+        });
+        return;
+    }
+    try {
+        await deleteRedirect(config, parsed.from, parsed.message, parsed.author);
+        reply.code(204).send();
+    }
+    catch (error) {
+        if (error instanceof ManageRedirectError) {
+            sendManageRedirectError(reply, error);
+            return;
+        }
+        throw error;
+    }
+}
+// from/to are always taken from the JSON body, never a URL path
+// segment: they are arbitrary public URLs that may contain slashes,
+// and critically none of these operations address a filesystem path
+// at all (this mutates one entry inside redirects.json, not a file at
+// a client-supplied path) - sanitisePath/path-traversal simply doesn't
+// apply here, matching POST /content/move's existing body-carries-the-
+// identity precedent rather than forcing an arbitrary URL into a route
+// segment.
+export const redirectsRoutes = async (fastify, opts) => {
+    fastify.get('/redirects', { preHandler: requireScope(opts.tokens, 'content') }, async (request, reply) => handleListRedirects(request, reply, opts.config));
+    fastify.post('/redirects', { preHandler: requireScope(opts.tokens, 'content'), config: WRITE_ROUTE_RATE_LIMIT }, async (request, reply) => handleCreateRedirect(request, reply, opts.config));
+    fastify.put('/redirects', { preHandler: requireScope(opts.tokens, 'content'), config: WRITE_ROUTE_RATE_LIMIT }, async (request, reply) => handleUpdateRedirect(request, reply, opts.config));
+    fastify.delete('/redirects', { preHandler: requireScope(opts.tokens, 'content'), config: WRITE_ROUTE_RATE_LIMIT }, async (request, reply) => handleDeleteRedirect(request, reply, opts.config));
+};

package/dist/routes/search-public.d.ts

@@ -0,0 +1,6 @@
+import type { FastifyPluginAsync } from 'fastify';
+import type { SiteConfig } from '../config.ts';
+export interface SearchPublicRouteOptions {
+    config: SiteConfig;
+}
+export declare const searchPublicRoutes: FastifyPluginAsync<SearchPublicRouteOptions>;

package/dist/routes/search-public.js

@@ -0,0 +1,104 @@
+import { queryContent } from "../search/query-content.js";
+import { NO_AUTH_ROUTE_RATE_LIMIT } from "../services/rate-limit-config.js";
+const FIELD_OPS = ['eq', 'gt', 'gte', 'lt', 'lte'];
+const DEFAULT_LIMIT = 20;
+const MAX_LIMIT = 100;
+function badRequest(reply, message) {
+    reply.code(400).send({ statusCode: 400, error: 'Bad Request', message });
+}
+// field:value (op implied "eq") or field:op:value. Split on the FIRST
+// colon, then check whether the next segment up to a second colon is
+// one of the known op words - a value that itself contains a colon
+// (unlikely for the fields this targets, but not impossible) still
+// parses correctly either way, since only a genuine, recognised op
+// token is ever treated as one.
+function parseFilter(raw) {
+    const firstColon = raw.indexOf(':');
+    if (firstColon <= 0) {
+        return undefined;
+    }
+    const field = raw.slice(0, firstColon);
+    const rest = raw.slice(firstColon + 1);
+    const secondColon = rest.indexOf(':');
+    if (secondColon !== -1) {
+        const maybeOp = rest.slice(0, secondColon);
+        if (FIELD_OPS.includes(maybeOp)) {
+            const value = rest.slice(secondColon + 1);
+            return value === '' ? undefined : { field, op: maybeOp, value };
+        }
+    }
+    return rest === '' ? undefined : { field, op: 'eq', value: rest };
+}
+function parseSort(raw) {
+    return raw.startsWith('-') ? { field: raw.slice(1), direction: 'desc' } : { field: raw, direction: 'asc' };
+}
+function parseLimit(raw) {
+    if (raw === undefined) {
+        return DEFAULT_LIMIT;
+    }
+    const parsed = Number.parseInt(raw, 10);
+    if (!Number.isFinite(parsed) || parsed < 1) {
+        return DEFAULT_LIMIT;
+    }
+    return Math.min(parsed, MAX_LIMIT);
+}
+function parseOffset(raw) {
+    if (raw === undefined) {
+        return 0;
+    }
+    const parsed = Number.parseInt(raw, 10);
+    return Number.isFinite(parsed) && parsed >= 0 ? parsed : 0;
+}
+async function handleSearch(request, reply, config) {
+    const { q, pageType, sort } = request.query;
+    const rawFilters = request.query.filter;
+    const filterStrings = rawFilters === undefined ? [] : Array.isArray(rawFilters) ? rawFilters : [rawFilters];
+    const filters = [];
+    for (const raw of filterStrings) {
+        const parsed = parseFilter(raw);
+        if (!parsed) {
+            badRequest(reply, `invalid filter "${raw}" - expected field:value or field:op:value`);
+            return;
+        }
+        if (parsed.op !== 'eq' && !Number.isFinite(Number(parsed.value))) {
+            badRequest(reply, `value must be numeric for op "${parsed.op}" (filter "${raw}")`);
+            return;
+        }
+        filters.push(parsed);
+    }
+    const response = queryContent(config.searchIndexPath, {
+        q,
+        pageType,
+        filters,
+        sort: sort ? parseSort(sort) : undefined,
+        limit: parseLimit(request.query.limit),
+        offset: parseOffset(request.query.offset),
+    });
+    reply.send(response);
+}
+// The one public query surface - full-text (q), structured filters,
+// sort, and pagination all in one endpoint (query-content.ts's own
+// queryContent), rather than three narrow ones. Deliberately no
+// requireScope, unlike every other route in this codebase: it's
+// read-only and can only ever surface already-published data
+// (rebuild-index.ts never indexes drafts or unpublished content), so
+// there's nothing here a site visitor couldn't already see by
+// browsing the live site directly - the whole point of this route is
+// that a theme's own front-end JS can call it directly, which a
+// token requirement would rule out entirely (a bearer token embedded
+// in public client-side JS is not a secret - anyone's dev tools can
+// read it straight back out, and this agent's tokens all carry real
+// write scopes, not just search). NO_AUTH_ROUTE_RATE_LIMIT, the same
+// defense-in-depth GET /v1/capabilities already has.
+//
+// GET /search.json, not GET /v1/search: this is a stable, public,
+// front-end-facing contract, not part of the versioned admin/
+// integration surface under /v1 - registered without a prefix in
+// server.ts, alongside mediaPublicRoutes/assetsRoutes/sitemapRoutes.
+// A single reserved path, not a whole prefix (unlike /media/* or
+// /assets/*): a site's own content page can still live at the bare
+// /search URL (see granite-starter/theme/sections/search-demo.liquid,
+// which does exactly that) - only this one exact path is claimed.
+export const searchPublicRoutes = async (fastify, opts) => {
+    fastify.get('/search.json', { config: NO_AUTH_ROUTE_RATE_LIMIT }, async (request, reply) => handleSearch(request, reply, opts.config));
+};

package/dist/routes/search.d.ts

@@ -0,0 +1,8 @@
+import type { FastifyPluginAsync } from 'fastify';
+import type { SiteConfig } from '../config.ts';
+import type { TokenEntry } from '../server-config.ts';
+export interface SearchRouteOptions {
+    config: SiteConfig;
+    tokens: TokenEntry[];
+}
+export declare const searchRoutes: FastifyPluginAsync<SearchRouteOptions>;

package/dist/routes/search.js

@@ -0,0 +1,15 @@
+import { rebuildIndex } from "../search/rebuild-index.js";
+import { WRITE_ROUTE_RATE_LIMIT } from "../services/rate-limit-config.js";
+import { requireScope } from "../services/token-auth.js";
+// The read side (GET /search.json) lives in routes/search-public.ts,
+// registered separately, unprefixed, in server.ts - this file only
+// ever holds the authenticated write side, matching media.ts (write,
+// under /v1) vs media-public.ts (public read, unprefixed).
+export const searchRoutes = async (fastify, opts) => {
+    fastify.post('/search/rebuild', { preHandler: requireScope(opts.tokens, 'content'), config: WRITE_ROUTE_RATE_LIMIT }, async (_request, reply) => {
+        // rebuildIndex is already self-enqueue()d (search/rebuild-index.ts) -
+        // never wrap it in a second enqueue() here, nested calls deadlock.
+        await rebuildIndex(opts.config);
+        reply.send({ ok: true });
+    });
+};

package/dist/routes/settings.d.ts

@@ -0,0 +1,10 @@
+import type { FastifyPluginAsync } from 'fastify';
+import type { SiteConfig } from '../config.ts';
+import type { ThemeState } from '../theme-state.ts';
+import type { TokenEntry } from '../server-config.ts';
+export interface SettingsRouteOptions {
+    config: SiteConfig;
+    theme: ThemeState;
+    tokens: TokenEntry[];
+}
+export declare const settingsRoutes: FastifyPluginAsync<SettingsRouteOptions>;

package/dist/routes/settings.js

@@ -0,0 +1,68 @@
+import { isValidCommitAuthor } from "../services/git.js";
+import { WRITE_ROUTE_RATE_LIMIT } from "../services/rate-limit-config.js";
+import { readSiteSettings, resolveSiteSettings, SaveSiteSettingsError, saveSiteSettings } from "../services/site-settings.js";
+import { requireScope } from "../services/token-auth.js";
+function parseSaveSettingsBody(body) {
+    if (typeof body !== 'object' || body === null) {
+        return null;
+    }
+    const { settings, message, author } = body;
+    if (settings === undefined || typeof message !== 'string' || message === '' || !isValidCommitAuthor(author)) {
+        return null;
+    }
+    return { settings, message, author };
+}
+// GET: everything the admin needs to build the Site Settings form - the
+// theme's schema (null when it defines no settings), the values saved so
+// far, what templates actually see (saved values, defaults filling the
+// rest), and the ETag a save must present.
+async function handleGetSettings(reply, opts) {
+    const { themeSchemas } = opts.theme.current;
+    const stored = readSiteSettings(opts.config);
+    if (stored.etag !== null) {
+        reply.header('etag', stored.etag);
+    }
+    reply.send({
+        schema: themeSchemas.settings ?? null,
+        settings: stored.settings,
+        resolved: resolveSiteSettings(opts.config, themeSchemas),
+    });
+}
+// PUT: saves and commits at once, like a menu - no draft state. If-Match
+// is required; "*" (or anything) is accepted while no settings file
+// exists yet.
+async function handleSaveSettings(request, reply, opts) {
+    const ifMatch = request.headers['if-match'];
+    if (typeof ifMatch !== 'string' || ifMatch.length === 0) {
+        reply.code(428).send({ statusCode: 428, error: 'Precondition Required', message: 'An If-Match header is required to save site settings' });
+        return;
+    }
+    const parsed = parseSaveSettingsBody(request.body);
+    if (!parsed) {
+        reply.code(400).send({
+            statusCode: 400,
+            error: 'Bad Request',
+            message: 'Expected { settings: object, message: string, author: { name, email } }',
+        });
+        return;
+    }
+    try {
+        const etag = await saveSiteSettings(opts.config, opts.theme.current.themeSchemas, parsed.settings, ifMatch, parsed.message, parsed.author);
+        reply.header('etag', etag).send({ ok: true });
+    }
+    catch (error) {
+        if (error instanceof SaveSiteSettingsError && error.reason === 'conflict') {
+            reply.code(409).send({ statusCode: 409, error: 'Conflict', message: error.message });
+            return;
+        }
+        if (error instanceof SaveSiteSettingsError && error.reason === 'validation-failed') {
+            reply.code(400).send({ statusCode: 400, error: 'Bad Request', message: error.message, errors: error.errors });
+            return;
+        }
+        throw error;
+    }
+}
+export const settingsRoutes = async (fastify, opts) => {
+    fastify.get('/settings', { preHandler: requireScope(opts.tokens, 'content') }, async (_request, reply) => handleGetSettings(reply, opts));
+    fastify.put('/settings', { preHandler: requireScope(opts.tokens, 'content'), config: WRITE_ROUTE_RATE_LIMIT }, async (request, reply) => handleSaveSettings(request, reply, opts));
+};

package/dist/routes/sitemap.d.ts

@@ -0,0 +1,7 @@
+import type { FastifyPluginAsync } from 'fastify';
+import type { SiteConfig } from '../config.ts';
+export interface SitemapRouteOptions {
+    config: SiteConfig;
+}
+export declare function buildSitemapUrls(config: SiteConfig): string[];
+export declare const sitemapRoutes: FastifyPluginAsync<SitemapRouteOptions>;