@o-a/cms-agent 0.1.0

package/dist/routes/index.d.ts

@@ -0,0 +1,19 @@
+import type { FastifyPluginAsync } from 'fastify';
+import type { Liquid } from 'liquidjs';
+import type { SiteConfig } from '../config.ts';
+import type { ThemeTemplates } from '../renderer/theme-templates.ts';
+import type { TokenEntry } from '../server-config.ts';
+import type { ThemeSchemas } from '../services/validation.ts';
+import type { PageTemplate } from '../services/theme-page-templates.ts';
+export interface V1RouteOptions {
+    config: SiteConfig;
+    themeSchemas: ThemeSchemas;
+    pageTemplates: PageTemplate[];
+    themeTemplates: ThemeTemplates;
+    layouts: Record<string, string>;
+    engine: Liquid;
+    tokens: TokenEntry[];
+    ipAllowlist: string[];
+    maxUploadBytes: number;
+}
+export declare const v1Routes: FastifyPluginAsync<V1RouteOptions>;

package/dist/routes/index.js

@@ -0,0 +1,84 @@
+import { batchRoutes } from "./batch.js";
+import { capabilitiesRoutes } from "./capabilities.js";
+import { contentRoutes } from "./content.js";
+import { draftsRoutes } from "./drafts.js";
+import { gitRoutes } from "./git.js";
+import { mediaRoutes } from "./media.js";
+import { menusRoutes } from "./menus.js";
+import { previewRevisionRoutes } from "./preview-revision.js";
+import { previewRoutes } from "./preview.js";
+import { publishRoutes } from "./publish.js";
+import { redirectsRoutes } from "./redirects.js";
+import { searchRoutes } from "./search.js";
+import { themeRoutes } from "./theme.js";
+import { ipAllowlistGuard } from "../services/ip-allowlist.js";
+// The /v1 aggregator: buildServer registers this once with
+// { prefix: '/v1', ...V1RouteOptions }, and every route-group plugin
+// (capabilities.ts, preview.ts, and later content/drafts/publish/etc.)
+// registers itself here with a bare, unprefixed path. Each route-group
+// plugin is registered plainly (never wrapped in fastify-plugin's
+// fp()), so it keeps its own encapsulation scope - required for Group
+// B's auth preHandler hooks to gate only the routes that need them.
+// Plugins that don't need site data (capabilities.ts) simply ignore
+// the passed-through opts.
+export const v1Routes = async (fastify, opts) => {
+    // A coarse "is this client's network address allowed to talk to the
+    // API at all" gate, applied to the entire /v1 surface uniformly
+    // (including capabilities.ts and every GET route) - orthogonal to
+    // requireScope's per-route, per-scope exemptions. Added on this
+    // fastify instance (v1Routes's own parameter, never wrapped in fp())
+    // before any nested register() call, so it cascades to every plugin
+    // registered as a child below but never to publicRoutes/assetsRoutes
+    // (siblings registered directly on the root app, outside this
+    // encapsulation context) - verified with a real request, not just
+    // asserted.
+    fastify.addHook('onRequest', ipAllowlistGuard(opts.ipAllowlist));
+    fastify.register(capabilitiesRoutes, { maxUploadBytes: opts.maxUploadBytes });
+    // Fastify passes the *entire* options object a plugin was registered
+    // with - including `prefix` - through as this plugin's own second
+    // argument. Passing `opts` straight through to a nested register()
+    // call would carry that `prefix: '/v1'` along with it, double-
+    // applying the prefix (confirmed empirically: routes ended up
+    // registered at /v1/v1/preview/*). Re-pack only the site-data
+    // fields, never `opts` itself, for any nested plugin registration.
+    fastify.register(previewRoutes, {
+        config: opts.config,
+        themeTemplates: opts.themeTemplates,
+        layouts: opts.layouts,
+        engine: opts.engine,
+        tokens: opts.tokens,
+    });
+    fastify.register(previewRevisionRoutes, {
+        config: opts.config,
+        themeTemplates: opts.themeTemplates,
+        layouts: opts.layouts,
+        engine: opts.engine,
+        tokens: opts.tokens,
+    });
+    // contentRoutes needs no themeTemplates (it never renders anything),
+    // so it gets its own narrower options shape rather than the full
+    // bundle out of convenience - matching capabilities.ts's precedent
+    // of registering with only what it actually uses.
+    fastify.register(contentRoutes, { config: opts.config, tokens: opts.tokens });
+    fastify.register(draftsRoutes, {
+        config: opts.config,
+        themeSchemas: opts.themeSchemas,
+        tokens: opts.tokens,
+    });
+    fastify.register(publishRoutes, {
+        config: opts.config,
+        themeSchemas: opts.themeSchemas,
+        tokens: opts.tokens,
+    });
+    fastify.register(batchRoutes, {
+        config: opts.config,
+        themeSchemas: opts.themeSchemas,
+        tokens: opts.tokens,
+    });
+    fastify.register(gitRoutes, { config: opts.config, tokens: opts.tokens });
+    fastify.register(mediaRoutes, { config: opts.config, tokens: opts.tokens, maxUploadBytes: opts.maxUploadBytes });
+    fastify.register(searchRoutes, { config: opts.config, tokens: opts.tokens });
+    fastify.register(redirectsRoutes, { config: opts.config, tokens: opts.tokens });
+    fastify.register(menusRoutes, { config: opts.config, tokens: opts.tokens });
+    fastify.register(themeRoutes, { themeSchemas: opts.themeSchemas, pageTemplates: opts.pageTemplates, tokens: opts.tokens });
+};

package/dist/routes/media-public.d.ts

@@ -0,0 +1,5 @@
+import type { FastifyPluginAsync } from 'fastify';
+import type { SiteConfig } from '../config.ts';
+export declare const mediaPublicRoutes: FastifyPluginAsync<{
+    config: SiteConfig;
+}>;

package/dist/routes/media-public.js

@@ -0,0 +1,48 @@
+import { openLocalFsMediaDriver } from "../media/drivers/local-fs-driver.js";
+import { mimeTypeFor } from "../services/mime-types.js";
+async function handleMediaRequest(request, reply, config) {
+    const relativePath = request.params['*'];
+    // Never read: Fastify doesn't require query params to be declared or
+    // consumed, so a Shopify-style ?width=1500 suffix
+    // (docs/cms-build-plan.md's Phase 4) is automatically inert with no
+    // code needed to "ignore" it - this route is the MVP passthrough
+    // driver, real resizing is separately-scoped future work.
+    const bytes = await openLocalFsMediaDriver(config.mediaRoot).get(relativePath);
+    if (bytes === null) {
+        reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No media file at "${relativePath}"` });
+        return;
+    }
+    // nosniff: mimeTypeFor() falls back to application/octet-stream for
+    // anything outside its small known-extension table (uploads aren't
+    // restricted to that table, only to the images-only allowlist in
+    // media.ts), and without this header some browsers will still
+    // content-sniff an octet-stream response - the same stored-content
+    // risk class SVG rejection already exists to avoid for that specific
+    // case.
+    // Access-Control-Allow-Origin: * - same reasoning as assets.ts:
+    // fonts specifically enforce CORS unconditionally, and the admin's
+    // preview route proxies a site's HTML into its own origin (with a
+    // <base href> fix), making genuinely cross-origin browser requests
+    // for what looks like a same-origin path. Consistent with this
+    // route already being deliberately unauthenticated and public.
+    reply
+        .header('X-Content-Type-Options', 'nosniff')
+        .header('Access-Control-Allow-Origin', '*')
+        .type(mimeTypeFor(relativePath))
+        .send(bytes);
+}
+// Deliberately and permanently unauthenticated, same reasoning as
+// assets.ts: uploaded media must be fetchable by any visitor's browser
+// without a token, same as the public website itself. Registered
+// without a /v1 prefix, directly on app in server.ts, alongside
+// assetsRoutes/publicRoutes.
+//
+// Reads go through MediaStorageDriver.get() rather than raw fs calls
+// (unlike assets.ts, which touches fs directly since theme assets are
+// always local) - the one deliberate deviation from assets.ts's own
+// shape, since a future object-storage driver needs this route to
+// stay storage-agnostic. sanitisePath is called inside the driver
+// itself (local-fs-driver.ts), not here - see that file's own comment.
+export const mediaPublicRoutes = async (fastify, opts) => {
+    fastify.get('/media/*', async (request, reply) => handleMediaRequest(request, reply, opts.config));
+};

package/dist/routes/media.d.ts

@@ -0,0 +1,9 @@
+import type { FastifyPluginAsync } from 'fastify';
+import type { SiteConfig } from '../config.ts';
+import type { TokenEntry } from '../server-config.ts';
+export interface MediaRouteOptions {
+    config: SiteConfig;
+    tokens: TokenEntry[];
+    maxUploadBytes: number;
+}
+export declare const mediaRoutes: FastifyPluginAsync<MediaRouteOptions>;

package/dist/routes/media.js

@@ -0,0 +1,84 @@
+import { extname } from 'node:path';
+import multipart from '@fastify/multipart';
+import { ManageMediaError, deleteMedia, listMedia, putMedia } from "../media/manage-media.js";
+import { PathSafetyError } from "../services/path-safety.js";
+import { WRITE_ROUTE_RATE_LIMIT } from "../services/rate-limit-config.js";
+import { requireScope } from "../services/token-auth.js";
+// Images only - confirmed with the user, not a general document
+// library. Checked against the *original* uploaded filename, not the
+// client-supplied mimetype header (trivially spoofable) and not the
+// stored content-addressed filename (built only after this check
+// passes, from the same already-validated extension). .svg is
+// rejected regardless of this list even though it's technically an
+// image format - docs/cms-build-plan.md's own "SVG rejected outright,
+// not sanitised" decision.
+const ALLOWED_UPLOAD_EXTENSIONS = new Set(['.jpg', '.jpeg', '.png', '.gif', '.webp']);
+function sendManageMediaError(reply, error) {
+    if (error.reason === 'not-found') {
+        reply.code(404).send({ statusCode: 404, error: 'Not Found', message: error.message });
+        return;
+    }
+    throw error;
+}
+async function handleListMedia(_request, reply, config) {
+    reply.send(await listMedia(config));
+}
+async function handleUploadMedia(request, reply, config) {
+    const data = await request.file();
+    if (!data) {
+        reply.code(400).send({ statusCode: 400, error: 'Bad Request', message: 'Expected a multipart file upload' });
+        return;
+    }
+    const extension = extname(data.filename).toLowerCase();
+    if (!ALLOWED_UPLOAD_EXTENSIONS.has(extension)) {
+        reply.code(415).send({
+            statusCode: 415,
+            error: 'Unsupported Media Type',
+            message: `"${extension}" is not an accepted image type`,
+        });
+        return;
+    }
+    // No try/catch around toBuffer(): @fastify/multipart's own
+    // RequestFileTooLargeError already carries .statusCode = 413, so it
+    // passes straight through server.ts's existing global error handler
+    // unchanged - the same "just throw and let the existing handler map
+    // it" pattern already used for AuthError elsewhere. busboy enforces
+    // limits.fileSize *during* the stream (rejecting once the cap is
+    // hit, never silently truncating), not after buffering an unbounded
+    // body into memory first - this is what "capped at the stream
+    // level" actually means in practice.
+    const bytes = await data.toBuffer();
+    const result = await putMedia(config, data.filename, bytes);
+    reply.code(201).send(result);
+}
+async function handleDeleteMedia(request, reply, config) {
+    const filename = request.params['*'];
+    try {
+        await deleteMedia(config, filename);
+        reply.code(204).send();
+    }
+    catch (error) {
+        if (error instanceof PathSafetyError) {
+            reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No media file at "${filename}"` });
+            return;
+        }
+        if (error instanceof ManageMediaError) {
+            sendManageMediaError(reply, error);
+            return;
+        }
+        throw error;
+    }
+}
+export const mediaRoutes = async (fastify, opts) => {
+    // Registered inside this plugin's own encapsulation scope (media.ts
+    // is registered plainly, never wrapped in fastify-plugin's fp() -
+    // matching this codebase's house rule so Group B's auth preHandler
+    // hooks keep working), not globally in server.ts - confines the
+    // multipart content-type parser and .file()/.files() decorations to
+    // media routes only, leaving every other route file's default JSON
+    // body parsing completely untouched.
+    await fastify.register(multipart, { limits: { fileSize: opts.maxUploadBytes } });
+    fastify.get('/media', { preHandler: requireScope(opts.tokens, 'media') }, async (request, reply) => handleListMedia(request, reply, opts.config));
+    fastify.post('/media', { preHandler: requireScope(opts.tokens, 'media'), config: WRITE_ROUTE_RATE_LIMIT }, async (request, reply) => handleUploadMedia(request, reply, opts.config));
+    fastify.delete('/media/*', { preHandler: requireScope(opts.tokens, 'media'), config: WRITE_ROUTE_RATE_LIMIT }, async (request, reply) => handleDeleteMedia(request, reply, opts.config));
+};

package/dist/routes/menus.d.ts

@@ -0,0 +1,8 @@
+import type { FastifyPluginAsync } from 'fastify';
+import type { SiteConfig } from '../config.ts';
+import type { TokenEntry } from '../server-config.ts';
+export interface MenusRouteOptions {
+    config: SiteConfig;
+    tokens: TokenEntry[];
+}
+export declare const menusRoutes: FastifyPluginAsync<MenusRouteOptions>;

package/dist/routes/menus.js

@@ -0,0 +1,77 @@
+import { isValidCommitAuthor } from "../services/git.js";
+import { ManageMenuError, saveMenu } from "../services/manage-menus.js";
+import { PathSafetyError } from "../services/path-safety.js";
+import { WRITE_ROUTE_RATE_LIMIT } from "../services/rate-limit-config.js";
+import { requireScope } from "../services/token-auth.js";
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.length > 0;
+}
+// The body is wrapped ({ content, message, author }), not raw menu
+// content the way PUT /v1/drafts/:path is: unlike a draft save, this
+// commits immediately, so it needs the same message/author metadata
+// every other commit-creating write in this API takes in its body
+// (redirects, publish, delete, move) - a header-based convention would
+// be a new, inconsistent pattern for no reason.
+function parseSaveMenuBody(body) {
+    if (typeof body !== 'object' || body === null) {
+        return null;
+    }
+    const { content, message, author } = body;
+    if (content === undefined || !isNonEmptyString(message) || !isValidCommitAuthor(author)) {
+        return null;
+    }
+    return { content, message, author };
+}
+async function handleSaveMenu(request, reply, config) {
+    const relativePath = request.params['*'];
+    // A static per-request property (is the header present at all on
+    // *this* request), not shared mutable state - no TOCTOU risk in
+    // checking it here, before the queue, matching drafts.ts's own
+    // precedent exactly (the ETag comparison itself must happen inside
+    // the queued job, this presence check does not).
+    const ifMatch = request.headers['if-match'];
+    if (typeof ifMatch !== 'string' || ifMatch.length === 0) {
+        reply.code(428).send({
+            statusCode: 428,
+            error: 'Precondition Required',
+            message: 'An If-Match header is required to save a menu',
+        });
+        return;
+    }
+    const parsed = parseSaveMenuBody(request.body);
+    if (!parsed) {
+        reply.code(400).send({
+            statusCode: 400,
+            error: 'Bad Request',
+            message: 'Expected { content: object, message: string, author: { name, email } }',
+        });
+        return;
+    }
+    try {
+        const newEtag = await saveMenu(config, relativePath, parsed.content, ifMatch, parsed.message, parsed.author);
+        reply.header('etag', newEtag).send({ ok: true });
+    }
+    catch (error) {
+        if (error instanceof PathSafetyError) {
+            reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No menu at "${relativePath}"` });
+            return;
+        }
+        if (error instanceof ManageMenuError && error.reason === 'conflict') {
+            reply.code(409).send({ statusCode: 409, error: 'Conflict', message: error.message });
+            return;
+        }
+        if (error instanceof ManageMenuError && error.reason === 'validation-failed') {
+            reply.code(400).send({ statusCode: 400, error: 'Bad Request', message: error.message });
+            return;
+        }
+        throw error;
+    }
+}
+// GET/DELETE/move for menus/ paths deliberately stay on the existing
+// generic /v1/content routes (Group N) - only this write path is new.
+// Its own namespace (/v1/menus, not wedged into /v1/content), matching
+// how redirects got /v1/redirects rather than overloading /v1/content
+// with type-conditional write behaviour.
+export const menusRoutes = async (fastify, opts) => {
+    fastify.put('/menus/*', { preHandler: requireScope(opts.tokens, 'content'), config: WRITE_ROUTE_RATE_LIMIT }, async (request, reply) => handleSaveMenu(request, reply, opts.config));
+};

package/dist/routes/preview-revision.d.ts

@@ -0,0 +1,13 @@
+import type { FastifyPluginAsync } from 'fastify';
+import type { Liquid } from 'liquidjs';
+import type { SiteConfig } from '../config.ts';
+import type { ThemeTemplates } from '../renderer/theme-templates.ts';
+import type { TokenEntry } from '../server-config.ts';
+export interface PreviewRevisionRouteOptions {
+    config: SiteConfig;
+    themeTemplates: ThemeTemplates;
+    layouts: Record<string, string>;
+    engine: Liquid;
+    tokens: TokenEntry[];
+}
+export declare const previewRevisionRoutes: FastifyPluginAsync<PreviewRevisionRouteOptions>;

package/dist/routes/preview-revision.js

@@ -0,0 +1,109 @@
+import { join } from 'node:path';
+import { PageRenderError, parsePageContent, renderLoadedPage } from "../renderer/render-page.js";
+import { GitShowError, readFileAtRevision } from "../services/git-history.js";
+import { isValidGitRef } from "../services/git.js";
+import { PathSafetyError } from "../services/path-safety.js";
+import { isBlogUrl, urlToPostPath } from "../services/post-urls.js";
+import { requireScope } from "../services/token-auth.js";
+import { urlToPagePath } from "../services/urls.js";
+// A dedicated top-level route rather than nesting under /preview/*
+// (e.g. /preview/:ref/*): page URLs can be arbitrarily nested
+// (E1 - content/pages/about/team.json resolves at /about/team), so a
+// parametric+wildcard sibling registered under the same prefix as the
+// existing bare /preview/* wildcard would make any multi-segment
+// preview URL genuinely ambiguous between "page team under about" and
+// "ref=about, page /team". Keeping this on its own /preview-revision
+// prefix, a sibling of /preview rather than nested inside it, avoids
+// that collision entirely - the same shape /git/show/:ref/* already
+// uses alongside /preview/*.
+//
+// readFileAtRevision resolves paths relative to config.siteRoot, not
+// config.contentRoot (confirmed by git-history.ts/git.test.ts's own
+// "content/pages/about.json" usage) - so unlike preview.ts's
+// toRenderPath/toPostsRenderPath (contentRoot-relative), the path
+// built here is prefixed with "content/".
+function toRevisionPath(pagesRelativePath) {
+    return join('content', 'pages', pagesRelativePath);
+}
+function toPostsRevisionPath(postsRelativePath) {
+    return join('content', 'posts', postsRelativePath);
+}
+async function handlePreviewRevisionRequest(request, reply, config, themeTemplates, layouts, engine) {
+    const { ref } = request.params;
+    const url = `/${request.params['*']}`;
+    if (!isValidGitRef(ref)) {
+        reply.code(400).send({ statusCode: 400, error: 'Bad Request', message: `Invalid ref: "${ref}"` });
+        return;
+    }
+    try {
+        const isPost = isBlogUrl(url);
+        let repoRelativePath;
+        if (isPost) {
+            const relativePath = urlToPostPath(url);
+            if (relativePath === null) {
+                reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No page at "${url}"` });
+                return;
+            }
+            repoRelativePath = toPostsRevisionPath(relativePath);
+        }
+        else {
+            repoRelativePath = toRevisionPath(urlToPagePath(url));
+        }
+        const raw = readFileAtRevision(config, ref, repoRelativePath);
+        const page = parsePageContent(raw.toString('utf-8'));
+        const html = await renderLoadedPage(page, config, themeTemplates, layouts, engine);
+        reply.type('text/html; charset=utf-8').send(html);
+    }
+    catch (error) {
+        if (error instanceof PathSafetyError) {
+            reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No page at "${url}"` });
+            return;
+        }
+        if (error instanceof GitShowError) {
+            const code = error.reason === 'invalid-ref' ? 400 : 404;
+            reply.code(code).send({
+                statusCode: code,
+                error: code === 400 ? 'Bad Request' : 'Not Found',
+                message: error.message,
+            });
+            return;
+        }
+        if (error instanceof SyntaxError) {
+            reply.code(404).send({
+                statusCode: 404,
+                error: 'Not Found',
+                message: `No renderable page at "${url}" at revision "${ref}"`,
+            });
+            return;
+        }
+        if (error instanceof PageRenderError) {
+            if (error.reason === 'page-not-found') {
+                reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No page at "${url}"` });
+                return;
+            }
+            // missing-section-type/missing-block-type/missing-layout/
+            // template-error: a deliberate divergence from preview.ts and
+            // public.ts, which let these reasons bubble to an uncaught 500.
+            // For those routes, a broken theme/content combination reachable
+            // today is genuinely an operational bug worth alerting on. Here,
+            // "today's theme doesn't have a section type this old revision
+            // used" is an expected, user-facing outcome (themes/layouts/menus
+            // are never revision-pinned, only the page body is - see
+            // render-page.ts's renderLoadedPage comment), not a bug - the
+            // admin needs a stable 4xx it can catch and turn into "this
+            // revision can't be previewed with the current theme" copy,
+            // not a raw 500.
+            reply.code(422).send({
+                statusCode: 422,
+                error: 'Unprocessable Entity',
+                message: error.message,
+                reason: error.reason,
+            });
+            return;
+        }
+        throw error;
+    }
+}
+export const previewRevisionRoutes = async (fastify, opts) => {
+    fastify.get('/preview-revision/:ref/*', { preHandler: requireScope(opts.tokens, 'content') }, async (request, reply) => handlePreviewRevisionRequest(request, reply, opts.config, opts.themeTemplates, opts.layouts, opts.engine));
+};

package/dist/routes/preview.d.ts

@@ -0,0 +1,13 @@
+import type { FastifyPluginAsync } from 'fastify';
+import type { Liquid } from 'liquidjs';
+import type { SiteConfig } from '../config.ts';
+import type { ThemeTemplates } from '../renderer/theme-templates.ts';
+import type { TokenEntry } from '../server-config.ts';
+export interface PreviewRouteOptions {
+    config: SiteConfig;
+    themeTemplates: ThemeTemplates;
+    layouts: Record<string, string>;
+    engine: Liquid;
+    tokens: TokenEntry[];
+}
+export declare const previewRoutes: FastifyPluginAsync<PreviewRouteOptions>;

package/dist/routes/preview.js

@@ -0,0 +1,52 @@
+import { join } from 'node:path';
+import { PageRenderError, renderPage } from "../renderer/render-page.js";
+import { PathSafetyError } from "../services/path-safety.js";
+import { isBlogUrl, urlToPostPath } from "../services/post-urls.js";
+import { requireScope } from "../services/token-auth.js";
+import { urlToPagePath } from "../services/urls.js";
+// Same pagesRoot/contentRoot seam as public.ts - see that file's
+// toRenderPath comment. Preview never consults redirects.json:
+// redirects are a public-URL concept, and an editor previewing a
+// specific page path isn't redirected.
+function toRenderPath(pagesRelativePath) {
+    return join('pages', pagesRelativePath);
+}
+// Same seam as toRenderPath above, for posts.
+function toPostsRenderPath(postsRelativePath) {
+    return join('posts', postsRelativePath);
+}
+async function handlePreviewRequest(request, reply, config, themeTemplates, layouts, engine) {
+    const url = `/${request.params['*']}`;
+    try {
+        // /blog is a permanently reserved namespace, same as public.ts -
+        // no redirects.json fallback here either way (preview never
+        // consults it, per this file's own established comment above).
+        if (isBlogUrl(url)) {
+            const relativePath = urlToPostPath(url);
+            if (relativePath === null) {
+                reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No page at "${url}"` });
+                return;
+            }
+            const html = await renderPage(config, themeTemplates, layouts, engine, toPostsRenderPath(relativePath), 'preview');
+            reply.type('text/html; charset=utf-8').send(html);
+            return;
+        }
+        const relativePath = urlToPagePath(url);
+        const html = await renderPage(config, themeTemplates, layouts, engine, toRenderPath(relativePath), 'preview');
+        reply.type('text/html; charset=utf-8').send(html);
+    }
+    catch (error) {
+        if (error instanceof PathSafetyError) {
+            reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No page at "${url}"` });
+            return;
+        }
+        if (error instanceof PageRenderError && error.reason === 'page-not-found') {
+            reply.code(404).send({ statusCode: 404, error: 'Not Found', message: `No page at "${url}"` });
+            return;
+        }
+        throw error;
+    }
+}
+export const previewRoutes = async (fastify, opts) => {
+    fastify.get('/preview/*', { preHandler: requireScope(opts.tokens, 'content') }, async (request, reply) => handlePreviewRequest(request, reply, opts.config, opts.themeTemplates, opts.layouts, opts.engine));
+};

package/dist/routes/public.d.ts

@@ -0,0 +1,11 @@
+import type { FastifyPluginAsync } from 'fastify';
+import type { Liquid } from 'liquidjs';
+import type { SiteConfig } from '../config.ts';
+import type { ThemeTemplates } from '../renderer/theme-templates.ts';
+export interface PublicRouteOptions {
+    config: SiteConfig;
+    themeTemplates: ThemeTemplates;
+    layouts: Record<string, string>;
+    engine: Liquid;
+}
+export declare const publicRoutes: FastifyPluginAsync<PublicRouteOptions>;