@o-a/cms-agent 0.1.0

package/dist/services/rate-limit-config.d.ts

@@ -0,0 +1,9 @@
+export declare const WRITE_ROUTE_RATE_LIMIT: {
+    rateLimit: {};
+};
+export declare const CAPABILITIES_RATE_LIMIT: {
+    rateLimit: {
+        max: number;
+        timeWindow: number;
+    };
+};

package/dist/services/rate-limit-config.js

@@ -0,0 +1,20 @@
+// Shared rate-limit config markers for route options objects
+// (Fastify's config: { rateLimit: {...} } opt-in shape, consumed by
+// @fastify/rate-limit registered with global: false in server.ts).
+// One constant per tier, not ad-hoc literals at each of the ~10 call
+// sites, both for DRYness and so the structural test
+// (test/static/static-analysis.test.ts) has something unambiguous to
+// grep for.
+// An empty per-route override: @fastify/rate-limit (registered with
+// global: false in server.ts) still requires each route to opt in via
+// this marker, but an empty {} inherits the plugin's own registration-
+// level max/timeWindow - which server.ts sets from serverConfig.rateLimit
+// (site.config.json-configurable, defaulting to 60/min - see
+// server-config.ts). Verified empirically before relying on it: a
+// route's own config.rateLimit only needs *something* present to opt
+// in, not a duplicated copy of the numbers.
+export const WRITE_ROUTE_RATE_LIMIT = { rateLimit: {} };
+// Generous defense-in-depth against basic scanning of the one endpoint
+// reachable with zero credentials, not a meaningful throttle on
+// legitimate use.
+export const CAPABILITIES_RATE_LIMIT = { rateLimit: { max: 300, timeWindow: 60000 } };

package/dist/services/redirects.d.ts

@@ -0,0 +1,27 @@
+import type { SiteConfig } from '../config.ts';
+export type RedirectReason = 'redirect-cycle' | 'malformed-file' | 'invalid-target';
+export declare class RedirectError extends Error {
+    readonly reason: RedirectReason;
+    constructor(reason: RedirectReason, message: string);
+}
+export interface RedirectEntry {
+    from: string;
+    to: string;
+    note?: string;
+}
+export interface Redirects {
+    schemaVersion: number;
+    entries: RedirectEntry[];
+}
+export declare const CURRENT_REDIRECTS_SCHEMA_VERSION = 1;
+export declare function loadRedirects(config: SiteConfig): Redirects;
+export declare function loadRedirectsStrict(config: SiteConfig): Redirects;
+export declare function serialiseRedirects(entries: RedirectEntry[]): string;
+export declare function buildRedirectLookup(entries: RedirectEntry[]): Map<string, string>;
+export interface AddRedirectResult {
+    entries: RedirectEntry[];
+    retargeted: RedirectEntry[];
+}
+export declare function addRedirect(entries: RedirectEntry[], from: string, to: string, note?: string): AddRedirectResult;
+export declare function removeRedirectForPath(entries: RedirectEntry[], url: string): RedirectEntry[];
+export declare function isValidRedirectTarget(value: string): boolean;

package/dist/services/redirects.js

@@ -0,0 +1,175 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { validateRedirects } from "./validation.js";
+export class RedirectError extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.name = 'RedirectError';
+        this.reason = reason;
+    }
+}
+export const CURRENT_REDIRECTS_SCHEMA_VERSION = 1;
+const EMPTY_REDIRECTS = { schemaVersion: CURRENT_REDIRECTS_SCHEMA_VERSION, entries: [] };
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+// The old shape (pre-Group M) was a flat { from: to } map, with no
+// schemaVersion or entries key at all. Identified purely by the
+// ABSENCE of both new-shape keys - a file that has an `entries` key is
+// always treated as new-shape from here on, even if malformed, so a
+// corrupt new-shape file is never silently reinterpreted as an empty
+// old-shape map (which would look like "no redirects" and risk a
+// write-time caller clobbering real data - see loadRedirectsStrict).
+function isOldFlatShape(value) {
+    return !('schemaVersion' in value) && !('entries' in value);
+}
+function upgradeOldFlatShape(value) {
+    const entries = Object.entries(value)
+        .filter((pair) => typeof pair[1] === 'string')
+        .map(([from, to]) => ({ from, to }));
+    return { schemaVersion: CURRENT_REDIRECTS_SCHEMA_VERSION, entries };
+}
+// Read-time loader, used by public request handling (resolve-url.ts,
+// resolve-blog-url.ts) as well as by write paths before they call
+// loadRedirectsStrict for the extra guarantee. Graceful-empty on any
+// failure - including a malformed new-shape file - matching
+// theme-schemas.ts's established pattern: a corrupt redirects.json
+// must never crash public page serving, it should just mean redirects
+// don't resolve until the file is fixed.
+export function loadRedirects(config) {
+    let raw;
+    try {
+        raw = JSON.parse(readFileSync(config.redirectsPath, 'utf-8'));
+    }
+    catch {
+        return EMPTY_REDIRECTS;
+    }
+    if (!isPlainObject(raw)) {
+        return EMPTY_REDIRECTS;
+    }
+    if (isOldFlatShape(raw)) {
+        return upgradeOldFlatShape(raw);
+    }
+    const result = validateRedirects(raw);
+    if (!result.valid) {
+        return EMPTY_REDIRECTS;
+    }
+    return raw;
+}
+// Stricter sibling of loadRedirects, for write paths only (manage-
+// redirects.ts, and any other future direct redirect writer). Unlike
+// the graceful read-time loader, this throws on a malformed new-shape
+// file instead of silently treating it as empty - a write that follows
+// an incorrectly-"empty" load would overwrite and destroy whatever
+// real entries the file actually held, which is a much worse outcome
+// for a write than for a page render.
+export function loadRedirectsStrict(config) {
+    if (!existsSync(config.redirectsPath)) {
+        return EMPTY_REDIRECTS;
+    }
+    let raw;
+    try {
+        raw = JSON.parse(readFileSync(config.redirectsPath, 'utf-8'));
+    }
+    catch {
+        throw new RedirectError('malformed-file', 'redirects.json exists but is not valid JSON; refusing to write until it is fixed');
+    }
+    if (!isPlainObject(raw)) {
+        throw new RedirectError('malformed-file', 'redirects.json exists but is not a JSON object');
+    }
+    if (isOldFlatShape(raw)) {
+        return upgradeOldFlatShape(raw);
+    }
+    const result = validateRedirects(raw);
+    if (!result.valid) {
+        throw new RedirectError('malformed-file', `redirects.json exists but does not match the expected shape: ${result.errors.map((e) => e.message).join(', ')}`);
+    }
+    return raw;
+}
+export function serialiseRedirects(entries) {
+    const redirects = { schemaVersion: CURRENT_REDIRECTS_SCHEMA_VERSION, entries };
+    return JSON.stringify(redirects, null, 2);
+}
+export function buildRedirectLookup(entries) {
+    return new Map(entries.map((entry) => [entry.from, entry.to]));
+}
+// Collapses chains at write time. Walks `to` forward through any
+// existing chain to its final destination (not just one hop), then
+// rewrites every existing entry that pointed at the just-added `from`
+// to point at that final destination too, so old entries stay
+// collapsed alongside the new one. Also handles updating an existing
+// entry in place: if `from` already has an entry, it is replaced.
+export function addRedirect(entries, from, to, note) {
+    const byFrom = new Map(entries.map((entry) => [entry.from, entry]));
+    let target = to;
+    const visited = new Set();
+    for (;;) {
+        const next = byFrom.get(target)?.to;
+        if (next === undefined) {
+            break;
+        }
+        if (visited.has(target)) {
+            throw new RedirectError('redirect-cycle', `redirects.json already contains a cycle reachable from "${to}"`);
+        }
+        visited.add(target);
+        target = next;
+    }
+    // The walk above only detects a cycle among *pre-existing* entries.
+    // A walk that terminates normally can still resolve back to `from`
+    // itself (e.g. adding "/b" -> "/a" when "/a" -> "/b" already exists:
+    // the walk hits "/b", which has no further mapping, and stops without
+    // revisiting anything) - that's a self-referential redirect, checked
+    // separately here.
+    if (target === from) {
+        throw new RedirectError('redirect-cycle', `Adding redirect "${from}" -> "${to}" would create a cycle (resolves back to "${from}")`);
+    }
+    const retargeted = [];
+    const updated = [];
+    for (const entry of entries) {
+        if (entry.from === from) {
+            continue;
+        }
+        if (entry.to === from) {
+            const rewritten = { ...entry, to: target };
+            retargeted.push(rewritten);
+            updated.push(rewritten);
+            continue;
+        }
+        updated.push(entry);
+    }
+    const newEntry = note !== undefined ? { from, to: target, note } : { from, to: target };
+    updated.push(newEntry);
+    return { entries: updated, retargeted };
+}
+export function removeRedirectForPath(entries, url) {
+    if (!entries.some((entry) => entry.from === url)) {
+        return entries;
+    }
+    return entries.filter((entry) => entry.from !== url);
+}
+// Checked by char code rather than a regex control-character class, to
+// avoid embedding literal control characters in source.
+function hasControlCharacter(value) {
+    for (let i = 0; i < value.length; i += 1) {
+        const code = value.charCodeAt(i);
+        if (code <= 0x1f || code === 0x7f) {
+            return true;
+        }
+    }
+    return false;
+}
+// Shared by manage-redirects.ts (POST/PUT /v1/redirects) and the
+// retroactive fix to delete-content.ts's client-supplied redirectTo -
+// both must enforce the same rule on a redirect target, or the two
+// write paths would silently disagree on what's allowed into the same
+// file. Internal-only: must start with a single "/", never a scheme,
+// host, or protocol-relative "//" - closes an open-redirect vector.
+// Control characters are rejected regardless of the internal/external
+// question, since public.ts writes this value directly into the
+// Location response header.
+export function isValidRedirectTarget(value) {
+    if (value.length === 0 || hasControlCharacter(value)) {
+        return false;
+    }
+    return value.startsWith('/') && !value.startsWith('//');
+}

package/dist/services/resolve-blog-url.d.ts

@@ -0,0 +1,11 @@
+import type { SiteConfig } from '../config.ts';
+export type ResolvedBlogUrl = {
+    kind: 'post';
+    relativePath: string;
+} | {
+    kind: 'redirect';
+    to: string;
+} | {
+    kind: 'not-found';
+};
+export declare function resolveBlogUrl(config: SiteConfig, url: string): ResolvedBlogUrl;

package/dist/services/resolve-blog-url.js

@@ -0,0 +1,31 @@
+import { existsSync } from 'node:fs';
+import { sanitisePath } from "./path-safety.js";
+import { buildRedirectLookup, loadRedirects } from "./redirects.js";
+import { urlToPostPath } from "./post-urls.js";
+// Mirrors resolve-url.ts's shape exactly (a live post always wins over
+// a redirect at the same URL), kept as its own distinct result type
+// rather than reusing ResolvedUrl - clearer branching at the call site
+// and avoids touching Group C's already-tested resolve-url.ts.
+//
+// Unlike pagesRoot (always expected to exist on a real site),
+// postsRoot is optional - a site that has never used blog posts has
+// no content/posts/ directory at all. sanitisePath calls realpathSync
+// directly on its root argument, which throws a raw, uncaught ENOENT
+// if that root itself is missing - so postsRoot's existence is checked
+// first, before ever calling sanitisePath, rather than letting a
+// perfectly ordinary "no posts yet" site crash on its first /blog/ hit.
+export function resolveBlogUrl(config, url) {
+    const relativePath = urlToPostPath(url);
+    if (relativePath !== null && existsSync(config.postsRoot)) {
+        const postFile = sanitisePath(config.postsRoot, relativePath);
+        if (existsSync(postFile)) {
+            return { kind: 'post', relativePath };
+        }
+    }
+    const lookup = buildRedirectLookup(loadRedirects(config).entries);
+    const to = lookup.get(url);
+    if (to !== undefined) {
+        return { kind: 'redirect', to };
+    }
+    return { kind: 'not-found' };
+}

package/dist/services/resolve-url.d.ts

@@ -0,0 +1,11 @@
+import type { SiteConfig } from '../config.ts';
+export type ResolvedUrl = {
+    kind: 'page';
+    relativePath: string;
+} | {
+    kind: 'redirect';
+    to: string;
+} | {
+    kind: 'not-found';
+};
+export declare function resolveUrl(config: SiteConfig, url: string): ResolvedUrl;

package/dist/services/resolve-url.js

@@ -0,0 +1,20 @@
+import { existsSync } from 'node:fs';
+import { sanitisePath } from "./path-safety.js";
+import { buildRedirectLookup, loadRedirects } from "./redirects.js";
+import { urlToPagePath } from "./urls.js";
+// A redirect whose "from" matches a live page is never served: the
+// page always wins (E6). Only consults redirects.json when no live
+// page exists at the requested URL.
+export function resolveUrl(config, url) {
+    const relativePath = urlToPagePath(url);
+    const pageFile = sanitisePath(config.pagesRoot, relativePath);
+    if (existsSync(pageFile)) {
+        return { kind: 'page', relativePath };
+    }
+    const lookup = buildRedirectLookup(loadRedirects(config).entries);
+    const to = lookup.get(url);
+    if (to !== undefined) {
+        return { kind: 'redirect', to };
+    }
+    return { kind: 'not-found' };
+}

package/dist/services/startup-checks.d.ts

@@ -0,0 +1,10 @@
+export type StartupCheckReason = 'node-version-too-low' | 'site-root-missing' | 'git-binary-absent' | 'not-a-git-repo' | 'invalid-site-config' | 'invalid-token-config';
+export declare class StartupCheckError extends Error {
+    readonly reason: StartupCheckReason;
+    constructor(reason: StartupCheckReason, message: string);
+}
+export interface StartupCheckOptions {
+    env?: NodeJS.ProcessEnv;
+    nodeVersion?: string;
+}
+export declare function runStartupChecks(siteRoot: string, options?: StartupCheckOptions): void;

package/dist/services/startup-checks.js

@@ -0,0 +1,81 @@
+import { execFileSync } from 'node:child_process';
+import { readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+export class StartupCheckError extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.name = 'StartupCheckError';
+        this.reason = reason;
+    }
+}
+function parseVersion(version) {
+    const [major = 0, minor = 0, patch = 0] = version
+        .replace(/^v/, '')
+        .split('.')
+        .map((part) => Number.parseInt(part, 10) || 0);
+    return { major, minor, patch };
+}
+function isBelow(version, floor) {
+    if (version.major !== floor.major) {
+        return version.major < floor.major;
+    }
+    if (version.minor !== floor.minor) {
+        return version.minor < floor.minor;
+    }
+    return version.patch < floor.patch;
+}
+// Reads the Node version floor from the agent's own package.json rather
+// than hardcoding a second literal here, so the dev-toolchain minimum
+// (package.json engines.node, driven by --experimental-strip-types) and
+// the shipped-agent's runtime minimum can't drift apart by accident.
+// This is the agent's own bundled file, not site data, so resolving it
+// relative to this module's own location is correct here, the same way
+// validation.ts resolves its own schema files.
+function readNodeVersionFloor() {
+    const packageJsonPath = join(import.meta.dirname, '..', '..', 'package.json');
+    const packageJson = JSON.parse(readFileSync(packageJsonPath, 'utf-8'));
+    const floor = packageJson.engines?.node;
+    if (!floor) {
+        throw new Error('package.json is missing engines.node');
+    }
+    return floor.replace(/^[^\d]*/, '');
+}
+// Fail-fast, in this specific order. Checking "is a git repo" before
+// confirming the site root exists would make a missing root fail with
+// the same ENOENT as "git binary absent" (both execFileSync failures),
+// which would misreport one case as the other.
+export function runStartupChecks(siteRoot, options = {}) {
+    const nodeVersion = options.nodeVersion ?? process.version;
+    const floor = parseVersion(readNodeVersionFloor());
+    if (isBelow(parseVersion(nodeVersion), floor)) {
+        throw new StartupCheckError('node-version-too-low', `Node ${readNodeVersionFloor()} or later is required, found ${nodeVersion}`);
+    }
+    try {
+        if (!statSync(siteRoot).isDirectory()) {
+            throw new Error('not a directory');
+        }
+    }
+    catch {
+        throw new StartupCheckError('site-root-missing', `Site root does not exist or is not a directory: ${siteRoot}`);
+    }
+    const env = options.env ?? process.env;
+    try {
+        // Deliberately not run with cwd: siteRoot, so this check never
+        // depends on the site root existing.
+        execFileSync('git', ['--version'], { env, stdio: 'ignore' });
+    }
+    catch {
+        throw new StartupCheckError('git-binary-absent', 'git binary not found on PATH');
+    }
+    try {
+        execFileSync('git', ['rev-parse', '--is-inside-work-tree'], {
+            cwd: siteRoot,
+            env,
+            stdio: 'ignore',
+        });
+    }
+    catch {
+        throw new StartupCheckError('not-a-git-repo', `Site root is not a git repository: ${siteRoot}`);
+    }
+}

package/dist/services/static-file.d.ts

@@ -0,0 +1,7 @@
+import type { FastifyReply } from 'fastify';
+export interface StaticFileMatch {
+    fullPath: string;
+    contentType: string;
+}
+export declare function findStaticFile(root: string, relativePath: string): StaticFileMatch | null;
+export declare function sendStaticFile(reply: FastifyReply, match: StaticFileMatch): void;

package/dist/services/static-file.js

@@ -0,0 +1,37 @@
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { mimeTypeFor } from "./mime-types.js";
+import { PathSafetyError, sanitisePath } from "./path-safety.js";
+export function findStaticFile(root, relativePath) {
+    // sanitisePath's own symlink-escape check calls realpathSync on the
+    // root itself, which throws (a raw ENOENT, not a PathSafetyError) if
+    // the root doesn't exist at all. theme/assets/ is always created by
+    // scaffoldSite, but theme/root/ is genuinely optional (found live:
+    // this crashed with a 500 on a fixture site with no theme/root/ at
+    // all) - checked here rather than in sanitisePath itself, since
+    // every other caller of that shared, security-audited function
+    // legitimately expects its root to exist.
+    if (!existsSync(root)) {
+        return null;
+    }
+    try {
+        const fullPath = sanitisePath(root, relativePath);
+        if (!existsSync(fullPath) || !statSync(fullPath).isFile()) {
+            return null;
+        }
+        return { fullPath, contentType: mimeTypeFor(fullPath) };
+    }
+    catch (error) {
+        if (error instanceof PathSafetyError) {
+            return null;
+        }
+        throw error;
+    }
+}
+// Access-Control-Allow-Origin: * - both callers are already
+// deliberately unauthenticated, public routes (see assets.ts's own
+// comment for the full reasoning: a font loaded via @font-face
+// enforces CORS unconditionally, and the admin's preview route makes
+// genuinely cross-origin requests for paths that look same-origin).
+export function sendStaticFile(reply, match) {
+    reply.header('Access-Control-Allow-Origin', '*').type(match.contentType).send(readFileSync(match.fullPath));
+}

package/dist/services/theme-component-file.d.ts

@@ -0,0 +1,5 @@
+export interface ParsedThemeComponentFile {
+    markup: string;
+    schema: object;
+}
+export declare function parseThemeComponentFile(source: string): ParsedThemeComponentFile | null;

package/dist/services/theme-component-file.js

@@ -0,0 +1,32 @@
+// {% schema %} ... {% endschema %} embedded in a single .liquid file,
+// matching Shopify's own theme-section convention - the natural fit
+// since this project already deliberately mirrors Shopify-style
+// sections and blocks. Never a real, live Liquid tag (CLAUDE.md: no
+// dynamically registered Liquid tags or filters, ever) - extracted by
+// plain string parsing before the file is ever handed to the Liquid
+// engine, and stripped out of what actually gets rendered.
+const SCHEMA_BLOCK_PATTERN = /\{%-?\s*schema\s*-?%\}([\s\S]*?)\{%-?\s*endschema\s*-?%\}/;
+// Returns null if no schema block is found, or its content isn't
+// valid JSON - callers treat this the same as today's "file missing/
+// unreadable" case (skip, don't throw). A deliberate behaviour change
+// from the old two-file shape: previously markup and schema loaded and
+// failed independently; now they're one file, so a broken schema block
+// fails the whole component, not just the schema half.
+export function parseThemeComponentFile(source) {
+    const match = SCHEMA_BLOCK_PATTERN.exec(source);
+    if (!match) {
+        return null;
+    }
+    let schema;
+    try {
+        schema = JSON.parse(match[1]);
+    }
+    catch {
+        return null;
+    }
+    if (typeof schema !== 'object' || schema === null) {
+        return null;
+    }
+    const markup = source.slice(0, match.index) + source.slice(match.index + match[0].length);
+    return { markup, schema };
+}

package/dist/services/theme-page-templates.d.ts

@@ -0,0 +1,7 @@
+import { type ThemeSchemas } from './validation.ts';
+export interface PageTemplate {
+    id: string;
+    title: string;
+    content: unknown;
+}
+export declare function loadPageTemplates(templatesRoot: string, themeSchemas: ThemeSchemas): PageTemplate[];

package/dist/services/theme-page-templates.js

@@ -0,0 +1,53 @@
+import { readdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { validatePage } from "./validation.js";
+// templatesRoot is agent configuration (config.templatesRoot), not a
+// request-supplied :path parameter - same non-sanitised, boot-time-only
+// directory walk as theme-schemas.ts's own loadTypeSchemas, never
+// reused for untrusted request paths.
+//
+// Flat *.json files, one per template, named directly (e.g.
+// blog-article.json) - mirrors loadTypeSchemas's walk exactly. Each
+// file must already be a fully valid page (the same page.schema.json
+// every real content/pages/*.json file is validated against, via the
+// theme's own current section/block schemas) - a template IS a real
+// page file, nothing more, so a theme author can create one by
+// literally copying and adapting a real page rather than learning a
+// new authoring convention. A template that fails to parse or fails
+// validation is skipped, never a boot failure - same defensive
+// handling loadTypeSchemas already gives a malformed schema.json.
+export function loadPageTemplates(templatesRoot, themeSchemas) {
+    const templates = [];
+    let entries;
+    try {
+        entries = readdirSync(templatesRoot, { withFileTypes: true })
+            .filter((entry) => entry.isFile() && entry.name.endsWith('.json'))
+            .map((entry) => entry.name);
+    }
+    catch {
+        return templates;
+    }
+    for (const fileName of entries) {
+        const id = fileName.slice(0, -'.json'.length);
+        let raw;
+        try {
+            raw = readFileSync(join(templatesRoot, fileName), 'utf-8');
+        }
+        catch {
+            continue;
+        }
+        let content;
+        try {
+            content = JSON.parse(raw);
+        }
+        catch {
+            continue;
+        }
+        if (!validatePage(content, themeSchemas).valid) {
+            continue;
+        }
+        const title = content.title;
+        templates.push({ id, title, content });
+    }
+    return templates;
+}

package/dist/services/theme-schemas.d.ts

@@ -0,0 +1,2 @@
+import { type ThemeSchemas } from './validation.ts';
+export declare function loadThemeSchemas(themeRoot: string): ThemeSchemas;

package/dist/services/theme-schemas.js

@@ -0,0 +1,63 @@
+import { readdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { parseThemeComponentFile } from "./theme-component-file.js";
+import { requiredFieldsHaveValidDefaults } from "./validation.js";
+// themeRoot is agent configuration (the configured site's theme
+// directory), not a request-supplied :path parameter. This walk is
+// deliberately NOT the Group B path-sanitisation helper and must
+// never be reused for untrusted request paths.
+//
+// Flat *.liquid files, one per type, named directly (e.g. hero.liquid,
+// media-text.liquid) - no subfolder per type. Mirrors theme-templates.ts's
+// loadFlatTemplates walk exactly (already established for snippets/
+// layouts), extended to extract the embedded {% schema %} block instead
+// of returning the raw file contents.
+function loadTypeSchemas(typesDir) {
+    const schemas = {};
+    const acceptsBlocks = {};
+    let entries;
+    try {
+        entries = readdirSync(typesDir, { withFileTypes: true })
+            .filter((entry) => entry.isFile() && entry.name.endsWith('.liquid'))
+            .map((entry) => entry.name);
+    }
+    catch {
+        return { schemas, acceptsBlocks };
+    }
+    for (const fileName of entries) {
+        const type = fileName.slice(0, -'.liquid'.length);
+        let source;
+        try {
+            source = readFileSync(join(typesDir, fileName), 'utf-8');
+        }
+        catch {
+            continue;
+        }
+        const parsed = parseThemeComponentFile(source);
+        if (!parsed) {
+            continue;
+        }
+        // A type whose required settings fields lack usable defaults is
+        // skipped the same way a malformed schema block already is -
+        // never a boot failure, just excluded from what gets registered
+        // (theme-authoring-guide.md, Group L).
+        if (!requiredFieldsHaveValidDefaults(parsed.schema)) {
+            continue;
+        }
+        schemas[type] = parsed.schema;
+        // The only place "does this type support nested blocks" is ever
+        // expressed - a markup convention (does the template loop
+        // blocksHtml), not a schema field (theme-authoring-guide.md).
+        acceptsBlocks[type] = parsed.markup.includes('blocksHtml');
+    }
+    return { schemas, acceptsBlocks };
+}
+export function loadThemeSchemas(themeRoot) {
+    const sections = loadTypeSchemas(join(themeRoot, 'sections'));
+    const blocks = loadTypeSchemas(join(themeRoot, 'blocks'));
+    return {
+        sections: sections.schemas,
+        blocks: blocks.schemas,
+        acceptsBlocks: { sections: sections.acceptsBlocks, blocks: blocks.acceptsBlocks },
+    };
+}

package/dist/services/token-auth.d.ts

@@ -0,0 +1,10 @@
+import type { FastifyRequest } from 'fastify';
+import type { Scope, TokenEntry } from '../server-config.ts';
+export type AuthReason = 'missing-token' | 'invalid-token' | 'missing-scope';
+export declare class AuthError extends Error {
+    readonly reason: AuthReason;
+    readonly statusCode: number;
+    constructor(reason: AuthReason, message: string);
+}
+export declare function verifyToken(tokens: TokenEntry[], presentedToken: string): Scope[] | null;
+export declare function requireScope(tokens: TokenEntry[], scope: Scope): (request: FastifyRequest) => Promise<void>;