@o-a/cms-agent 0.1.0

package/dist/routes/assets.d.ts

@@ -0,0 +1,6 @@
+import type { FastifyPluginAsync } from 'fastify';
+import type { SiteConfig } from '../config.ts';
+export interface AssetsRouteOptions {
+    config: SiteConfig;
+}
+export declare const assetsRoutes: FastifyPluginAsync<AssetsRouteOptions>;

package/dist/routes/assets.js

@@ -0,0 +1,30 @@
+import { findStaticFile, sendStaticFile } from "../services/static-file.js";
+async function handleAssetRequest(request, reply, config) {
+    const relativePath = request.params['*'];
+    const match = findStaticFile(config.assetsRoot, relativePath);
+    if (!match) {
+        reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No asset at "${relativePath}"` });
+        return;
+    }
+    // A synchronous buffered read, not a stream: reply.send(stream) was
+    // verified empirically to produce an empty body in this Fastify
+    // version (confirmed both via .inject() and a real socket, isolated
+    // down to a minimal repro) - a real, environment-specific problem,
+    // not a mistake in this route's own logic. No Range/If-Range support
+    // in this pass either way (nothing has asked for large-file
+    // streaming yet), so buffering the whole file is not a meaningful
+    // regression. sendStaticFile (services/static-file.ts) does this
+    // read, shared with routes/public.ts's root-mirror check.
+    sendStaticFile(reply, match);
+}
+// Deliberately and permanently unauthenticated: static assets (CSS/JS/
+// images) must be fetchable by any visitor's browser without a token,
+// same as the public website itself. Registered without a /v1 prefix,
+// directly on app in server.ts, alongside publicRoutes. No guard
+// against the public catch-all's own /* wildcard is needed here - this
+// is the more specific static-prefixed route winning cleanly (verified
+// empirically), not the reverse case that needed public.ts's /v1/*
+// guard.
+export const assetsRoutes = async (fastify, opts) => {
+    fastify.get('/assets/*', async (request, reply) => handleAssetRequest(request, reply, opts.config));
+};

package/dist/routes/batch.d.ts

@@ -0,0 +1,10 @@
+import type { FastifyPluginAsync } from 'fastify';
+import type { SiteConfig } from '../config.ts';
+import type { ThemeSchemas } from '../services/validation.ts';
+import type { TokenEntry } from '../server-config.ts';
+export interface BatchRouteOptions {
+    config: SiteConfig;
+    themeSchemas: ThemeSchemas;
+    tokens: TokenEntry[];
+}
+export declare const batchRoutes: FastifyPluginAsync<BatchRouteOptions>;

package/dist/routes/batch.js

@@ -0,0 +1,148 @@
+import { BatchError, runBatch } from "../services/batch.js";
+import { isValidCommitAuthor } from "../services/git.js";
+import { PathSafetyError } from "../services/path-safety.js";
+import { WRITE_ROUTE_RATE_LIMIT } from "../services/rate-limit-config.js";
+import { requireScope } from "../services/token-auth.js";
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.length > 0;
+}
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null;
+}
+function parseOperation(value) {
+    if (!isPlainObject(value)) {
+        return null;
+    }
+    const { type } = value;
+    switch (type) {
+        case 'draft-write': {
+            const { path, content, expectedEtag } = value;
+            if (!isNonEmptyString(path) || !isPlainObject(content) || !isNonEmptyString(expectedEtag)) {
+                return null;
+            }
+            return { type, path, content, expectedEtag };
+        }
+        case 'draft-discard': {
+            const { path } = value;
+            if (!isNonEmptyString(path)) {
+                return null;
+            }
+            return { type, path };
+        }
+        case 'content-delete': {
+            const { path, redirectTo } = value;
+            if (!isNonEmptyString(path) || (redirectTo !== undefined && !isNonEmptyString(redirectTo))) {
+                return null;
+            }
+            return { type, path, redirectTo };
+        }
+        case 'move': {
+            const { from, to } = value;
+            if (!isNonEmptyString(from) || !isNonEmptyString(to)) {
+                return null;
+            }
+            return { type, from, to };
+        }
+        default:
+            return null;
+    }
+}
+function parsePublish(value) {
+    if (!isPlainObject(value)) {
+        return null;
+    }
+    const { paths } = value;
+    if (!Array.isArray(paths) || paths.length === 0 || !paths.every(isNonEmptyString)) {
+        return null;
+    }
+    return { relativePaths: paths };
+}
+const BATCH_BODY_SHAPE = 'Expected { operations: BatchOperation[], publish?: { paths: string[] }, message: string, author: { name, email } }';
+function parseBatchBody(body) {
+    if (!isPlainObject(body)) {
+        return null;
+    }
+    const { operations, publish, message, author } = body;
+    if (!Array.isArray(operations)) {
+        return null;
+    }
+    const parsedOperations = [];
+    for (const raw of operations) {
+        const operation = parseOperation(raw);
+        if (!operation) {
+            return null;
+        }
+        parsedOperations.push(operation);
+    }
+    let parsedPublish;
+    if (publish !== undefined) {
+        const result = parsePublish(publish);
+        if (!result) {
+            return null;
+        }
+        parsedPublish = result;
+    }
+    if (!isNonEmptyString(message) || !isValidCommitAuthor(author)) {
+        return null;
+    }
+    return { operations: parsedOperations, publish: parsedPublish, message, author };
+}
+// Maps every BatchReason to a status code, mirroring the same mapping
+// each originating service's own route already applies (publish.ts's
+// replyForPublishError, content.ts's move/delete handlers, drafts.ts's
+// conflict/validation-failed handling) - kept as one switch here since
+// batch.ts's BatchReason is a superset drawn from all four services.
+function replyForBatchError(reply, error) {
+    switch (error.reason) {
+        case 'conflict':
+            reply.code(409).send({ statusCode: 409, error: 'Conflict', message: error.message });
+            return;
+        case 'destination-exists':
+            reply.code(409).send({ statusCode: 409, error: 'Conflict', message: error.message });
+            return;
+        case 'has-children':
+            reply.code(409).send({ statusCode: 409, error: 'Conflict', message: error.message });
+            return;
+        case 'validation-failed':
+        case 'duplicate-path':
+        case 'redirect-cycle':
+            reply.code(400).send({ statusCode: 400, error: 'Bad Request', message: error.message });
+            return;
+        case 'page-not-found':
+        case 'source-not-found':
+        case 'draft-not-found':
+            reply.code(404).send({ statusCode: 404, error: 'Not Found', message: error.message });
+            return;
+        default:
+            // write-failed / commit-failed / rollback-failed: no client-side
+            // fix applies, fall through to the global handler's sanitised 500.
+            throw error;
+    }
+}
+export const batchRoutes = async (fastify, opts) => {
+    fastify.post('/batch', { preHandler: requireScope(opts.tokens, 'content'), config: WRITE_ROUTE_RATE_LIMIT }, async (request, reply) => {
+        const parsed = parseBatchBody(request.body);
+        if (!parsed) {
+            reply.code(400).send({ statusCode: 400, error: 'Bad Request', message: BATCH_BODY_SHAPE });
+            return;
+        }
+        try {
+            await runBatch(opts.config, opts.themeSchemas, parsed.operations, parsed.publish, parsed.message, parsed.author);
+            reply.send({ ok: true });
+        }
+        catch (error) {
+            // PathSafetyError has no .statusCode - left uncaught it falls
+            // through to the global handler's sanitised 500, the same gap
+            // every other route touching a :path already guards against.
+            if (error instanceof PathSafetyError) {
+                reply.code(404).send({ statusCode: 404, error: 'Not Found', message: 'No content at that path' });
+                return;
+            }
+            if (error instanceof BatchError) {
+                replyForBatchError(reply, error);
+                return;
+            }
+            throw error;
+        }
+    });
+};

package/dist/routes/capabilities.d.ts

@@ -0,0 +1,5 @@
+import type { FastifyPluginAsync } from 'fastify';
+export interface CapabilitiesRouteOptions {
+    maxUploadBytes: number;
+}
+export declare const capabilitiesRoutes: FastifyPluginAsync<CapabilitiesRouteOptions>;

package/dist/routes/capabilities.js

@@ -0,0 +1,27 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { CURRENT_SCHEMA_VERSION } from "../migrations/index.js";
+import { CAPABILITIES_RATE_LIMIT } from "../services/rate-limit-config.js";
+import { DRIVER_NAME } from "../search/drivers/node-sqlite-driver.js";
+// The agent's own bundled package.json, not site data - the same
+// import.meta.dirname-relative pattern already established in
+// validation.ts/startup-checks.ts for the agent's own files.
+function readAgentVersion() {
+    const packageJsonPath = join(import.meta.dirname, '..', '..', 'package.json');
+    const packageJson = JSON.parse(readFileSync(packageJsonPath, 'utf-8'));
+    return packageJson.version ?? '0.0.0';
+}
+export const capabilitiesRoutes = async (fastify, opts) => {
+    fastify.get('/capabilities', { config: CAPABILITIES_RATE_LIMIT }, async () => ({
+        agentVersion: readAgentVersion(),
+        contentSchemaVersion: CURRENT_SCHEMA_VERSION,
+        sqliteDriver: DRIVER_NAME,
+        // Named distinctly from site.config.json's own "media.maxUploadBytes"
+        // key so this response reads unambiguously next to its siblings -
+        // lets the admin's own client-side upload check validate against
+        // the same limit the server will actually enforce (@fastify/multipart's
+        // limits.fileSize in media.ts), rather than a separately hardcoded
+        // guess that could drift.
+        maxMediaUploadBytes: opts.maxUploadBytes,
+    }));
+};

package/dist/routes/content.d.ts

@@ -0,0 +1,8 @@
+import type { FastifyPluginAsync } from 'fastify';
+import type { SiteConfig } from '../config.ts';
+import type { TokenEntry } from '../server-config.ts';
+export interface ContentRouteOptions {
+    config: SiteConfig;
+    tokens: TokenEntry[];
+}
+export declare const contentRoutes: FastifyPluginAsync<ContentRouteOptions>;

package/dist/routes/content.js

@@ -0,0 +1,166 @@
+import { ContentReadError, listContent, readContentFile } from "../services/content-read.js";
+import { DeleteContentError, deleteContent } from "../services/delete-content.js";
+import { isValidCommitAuthor } from "../services/git.js";
+import { MoveError, movePage } from "../services/move.js";
+import { PathSafetyError } from "../services/path-safety.js";
+import { WRITE_ROUTE_RATE_LIMIT } from "../services/rate-limit-config.js";
+import { requireScope } from "../services/token-auth.js";
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.length > 0;
+}
+// content/drafts/ and content/redirects.json sit inside contentRoot
+// (Group N) but are not page-shaped content reachable through the
+// generic content routes - drafts have their own dedicated /v1/drafts/*
+// surface with its own semantics, and redirects.json is agent-managed
+// data with its own /v1/redirects surface. Without this check, a
+// client request resolving into either would either leak an unpublished
+// draft's raw bytes through the "live content" read endpoint, or
+// (for DELETE) unlink a file that was never git-tracked and blow up in
+// commitPaths with a spurious 500 - both real bugs the nesting would
+// introduce, not present when drafts/redirects.json were siteRoot
+// siblings of contentRoot.
+function isReservedContentPath(relativePath) {
+    return relativePath === 'redirects.json' || relativePath === 'drafts' || relativePath.startsWith('drafts/');
+}
+async function handleReadContent(request, reply, config) {
+    const relativePath = request.params['*'];
+    if (isReservedContentPath(relativePath)) {
+        reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No content at "${relativePath}"` });
+        return;
+    }
+    try {
+        const { bytes, etag } = readContentFile(config.contentRoot, relativePath);
+        reply.header('etag', etag).type('application/json; charset=utf-8').send(bytes);
+    }
+    catch (error) {
+        // PathSafetyError has no .statusCode - left uncaught it would fall
+        // through to the global handler's generic sanitised 500, matching
+        // the gap preview.ts's precedent already guards against.
+        if (error instanceof PathSafetyError || (error instanceof ContentReadError && error.reason === 'not-found')) {
+            reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No content at "${relativePath}"` });
+            return;
+        }
+        throw error;
+    }
+}
+function parseDeleteContentBody(body) {
+    if (typeof body !== 'object' || body === null) {
+        return null;
+    }
+    const { redirectTo, message, author } = body;
+    if (redirectTo !== undefined && !isNonEmptyString(redirectTo)) {
+        return null;
+    }
+    if (!isNonEmptyString(message) || !isValidCommitAuthor(author)) {
+        return null;
+    }
+    return { redirectTo, message, author };
+}
+async function handleDeleteContent(request, reply, config) {
+    const relativePath = request.params['*'];
+    if (isReservedContentPath(relativePath)) {
+        reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No content at "${relativePath}"` });
+        return;
+    }
+    const parsed = parseDeleteContentBody(request.body);
+    if (!parsed) {
+        reply.code(400).send({
+            statusCode: 400,
+            error: 'Bad Request',
+            message: 'Expected { redirectTo?: string, message: string, author: { name, email } }',
+        });
+        return;
+    }
+    try {
+        await deleteContent(config, relativePath, parsed.redirectTo, parsed.message, parsed.author);
+        reply.code(204).send();
+    }
+    catch (error) {
+        if (error instanceof PathSafetyError) {
+            reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No content at "${relativePath}"` });
+            return;
+        }
+        if (error instanceof DeleteContentError) {
+            if (error.reason === 'page-not-found') {
+                reply.code(404).send({ statusCode: 404, error: 'Not Found', message: error.message });
+                return;
+            }
+            if (error.reason === 'has-children') {
+                reply.code(409).send({ statusCode: 409, error: 'Conflict', message: error.message });
+                return;
+            }
+            if (error.reason === 'redirect-cycle' || error.reason === 'invalid-redirect-target') {
+                reply.code(400).send({ statusCode: 400, error: 'Bad Request', message: error.message });
+                return;
+            }
+        }
+        throw error;
+    }
+}
+function parseMoveContentBody(body) {
+    if (typeof body !== 'object' || body === null) {
+        return null;
+    }
+    const { from, to, message, author, createRedirect } = body;
+    if (!isNonEmptyString(from) || !isNonEmptyString(to)) {
+        return null;
+    }
+    if (!isNonEmptyString(message) || !isValidCommitAuthor(author)) {
+        return null;
+    }
+    if (createRedirect !== undefined && typeof createRedirect !== 'boolean') {
+        return null;
+    }
+    return { from, to, message, author, createRedirect };
+}
+async function handleMoveContent(request, reply, config) {
+    const parsed = parseMoveContentBody(request.body);
+    if (!parsed) {
+        reply.code(400).send({
+            statusCode: 400,
+            error: 'Bad Request',
+            message: 'Expected { from: string, to: string, message: string, author: { name, email } }',
+        });
+        return;
+    }
+    try {
+        await movePage(config, parsed.from, parsed.to, parsed.message, parsed.author, {
+            createRedirect: parsed.createRedirect,
+        });
+        reply.send({ ok: true });
+    }
+    catch (error) {
+        if (error instanceof PathSafetyError) {
+            reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No page at "${parsed.from}"` });
+            return;
+        }
+        if (error instanceof MoveError) {
+            if (error.reason === 'source-not-found') {
+                reply.code(404).send({ statusCode: 404, error: 'Not Found', message: error.message });
+                return;
+            }
+            if (error.reason === 'destination-exists') {
+                reply.code(409).send({ statusCode: 409, error: 'Conflict', message: error.message });
+                return;
+            }
+        }
+        throw error;
+    }
+}
+async function handleListContent(request, reply, config) {
+    const { type, prefix, draftStatus } = request.query;
+    const entries = listContent(config, { type, prefix, draftStatus });
+    reply.send(entries);
+}
+export const contentRoutes = async (fastify, opts) => {
+    fastify.get('/content', { preHandler: requireScope(opts.tokens, 'content') }, async (request, reply) => handleListContent(request, reply, opts.config));
+    fastify.get('/content/*', { preHandler: requireScope(opts.tokens, 'content') }, async (request, reply) => handleReadContent(request, reply, opts.config));
+    fastify.delete('/content/*', { preHandler: requireScope(opts.tokens, 'content'), config: WRITE_ROUTE_RATE_LIMIT }, async (request, reply) => handleDeleteContent(request, reply, opts.config));
+    // A static path, distinct from the GET/DELETE /content/* wildcard
+    // above by method as well as by not matching the wildcard's own
+    // prefix shape at all (POST here, GET/DELETE there) - no routing
+    // collision, per Group C's own verified precedent that Fastify
+    // prefers static/exact matches over a wildcard regardless of
+    // registration order.
+    fastify.post('/content/move', { preHandler: requireScope(opts.tokens, 'content'), config: WRITE_ROUTE_RATE_LIMIT }, async (request, reply) => handleMoveContent(request, reply, opts.config));
+};

package/dist/routes/drafts.d.ts

@@ -0,0 +1,10 @@
+import type { FastifyPluginAsync } from 'fastify';
+import type { SiteConfig } from '../config.ts';
+import type { ThemeSchemas } from '../services/validation.ts';
+import type { TokenEntry } from '../server-config.ts';
+export interface DraftsRouteOptions {
+    config: SiteConfig;
+    themeSchemas: ThemeSchemas;
+    tokens: TokenEntry[];
+}
+export declare const draftsRoutes: FastifyPluginAsync<DraftsRouteOptions>;

package/dist/routes/drafts.js

@@ -0,0 +1,73 @@
+import { ContentReadError, readContentFile } from "../services/content-read.js";
+import { DraftError, discardDraft, saveDraft } from "../services/drafts.js";
+import { PathSafetyError } from "../services/path-safety.js";
+import { WRITE_ROUTE_RATE_LIMIT } from "../services/rate-limit-config.js";
+import { requireScope } from "../services/token-auth.js";
+async function handleReadDraft(request, reply, config) {
+    const relativePath = request.params['*'];
+    try {
+        const { bytes, etag } = readContentFile(config.draftsRoot, relativePath);
+        reply.header('etag', etag).type('application/json; charset=utf-8').send(bytes);
+    }
+    catch (error) {
+        if (error instanceof PathSafetyError || (error instanceof ContentReadError && error.reason === 'not-found')) {
+            reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No draft at "${relativePath}"` });
+            return;
+        }
+        throw error;
+    }
+}
+async function handleSaveDraft(request, reply, config, themeSchemas) {
+    const relativePath = request.params['*'];
+    // A static per-request property (is the header present at all on
+    // *this* request), not shared mutable state - no TOCTOU risk in
+    // checking it here, before the queue, unlike the ETag comparison
+    // itself (E2/E4/E6), which must happen inside saveDraftJob.
+    const ifMatch = request.headers['if-match'];
+    if (typeof ifMatch !== 'string' || ifMatch.length === 0) {
+        reply.code(428).send({
+            statusCode: 428,
+            error: 'Precondition Required',
+            message: 'An If-Match header is required to save a draft',
+        });
+        return;
+    }
+    try {
+        const newEtag = await saveDraft(config, themeSchemas, relativePath, request.body, ifMatch);
+        reply.header('etag', newEtag).send({ ok: true });
+    }
+    catch (error) {
+        if (error instanceof PathSafetyError) {
+            reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No draft at "${relativePath}"` });
+            return;
+        }
+        if (error instanceof DraftError && error.reason === 'conflict') {
+            reply.code(409).send({ statusCode: 409, error: 'Conflict', message: error.message });
+            return;
+        }
+        if (error instanceof DraftError && error.reason === 'validation-failed') {
+            reply.code(400).send({ statusCode: 400, error: 'Bad Request', message: error.message, errors: error.errors });
+            return;
+        }
+        throw error;
+    }
+}
+async function handleDiscardDraft(request, reply, config) {
+    const relativePath = request.params['*'];
+    try {
+        await discardDraft(config, relativePath);
+        reply.code(204).send();
+    }
+    catch (error) {
+        if (error instanceof PathSafetyError) {
+            reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No draft at "${relativePath}"` });
+            return;
+        }
+        throw error;
+    }
+}
+export const draftsRoutes = async (fastify, opts) => {
+    fastify.get('/drafts/*', { preHandler: requireScope(opts.tokens, 'content') }, async (request, reply) => handleReadDraft(request, reply, opts.config));
+    fastify.put('/drafts/*', { preHandler: requireScope(opts.tokens, 'content'), config: WRITE_ROUTE_RATE_LIMIT }, async (request, reply) => handleSaveDraft(request, reply, opts.config, opts.themeSchemas));
+    fastify.delete('/drafts/*', { preHandler: requireScope(opts.tokens, 'content'), config: WRITE_ROUTE_RATE_LIMIT }, async (request, reply) => handleDiscardDraft(request, reply, opts.config));
+};

package/dist/routes/git.d.ts

@@ -0,0 +1,8 @@
+import type { FastifyPluginAsync } from 'fastify';
+import type { SiteConfig } from '../config.ts';
+import type { TokenEntry } from '../server-config.ts';
+export interface GitRouteOptions {
+    config: SiteConfig;
+    tokens: TokenEntry[];
+}
+export declare const gitRoutes: FastifyPluginAsync<GitRouteOptions>;

package/dist/routes/git.js

@@ -0,0 +1,158 @@
+import { commitWorkingTreeChanges } from "../services/git-commit.js";
+import { GitShowError, getCommitLog, readFileAtRevision } from "../services/git-history.js";
+import { RevertError, revertPaths } from "../services/git-revert.js";
+import { isValidCommitAuthor, isValidGitRef } from "../services/git.js";
+import { mimeTypeFor } from "../services/mime-types.js";
+import { PathSafetyError } from "../services/path-safety.js";
+import { WRITE_ROUTE_RATE_LIMIT } from "../services/rate-limit-config.js";
+import { requireScope } from "../services/token-auth.js";
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.length > 0;
+}
+async function handleGitLog(request, reply, config) {
+    const { path, limit: rawLimit } = request.query;
+    let limit;
+    if (rawLimit !== undefined) {
+        const parsed = Number(rawLimit);
+        if (!Number.isInteger(parsed) || parsed < 1) {
+            reply.code(400).send({
+                statusCode: 400,
+                error: 'Bad Request',
+                message: '"limit" must be a positive integer',
+            });
+            return;
+        }
+        limit = parsed;
+    }
+    try {
+        const result = getCommitLog(config, { path, limit });
+        reply.send(result);
+    }
+    catch (error) {
+        // PathSafetyError has no .statusCode - left uncaught it falls
+        // through to the global handler's sanitised 500, the same gap
+        // every other route touching a :path already guards against.
+        if (error instanceof PathSafetyError) {
+            reply.code(404).send({ statusCode: 404, error: 'Not Found', message: 'No content at that path' });
+            return;
+        }
+        throw error;
+    }
+}
+async function handleGitShow(request, reply, config) {
+    const { ref } = request.params;
+    const relativePath = request.params['*'];
+    if (!isValidGitRef(ref)) {
+        reply.code(400).send({ statusCode: 400, error: 'Bad Request', message: `Invalid ref: "${ref}"` });
+        return;
+    }
+    try {
+        const content = readFileAtRevision(config, ref, relativePath);
+        reply.type(mimeTypeFor(relativePath)).send(content);
+    }
+    catch (error) {
+        if (error instanceof PathSafetyError) {
+            reply.code(404).send({ statusCode: 404, error: 'Not Found', message: 'No content at that path' });
+            return;
+        }
+        if (error instanceof GitShowError) {
+            // Two distinct codes, not collapsed to one 404: unlike public.ts's
+            // deliberate traversal-vs-miss collapse (justified there because
+            // that route is unauthenticated, where leaking which case
+            // occurred would aid enumeration), this route sits behind
+            // requireScope already - there's no equivalent risk, and
+            // collapsing here would only make an admin's diff/history UI
+            // worse for no security benefit.
+            const code = error.reason === 'invalid-ref' ? 400 : 404;
+            reply.code(code).send({
+                statusCode: code,
+                error: code === 400 ? 'Bad Request' : 'Not Found',
+                message: error.message,
+            });
+            return;
+        }
+        throw error;
+    }
+}
+function parseRevertBody(body) {
+    if (typeof body !== 'object' || body === null) {
+        return null;
+    }
+    const { ref, paths, message, author } = body;
+    if (!isNonEmptyString(ref)) {
+        return null;
+    }
+    if (!Array.isArray(paths) || paths.length === 0 || !paths.every(isNonEmptyString)) {
+        return null;
+    }
+    if (!isNonEmptyString(message) || !isValidCommitAuthor(author)) {
+        return null;
+    }
+    return { ref, paths, message, author };
+}
+async function handleGitRevert(request, reply, config) {
+    const parsed = parseRevertBody(request.body);
+    if (!parsed) {
+        reply.code(400).send({
+            statusCode: 400,
+            error: 'Bad Request',
+            message: 'Expected { ref: string, paths: string[], message: string, author: { name, email } }',
+        });
+        return;
+    }
+    try {
+        await revertPaths(config, parsed.ref, parsed.paths, parsed.message, parsed.author);
+        reply.send({ ok: true });
+    }
+    catch (error) {
+        if (error instanceof PathSafetyError) {
+            reply.code(404).send({ statusCode: 404, error: 'Not Found', message: 'No content at that path' });
+            return;
+        }
+        if (error instanceof RevertError) {
+            if (error.reason === 'invalid-ref') {
+                reply.code(400).send({ statusCode: 400, error: 'Bad Request', message: error.message });
+                return;
+            }
+            if (error.reason === 'path-not-found-at-ref') {
+                reply.code(404).send({ statusCode: 404, error: 'Not Found', message: error.message });
+                return;
+            }
+            // write-failed/commit-failed/rollback-failed: no client-side fix
+            // applies, fall through to the global handler's sanitised 500.
+        }
+        throw error;
+    }
+}
+function parseCommitBody(body) {
+    if (typeof body !== 'object' || body === null) {
+        return null;
+    }
+    const { message, author } = body;
+    if (!isNonEmptyString(message) || !isValidCommitAuthor(author)) {
+        return null;
+    }
+    return { message, author };
+}
+async function handleGitCommit(request, reply, config) {
+    const parsed = parseCommitBody(request.body);
+    if (!parsed) {
+        reply.code(400).send({
+            statusCode: 400,
+            error: 'Bad Request',
+            message: 'Expected { message: string, author: { name, email } }',
+        });
+        return;
+    }
+    // Any GitOperationError here is not caught - it rethrows to the
+    // global error handler's sanitised 500, same as every other route's
+    // uncaught commitPaths failure.
+    const result = await commitWorkingTreeChanges(config, parsed.message, parsed.author);
+    reply.send({ ok: true, committed: result === 'committed' });
+}
+export const gitRoutes = async (fastify, opts) => {
+    fastify.get('/git/log', { preHandler: requireScope(opts.tokens, 'content') }, async (request, reply) => handleGitLog(request, reply, opts.config));
+    fastify.get('/git/show/:ref/*', { preHandler: requireScope(opts.tokens, 'content') }, async (request, reply) => handleGitShow(request, reply, opts.config));
+    fastify.post('/git/revert', { preHandler: requireScope(opts.tokens, 'content'), config: WRITE_ROUTE_RATE_LIMIT }, async (request, reply) => handleGitRevert(request, reply, opts.config));
+    fastify.post('/git/commit', { preHandler: requireScope(opts.tokens, 'content'), config: WRITE_ROUTE_RATE_LIMIT }, async (request, reply) => handleGitCommit(request, reply, opts.config));
+};